Common use of PEBC Employee Benefits Enrollment Application and Database Software Maintenance and Support Clause in Contracts

PEBC Employee Benefits Enrollment Application and Database Software Maintenance and Support. PEBC Maintenance and Support includes troubleshooting, modifying, upgrading, maintaining, improving security, and enhancing systems and applications which may be running in a production environment. This software is written in C#, housed in Azure, and the data is housed in a SQL Server database. PEBC provides healthcare benefits administrative services for Dallas County, Tarrant County, Denton County, Parker County and the North Texas Tollway Authority. Files are received weekly from each entity related to the health insurance being provided to employees and retirees. These files are reviewed, loaded and processed into the database using the Benefits Administration Software. • The software uses rules engines and stored procedures to: o identify errors in the data; o make corrections; o prepare the information for submittal to insurance providers; and o process files containing information on tax saver and/or health savings plans that are submitted to vendors. • In addition to traditional software maintenance activities of bug fixes, patches, etc., the vendor will also: o provide software development services as needed for development of new features o perform modifications required due to regulatory changes or plan changes of customer entities o Maintain the Azure environment from the standpoint of provisioning users, removing users, ensuring updates to the environment are made using a process that ensure the system continues to operate accurately and performance meet PEBC needs. • Security of the system is critical. This requires: o The vendor to possess and exercise expertise in Microsoft Azure security best practices around, but not limited to: ▪ Network segmentation, ▪ Network Security Groups, ▪ Azure Security Center, ▪ Data security/encryption ▪ Identity management, ▪ Virtual machine hardening, and ▪ Endpoint access control. • All application development must, at a minimum, adhere to the standards outlined in the Open Web Application Security Project’s (OWASP) Application Security Verification Standard (ASVS) at Level 2. • All code changes must be scanned for vulnerabilities before being put to User Acceptance Testing to ensure any weaknesses are addressed. Additionally, all software in use must remain current to provide a secure environment so the vendor will be responsible for ensuring that occurs. Additional responsibilities include documenting and managing the process for adding new users to the system and removing users when requested by PEBC. The successful vendor will be required to sign a Business Associate Agreement with PEBC. This agreement satisfies the HIPAA requirements of the engagement. • Submit data updates to vendors in custom data formats • Assure high data integrity, while meeting regular (at least weekly) data processing deadlines • Implement innovative data programming techniques to meet unique business needs • A comprehensive and detailed list of desired features can be found as PEBC Scope of Services. Detailed Scope of Work: The response document should provide a comprehensive description of the project's scope of work, including but not limited to:

PEBC Employee Benefits Enrollment Application and Database Software Maintenance and Support. PEBC Maintenance and Support includes troubleshooting, modifying, upgrading, maintaining, improving security, and enhancing systems and applications which may be running in a production environment. This software is written in C#, housed in Azure, and the data is housed in a SQL Server database. PEBC provides healthcare benefits administrative services for Dallas County, Tarrant County, Denton County, Parker County and the North Texas Tollway Authority. Files are received weekly from each entity related to the health insurance being provided to employees and retirees. These files are reviewed, loaded and processed into the database using the Benefits Administration Software. • The software uses rules engines and stored procedures to: o identify errors in the data; o make corrections; o prepare the information for submittal to insurance providers; and o process files containing information on tax saver and/or health savings plans that are submitted to vendors. • In addition to traditional software maintenance activities of bug fixes, patches, etc., the vendor will also: o provide software development services as needed for development of new features o perform modifications required due to regulatory changes or plan changes of customer entities o Maintain the Azure environment from the standpoint of provisioning users, removing users, ensuring updates to the environment are made using a process that ensure the system continues to operate accurately and performance meet PEBC needs. • Security of the system is critical. This requires: o The vendor to possess and exercise expertise in Microsoft Azure security best practices around, but not limited to: ▪ Network segmentation, ▪ Network Security Groups, ▪ Azure Security Center, ▪ Data security/encryption ▪ Identity management, ▪ Virtual machine hardening, and ▪ Endpoint access control. • All application development must, at a minimum, adhere to the standards outlined in the Open Web Application Security Project’s (OWASP) Application Security Verification Standard (ASVS) at Level 2. • All code changes must be scanned for vulnerabilities before being put to User Acceptance Testing to ensure any weaknesses are addressed. Additionally, all software in use must remain current to provide a secure environment so the vendor will be responsible for ensuring that occurs. Additional responsibilities include documenting and managing the process for adding new users to the system and removing users when requested by PEBC. The successful vendor will be required to sign a Business Associate Agreement with PEBC. This agreement satisfies the HIPAA requirements of the engagement. • Submit data updates to vendors in custom data formats • Assure high data integrity, while meeting regular (at least weekly) data processing deadlines • Implement innovative data programming techniques to meet unique business needs • A comprehensive and detailed list of desired features can be found as PEBC Scope of Services. Detailed Scope of Work: The response document should provide a comprehensive description of the project's scope of work, including but not limited to:.

PEBC Employee Benefits Enrollment Application and Database Software Maintenance and Support. PEBC Maintenance and Support includes troubleshooting, modifying, upgrading, maintaining, improving security, and enhancing systems and applications which may be running in a production environment. This software is written in C#, housed in Azure, and the data is housed in a SQL Server database. PEBC provides healthcare benefits administrative services for Dallas County, Tarrant County, Denton County, Parker County and the North Texas Tollway Authority. Files are received weekly from each entity related to the health insurance being provided to employees and retirees. These files are reviewed, loaded and processed into the database using the Benefits Administration Software. • The software uses rules engines and stored procedures to: o identify errors in the data; o make corrections; o prepare the information for submittal to insurance providers; and o process files containing information on tax saver and/or health savings plans that are submitted to vendors. • In addition to traditional software maintenance activities of bug fixes, patches, etc., the vendor will also: o provide software development services as needed for development of new features o perform modifications required due to regulatory changes or plan changes of customer entities o Maintain the Azure environment from the standpoint of provisioning users, removing users, ensuring updates to the environment are made using a process that ensure the system continues to operate accurately and performance meet PEBC needs. • Security of the system is critical. This requires: o The vendor to possess and exercise expertise in Microsoft Azure security best practices around, but not limited to: ▪ Network segmentation, ▪ Network Security Groups, ▪ Azure Security Center, ▪ Data security/encryption ▪ Identity management, ▪ Virtual machine hardening, and ▪ Endpoint access control. • All application development must, at a minimum, adhere to the standards outlined in the Open Web Application Security Project’s (OWASP) Application Security Verification Standard (ASVS) at Level 2. • All code changes must be scanned for vulnerabilities before being put to User Acceptance Testing to ensure any weaknesses are addressed. Additionally, all software in use must remain current to provide a secure environment so the vendor will be responsible for ensuring that occurs. Additional responsibilities include documenting and managing the process for adding new users to the system and removing users when requested by PEBC. The successful vendor will be required to sign a Business Associate Agreement with PEBC. This agreement satisfies the HIPAA requirements of the engagement. • Submit data updates to vendors in custom data formats • Assure high data integrity, while meeting regular (at least weekly) data processing deadlines • Implement innovative data programming techniques to meet unique business needs • A comprehensive and detailed list of desired features can be found as PEBC Scope of Services. Detailed Scope of Work: The response document should provide a comprehensive description of the project's scope of work, including but not limited to: