deloitte consulting sp-20-0115 response packet final...jun 19, 2020 · sp-20-0115 response packet...

SP-20-0115 Response Packet of 16

RESPONSE PACKET SP-20-0115


PROPOSAL SIGNATURE PAGE

PROSPECTIVE CONTRACTOR INFORMATION

Company: Deloitte Consulting LLP

Address: 522 West 2nd Street, Suite 600 AR Vendor # (if known) 100182017

City: Austin State: TX Zip Code: 78701

Business Designation:

☐ Individual ☐ Sole Proprietorship ☐ Public Service Corp

Partnership ☐ Corporation ☐ Nonprofit

Minority and Women- Owned Designation*:

Not Applicable ☐ American Indian ☐ Service-Disabled Veteran

☐ African American ☐ Hispanic American ☐ Women-Owned

☐ Asian American ☐ Pacific Islander American

AR Certification #: * See Minority and Women-Owned Business Policy

PROSPECTIVE CONTRACTOR CONTACT INFORMATION

Contact Person: Sanjeev Sethi Title: Managing Director

Phone: (512) 507-4155 Alternate Phone: (512) 691-2318

Email: [email protected]

CONFIRMATION OF REDACTED COPY

☐ YES, a redacted copy of submission documents is enclosed. NO, a redacted copy of submission documents is not enclosed. I understand a full copy of non-

redacted submission documents will be released if requested.

ILLEGAL IMMIGRANT CONFIRMATION

By signing and submitting a response to this Solicitation, a Prospective Contractor agrees and certifies that they do not employ or contract with illegal immigrants. If selected, the Prospective Contractor certifies that they will not employ or contract with illegal immigrants during the aggregate term of a contract.

ISRAEL BOYCOTT RESTRICTION CONFIRMATION

By checking the box below, a Prospective Contractor agrees and certifies that they do not boycott Israel, and if selected, will not boycott Israel during the aggregate term of the contract. Prospective Contractor does not and will not boycott Israel.

An official authorized to bind the Prospective Contractor to a resultant contract shall sign below.

The signature below signifies agreement that any exception that conflicts with a Requirement of this Solicitation will cause the Prospective Contractor’s proposal to be rejected.

Authorized Signature: Title: Managing Director Printed/Typed Name: Sanjeev Sethi Date: 06/19/2020


INFORMATION FOR EVALUATION

Prospective Contractors should provide a response to each item/question in this section. Prospective Contractors may expand the space under each item/question to provide a complete response.

Prospective Contractors may also use a separate form. If using a separate form, Prospective Contractors shall clearly and distinctly identify the section and item (i.e., E.1.A).

Responses for each item must be limited to three hundred (300) words. Prospective Contractors should not include additional information if not pertinent to the itemized request.

Maximum

RAW Score Available

E.1 EXPERIENCE AND QUALIFICATIONS

A. Describe previous or current engagements performed by your organization within the last three (3) years of similar size and scope to those described in the Solicitation that demonstrate your organization’s capability to perform all services required in the Solicitation. For each engagement referenced, provide the entity name, contact information (including contact name and email address), contract term dates, and geographic area serviced.

Engagement #1 Engagement #2 Engagement #3

Customer State of Texas State of Michigan State of New York

Entity Name Texas Health and Human Services Commission (HHSC)

Department of Health and Human Services (DHHS)

New York State Department of Labor (DOL)

Services Launched “Texas Health Trace” to enable residents to perform self-assessments of symptoms and direct resident to testing sites. Provided robust Case Management functions to enable up to 5,000 Case Investigators to perform contact tracing and follow-up.

Integrated with Amazon Pinpoint, Deloitte’s CRM solution is enrolling people in automated daily health assessments, significantly reducing the volume of manual outreach. Additionally, Deloitte’s Solution integrated with Amazon Connect to provide volunteer agents with secure outbound calling for citizens requiring manual follow-up.

Deloitte scope of services include over 1500 agents for oversight and support of Contact Center.

Deloitte also implemented Interactive Voice Response System, Chatbots and automated the Claims Entry process using Robotic Process Automation.

Contact Name Cassie Jordan Matthew Buck Peter Brancato


Title Deputy CIO Assistant Administrator Associate Commissioner

Email ID [email protected]

[email protected] [email protected]

Phone # 512-243-4909 517-243-8642 518-457-4238

Contract Term

4/23/2020 – Ongoing

4/28/2020 – Ongoing

4/4/2020 – Ongoing

Geographic Area Serviced

Statewide Statewide Statewide

B. Include experience implementing and operating contact tracing systems. 5 points

The rapid spread of the COVID-19 virus is challenging governments to act in ways normally reserved for war, depressions, or natural disasters. Governments are taking extreme measures to limit the economic disruption and human costs. Arkansas’s response to this crisis must account for the urgency of the situation and consider both short and long-term perspectives. Deloitte is equipped with hundreds of experienced healthcare professionals embedded within our Firm, supporting state, local clients and healthcare providers, the Centers for Disease Control and Prevention, and the Department of Health and Human Services. In response to COVID-19, we have engagements across 16 states including deployment of 7 major contact centers in support of Unemployment Insurance (UI), Pandemic Unemployment Assistance (PUA), Incident Centers and Contact Tracing. Refer to Appendix A – Qualification and Experience for more details. Deloitte currently works with the Arkansas Department of Human Services (DHS), delivering some of the largest successful IT initiatives and maintaining and operating over 130 application systems since 2017. Deloitte brings a wealth of experience including: • Market leader in working with state and local health & human services agencies in 47 States and

Washington D.C. • Deloitte has epidemiologists supporting the CDC specializing in public health surveillance,

outbreak investigations, and infection control • Deloitte has 30+ physicians providing services in healthcare strategy, interoperability,

modernization, and public health services including the COVID-19 pandemic • Among other clients, Deloitte has partnered with the CDC to assist with their COVID-19

emergency response coordination Deloitte understands that the State must act swiftly and with confidence as you transition to the next phase of managing the COVID-19 virus. We're ready to serve you and Arkansans and support the Arkansas Department of Health (ADH) efforts to control and prevent the spread of COVID-19.


C. Include the size of the system installation, a brief description of the solution provided, and the methodology employed.

5 points

Texas Health Trace (THT) - Deloitte leveraged Salesforce to rapidly deploy a web application called THT that enabled self-screening, case management, data integration and visualization. THT is cloud-based, cost-effective, and configurable per government regulations. The application is a single source of truth for accurate information about how COVID-19 is spreading. Data can be visualized to empower COVID-19 tracking for additional analysis.

Currently, over 2000 tracers use the system, with plans to expand to 5000 tracers.

Michigan Contact Tracing Application (MCTA) – Deloitte implemented a Salesforce Service Cloud Contact Tracing platform that is integrated with Amazon Connect/Pinpoint to allow for both manual and automated monitoring of contacts. Contacts are imported into the MCTA from the Michigan Outbreak Management Solution (OMS) where they are stored to be monitored.

Currently, over 350 tracers use the system and over 25,500 successful contacts have been completed. Michigan is planning to expand more tracers.

New York DOL Unemployment Support System - Deloitte has deployed over 500 inbound customer service agents and is providing operations, oversight and support of the contact center. We implemented Interactive Voice Response System for call routing and measurement; developed chatbots to maximize deflection; developed and implemented Robotics Process Automation bots to automate entry and validation of claims; and developed and implemented an outbound communication strategy including social media sensing.

In addition, DOL asked Deloitte to temporarily surge hundreds of personnel to make outbound calls to collect important information. In 3 days, Deloitte sourced and trained 1,000 staff and stood up outbound call center technology, then successfully called 20,000+ claimants in 2 days.

Implementation Methodology - In the above examples, Deloitte used an Agile Methodology to plan, design, develop, test, and deploy the solutions in collaboration with the states and continues to use the methodology to implement additional functionality.

D. Include experience staffing and managing a call center utilizing remote staff with outbound unsolicited call experience specifically for health care related phone-based education.

5 points

Deloitte has worked with state governments across the country to define the scope and rapidly establish inbound/outbound contact centers to meet the critical demand posed by the pandemic. We have established an initial capability to support inbound/outbound contact center operations, we have worked to implement continuous improvement methodologies like quality and workforce management for 2,500 agents. Specific to outbound, we have established campaign management protocols where we identify the net contactable records and follow a path through complete file penetration and associated scripting and reporting. Once the outbound calling list was determined, the team forecasted the number of resources needed in order to complete the calling list. In turn, the following process was followed: Sourcing • Access to over 1.5 million pre-screened candidates and pipeline of 2000 contact tracers across the

U.S. • Sourcing channels include social media, job boards, automated outreach via machine intelligence

capability, additional grassroots efforts (local schools, nonprofits, prioritized/minority communities, volunteer organizations)

Screening


• Automated multi-hurdle applicant screening and tracking platform • Comprehensive online testing and interview capabilities which will include language

comprehension, medical, foreign language competency, and behavioral assessments to screen candidates

• Validated the candidate meets the technology requirements on their personal computer for the needed technology through targeted questions

Candidate Selection • Utilizing results of screening assessments, Deloitte made contingent offers of employment to paid

staff • Candidates completed background checks • Candidates completed an IT security assessment on their personal computer for ensuring the

appropriate equipment and capability with the solution Onboarding • Staff completed onboarding forms in digital onboarding solution • Staff completed contact tracing training and learning assessments When the training and onboarding was completed, customer contacts were made through a predictive dialer integrated into the Omni-Channel telephony solution and tracked through a designated case management system.

E. Include experience providing phone-based education about government agency program topics.

5 points

Deloitte has provided phone-based education to the public about government agency topics through the deployment of major contact centers across the Federal government and states. This includes contact centers supporting COVID-19 efforts, such as Contact Tracing, Unemployment Insurance (UI), Pandemic Unemployment Assistance (PUA), and Incident Centers in states such as New York and California. For example, in New York, California, Ohio, Illinois, and New Mexico, our contact center staff provides phone-based education to citizens on unemployment insurance, benefits, eligibility criteria, as well as address questions that individuals had. Additionally, Deloitte partnered with multiple Federal government agencies to stand-up a contact center for the Pre-Existing Conditions Insurance Plan (PCIP) which, at its height, serviced individuals in 40 States and the District of Columbia. Our contact center staff provided at-risk enrollees with critical information about transitioning to health care coverage offered and how to apply. for coverage. To prepare our staff to provide education services, we have a robust training program to provide accurate information to the public specific to each state or program. For example, we have prepared over 10,000 contact tracers using role-based training based on CDC protocols, guidelines, and rules, on how to provide education to the public, such as resource availability, criticality of gathering contact tracing referrals and COVID-19 health protocols. During ongoing operations, we provide a knowledge management system where the staff will be able to access knowledge articles continuously updated to reflect the most up to date information required to educate the public. We also implement quality management and reporting programs to measure staff effectiveness of educational outreach and make continuous improvements on education materials.

F. Include experience providing report documentation for phone-based interviews. 5 points

In our deployment of contact centers, we prepare our virtual staff to conduct phone-based interviews to gather the right information, provide consultative support to individuals in need, and document findings. Key highlights of our experience include: • In our contact centers supporting COVID-19 related Unemployment Insurance (UI) such as New


York, our staff conducted an outbound campaign. We conducted phone interviews to document eligibility and claimant status data (e.g., employment background, earnings history) from over 200,000 claimants

• Our virtual contact center staff supporting the Pre-Existing Conditions Insurance Plan (PCIP) conducted approximately 300,000 phone-based interviews to document healthcare needs. We identified enrollees needing follow-up outreach calls, and subsequently walked them through how to enroll for appropriate health insurance.

• We also train our staff how to conduct sensitive interviews in a logical fashion so that documentation is recorded in a timely and efficient way. One of the key tools that we use to support effective report documentation are tailored scripts developed for case investigation and case tracing

• In Nevada, our contact tracing staff is documenting the results of investigation and following up with exposed individuals in our contact tracing case management solution

Our staff is fully prepared and trained to capture and document relevant information through the training program that we implement during the stand up of our contact centers. For example, we have conducted virtual bootcamp training for over 10,000 contact tracers across Kentucky, Texas, Nevada, and Michigan that included how to properly interview an individual to gather information and document findings in the specific contact tracing solution used by the state.

G. Include experience managing staffing levels for onsite and remote staff where workload fluctuations were constant.

5 points

Through the implementation of Workforce Management (WFM) applications for the US Navy and contact tracing initiatives for the States of California, Illinois, Ohio, New York and Nevada, Deloitte has a well-defined methodology to forecast, schedule and staff both onsite and remote agent teams. This solution optimizes staffing coverage in periods of normal peak as well as dramatic shifts in contact volume. Using workforce management software such as IEX, Verint or Calabrio, the required staff levels can be determined based on the mutually agreed upon service levels, average handle time, off the phone time (breaks, lunches, etc.) and training needs. A forecast will be formulated to determine the likely contact volume in 30-minute intervals of any given day. In turn, a schedule will be formulated to ensure the level of staffing will meet the expected demand. The staffing levels and contact volumes will be monitored in real time and surge support will be available when the contact volume is higher than expected. To ensure the desired service levels are met and agent performance is maximized, the contact center is monitored in real time utilizing online dashboards and reports. Workforce and contact volume trends will be tracked, and schedules adjusted based on business need. Also, weekly performance reports will be provided for business insight and any possible service delivery adjustments.

E.2 CALL CENTER CAPABILITIES

A. Discuss your organization’s capabilities in providing overall operation and management of a call center for ADH that utilizes remote staff.

5 points

Deloitte has successfully deployed 7 major contact centers in support of state’s COVID-19 responses and will leverage our proven structure, processes, tools and templates for Arkansas. Deloitte has the full suite of offerings and capabilities to establish and operate Contact Tracing Management System on a turnkey basis. We can also offer selective services such as Case Management, Contact Tracing, Workforce Management, Omni-Channel handling and routing, performance data analysis and reporting based on Arkansas’s need. Deloitte will work with the State during the interview phase to discuss and finalize the scope of services.


To supervise and perform the daily tracing work, we recommend an operating model with primary remote roles: • Supervisor: provides day to day oversight for contact tracing team with a recommended ratio of 25

contact tracers to 1 Supervisor • Contact Tracer: conduct tracing activities • Case Investigator: perform initial interview and document potential contacts Along with these primary remote roles, we will work with ADH to determine the makeup of the State’s team of community resource coordinators when referrals come in. An overview of the operating model of our call center operational capability is below:

To support this operating model, we deploy contact handling, workforce management, and performance monitoring technology depending on the technology needs of the State. Deloitte utilizes cloud-based telephony and CRM applications and deploy the solution across remote staff utilizing their personal computers and mobile phones. We also deploy our contact tracing solution, GovConnect, to track cases and referrals used by the contact tracing staff. Depending on ADH’s technology requirements, we will either provide these solutions or determine how our solution set fits into Arkansas’s existing architecture.

B. Discuss training methods your organization employs for all call center workers whether onsite or remote.

5 points

Deloitte has developed a training package specifically for Contact Notifiers. This system will be utilized to support the State of Arkansas for this initiative. We will quickly mobilize using existing tools, functional protocols and technical training content, and strategies to jumpstart our training for Arkansas. Virtual education programs covering government agency program topics are first approached by capturing knowledge from both Deloitte subject matter experts and existing Arkansas sources. The curriculum is then structured with a phased approach using scenario-based techniques to deliver digestible pieces of knowledge to newly recruited trainees. The comprehensive curriculum is then packaged and delivered in a virtual and interactive environment. These environments allow for instructor led learnings, sharing best practices, live Q&A with in-house experts, and time for self-learning. An overview of the training course is as follows:

• COVID-19 Fundamentals – Delivers soft skills and COVID-19 knowledge recommended by the

CDC for all Contact Notifiers • Contact Notifier Protocol – Provides Arkansas-specific procedures and processes to deliver a


consistent feel of services

• Information Security – Trains Contact Notifiers and Supervisors on the information security and PII practices they need to safeguard information

• Supervisor+ – Supports operational excellence by empowering Supervisors with the knowledge they need to support Contact Notifiers (time management, coaching, problem solving)

At the end of training, contract tracer-level knowledge checks are used to measure trainee performance. Post training, a regular cadence of strategic communications and “Office-Hours” (virtual discussion and expert live Q&A sessions) are held in order to increase engagement, identify knowledge gaps, and provide relevant supplemental learnings.

E.3 CONTACT TRACING CAPABILITIES

A. Discuss training methods your organization employs for in-person, home visit Contact Tracing.

5 points

Deloitte will adapt the virtual trainings delivered to call center workers for in-person, home visit staff. The knowledge capture step within the training process will be augmented with specialized topics from both Deloitte and State of Arkansas experts to ensure curriculum is specific to the work. The virtual curriculum and content can be fully utilized in modalities other than virtual, as required. Deloitte will make every effort to interview the Person Under Investigation (PUI) by telephone, however, if in-person notification, home visit Contact Tracing is needed, we will employ a comprehensive training curriculum that includes the following components: 1) Using Personal Protective Equipment (PPE) 2) Interviewing and assessing persons with symptoms (PUIs for COVID-19) 3) Interviewing and assessing persons without symptoms (asymptomatic close contacts who have been exposed to a suspect or lab-confirmed case of COVID-19) and 4) Job Aids on infection prevention and control. Our training leverages CDC guidelines for evaluating PUIs in residential settings and guidelines on using PPE. In addition to the training, Deloitte will provide the workforce management and oversight of the in-person home visits where telephone contacts were not successful. Deloitte assumes the State will provide the resources to perform the in-person home visits.

B. Discuss training methods your organization employs to ensure all workers have full knowledge of HIPAA requirements.

5 points

Deloitte will deliver initial virtual trainings on a rolling basis to meet the demands and volume requirements of the program. In order to properly train and onboard new staff members, Deloitte has developed and implemented a virtual training program to specifically train contact tracing workers on Health Insurance Portability & Accountability Act of 1996 (HIPAA). Through this program, the employees will be provided a background of what HIPAA is and why it is applicable to those servicing in a contact tracing role. Furthermore, the training will familiarize workers with the HIPAA rules: Privacy, Security, Enforcement and Omnibus.

In addition, employees will learn about Personally Identifiable Information (PII) and Protected Health Information (PHI) and how it relates to HIPAA. The training informs the workers on the types of information they will encounter while performing their duties and the proper ways to safeguard this information.

Successful training completion will be monitored and tracked for each staff member via knowledge checks which must be successfully complete prior to start. Supplemental and ongoing learnings will


be provided to enable continuous improvement through a number of channels.

C. Discuss management and oversight processes your organization employs to ensure full HIPAA compliance.

5 points

Deloitte is a leader in the State, Local and Higher Education industry and has a team of subject matter specialists with broad experiences assisting clients with security and data privacy risks. We have more than 7,500 dedicated professionals in the areas of information security and data privacy. These professionals work with our State, Federal and Private sector clients advising them on privacy, confidentiality and information security compliance challenges. Deloitte works with a number of States and Divisions in order to deliver detailed and robust Cybersecurity and Privacy Plans that address comprehensive requirements for a host of systems and programs including those mandated by compliance and regulatory agencies such as HIPAA. We have experience working with Health and Human Services (HHS) agencies to provide strategic advisory services and assist in solving security management and oversight challenges when adopting new technologies and processes for contact tracing.

Deloitte requires that security and privacy programs have the capability to support the implementation of administrative, technical and physical safeguards as required under HIPAA regulation, including the following:

• Administrative Safeguards

o Security Management Process o Security Personnel o Information Access Management o Workforce Training and Management o Evaluation

• Technical Safeguards o Access Control o Audit Controls o Integrity Controls o Transmission Security

• Physical Safeguards o Facility Access and Control o Workstation and Device Security

Deloitte will work with the Arkansas Department of Health (ADH) to help confirm the developed contact tracing program is designed to help educate ADH staff concerning HIPAA regulation, the proper use and disclosure of Protected Health Information (PHI), the proper safeguards for confidential information including electronic Protected Health Information (ePHI) or other confidential information, and meet the requirements from ADH HIPAA Policies and Procedures.

D. Describe processes your organization uses to rapidly disseminate and implement programmatic and operational changes to all personnel.

5 points

To communicate important information to all personnel, the following multi-tiered approach will be taken based on communication channel: • Email

o An email distribution list will be created to send the latest information, tips & tricks, quick


start guides and announcements.

• Dashboard o A real time dashboard on the agent screen that contains both current and archived

information.

• Knowledge Management o A robust knowledge management solution will be in place that will allow agents to quickly

resolve customer issues. This information will be available via the CRM system and mobile devices.

• Chat/Collaboration Tools o Online mechanisms allow for supervisors to communicate and collaborate with all staff

members regardless of location in real time. The program will also allow message to be broadcast to all personnel.

• Text Message o For personnel conducting in-person home visits that may not be accessing these systems

or their email on a regular basis, broadcast text messages will be used.

E. Describe your organization’s capabilities in communicating with individuals who

speak languages other than English. Include all languages your organization is able to provide.

5 points

Deloitte has implemented and currently operates contact centers across many states serving customers in multiple languages. As part of our hiring process, we actively recruit and screen for multi-lingual individuals based on the need of the State. For example, based on Arkansas’ needs, we can hire a percentage of bilingual contact tracers for higher density languages such as Spanish, Vietnamese and Marshallese.

For lower density languages, we will employ a language line for translational services so that interviews are conducted in a recipient’s preferred or native language. Through a language line, our team members have access to on-demand interpretation services in more than 180 languages.

E.4 COMMUNITY HEALTH CARE

A. Describe your organization’s experience and capabilities in training and collaborating with community-based health care programs and initiatives.

5 points

Deloitte is consistently recognized as an industry leader for the depth and breadth of our experience and the range of health care program support we provide to state agencies. We have provided health and human services consulting to 46 of 50 U.S. states, the District of Columbia, Puerto Rico, Canada, and the United Kingdom. We currently serve 35 active HHS state government clients and have offices in 21 state capitals. Having served U.S. state government clients for more than 50 years, the practice continues to build on that success by staying committed to helping clients take on their toughest issues; delivering consistent, high-quality service; and helping states provide extraordinary health and social services to their constituents.

Deloitte has a public health team of 400+ practitioners supporting the CDC and its work with state, local, tribal, and territorial jurisdictions. We have worked extensively with internal (e.g., leaders and staff) and external stakeholders (recipients, national partners, at-risk populations) in the design, development, and delivery of new solutions for many critical CDC programs. Our CDC team has supported multiple emergency responses including Hurricane Katrina, H1N1, the Haiti earthquake,


MERS, Meningitis, Ebola, Zika, and currently COVID-19. For example:

State of Texas collaborated with Deloitte to put in place a Self-Service portal in order to track COVID-19 cases and to support case management workers throughout the states.

State of Connecticut partnered with Deloitte to deploy actionable guidance program to businesses to ensure they were adhering to COVID-19 safety guidelines. This program has allowed business to safely reopen and meet the evolving needs.

The Wisconsin Emergency Operations Center worked with Deloitte to establish a process to quickly identify residents diagnosed with COVID-19 and connect them with needed resources to minimize infection.

B. Describe your organization’s experience and capabilities working with and providing services for the underserved and populations or groups with health disparities

5 points

The COVID-19 crisis has created a multitude of challenges for vulnerable populations especially the elderly, disabled, ethnic minorities, and other populations with socioeconomic and health risks. Deloitte is dedicated to advancing health equity and has worked with clients across the world on health disparity issues. Our Drivers of Health and Equity practice works with stakeholders across the public health and healthcare ecosystem - providers, payors, employers, life sciences, federal, state, and local governments- to understand, assess, and address the drivers of health and equity.

Recently, The Commonwealths of Virginia and Pennsylvania partnered with Deloitte to accomplish the following:

• Identify and prioritize resources and decision points impacting marginalized and at-risk individuals and communities.

• Support intentional inclusion of the needs of at-risk and marginalized individuals and communities within each working group related to preparedness, mitigation, response, and recovery.

These tasks are being undertaken through the use of using Deloitte’s Health360 Coronavirus Response Management Platform (CRMP). As a result, there is more focused use of resources to provide assistance to those with socioeconomic and health risks from COVID-19. The targeted population interventions were based on advanced analytics of comorbidities, social determinants of health, and community needs.

Deloitte also works with multiple state health and human services agencies to provide program and technology support. This support is for the programs like Long Term Care, Health Care of Adult and Disabled, Mental Health, Behavioral Health, Substance Abuse etc.

E.5 DATA MANAGEMENT AND SECURITY

A. Discuss strategies and practices your organization proposes to complete employee technology verification and vetting to ensure potential hires possess adequate technology infrastructure (phones, computers, etc.), phone access, and internet access. If your organization intends to provide necessary technology infrastructure to contact tracers, please describe how your organization will accomplish this.

5 points

Deloitte has the ability to screen potential employees for: the ability to work remotely with a dedicated workspace, broadband internet access, and a computer capable of running the Deloitte virtual desktop infrastructure (VDI). Deloitte has developed a hardware and internet access standard for remote tracers. Potential employees unable to meet those requirements are excluded from consideration.


All other necessary technology infrastructure will be provided by Deloitte through the VDI including: a soft phone for incoming and outgoing phone calls, access to the tracking and tracing system, and any required access to State of Arkansas systems. All PII and PHI information will only be available in the VDI, not on the tracer provided computer. Access to the VDI could require multifactor authentication and a secure VPN.

Deloitte has experience managing remote tracers as part of our COVID-19 support for multiple states. This experience enables us to support the technology remotely; in the event local support is required, Deloitte will provide that support through its local offices.

B. Discuss your organization’s strategies for providing redundancy, fault tolerance, and an uptime of 99.9% annual website availability.

5 points

Deloitte’s cloud based artificial intelligence (AI)-driven solution provides integration with Active Directory and API calls to external systems including CRM, WFM, Quality Management, Outbound campaign Management, and with the State of Arkansas’s backend database and application as needed.

Deloitte’s will leverage the AWS and Salesforce cloud platform to deploy Arkansas’s Contact Tracing Management System. Salesforce offers a “Platform-as-a-Service” (PaaS) architecture that shares the highly efficient, highly secure cloud platform with multiple other organizations hosted on cloud. The Salesforce platform provides for a reliable, scalable, load-balanced and redundant environment to support organizations and their growing infrastructure and networking needs without needing to make hardware or configuration changes to the system. The State also gets the full benefits of the robust backup, failover, disaster recovery, and other infrastructure services Salesforce has in place that are required for an organization’s mission-critical system.

Deloitte establishes thresholds and proactively monitor the utilization of the system resources to identify any potential issues with the system performance and availability. Currently, Deloitte maintains and operate over 130 applications for the Department of Human Services with meeting/exceeding service level requirements of 99.75% system availability.

C. Describe the processes employed by your organization to ensure Contract Tracing personnel can capture and transmit protected health information (PHI).

5 points

Deloitte’s case management and proximity tracking solution will secure and allow for the capture and transmission of PHI utilizing the security and privacy processes and mechanisms. Cyber capabilities are integrated into system development and implementation activities. Our case management system will include cybersecurity testing and evaluation, including: • Static and dynamic application testing • Network vulnerability assessments • Manual code reviews • Functional security testing of roles/objects for proper access

Privacy principles are applied to the solution that collects and processes PII. It is also important to consider necessary PHI controls from a HIPAA standpoint. Some of the HIPAA considerations are listed below: • Inquiries and complaints: Enable individuals to follow a defined process to file inquiries and

complaints • Training: Train all individuals who may be processing PHI on the policies and procedures around


the data • Disclosure: Individuals have a right to a record of the disclosures of PHI by a covered entity • Restriction: Individuals have a right to request a covered entity limit the use or disclosure of PHI • Security: PHI policies and procedures exist to address access, proper handling, security incidents,

and transmission across electronic networks • Audit: Enable mechanisms that record and examine activity in systems that process PHI • Integrity: Enable mechanisms that protect PHI from improper altercation or destruction • Authentication: Enable mechanisms to ensure that the person / entity requesting access to PHI is

the one who submitted claim or is an authorized case worker

Our solution will provide an SSL 3.0 or TLS 1.2 secure connection for access to the ADH database, which will reside within a secure environment with encryption of data at rest, through which the contact tracing workers will capture and transmit PHI.

D. Describe your organization’s level of understanding and experience working with the privacy and security practices and processes as defined by the National Institute of Standards and Technology (NIST) and Health Information Technology for Economic and Clinical Health (HITECH).

5 points

Deloitte is a leader in the State and Local industry and has a team of subject matter specialists with broad experiences assisting clients with security and data privacy risks, leveraging security practices defined by NIST and HITECH. Deloitte has deep compliance and operational experience amassed from assisting 250+ organizations globally in preparing for and achieving readiness for privacy regulations & standards, such as NIST and HITECH, and having performed cybersecurity engagements for organizations in 36 States including Arkansas. Currently, as part of the Arkansas’ Information Support Services (ISS) and Arkansas Integrated Eligibility System (ARIES) engagement, Deloitte works with the Department of Human Services (DHS) to provide security risk and compliance services, maintaining compliance with NIST 800-53 Rev. 4 standard. Deloitte understands that the HITECH Act contains four subtitles; Subtitle A concerns the promotion of health information technology and is split into two parts. Part 1 is concerned with improving healthcare quality, safety, and efficiency. Part 2 is concerned with the application and use of health information technology standards and reports. Subtitle B covers testing of health information technology, Subtitle C covers grants and loans funding, and Subtitle D covers privacy and security of electronic health information. Subtitle D is also split into two parts. Part 1 is concerned with improving privacy and security of health IT and PHI and part 2 covers the relationship between the HITECH Act and other laws. Deloitte will also leverage its Security and Privacy Assessment Framework which is built off industry standards such as NIST and has been leveraged for numerous States when deploying contact tracing and tracking solutions. By leveraging NIST standards such as special publication 800-53 and other security and privacy enabling guidelines, Deloitte is able to accelerate engagements and provide guidance for the protection of client and citizen data.

E.6 IMPLEMENTATION

A. Discuss your organization’s plan for completing implementation by July 1, 2020. Include a timetable of implementation activities your organization proposes for implementation and the activities expected to be completed by ADH.

5 points

Having deployed similar solutions throughout the country, Deloitte proposes the following implementation plan which includes an initial stand-up of the Command Center, CTT technology and contact tracing staff deployment in eight business days, followed by ongoing agile operations and


continuous improvement. The expectation is for the State of Arkansas to provide a project team to help facilitate the project and an outbound campaign list to enable customer outreach. Following figure depicts the high-level timeline of the implementation:


In accordance to section 2.8 A, Deloitte Consulting’s proposal is provided subject to reaching agreement on the supplemental terms and conditions, including agreement on liability. Should Deloitte Consulting be selected for an Interview, then per Solicitation Section 2.3, Deloitte Consulting will present the requested information, including the recommended implementation plan, proposal for performance of the services, and comprehensive pricing structure. In the event selected for award and upon mutual agreement, the foregoing will be confirmed in the final written agreement.

Appendix A – Qualification and Experience

deloitte consulting sp-20-0115 response packet final...jun 19, 2020 · sp-20-0115 response packet...

Documents