Page 1 of 116

INCENTIVE PORTFOLIO SOLUTIONS

KAISER PERMANENTE

REQUEST FOR PROPOSAL (RFP) No. 2015-00061

December 1, 2015

CONFIDENTIAL – DO NOT DISTRIBUTE Copyright © 2015 by Kaiser Foundation Health Plan/Hospitals. All rights reserved.

This document contains proprietary information to Kaiser Permanente. Information contained herein may be used only for the benefit of the Kaiser Permanente. Duplication or dissemination for any other purpose is prohibited.

Page 2 of 116

Table of Contents

1 INTRODUCTION AND PURPOSE ..................................................................................................................................... 4

1.1 INTRODUCTION ............................................................................................................................................................... 4 1.2 OBJECTIVE ..................................................................................................................................................................... 4 1.3 BASIS OF OFFERS ........................................................................................................................................................... 4 1.4 PROPOSAL SUBMISSION – ESOURCING ........................................................................................................................... 4 1.5 QUESTIONS REGARDING THE RFP .................................................................................................................................. 5 1.6 RFP SCHEDULE .............................................................................................................................................................. 5

2 RFP & PROPOSAL INFORMATION ................................................................................................................................ 6

2.1 GENERAL INSTRUCTIONS ............................................................................................................................................... 6 2.2 CONFIDENTIALITY .......................................................................................................................................................... 6 2.3 WITHDRAWAL OR MODIFICATIONS ................................................................................................................................ 6 2.4 COSTS FOR PROPOSAL DEVELOPMENT ........................................................................................................................... 6 2.5 PROPOSAL DISTRIBUTION............................................................................................................................................... 6 2.6 RFP REVISIONS .............................................................................................................................................................. 6 2.7 ACCEPTANCE OR REJECTION OF PROPOSALS .................................................................................................................. 7 2.8 VALIDITY PERIOD .......................................................................................................................................................... 7 2.9 BUSINESS ASSOCIATE AGREEMENT (BAA) .................................................................................................................... 7 2.10 SECOND TIER SUBCONTRACTING REPORT ...................................................................................................................... 7 2.11 OWNERSHIP AND RETENTION OF PROPOSAL DOCUMENTS ............................................................................................. 7 2.12 VENDOR RESPONSE FORM .............................................................................................................................................. 7

2.12.1 Functional And Technical Requirements ............................................................................................................. 8 2.12.2 Yes/No/Partial ...................................................................................................................................................... 8 2.12.3 Narrative Response .............................................................................................................................................. 8 2.12.4 Deviations, Enhancements, And System Modifications........................................................................................ 8

3 PROPOSAL CONTENT ....................................................................................................................................................... 9

3.1 AUTHORITY TO BIND ......................................................................................................................................................... 9 3.2 VENDOR INFORMATION ..................................................................................................................................................... 9

3.2.1 Company Background .......................................................................................................................................... 9 3.2.2 Client Base/References ...................................................................................................................................... 12

3.3 ACCOUNT TEAM ............................................................................................................................................................. 14 3.4 CUSTOMER SERVICE FOR KP ............................................................................................................................................ 15 3.5 TECHNOLOGY ................................................................................................................................................................. 17 3.6 TECHNICAL SERVICES AND SUPPORT ................................................................................................................................. 19 3.7 TRAINING ....................................................................................................................................................................... 19 3.8 FUNCTIONAL REQUIREMENTS ........................................................................................................................................... 21

Group A – Data Management ............................................................................................................................................ 21 Group B – Program-Product Requirements ...................................................................................................................... 29 Group C – HIPAA Authorization ....................................................................................................................................... 35 Group D – UI/UX,Web, Mobile Requirements .................................................................................................................. 40 Group E – Reports & Extracts ........................................................................................................................................... 46 Group F – Quality Control Management .......................................................................................................................... 56 Group G – Onboarding ...................................................................................................................................................... 61 Group H – Fulfillment Requirements................................................................................................................................. 67 Group I – Customer Support Requirements ....................................................................................................................... 70 Group J – Business Processes Requirements .................................................................................................................... 79

3.9 TECHNICAL REQUIREMENTS ........................................................................................................................................ 82 Group A – General Technology ......................................................................................................................................... 83 Group B – Availability ....................................................................................................................................................... 86 Group C – Performance .................................................................................................................................................... 88 Group D – Scalability ........................................................................................................................................................ 90

Page 3 of 116

Group E – Adaptability ...................................................................................................................................................... 92 Group F – Integration........................................................................................................................................................ 94 Group G – Managability .................................................................................................................................................... 98 Group H – Data Quality .................................................................................................................................................. 100 Group I – User Interface (UI) .......................................................................................................................................... 101 Group J – Implementation ............................................................................................................................................... 102 Group K – Deployment .................................................................................................................................................... 106 Group L – Release Management ...................................................................................................................................... 107 Group M – Training ......................................................................................................................................................... 108 Group N – Support ........................................................................................................................................................... 110

3.10 PRICE PROPOSAL ........................................................................................................................................................ 115 3.10.1 Pricing Considerations .................................................................................................................................... 115

3.11 CLOUD SERVICES AGREEMENT .................................................................................................................................. 116 3.12 VENDOR SECURITY CONTROLS ASSESSMENT QUESTIONNAIRE .................................................................................. 116

Page 4 of 116

1 Introduction and Purpose

1.1 Introduction

Kaiser Permanente (or “KP”) is the nation’s largest nonprofit public benefit health plan, serving over 10 million members with locations in 7 regions (Northern California, Southern California, Colorado, Georgia, Hawaii, Northwest [Oregon, Washington], and Mid-Atlantic States [Virginia, Maryland and Washington DC]. Our KP customers include national, federal, large-group regional, labor & trust, and mid to small size employer groups. KP partners with these employer-group customers to manage the health of their populations through workforce health consultation services, programs, and products. One of the common strategies employers are using to motivate positive behavior change within their workforce is wellness rewards programs. Over the past 3 years, KP has developed and expanded a suite of products to support employer-group customers with their wellness rewards programs. These solutions are differentiated by KP's integrated care system, leverage data from our electronic health record, and follow National Clinical Guidelines, ensuring members are rewarded for getting the right care at the right time. A robust back-end rules engine and complex system integration named the “health engagement platform” powers KP’s portfolio of product offerings: KP’s Wellness Rewards Products:

Data (individual-level report extracts): for customers who use an incentive program vendor, 3rd party, or self-administer their own rewards program

Portal plus data: for customers who want an online user interface for employees to track their progress on rewardable activities, where rewards can be administered by KP, or by the customer or 3rd party

Bulk Gift cards: for customers who want to order a quantity of cards to use for administering their own program.

1.2 Objective

Year-to-date, our products have supported over 1.5 million eligible members across 400 employer customers. To meet the growing demand for these capabilities and to extend our wellness program capabilities, we are exploring opportunities to partner with a vendor. We are conducting an RFP to help determine the viability of an outsourced leading edge solution to scale and extend our existing product suite. It is the expectation that KP’s requirements for our key offerings (data, portal plus data and bulk cards) will be addressed and that a vendor solution will enable us to continue to maintain our commitment to leverage data from KP’s integrated care delivery system and continue to support evidence-based clinical practices.

1.3 Basis of Offers

Products and/or services provided pursuant to this solicitation will be used by Kaiser Foundation Health Plan, Inc. and its customers and members. Kaiser Foundation Hospitals and Kaiser Foundation Health Plan, Inc. are charitable institutions within the meaning of the Nonprofit Institutions Act, 15 U.S.C. Section 13 (c), as interpreted in DeModena v. Kaiser Foundation Health Plan, Inc. 743 F2d 1388 (9th Cir 1984) cert denied 469 U.S. 1229 (1985) and are exempt from the Robinson-Patman Act restrictions on discriminatory pricing. As a result, Bidders may apply special pricing without reference to the general rules of the Robinson-Patman Act.

1.4 Proposal Submission – eSourcing

All proposal responses must be sent through the eSourcing system on the RFP Closing Date. Inclusion of marketing literature is strongly discouraged.

Proposals received after the RFP closing date may be rejected and returned at KP’s sole discretion. It is the Bidders' sole responsibility to ensure that its Proposal is received on or before the RFP Closing Date. Proposals will ONLY be accepted via the eSourcing submission process.

Page 5 of 116

1.5 Questions Regarding the RFP

Prior to the RFP closing date all written questions regarding this RFP should be sent electronically through KP’s eSourcing system. All written questions will be answered.

In addition, KP will schedule a question and answer conference call with each vendor individually to address any questions regarding the RFP.

1.6 RFP Schedule

Listed below are the important actions including the dates and times by which they are to be taken or completed.

DATE EVENT

1 December 2015 Distribute Request for Proposal

7-14 December 2015

(Closing on Dec 14 at 5pm PST)

Vendor Questions

Written RFP questions may be submitted to Kaiser Permanente via eSourcing. Additionally, KP will schedule a question and answer conference call with each vendor individually to address any questions regarding the RFP.

23 December 2015 no later than 5pm

PST

RFP Closing Date, completed proposal response transmitted to Kaiser Permanente via eSourcing.

14-20 January 2016

Vendor Demonstrations: KP will be scheduling vendor demonstrations during the week of 14-16 January 2016

21 January 2016

until award announcement

The “quiet” period. From this point forward until an actual award is made is the quiet period of the RFP solicitation. During the quiet period you may be contacted by Kaiser Permanente Staff asking questions for clarification on portions of your proposal. Any contact made by Kaiser Permanente personnel at this point should not be construed as selection as a finalist. Team members should not be contacted directly during this period, unless arranged by KP.

As part of our process during this period, all questions, status inquiries, etc. made by a vendor are to be directed to Maria Motta for a formal response.

Maria Anna B. Motta | National Sourcing Manager | Procurement & Supply Kaiser Foundation Health Plan, Inc. | 1800 Harrison St, 18th floor | Oakland, CA 94612 (Phone) 510.625-4844 (Fax) 510.625.4838 (Mobile) 510.368.6739 (Email) maria.a.motta@kp.org

February 2016

Bidders notified of Kaiser Permanente selection.

Notification will be accomplished by either a telephone call or electronic mail.

It is at this point that finalist selections will be made. If you are a finalist you will be contacted directly by KP. If you have not been contacted, it DOES NOT mean that your proposal has been rejected and that your firm is no longer being considered. It is Kaiser Permanente’s intention to keep all of its options available until an actual award has been made and a contract has been signed .

Kaiser Permanente does not guarantee the above schedule and reserves the right to modify this schedule and its events to best meet its needs.

Page 6 of 116

2 RFP & Proposal Information

2.1 General Instructions

The Proposal submission should be prepared succinctly and identify any deviations from the requested requirements.

Responses must be presented in the same order as the information is requested in the RFP. All proposal responses must identify the corresponding section number from the RFP. The Proposal must include a Table of Contents with page numbers and section tabs; references to all exhibits, and other included materials, and must contain sufficient detail to facilitate easy reference to all requested information.

This RFP is not an offer to contract. Only the execution of a written contract will obligate KP in accordance with the terms and conditions contained in such contract.

2.2 Confidentiality

This RFP is considered Kaiser Permanente proprietary confidential information. In responding to this RFP, the Bidder agrees to keep confidential this RFP and all information and materials which may be disclosed by Kaiser Permanente to Bidder’s employees, agents, and or subcontractors in the conduct of business under this RFP.

Except for protected health information (PHI) or individually identifiable information, which are always Confidential Information, Confidential Information does not include information that: (a) is or becomes a part of the public domain through no act or omission of the other party; (b) was in the other party's lawful possession prior to the disclosure and had not been obtained by the other party either directly or indirectly from the disclosing party; (c) is lawfully disclosed to the other party by a third party without restriction on disclosure; or (d) is independently developed by the other party without the use of confidential information.

2.3 Withdrawal or Modifications

Proposals may be withdrawn or modified by written request from the Bidder prior to the time set for receipt of Proposals. No oral withdrawals or modifications will be accepted. Bidders may not modify the proposals after the deadline for Proposal submission unless requested to do so by KP.

2.4 Costs for Proposal Development

All costs associated with the development and submission of the Proposal and any resulting contract negotiations shall be borne entirely by the Bidder.

2.5 Proposal Distribution

Distribution of Proposals to parties other than those specifically designated (and their subcontractors as applicable) is not authorized. Failure to observe this guideline may result in Bidder disqualification.

2.6 RFP Revisions

Kaiser Permanente may modify the RFP prior to the date set for its receipt of Proposals, by issuance of an addendum to the RFP sent through eSourcing to all Bidders who received a copy of this RFP. Addendums will be clearly marked as such. Each addendum will be numbered consecutively and will become part of this RFP.

Page 7 of 116

2.7 Acceptance or Rejection of Proposals

Kaiser Permanente reserves the right to reject any and all Proposals. Any deviations from the guidelines set forth in this RFP may result in a Proposal's being considered non-responsive and, therefore, could result in rejection of the Proposal or lower the overall evaluation score. KP reserves the right to (i) solicit Proposals again and/or (ii) accept a Proposal without further bidding and/or (iii) to further negotiate with the selected bidder. KP does not guarantee that an actual Agreement will result from this RFP and evaluation process. KP reserves the right to award in whole or in part.

2.8 Validity Period

Proposals are to be valid for a minimum period of six months after the Proposal due date.

2.9 Business Associate Agreement (BAA)

If you are awarded a contract you will be required to sign a Business Associate Agreement (BAA). Attached for Bidder’s review is a sample copy of KP’s BAA.

760497v4_Business_

Associate_Agreement_PS_Version_for_IT.doc

2.10 Second Tier Subcontracting Report

Kaiser Permanente is distinguished by our social purpose, which is reflected in our strong commitment to diversity throughout our organization, including supplier diversity. Moreover, as a prime federal contractor, KP is required to comply with federal laws established to provide small business the maximum practical opportunity to participate in our purchasing, contracting and subcontracting activities. We ask our prime suppliers to mirror our commitment. If you are awarded a contract you will be asked to submit a Tier II annual subcontracting plan to Kaiser Permanente. Attached for Bidder’s review is a copy of this document.

Tier II

Subcontracting Plan Master rev 1 09-2014.docx

2.11 Ownership and Retention of Proposal Documents

All written responses to this RFP shall become the property of Kaiser Permanente. By responding to this RFP, Bidder agrees that Kaiser Permanente reserves the right to incorporate the Bidder’s RFP response in whole or in part in any resulting agreement between the parties. KP reserves the right to utilize independent third-party consultants to assist it in proposal review. Consultants to this RFP process (if any), shall be under a non-disclosure agreement with KP.

2.12 Vendor Response Form

The purpose of the "Vendor Response Form" is to provide a standard method by which you describe in detail how you would meet the following requirements. Please record your response in the column corresponding to the section and item number and title, as provided in this RFP. If your solution includes a suite of products, identify what product (including version number) meets that requirement. Provide details on any version dependencies between different products such as an add-on module will only work with the latest version of the standard product. Provide details on any solutions that require specific versions of software, version dependencies or plug-ins. If reference materials are provided, indicate the section and page that corresponds to your response.

Page 8 of 116

2.12.1 Functional And Technical Requirements

The Functional and Technical Requirements in Sections 3.8 and 3.9 respectively have been organized into separate groups. Within the Vendor Response Form the requirements are listed in the first column and may appear in either statement and question form. Vendor’s narrative description/response in support of the statement or question in this column.

2.12.2 Yes/No/Partial

The second column in the Vendor Repose Form will contain Vendor’s answer to whether or not their solution meets KP’s requirement; “Yes”, meets KP’s requirement, “No”, does not meet KP’s requirement, or, “Partially”, partially meets KP’s requirement.

2.12.3 Narrative Response

All of KP’s requirements listed require a narrative response. This portion of the Vendor Response Form will contain Vendor’s response. This is a description of the manner in which the proposed solution will satisfy the Requirement. Responses to requirements should detail how your product meets that Requirement.

2.12.4 Deviations, Enhancements, And System Modifications

This column is to be used by the respondent when your solution does not 100% match the stated requirement. Vendor will have an opportunity to discuss deviations from the KP requirement; identify enhancements that you may propose to your existing system or define what future system modifications you will be developing in order to meet KP’s requirement. In addition, an intended general availability date for when any modifications that will satisfy the KP’s requirement will become available.

Vendor will identify if their response to a requirement is a Deviation, an Enhancement or if a System Modification is forthcoming.

Deviations – This column is to be used to disclose, in a succinct manner, all the ways that your product will deviate from the Requirements. The reasons why the specifications may not be met include, but are not limited to, one or more of the following:

o One or more aspects of the Requirements will not be supported as of the date or within the time line specified by KP or as of the RFP closing date;

o One or more aspects of the Requirements is supported but at a reduced level or standard of performance than that which KP desires;

o You propose an alternative method or approach to satisfy the Requirements, and the proposed alternative does not meet all of KP’s specifications; and / or

o For other reasons than those stated, above, the product will not fully meet KP’s expectations.

No matter how insignificant a Deviation may be, or how immaterial a KP specified feature or element may seem, you should clearly identify each and every feature, data element, or other aspect of your product that will not be provided exactly as specified by KP. When identifying the aspect that will not be met, you should reference the specific item number to which the description of the Deviation applies and explain the reason for the Deviation.

Enhancements – Vendor will identify each feature or aspect of their product and related services that exceeds KP’s specifications and explain the specific manner by which KP will benefit from the Enhancement. You must clearly delineate whether the Enhancement is incorporated as part of your product and/or standard service or is available as an option.

System Modifications – Vendor will identify the modifications, or specific aspects of such modifications, that Vendor is committing to provide by a specified date or within the time line specified in your proposal response. Vendor should provide a brief description of the needed system modifications, and record the expected date of general availability of the modifications.

If vendor intends to charge KP an additional fee for a specification enhancement or modification, note this in your response and detail the costs separately from the basic product fee detail in the pricing spreadsheet included in section 3.10 Price Proposal.

Page 9 of 116

3 Proposal Content

3.1 Authority to Bind

The Authority to Bind section should be presented at the beginning of Vendor’s Proposal. The RFP must be signed by an individual who is authorized to bind the Bidder contractually. The proposal should include the name of the company and the eSourcing RFP identification number. The name and title of the individual signing the form should be typed immediately below the signature. An unsigned Proposal may be rejected.

Authority to Bind Company Name: Viverae, Inc.

eSourcing RFP ID#: 2015-00061

Employee Signature

Date 12/22/2015 (The signature must be that of an employee that is authorized to commit your firm to an agreement.)

Printed Employee Name: Mike Lamb

Title of Employee: COO and President

3.2 Vendor Information

3.2.1 Company Background

Company Name: Viverae, Inc.

Address: 10670 N. Central Expressway, Ste. 700, Dallas, Texas 75231

Website: www.viverae.com

Primary Contact: Jim Trimarco, Chief Sales Officer

Telephone number: 972-677-1600

E-mail: Jim.Trimarco@Viverae.com

Individuals Authorized to commit company during negotiations:

Mike Lamb, Chief Operating Officer

Individuals authorized to sign legal documents:

Mike Lamb, Chief Operating Officer

Dun & Bradstreet Number and Rating 165463329. Viverae is in good standing.

Page 10 of 116

Tax ID Number 26-4218002

Age of Company 12 years

Size of Company. (Include number of FTE employees)

Total: 843 employees FT Employees: 429

Number of FTE employees that support incentive programs. Break out number of FTEs by area (e.g. technical vs. product development etc.)

Viverae has 843 employees that support incentive programs. As a fully-integrated program, Viverae’s services are designed, implemented, and maintained in-house. Sales – 23 (FT); 0 (PT) – Total = 23 Service Delivery (Client Services/Implementation) - 37 (FT); 1 (PT) – Total = 38 Screening Services – 203 (FT); 365 (Per Diem) – Total = 568 IT/Data Services and Support/Reporting – 50 (FT); 0 (PT) – Total = 50 Health Center – 63 (FT); 39 (PT) – Total = 102 Product Development – 9 (FT); 0 (PT) – Total = 9 Communications/Marketing – 19 (FT); 2 (PT) – Total = 21 Other Corporate Staff – 25 (FT); 7 (PT) – Total = 32 Totals: 429 (FT); 414 (PT/Per Diem); 843 TOTAL

Year and State of Incorporation The company was established as Elite Wellness, LLC in March 2003. Viverae, Inc. became a corporation on 1/30/2009 in the state of Delaware.

Recent mergers, acquisitions or IPO’s. Viverae has not undergone any recent mergers, acquisitions, or IPOs.

Financial profile of company. Include your company’s latest full audited operating year’s results and any quarterly updates. For publicly traded companies include your latest annual report, 10-K and 10-Q reports.

Viverae is a privately-held company that has financial backing from a private equity firm. Please see attached audited financial statements.

Provide total audited revenue and expenses for the previous three years. The statements should be prepared by a licensed Certified Public Accountant in accordance with the auditing standards and standards for accounting and review services of the American Institute of Certified Public Accountants. All statements in the audited financial statement must adhere to Generally Accepted Accounting Principles (GAAP).

Please see attached audited financial statements.

What percentage of your revenue do incentive programs represent? What was the total revenue derived from incentive offerings during the most recent fiscal year?

One hundred percent of Viverae’s revenue is derived from employer health management programs with incentive components.

Concise description of any business partners that may be providing support services as a part of this initiative. Please clearly define the nature of the relationship.

All services were developed and are maintained in-house. Viverae does use trusted subcontractors in Red Light States which include California, Nevada, Tennessee, and Washington. Red Light states are states which require you to hold a specific license to be in compliance with their public health code. California, for example, requires each person who conducts a finger stick to be certified

Page 11 of 116

phlebotomists or state licensed health care professional. Each person must show proof of their training. Contract Partners for Biometric Screening Services: • Clinical Reference Laboratory (CRL) – 6 years • Healthy Achievers – 6 years • Kan Do Health and Wellness – TN vendor only – 5 years

Has your company ever defaulted on a contract or been sued for failure to comply with contract terms? If yes, please explain.

No, Viverae has never defaulted on a contract or been sued for failure to comply with contract terms.

Has your company ever filed for bankruptcy? If so, provide date and chapter.

No, Viverae has never filed for bankruptcy.

Within the last three years, has your company been, or is it now, involved in any threatened litigation, investigation, reorganization, receivership, filing, strike, audit, corporate acquisition, or other action? If so, specify.

All litigation within the last three years has been employment-related and is confidential. In 2014, Viverae acquired OneHealth, a California-based company.

Do you currently provide goods or services to any clients that are direct KP competitors that may cause a conflict of interest in executing an agreement with KP? If yes, explain.

Viverae does not provide goods or services to any Customers that are in direct competition with KP and would therefore cause a conflict of interest.

Does anyone within your company who has the authority to direct or influence your response to the RFP have any financial or other interest in KP (such as an immediate family member that is employed by KP) that might create a conflict of interest or an appearance of a conflict of interest?

No, no individual within Viverae has any financial or other interest in KP that would therefore present a conflict of interest.

Please identify any changes in executive leadership over the past 2 years.

Within the last two years, Viverae has brought on board two executive-level individuals: - Michelle Brown, Vice President of Client Services - Kirsten Lester, Vice President of Product

Provide the attrition rate of employees over the past 2 years.

Viverae’s attrition rate for the past two years (2014 and 2015) was 17.7%, based on full-time employees.

Describe the location of your data centers and facilities that will be used in the provision of services to KP. KP requires that all KP data must be hosted in the United States and that there will be no access to or storage of KP data outside the United States. Indicate if any portion of the services will be provided offshore from locations outside the United States and the nature of any such offshore services.

Viverae’s data centers are housed at Rackspace in the U.S. Viverae’s services are provided from the corporate headquarters in Dallas, Texas. No services are provided offshore.

As to your data centers to be used in providing the services, please indicate if they are owned by you or are owned by a contracted hosting provider. Please indicate whether you and/or the contracted provider are SOC 2, Type 2 certified and provide a copy of the SOC

Viverae’s servers are owned by Viverae. Viverae undergoes annual SOC 2 reporting. Rackspace is also SOC 2, Type 2 certified. Please see Viverae’s attached SOC 2 report.

Page 12 of 116

2, Type 2 repoGrt(s) for the most recent period. If you or your provider are not so certified please indicate what controls that are in place to secure confidential data which may include protected health information and/or individually identifiable information

3.2.2 Client Base/References

List the top five relevant clients in which directly comparable services are provided, with a summary of the term of the account, the services provided, and the size of the account.

1. Aramark 2. Genesis Health Care 3. Houston Independent School District 4. Clorox 5. Concentra 6. Honor Health

Provide a list of all healthcare customers brokers or consultants you provide services to.

Below is a list of all healthcare customers brokers or consultants Viverae provides services to:

Marsh & McCLennan

AON

Arthur J. Gallagher

Brown & Brown

Wells Fargo

USI

Lockton

Hub International

Alliant

Towers Watson

Hays Group

IMA

Holmes Murphy

Higginbotham

Regions Insurance Group

TrueNorth

Please provide three current references. The clients listed as references should have been active healthcare client customers for the last 6-12 months. Each customer reference should include:

Name, phone number and email of contact

Name of client reference’s company

Brief description of the work performed for the client reference

Brief overview of the client reference’s business objectives and how they were met

1. Genesis A. Contacts: Karen Halstead, Senior Director

(Karen.halsted@genesishcc.com; 610-925-4058) and Leona Congdon, Human Resources Director (Leona.congdom@genesishcc.com,610-925-4068)

B. Work performed by Viverae: onsite screenings; Coaching II; Disease Management; Claims Integration; implemented custom screening registration processes and system enhancements to accommodate wellness committee in registering participants; annual custom home mailers to full population; required DM and Coaching program; and annual custom aggregate reporting by location and full population.

C. Business Objectives

High Engagement – Increased Engagement (over 70% participation

Page 13 of 116

in the overall goal in year 5 (includes HRA, screening, and required coaching) – highest out of all five years); for those eligible for DM, those who enrolled had 32% higher engagement in the HRA and Screening and 5.2 touchpoints of engagement in other activities (online learning and challenges).

Culture – Built a culture of wellness with annual screenings and engagement activities like online learning courses, challenges, and health coaching; provided educational materials for participants pertinent to chronic conditions and lifestyle changes

Risk Reduction – Health Score increase in the claims cohort population from 82.1 to 83.1 by year 4 (population of 7,961)

2. Arthur J. Gallagher A. Contacts: Darota Diehl

(dorota_diehl@ajg.com; 630-285-3853) B. Work Peformed by Viverae: Implemented

custom screening processes and billing methods; created product enhacements to help client administer program; crafted custom communications and home mailers.

C. Business Objectives

Long Term and Consistent Engagement – installed a custom quarterly program with multiple incentive opportunities baked in; participants have new goals to meet at the end of each quarter and are rewarded for continuous efforts for all-year engagements

Culture of Wellness – Viverae supports monthly Wellness Ambassador calls with AJG and provides a clinical expert to discuss wellness related topics during each meeting.

3. The E.W. Scripps Company A. Contacts: Kevin Donoghue

(Donoghue@scripps.com; 513-977-3967); Laura Beebe (laura.beebe@scripps.com; 513-977-3789)

B. Work Performed by Viverae: Strategically changed program to offer a wellness solution that increased member engagement and enhanced culture while also being easier to administer incentives; implemented a wellness committee from the ground-up

C. Business Objectives:

Page 14 of 116

Increased engagement – have surpassed total number completed assessments in first 8 weeks of Year Two, than total completed in all of Year 1; increased device integration usage by over 250% (this has also impacted challenged participation by showing an increase for both peer and employer challenges)

Culture of Wellness – Built wellness committee network made-up of 70+ committee participants; wellness committee meets monthly to discuss a predetermined topic of focus that is deployed during the upcoming month; and committee participants are tasked with specific activities each month to help engage participants as their own locations and raise further awareness of the wellness program and resources.

3.3 Account Team

Provide an organization chart detailing resources that will support KP if awarded a contract including but not limited to: account management, product development, technical resources, client implementations, customer service, etc. Provide the number of resources, their roles/responsibilities, and percent allocation of each FTE to the KP account. Will these be shared resources?

See attached deck with Client Services overview slides that describe the breadth of service, the account team org structure, roles/responsibilities, and the approach Viverae takes to book of business account assignment. There are ~50 people in Client Services today. There are both shared and dedicated resources within the team.

Provide profiles of Vendor’s proposed KP account team. Profiles shall include but are not limited to professional service descriptions, years of experience in this role, and length of employment with Vendor

Vice President, Client Services has 20+ years experience leading client services teams, two years tenure with Viverae. Directors have 10+ years experience leading account management professionals, average tenure with Viverae is two years. CRMs have an average of seven years experience working with Customers within and across a variety of industry verticals including the healthcare industry vertical, average tenure with Viverae is two years.

Please describe measures the vendor will undertake to ensure sufficient resources are available and adequately responsive so that KP related inquiries or issues are addressed and resolved in a timely and professional manner in accordance with SLAs. What response

CRM conducts bi-weekly calls with each client to review any open items, provide updates and field questions/requests. The account team service model provides Cusomters with a primary point-of-contact and alternative point-of-contacts including account support, directors and VP to ensure

Page 15 of 116

time can KP expect, by need, from each respective team?

Customers are never without the ability to speak to someone quickly, when necessary. Client Services turnaround time for acknowledging emails and phone calls is one business day.

3.4 Customer Service for KP

How does your company measure their ability to satisfy customer needs and customer satisfaction?

To gauge both member/participant and client satisfaction, Viverae uses a variety of satisfaction measurement protocols including: member surveys; metrics for sustained engagement, year-over-year (“YOY”) improvement, risk factor reduction; and member responses in the annual Health Risk Assessment (“HRA”) completion. Viverae can measure member satisfaction in the tangible proof of results and adherence to the member’s care plan. The Viverae Client Satisfaction Survey provides sustainable proof that Viverae programs produce the desired results. The Client Referral Index is a measure where current and legacy Customers are asked about the likeliness to refer Viverae to other companies with similar needs. Viverae also evaluates retention of legacy Customers whose contract renewals have extended into second and third terms with Viverae. Viverae constantly monitors member satisfaction interactions for maximized satisfaction of services including biometric screenings and coaching interactions. Some surveys are quarterly (such as immediately following onsite biometric screenings). Satisfaction of Client Services team members is measured by an annual Client Services Satisfaction Survey. Viverae’s overall participant satisfaction rate is 93% over the past three years.

Please describe your Customer Service organization, hours of operation and internal operating systems.

The Heath Center’s dedicated phone, email and secure fax provide quick support to participants surrounding portal functionality, program components such as online HRA completions, event sign-ups, password resets, and various other inquiries. The team serves as the primary solutions provider for incoming client calls and issues management including daily health management program requests, IT/data support, account questions, technical support, and other issues and concerns. The Health Center hours are Monday – Thursday, 7 a.m. – 7:30 p.m. CT and Friday, 7 a.m. – 6 p.m. CT. The Viverae Customer Service team is comprised of full-time onsite representatives in the Dallas, Texas

Page 16 of 116

headquarters. During peak seasons of high call volume, Viverae retains seasonal staff members for quality assurance and to maintain minimal hold times. Viverae’s dedicated phone line includes call back queues that allow participants to retain their position in the hold queue by entering call back information that the system auto-redials upon the availability of the next representative. The average hold time is less than 22 seconds. Member support phone number: 1- 800-VIVERAE.

Please outline your customer service process, policies and normal order entry cycle times.

The Screening, Client Relationship Manager (“CRM”), and direct member/client cases that are received and handled through member support are submitted within one (1) business day and resolved in three (3) to five (5) business days. Once a resolution is received, a Member Support Representative (“MSR”) has two (2) business days to provide the member with a resolution.

Can your company accept EDI and EFT transactions for PO’s, invoices and payment?

Yes, Viverae accepts EFT transactions for invoice payments.

Can your company provide detailed monthly account management reporting and periodic e.g. quarterly metrics review?

It is a standard practice for Viverae CRMs to provide Customers with bi-weekly reporting and quarterly business reviews.

Please describe your customer issue resolution process and escalation procedures.

Viverae provides an escalation process and Senior Leadership contact information should any situation warrant such action. The CRM is the primary liaison between the client and the entire Viverae team. If an issue should arise, the assigned client services representative will engage the appropriate team members and any wellness committee members as is appropriate. The CRM will be responsible for organizing any necessary discussions and solutions with the client and will provide regular updates until the issue is resolved. When the issue has been resolved, the CRM will provide a summary of the issue and its resolution. The client services representative will also conduct regular follow-ups to ensure that the issue does not reoccur. For IT/data issues, Viverae has an online helpdesk/ticketing process that allows Customers to track their IT issues. Viverae also has a formal escalation process, disaster recovery, and backup procedures.

How does your company document and manage unique customer requirements? How does your company communicate changing market and industry trends to customers?

For unique customer requirements, Viverae personnel utilize the Business Requirements Document (“BRD”) and associated process, which includes the problems Viverae should solve for, specific solutions as well as milestones and deliverables. This BRD will be reviewed and approved by all parties – Viverae, Client, and KP. Viverae has a systematic approach to communicating with a client’s management team and partners, including: updates about Viverae programs and various portals; notices; and various other outreach. KP’s CRM will develop a schedule that works for KP’s internal client liaison to discuss program elements and updates.

Page 17 of 116

KP Customers will be added to a database that identifies what level of announcements they would like to receive from Viverae and thus pass on to their participants. The system follows the following approach:

Level 1 – Marketing Promotions, Social Media Promotions, General Viverae Client Communications, and Viverae Notices

Level 2 – General Viverae Client Communications, Social Media Promotions, and Viverae Notices

Level 3 – General Viverae Client Communications and Viverae Notices

Level 4 – Viverae Notices

Level 5 – NO notices Customers on Levels 4 and 5 still receive updates, but are contacted only by their Client Relationship Manager. Direct participant communication is sent via Secure Message, which is accessed in the member portal.

3.5 Technology

Please describe how your Engineering group interfaces with the customer to satisfy requirements and special needs.

For unique KP requirements, Viverae Product team will utilize the Business Requirements Document (“BRD”) Technical Specifications Document and associated process, which includes the problems Viverae should solve for, specific solutions as well as milestones and deliverables. This BRD will be reviewed and approved by all parties – Viverae and KP.

Please describe your capability to partner with the customer’s design group on the “front-end” of new product development.

For unique customer requirements, Viverae personnel utilize the Business Requirements Document (“BRD”) and associated process, which includes the problems Viverae should solve for, specific solutions as well as milestones and deliverables. This BRD will be reviewed and approved by all parties – Viverae, Client, and KP. Viverae will leverage its in-house UX/UI and Product Management resources when needed for customer specific “front-end” requirements. Viverae’s Software Application Development team will perform development and quality assurance testing with established, auditable processes and documentation.

Please expand on your company’s vision and strategy to maintain long-term leadership in your industry. How do you communicate emerging trends to customers?

Workplace wellness is always top of mind for Viverae. Believing that the single greatest impact we can have on the healthcare crisis in the US is through workplace wellness programs, CEO and Founder Michael Nadeau has led Viverae to become a thought leader in the wellness industry. His vision of a true healthy workplace culture led to Viverae being named as one of the best places to work in the area and the industry by Dallas Business Journal and Fortune.com.

Page 18 of 116

Evidenced through a strategic communications schedule that includes social media, blogs, case studies, whitepapers, and bylined articles, Viverae invests in educating the market daily. In 2016, Viverae’s consultative approach will include regular communications to partners through a monthly Broker Report providing an overview of critical cohort data and previews to upcoming enhancements. This information will be used to provide best practices while improving engagement and program performance.

Describe your roadmap strategy including plans for future enhancements.

Employers and employees are faced with complex benefit options. To improve the experience, wellness program components need to be easily accessible, appeal to the entire population and drive continuous program engagement. By focusing on the participant experience, Viverae has been able to achieve these goals. Updates include enhanced personalization to the participant, reimagining how participants engage in challenges and a new progress-based Goal Management experience. Most wellness programs only measure participation. Program success depends on more than that, which is why we are launching the new Viverae Engagement Index ™. Viverae clients will be able to understand how their population is engaging (Low, Moderate, High, Very High Engagement) to determine if their program design and incentives are effective, and what program components can be incorporated to increase their results. In simplifying how our clients understand their programs, Viverae bridges the gap between data and understanding. Viverae’s 3-5 year strategy can be found in response to 3.9 Group N 20.

Please provide an overview of your production capacity and explain how your company manages seasonal demand; unplanned customer variances.

As a Software-as-a-Service (“SaaS”) solution, Viverae’s ability to manage production capacity is realized through employing Agile methodologies – Scrum and Kanban. These methodologies support unplanned customer variances. Client and member production work is managed through Scrum, while unplanned development can be accommodated through Kanban, where there is more flexibility in work prioritization.

How do you ensure that enhancements or planned releases for other customers or your overall product do not impact KP implementations to forecasts and production schedules?

Client and member production work is managed through Scrum, where work is planned in 2-3 week Sprints. Prioritization of production work occurs ahead of the Sprint and disruptions are not easily tolerated; whereas, unplanned development can be accommodated through Kanban, where there is more flexibility in work prioritization. As a SaaS model, meeting KP requirements and implementation of KP and KP Customers will not disrupt production work. Conversely, Viverae production work will not disrupt KP-specific forecasts and production schedules.

Page 19 of 116

3.6 Technical Services and Support

Do you provide a technical support hotline?

Viverae will provide a direct technical support hotline to support KP-specific issues. If needed, on-call staff will be assigned for off-business-hours escalations.

Do you have 24/7 emergency service? A 24/7 emergency service will be implemented to support KP issues.

Do you have remote administration and remote diagnostic capabilities?

As a SaaS solution, Viverae has the ability to administer and diagnose remotely. No special capabilities need to be built to support KP.

How and from where do you support the products?

The Viverae member portal is a web-based product that is designed and hosted by Viverae. Support is provided by Viverae’s onsite Health Center, which provides quick support to participants surrounding portal functionality, and program components (i.e., HRA completions, event sign-ups, password resets, etc.). The team serves as the primary solutions provider for incoming client calls and issue management including daily health management program requests, IT/data support, account questions, technical support, and other issues and concerns.

3.7 Training

Is training offered (initial training, recurrent training)? Is training done at Customer’s site? What are the options?

Training can and will be provided as train-the-trainer, which includes all training materials. Other training approaches can be discussed to best support deployment and ongoing support as offerings evolve. Viverae will provide options for web-based and on-site including, but not limited to, plans for: resources, materials, locations, frequency, and processes.

Will you prepare training and usage materials specifically to meet KP’s requirements?

Viverae will provide product documentation to support KP’s specific requirements. Training can and will be provided as train-the-trainer, which includes all training materials. Other training approaches can be discussed to best support deployment and ongoing support as offerings evolve.

Do you have user demos or guides that can be used with program participants to explain program design? Do you have any demos or guides to support KP customers with program overview or best practices for successful programs?

Viverae has provided demo access logins for the sake of showcasing the product to customers. Additionally, Viverae has created a microsite designed to simulate from KP’s perspective the offerings provided as a portal. To visit the microsite please visit: http://viverae.com/kaiser/. To visit the demo login please go to www.myviverae.com. Login: joesmith138; password: c. For KP customer’s Viverae Communications Launch Toolkit includes a Program Overview video and a “What to Expect Video Series” that covers Biometric Screenings, Health Coaching, and Disease Management.

Page 20 of 116

Page 21 of 116

3.8 Functional Requirements

The Functional Requirements have been organized into groupings around a common functionality, such as “Reports & Extracts” and “Onboarding”. Within each functional group, the requirements may be listed in both statement and question form. The functional requirements are set up in the Vendor Response form as described in Section XX.X. Each functional group is identified with a letter, with the requirements being numbered from 1 within that letter group. This is to facilitate a unique identity for each requirement, and should be used as a reference point going forward, i.e. the 1st requirement in the 1st group will be known as requirement A1.

Group A – Data Management

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 General

1.1 PHI Data Storage and Transmission

1.1.1 KP leverages the NIST 800-53 v4 standard in regard to our expectations for protecting Personal Health Information (PHI). Does your solution align with NIST 800-53 v4? Please describe specific controls you have adopted around protecting PHI data storage and transmission. What is your point of view on secure integration of networks and applications (where applicable)?

Yes While Viverae Information Security Policies and Standards are based on ISO 27000 Series and CoBiT, it is highly aligned with NIST 800 which includes many of the same controls that are mapped to different control objectives in the NIST 800 series.

Viverae’s Policies and Standards state that all Data at Rest and Data in Transit shall be encrypted using state-of-the-art commercially available encryption tools.

Viverae provides a SaaS application accessible via a browser. Integration of networks and applications are not applicable to this solution.

1.2 Multiple Data File Sources

1.2.1 Ability to perform ETL process for individual-level participant data (snapshot, cumulative and/or delta) in preparation for each Customer’s program launch as well as throughout the program, in multiple data file types from KP and third party sources, including but not limited to:

Eligibility data, both global (across all programs) and by Customer, from KP

Health risk assessment (THA) data (digital and paper versions) from KP’s preferred vendor HMI (Johnson & Johnson)

Digital coaching healthy lifestyle programs (HLPs) data from KP’s preferred vendor HMI (Johnson & Johnson)

Yes

Yes

Yes

In general, Viverae can support importing via ETL any number of participant data points. Viverae will work with KP to determine how the data will be used once consumed. For example, will the participant be presented with the data; will an algorithm for risk assessment be used prior to presentation to the participant and/or Customer; will the data only be used for reporting to KP.

Viverae can accept Census Eligibility files from KP and third party sources, either in Viverae standard format or a custom format. Viverae supports ETL.

Page 22 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

”Health screenings” activity data from KP’s

Electronic Medical Record (e.g. biometric screenings, cancer screenings)

”Health screenings” outcomes data (biometric results) from KP’s Electronic Medical Record

Vaccine activity data (e.g. flu shot) from KP’s Electronic Medical Record

Telephonic Health Coaching call data, by topic, from KP’s systems

Chronic condition management data (e.g. Screening or physician encounter) from KP electronic medical record

Medication adherence data from KP’s electronic medical record

Maternity care/ engagement activity data from KP’s systems

Self-attested data about health behaviors (e.g. smoking/ exercise as a vital sign) from KP electronic medical record

”Health screenings” activity data from 3rd parties (e.g. onsite screenings by Maxim or Quest)

“Health activities” data from 3rd parties (e.g. Weight Watchers)

Tracker/ wearable device activity data from 3rd parties (e.g. Fitbit, Apple watch)

HIPAA Attestation accept/decline/no response data (digital and paper versions) collected from Vendor

Rewards Fulfillment activity data from Vendor’s system and/or 3rd party administrators

Additional requirements applicable across all data files listed above can be found in sections 1.3 – 1.7 below. Requirements applicable to specific to data files listed above can be found in section 2.0 and are indicated respectively.

Yes

Yes

Yes

Yes

Partial

Yes

Yes

Yes

Partial

Yes

Partial

Partial

Health Risk Assessment – Viverae has not received any requests so far to perform Health Risk Assessment Data; however technically feasible based on the data provided and system capabilities.

Digital Coaching Health Lifestyle Programs data can be accepted as an activity feed as it relates to incentive points for participants.

Viverae already accepts Health Screening Activity data for Viverae Screenings as well as third-party data.

Viverae accepts claims data to populate Preventive Care Services, as well as to identify participant chronic conditions. EMR data would allow Viverae to perform these activities earlier.

Items to be discussed for data integration and program inclusion:

Medication Adherence

Health Activities from third parties (e.g Weight Watchers)

HIPAA Authorization

Rewards Fulfillment

1.3 Flexible Schedule

Page 23 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.3.1 Ability to ingest and process data from multiple file sources on a specified schedule or ad hoc, with various frequencies (e.g., daily, weekly, etc.).

Yes Viverae can accept ad-hoc or automate a schedule for recurring files based on a specified schedule – Daily, Weekly, Biweekly, monthly, quarterly or yearly. Currently we are supporting over 300 Customers with both our standard and custom file data, which are delivered/processed based on a schedule.

1.4 Applying KP Clinical Guideline Rules

1.4.1 Ability to process all data from KP and 3rd party sources with rules as defined by KP for rewarding, including National Clinical Guidelines for screenings and other KP-defined rules for other clinical engagement activities. This includes but is not limited to frequency in which individuals need age and gender appropriate health screenings, number of telephonic coaching calls on a single topic, frequency of flu shot, etc.

Yes Viverae has the ability to provide data from KP and third party with custom rules as per request. The process around delivery of these custom requests goes through a delivery lifecycle, which includes requirements gathering, documentation, ETL process development, testing, and production schedule for recurring delivery. The data points are dependent on what Viverae’s platform/technology, Viverae Health Management System (“VHMS”), can hold and deliver.

1.5 Handling Duplicate Records for an Individual Across All File Sources

1.5.1 Ability to manage multiple individual participant’s data points for a given activity within or across multiple sources (e.g. biometric screening records from both KP and Maxim, or multiple biometric screening records from KP) and only reward for first qualifying event.

Yes Incentives can be configured to look for only the first instance of an event.

1.6 Quality Monitors, Notification and Remediation of Errors

1.6.1 Ability to monitor data quality from each file source and notify appropriate parties throughout ETL. Ability to provide KP reports of errors found in file data and root cause (if known). Quality check examples include file name and file format, missing information such as DOB, SSN, DOB format issues, gender different from M/F/U, missing or unknown State information, etc.

Yes Viverae can provide error reports and transmit via FTP to a third party vendor FTP or have the Customer pick-up from Viverae FTP. All of the quality check examples can be provided.

1.6.2 Ability to remediate errors found in data files during quality checks, or work with data sources (KP or 3rd parties) to remediate (correct errors). Ability to provide KP reports of remediation status to errors found.

Yes Viverae can provide error reports and transmit via FTP to a third party vendor FTP or have the client pick-up from Viverae FTP.

1.6.3 Ability to monitor changes in data from each file source and provide KP alerts immediately should any

Yes Viverae has the ability to track files received and errors which are reported from each of these files.

Page 24 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

issues occur and ongoing communication of resolution status. Ability to keep and provide KP audit log of all changes to data from each file performed during ETL process, by Customer.

1.6.4 Ability to monitor all inbound and outbound files from each data source and provide KP alerts immediately should any issues occur and ongoing communication of resolution status. Ability to keep a record of all inbound file s from all sources and all outbound files (reports and extracts to KP, Customer, and TPAs) noting data and time of transfer, number of records transferred and destination of transferred files. These records should be available to KP at any time upon request.

Yes Viverae has the ability to track inbound files received with time of transfer and total number of records received.

1.7 Historical/Retroactive Data

1.7.1 Ability to perform ETL process for historical data provided within each file source for retroactive rewarding of activities, i.e., a participant calls and requests reward that was not received from past program.

Yes Viverae can process participation/activity, biometric file feeds for both historical and current program years via an automated ETL process. Customers are provided with a standard format or Viverae can follow a custom file format for processing historical data.

1.7.2 Ability to maintain historical and current records of data ETL from each file source for record tracking, remediation and compliance purposes.

Yes The data files are expected to be transferred via SFTP by Client/Vendor to Viverae. Viveraes ETL file processing system picks up the file and tracks all the information in the file, including the time the file was posted to SFTP, total records processed, errored, held, and total records in the file. Historical data which are processed and captured in the Viverae System have an identifier attached to each record for audit tracking.

2.0 Outcomes Data from KP or 3rd Party

2.1 ETL of Outcomes Data

Page 25 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.1.1 Support data ETL (including rules application) of “outcomes” data (e.g. biometric screening results, chronic conditions) in various file formats with KP and Customer defined rules for rewardable ranges. Ability to provide “reasonable alternative” activity for reward earning should a participant fall out of defined range.

Yes Viverae has the ability to provide data from KP and third party with custom rules as per request. Viverae system has a placeholder to hold the screening, chronic conditions. Viverae provide Customers with a standard format and layout in which the screening and Health assessment results can be provided or the results can be custom developed and extracted in a format and layout using ETL. “outcomes” data file feed can be delivered based on KPs request.

2.1.2 Support data ETL (including rules application) of self-reported “outcomes” (e.g. biometric screening results, chronic conditions self-reported by participants on the UI) with KP and Customer defined rules for rewardable ranges. Ability to provide “reasonable alternative” activity for reward earning should a participant fall out of defined range.

Yes Viverae has the ability to provide data from KP and third party with custom rules as per request. Viverae system has a placeholder to hold the self-reported screening, chronic conditions. Viverae System indicates whether the reord is self-reported or reported via a claims. The data ETL for self-reported can be delivered based on a custom format/layout client need or in Viveare’s standard format (for Screening and HRA results)

2.2 Rules Application

2.2.1 Ability to lock outcomes value when target goal/range has been met.

Yes Incentives use rule evaluations when qualifying outcomes based metrics, which will allow for credit to be earned when a certain value is met.

Page 26 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Incentives use rule evaluations when qualifying outcomes based metrics, which will allow for credit to be earned when a certain value is met. Viverae’s platform/technology, VHMS, which includes all services and portals, has the ability to measure participant’s biometrics values against the target range based on any flexible healthy reference range established mutually by the employer and Viverae, while assigning status completion for the particular health status factor immediately upon reaching the target, therefore awarding credit or point for reaching this goal. Example: Customer may choose to establish the healthy reference range for BMI as 30 (as opposed to 25); once the participant completes the biometric screening via any of the offered methods, the BMI would be calculated by the system as a function of the height and weight (NOTE: in outcomes-based programs, typically the Viverae program and the VHMS allows for medical waist measurement to supersede the BMI measurement for qualification purposes); then, the BMI health status factor would be “locked” in the member record and s/he would qualify for that line item within the program design. Biometric measurements may be changed by a Viverae Health Professional upon a disputed results or other type of appeal.

2.2.2 Ability to allow outcomes values to refresh when target goal/range has not been met.

Yes Viverae provides the ability to measure participant’s biometrics values against the target range based on any flexible healthy reference range established mutually by the employer and Viverae, while assigning status completion for the particular health status factor immediately upon reaching the target, therefore awarding credit or point for reaching this goal. Outcomes and values will constantly be updated according to data loaded into VHMS allowing for on-going refresh of data and participant incentive qualification. One context for this is the Results Overwrite that members may take advantage of during an Appeal. If a target range has not been met by a participant, the alternatives will automatically be presented by the system.

2.2.3 Ability to display two outcomes values for the same activity to support a year over year comparison.

Yes Biometric Comparison allows for metrics to be compared year over year. VHMS holds biometric values in member records discreetly from year-to-year, therefore always allows a cohort comparison by nature of the technology’s inherent functionality, both on an aggregate level and member level.

2.2.4 Ability to perform mathematical calculations e.g. % when displaying multiple values of the same activity to comparison delta year over year.

Yes Viverae has the ability to perform mathematical calculations when displaying multiple values of the same activity to comparison delta year over year.

Page 27 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.2.5 Ability to support mathematical formulas

computing multiple values of different activities e.g. cardiovascular risk as an activity.

Yes Viverae has the ability to support mathetical formulas computing multiple values of different activities.

2.3 User Interface

2.3.1 Ability to allow UI rendering logic of different and multiple alternative activities to display to participant if outcomes values target goal/range has not been met

Yes Incentives can be set up to allow for multiple actions to be available for qualification of points with a max value. This allows for an outcomes based metric to be displayed, along with alternative actions to allow a member to view all available options. Various Reasonable Alternative Services (RAS) may be built into the incentive design to give participants’ choice, therefore allowing a user interface that renders logic of different and multiple alternative activities to display to participant if outcomes values target goal/range has not been met.

2.3.2 Ability to render the following information for a Customer’s “outcomes” program:

display or hide values

display or hide point redemption box

display URL hyperlinks to non KP sites dynamically display alternative activities text when a participant’s value is out of range (e.g. “your results require you to complete this alternative activity to earn the reward”)

Yes Viverae can configure completion-based programs. The ability to display/hide value as well as display/hide point redemption box is achievable.

Viverae supports URL hyperlinks to non-KP sites as designated by KP. This functionality exists and is used currently with Medline health information in the member portal.

Viverae supports outcomes based programs and can display alternative activities and text for participants whose values are out of range.

2.3.3 Ability to allow UI rendering logic displaying no data if not available or doesn’t meet data dictionary requirements.

Yes Incentive Programs area only displays if there is a qualified incentive program the member is eligible for that is active, or historical and still published.

3.0 Activity Processing

3.1 Hold Processing

3.1.1 Please provide evidence of the Vendor‘s ability to compile and load but not process eligible individuals activity data from all file sources until they have accepted HIPAA. In near real-time to HIPAA acceptance, data should flow to the application for

Yes All the files which are posted by the vendor goes through an automated file loading process which has several steps. The data processed from one stage to the next is monitored manually and also through a set of business rules and several statuses.

Page 28 of 116

A FUNCTIONAL REQUIREMENT

Data Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

processing based on business rules and rendering status on the UI to the individual.

3.2 Continuous Processing

3.2.1 Ability to provide continued processing of a participant’s data (e.g. activity completion feeds) for a defined period of time (customized by Customer e.g. 30 days, 10 days, 1 day, etc.) after the Customer’s program has officially ended (data run-out period).

Yes Viverae’s automated file processing has the provision to do this. All files are scheduled to be processed by client and Viverae has the option to turn off the file processing any time.

3.2.2 Ability to allow for UI viewing / user access to the portal post program end date to allow for data catch up of activities processing.

Yes The participant can login to the Viverae member portal and see all the post-program activities.

Page 29 of 116

Group B – Program-Product Requirements

B FUNCTIONAL REQUIREMENT

Program-Product

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 Activity Status

1.1 Tracking

1.1.1 Please provide evidence that your system’s business logic supports data-driven dynamic UI rendering unique to the individual participant in tracking the status of their activities, including but not limited to:

Completion status of an individual activity

Completion status of a series of activities

Completion status of a program (as defined by the Customer)

Unique value (reward) for completion of an individual activity (specific metrics as defined by Customer)

Sum values (rewards) for completion of a range of activities (max total can earn as defined by the Customer)

Yes Incentives can be displayed to eligible participants that provide them with the ability to view the completion status of each action, action groups that contain multiple action option, incentive points, and rewards earned.

2.0 Activity Rules

2.1 Gateways

2.1.1 Please provide evidence that your system’s business logic supports data-driven dynamic UI rendering unique to the individual participant in each Customer’s unique program designs with specific activity gateway rules (nested logic), including but not limited to:

Gateway – Requires the participant to complete the activities before they can earn credit for other activities.

Multiple gateways – Ability to support more than 1 gateway

Nested gateways – Ability to have a gateway activity and another gateway activity nested within. Another way to think about this rule would be sequence, where activities need to be completed in a specific order.

Yes Eligibility rules on programs along with rule evaluation and required options on action allow for all of these gateway options to be accommodated.

2.2 Series

Page 30 of 116

B FUNCTIONAL REQUIREMENT

Program-Product

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.2.1 Please provide evidence your system’s business

logic supports data-driven dynamic UI rendering unique to the individual participant in each Customer’s unique program designs with specific activity series rules, including but not limited to:

Allowing multiple child activities to be part of a parent activity where the parent is not considered complete unless all child activities are complete

Allowing multiple activities to exist where only a certain number of those activities can be completed for reward (choose 2 of 5)

Allowing multiple activities to exist where a certain number of those activities have to be completed for reward (2 required then choose 1 of 3 others)

Yes Parent activities can be displayed where multiple activites must be completed in order for the parent activity to register as completed and reward points.

SCREENSHOT PROVIDED: Group B 2.0 Activity Rules – Series 2.2.1

2.3 Individual Demographic Triggering

2.3.1 Please provide evidence your system’s business logic supports data-driven dynamic UI rendering unique to the individual participant in each Customer’s unique program designs with specific activity individual demographic triggering rules including but not limited to:

Allowing activities to be available for a participant only if the participant meets certain gender criteria; if does not meet, activity will be suppressed for that individual

Allowing activities to be available for a user only if the user meets certain age criteria; if does not meet, activity will be suppressed for that individual

Allowing activities to be available for a user only if the user meets certain Customer-defined demographic criteria; if does not meet, activity will be suppressed for that individual

Yes Activities such as preventive care services can be displayed uniquely for participants of different age, gender, or other defined criteria.

SCREENSHOT PROVIDED: Group B 2.0 Activity Rules – Demographic Triggering 2.3.1

2.4 Self-Reporting

2.4.1 Please provide evidence your system’s business logic supports data-driven dynamic UI rendering unique to the individual participant in each Customer’s unique program designs with self-reporting activity rules, including but not limited to:

Yes Various actitivies can be self-reported based on Client configuration and program design, including activities that qualify as reasonable alternative actions.

SCREENSHOT PROVIDED: Group B 2.0 Activity Rules – Self-Reporting 2.4.1

Page 31 of 116

B FUNCTIONAL REQUIREMENT

Program-Product

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Allow specific self-reported activities to be

available for a participant as defined by the Customer and suppressed for other individuals where not appropriate

Allow self-reporting of Customer-defined program activities by a participant to validate, on their honor, that they have completed the activity

allow self-reporting of Customer-defined “reasonable alternative” activities by a participant (when participant cannot complete program activity) to validate, on their honor, that they have completed the activity

3.0 Content Display

3.1 Activity

3.1.1 Please provide evidence your system’s business logic supports data-driven dynamic UI rendering unique to the individual participant in each Customer’s unique program designs with activity content display rules. The UI must configure to the individual to display their unique activity attributes, including but not limited to:

Activity title

Activity start and end date

Activity description and any rules associated with completing

Completion status of activity

Yes Activity details can be displayed to individual participants based on their own unique health profile, preventive care, and other requirements.

SCREENSHOT PROVIDED: Group B 3.0 Content Display – Activity 3.1.1

3.2 Program

3.2.1 The system’s business logic supports data-driven dynamic UI rendering unique to the individual participant in each Customer’s unique program designs with program content display rules, including but not limited to:

program description

program start date

program end date

Yes Program Description language is configurable and will only be shown to the selected eligibility group. Program Start Date and End Date is configurable and can be assigned to an eligibility group.

4.0 Data Processing

4.1 Data Run-Out Period

Page 32 of 116

B FUNCTIONAL REQUIREMENT

Program-Product

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

4.1.1 Please provide evidence your system’s business

logic supports the continued processing of a participant’s data (e.g. activity completion feeds) for a defined period of time after the Customer’s program has officially ended (data run-out period). Please describe how you ensure all activities completed within required time period are rewarded given inherent data lag and processing of file feeds from multiple sources.

Yes Participant data is tracked and reported for past program years. Look-back rules are implemented to accommodate data lag and ensure reported activities are credited and rewarded.

SCREENSHOT PROVIDED: Group B 4.0 Data Processing – Data Run-out Period 4.1

4.2 Retroactive Data

4.2.1 Please provide evidence your system’s business logic supports a method to define an activity that has a completion timeframe prior to the start of the program period in which the activity is active and retrieve and process that retroactive data.

Yes Viverae currently executes a look back period for preventive care coomponents completed prior to program start dates.

Additional components may be included but would require scope and system enhancements to support.

4.3 Dual Program Participation – Segmented Participants

4.3.1 Please provide evidence your system’s business logic supports the ability to allow a subset (segmentation) of participants of a Customer’s population to exist in multiple, overlapping programs at the same time.

Yes Program Designs can be driven by eligibility. Participants can be eligible for multiple, overlapping programs simultaneously. Programs are viewed on the member’s home/dashboard in summary form, as well as in the member’s program page with full details.

SCREENSHOT PROVIDED: Group B 4.0 Data Processing – Segmented Participants 4.3

4.4 Dual Program Participation – All Eligible Participants

4.4.1 Please provide evidence your system’s business logic supports the ability to allow all eligible participants in a given Customer’s population to exist in multiple, overlapping programs at the same time.

Yes Participants can be eligible for multiple, overlapping programs simultaneously. These are accessed on the Home Page as well as the Incentives Page.

SCREENSHOT PROVIDED: Group B Data Processing – All Eligible Participants 4.4

4.5 Mid-Program Participant Switching

4.5.1 Please provide evidence your system’s business logic supports the ability to identify and allow participants to switch programs midstream should their eligibility status, employer, or other circumstance occur.

Yes Participants are permitted (based on eligibility and other variables) to switch programs as needed as long as they remain with the same employer.

Page 33 of 116

B FUNCTIONAL REQUIREMENT

Program-Product

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

4.6 Mid-Program Participant Adding Or Dropping

4.6.1 Please provide evidence your system’s business logic supports the ability to identify and allow new participants to be added to a Customer’s program midstream, or existing participants to be dropped from program midstream should their eligibility status, employer, or other circumstance occur.

Yes The employer portal allows participants to be added or deleted at any point throughout the program year.

SCREENSHOT PROVIDED: Group B 4.0 Data Processing – Mid Program Member Add/Drop 4.6

5.0 Reward Rules

5.1 Program Reward Earning Amount Cap

5.1.1 Please provide evidence your system’s business logic supports the ability to cap a participant’s total program reward earnings at a given value as defined by the Customer, even if they continue to complete activities.

Yes A participant’s total program points can be capped per customer specifications. Other activities can accumulate additional points without impacting the capped reward amount.

SCREENSHOT PROVIDED: Group B Reward Rules

5.2 Family Reward Earning Amount Cap

5.2.1 Please provide evidence your system’s business logic supports to cap a family’s reward earnings at a given value (subscribers, spouse/domestic partner and dependents) as defined by the Customer, even if they continue to complete activities. Vendor should also allow different value caps for each participant type (subscribers, spouse/domestic partner, and dependents) as well as the sum total family earning value cap.

Yes Total program points for a partcipants spouse and dependents can be capped per customer specifications. Additional activities can accumulate additional points without impacting the capped reward amount.

SCREENSHOT PROVIDED: Group B Reward Rules

5.3 Activity Reward Earning Amount Cap

5.3.1 Please provide evidence your system’s business logic supports the ability to cap a participant’s reward earnings at a given value for a given activity or series of activities, as defined by the Customer, even if they continue to complete activities within that series or within the program.

Yes A participant’s total program points can be capped per customer specifications. Other activities can accumulate additional points without impacting the capped reward amount.

SCREENSHOT PROVIDED: Group B Reward Rules

5.4 Combination Caps

5.4.1 Please provide evidence your system’s business logic supports the ability to combine all of the caps defined above, as defined by a given Customer.

Yes Back-end reporting allows for rewarded points to be combined for participants and their spouse/dependents.

SCREENSHOT PROVIDED: Group B Reward Rules

Page 34 of 116

B FUNCTIONAL REQUIREMENT

Program-Product

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

6.0 Federated Single Sign On (FSSO)

6.1 System Integration With KP FSSO Infrastructure

6.1.1 Vendor’s platform for KP participants is integrated with KP FSSO Infrastructure, with KP.org registration credentials as Identity Provider and participant platform as Service Provider Model. SAML2.0 (language) must be used for data passing.

Yes Viverae supports SAML 2.0 for single sign-on as a Service Provider (SP), to provide a single sign-on experience to participants by integrating with the customer’s Identity Provider (IdP).

6.2 System Integration with KP's Vendor Infrastructure

6.2.1 Vendor’s platform for KP participants is integrated with other vendor platforms via pass-through from KP FSSO Infrastructure (with KP.org registration credentials as Identity Provider) for participant access to vendor programs or activities (i.e., KP’s vendor HMI/ Johnson & Johnson for access to Total Health Assessment and Healthy Lifestyle Programs). Participant platform as Service Provider Model with SAML2.0 for data passing.

Yes Provided that we are given a URL to call KP FSSO and ask to be authenticated and redirected to the Viverae member portal. This is common for federated IDPs but we should mention this here since it appears they may have their own proprietary software.

Page 35 of 116

Group C – HIPAA Authorization

C FUNCTIONAL REQUIREMENT

HIPAA Authorization

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 Digital HIPAA Authorization --

1.1 Digital Collection Capability

1.1.1 Provide functionality for administering a HIPAA authorization digitally for rewards eligibility. In standard process (programs with user portal), HIPAA authorization will be presented to user upon first login, requiring action (accept, decline, or cancel) before exposed to program dashboard. Only acceptance allows user to become an eligible participant and data to be shared.

Partial VHMS is configurable in content, UI, and client/member eligibility. HIPAA authorization can be built as a KP specific process and made available to all KP Customers and participants as a requirement.

VHMS already supports access and restrictions based on Terms of Use acceptance. Adding HIPAA authorization can be supported similarly.

HIPAA authorization will be presented to user after registration, upon first login. Viverae will require action (accept, decline, or cancel) before the user is exposed to the portal home/dashboard. Only acceptance allows user to become an eligible participant and data to be shared.

Viverae will log user accept/decline status for reporting purposes, as well as, offer the user the ability to change the status (i.e. declined to accepted)

1.2 User Interface & Experience

1.2.1 As related to HIPAA digital authorization, the user interface must:

Provide way for user to exit out of the HIPAA process if they do not want to make a choice to accept/decline (i.e. cancel button

provide way for users to change their HIPAA authorization status at any point during the program (i.e. change from “accept” to “decline” or vice versa)

provide tailored acknowledgement message to user upon each acceptance or declination of HIPAA authorization

control user’s access to program dashboard or other features/functionalities on site until HIPAA authorization is acquired (i.e. viewable information limited, rewardable activity status information “locked” until HIPAA authorized)

Partial VHMS is configurable in content, UI, and client/member eligibility. HIPAA authorization can be built as a KP specific process and made available to all KP Customers and participants as a requirement.

VHMS already supports access and restrictions based on Terms of Use acceptance. Adding HIPAA authorization can be supported similarly.

HIPAA authorization via digial access may provide the following with moderate enhancements:

• User to exit out of the HIPAA process if they do not want to make a choice to accept/decline (cancel button)

• Users can change their HIPAA authorization status at any point during the program (i.e. change from “accept” to “decline” or vice versa)

• A tailored acknowledgement message to the user upon each acceptance or declination of HIPAA authorization

• A method of controlling the user’s access to portal home/dashboard or other features/functionalities in the member portal until HIPAA authorization is obtained (i.e. viewable information limited, rewardable activity status information “locked” until HIPAA authorized). The later would be built as a required trigger from the HIPAA authorization.

Page 36 of 116

C FUNCTIONAL REQUIREMENT

HIPAA Authorization

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.3 System Access Control

1.3.1 System to control data processing and transfer of PHI based on HIPAA acceptance or rejection, i.e., Y/N flag, only authorized PHI can be processed and

shared)

Partial VHMS is configurable in content, UI, and client/member eligibility. HIPAA authorization can be built as a KP specific process and made available to all KP Customers and participants as a requirement.

VHMS already supports access and restrictions based on Terms of Use acceptance. Adding HIPAA authorization can be supported similarly.

VHMS will provide the ability to control data processing and transfer of PHI based on HIPAA acceptance or rejection, i.e., Y/N flag, therefore only authorized PHI will be processed and shared.

1.4 Status Change Capability

1.4.1 Provide a method for an end user to change their status (accept or decline) HIPAA authorization form at any point in time, with no limits to number of times status changes. Daily data processing will capture this and change eligibility settings and data-sharing authorization across all systems.

Partial Viverae provides reporting on participation and activation by member. HIPAA authorization will be added.

Viverae to provide a user a method to change his/her status (i.e. accept or decline) the HIPAA authorization form at any point in time during the active wellness program year, with no limits to number of times status changes. “Real-time” data processing may capture this and change eligibility settings and data-sharing authorization across all systems.

1.5 Status Change Tracking

1.5.1 Maintain a HIPAA status log and audit trail of all activity and changes related to HIPAA acceptance or declination. Reports should include the participant’s name, date(s) of authorization activity (accept, decline, change), and version of HIPAA (content) where applicable.

Partial Viverae provides reporting on participation and activation by member. HIPAA authorization will be added.

Viverae will maintain a HIPAA status log and audit trail of all activity and changes related to HIPAA acceptance or rejection and includes reports containing the user details, including, but not limited to: user’s name, date(s) of authorization activity (accept, decline, change), and version of HIPAA (content) where applicable.

1.6 Real-time Customer Based Reporting

1.6.1 Provide real-time refresh of individual’s HIPAA current and historical authorization status by Customer in reporting functionality available to KP.

Partial Viverae provides reporting on participation and activation by member. HIPAA authorization will be added.

Viverae to provide a “real-time” refresh of individual’s HIPAA current and historical authorization status by Customer in reporting functionality available to KP.

1.7 HIPAA Renewal Process

Page 37 of 116

C FUNCTIONAL REQUIREMENT

HIPAA Authorization

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.7.1 For each Customer’s renewal program, provide the functionality for the system to automatically expire each individual’s HIPAA authorization from the previous year and reset to null before a new program launches. Every new Customer’s program requires participants to do new HIPAA authorization per KP legal and compliance mandates.

Partial Viverae already supports new program year UI and content as it relates to restarting a participant in the portal.

For each Customer’s renewal program, Viverae provides the functionality to automatically expire each individual’s HIPAA authorization from the previous program year and reset to a null value prior to a new program launches to satisfy the requirement that every new KP customer’s program requires participants to do new HIPAA authorization per KP legal and compliance mandates.

1.8 Variations of HIPAA Content

1.8.1 Support, manage and track different versions of HIPAA authorization forms by Customer. Variations could be based on program type (activities vs outcomes) and Customer’s requested customizations in content.

Partial Viverae already supports new program year UI and content as it relates to restarting a participant in the portal.

Viverae to support, manage and track different versions of HIPAA authorization forms by Customer. Variations may occur based on program type (activities vs outcomes) and customer’s requested customizations in content.

1.9 HIPAA Acceptance on Behalf of The Member

1.9.1 Vendor shall provide functionality for HIPAA acceptance on behalf of an individual.

Partial Viverae will provide functionality for HIPAA acceptance on behalf of an individual.

1.10 Records and Retention

1.10.1 Ability to store the users electronic HIPAA signed form for 6 years for audit purposes per HIPAA regulations.

Partial Viverae has the ability to store the users’ electronic HIPAA signed form for six years for audit purposes per HIPAA regulations.

2.0 Standalone Digital HIPAA Authorization (HIPAA-only UI)

2.1 Authorization Capture

Page 38 of 116

C FUNCTIONAL REQUIREMENT

HIPAA Authorization

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.1.1 Capability for alternative user interface built to solely capture digital HIPAA authorization (not include program dashboard, etc.) when Customer only needs PHI data from KP to feed into their program administered by another Vendor or third party. Authorization will allow KP to pull data from electronic medical records and Vendor to produce individual data extracts to securely transfer to the Customer or third party for administration.

Partial Viverae provides a wizard-style member on-boarding process that can be configured for HIPAA authorization and restriction from full portal access.

Viverae to provide capability for alternative user interface built to solely capture digital HIPAA authorization (not include program dashboard, etc.) when Customer only needs PHI data from KP to feed into their program administered by another Vendor or third party. This will be accomplished via census load and file feed Y/N for HIPAA authorization. Member will still be required to log in to the system and complete HIPAA authorization. Can be easily accommodated in the uer on-boarding process already in place.

Authorization will allow KP to pull data from electronic medical records and Vendor to produce individual data extracts to securely transfer to the Customer or third party for administration.

2.2 Back-End Functionalities

2.2.1 Functionality requirements for standalone HIPAA are the same as listed for “digital HIPAA” in sections 1.1 to 1.10 above.

Yes Agreed.

3.0 Paper HIPAA Authorization

3.1 Operational Process For Mailing or E-Mailing Paper HIPAA Form to Users Upon Request

3.1.1 Operational process for providing individuals with paper-based HIPAA Authorization form upon request, should they not have access to the digital HIPAA authorization. Authorization processed after participant physically mails or e-mails the hardcopy based HIPAA form to Vendor.

Partial Standalone HIPAA will utilize a similar Viverae process for data entry that I used for validated forms and other program activities.

The Viverae offering accommodates an operational process for providing individuals with paper-based HIPAA Authorization form upon request, should they not have access to the digital HIPAA authorization. Authorization processed after participant physically mails or e-mails the hardcopy based HIPAA form to Vendor. Viverae Data Entry will handle all such requests.

3.2 Extracting Digital Information From Paper HIPAA Forms Into Digital Data Input Catalog

3.2.1 Method for transposing paper based HIPAA authorizations into digital form for historical reference/access by the system, such as Optical Character Recognition (OCR).

Partial Viverae utilizes various methods for transposing paper-based submissions into digital form for historical reference/access by the system, such as Optical Character Recognition (OCR) and standard Data Entry with QC.

Viverae to support methods for transposing paper-based HIPAA authorizations into digital form for historical reference/access by the system, such as Optical Character Recognition (OCR) and standard Data Entry with QC.

Page 39 of 116

C FUNCTIONAL REQUIREMENT

HIPAA Authorization

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

3.3 Back-End Functionalities

3.3.1 Functionality requirements for standalone HIPAA are the same as listed for “digital HIPAA” in sections 1.1 to 1.10 above.

Yes Agreed.

Page 40 of 116

Group D – UI/UX,Web, Mobile Requirements

D FUNCTIONAL REQUIREMENT

UI/UX, Web, Mobile

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 Optimization & Compatibility

1.1 Responsive Design

1.1.1 User Interface (UI) built with responsive design concept whereas all existing and future enhancements and new feature developments will be formatted to adapt to any screen size that accesses it, including but not limited to Windows, Mac, iOS and Android mobile devices and tablets.

Yes Viverae member portal functionality is accessible through mobile browsers with responsive design on Windows, Mac, iOS, and Android mobile devices and tablets.

SCREENSHOT PROVIDED: Group D 1.1 Responsive Design

1.2 Browser Compatibility

1.2.1 UI is supported on for Windows and Mac on all current browsers (e.g. Safari, Chrome, IE, and Firefox) and on multiple platforms (web, mobile). Also provide a list of all browsers and devices to which Vendor’s UI has been optimized.

Yes Supported browsers for VHMS include:

Firefox

Chrome

Internet Explorer 7, 8, 9 10 and 11

Safari

The Viverae member portal was developed using responsive design, allowing for all areas of the applications to be displayed on any modern mobile device or phone.

2.0 UI Content Customization & Loading

2.1 Content Customization

2.1.1 Ability to allow content (visual graphics, photos, logos, and text) customization on each page at individual participant and Customer levels, as requested by Customer and approved by KP.

Yes VHMS uses established configurability to accept and display content specific to each customer. Viverae’s implementation process with KP will support the KP approval process in addition to Customer approval.

2.2 Content Loading

Page 41 of 116

D FUNCTIONAL REQUIREMENT

UI/UX, Web, Mobile

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.2.1 Process during Onboarding to understand Customer-specific requirements for configurations on UI, including but not limited to content loading (visual and text). Please describe onboarding and content loading process, and the system’s automated quality checks to ensure loaded content meets set parameters for responsive UI rendering.

Yes The assigned Viverae Implementation Specialist will provide a Program Design Document as early as Week 2 of the implementation cycle that reflects the business requirements necessary to configure the employer’s requested incentive design. This document includes, but is not limited to, elected services, program year, assessment period, incentives (type, value, and distribution timeframe), required activities, point values, and eligibility. The Program Design Document goes through several phases before a final approved draft is executed by the Cient (or KP, as required). This signed documentation is required approximately 45 days prior to the program launch date and then passed along to the Viverae Configuration Team for program configuration build. Program/incentive/reward rules and activities are configured based on business requirements documented. Viverae executes a quality assurance process that monitors check and balances administered by both the Configuration and Implementation Teams in order to ensure the correct member activity and interactions are logged. The Customer will also be able to view the incentive program prior to the program launch date.

2.3 Dynamic Content

2.3.1 Ability to support content (visual and text) that is dynamic and the individual participant level. For example, a visual that would correspond with a participant’s own activity values for an outcomes program (e.g. sliding scale of where participant’s actual Blood Pressure is vs. the defined Target)

Yes The Viverae member portal provides member’s visibility to their biometric values and HRA reponses as well as acceptable ranges that can be defined by KP.

2.4 Languages

2.4.1 Do you support any languages besides English? To what degree can a participant experience the UI in a different language throughout the site? How does a participant select their language preferences and ensure content in their preferred language persists?

Yes The Viverae member portal is available in English and Spanish. Language Preference can be selected during registration, as well as in the member’s Preferences area.

3.0 UI Activities Rendering Logic

3.1 Activities-Based Programs

Page 42 of 116

D FUNCTIONAL REQUIREMENT

UI/UX, Web, Mobile

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

3.1.1 Please describe and provide visuals how Complex program activity logic such as Customer-defined activity parent-child relationships or nesting of activities would render on the UI. Specifically please show how the following would render on the UI:

Activities (Single) a participant needs to complete

Activity groups (Multiple Activities as a series) a participant needs to complete

Completion status of activities

Reward values of activities possible and earned (where applicable)

Yes Activities are shown within an “Action Group” in program design. Each Action Group can contain 1 or more individual activities that the member needs to complete.

Activities are shown within an “Action Group” in program design. Each Action Group can contain 1 or more individual activities that the member needs to complete.

Participants see a checkmark next to the activities that they have completed, along with the number of points they have achieved (if applicable).

Reward values are visible on the Incentives Page and the Home Page.

SCREENSHOT PROVIDED: Group D 3.1 Activities-based Program 3.1.1

3.2 Outcomes-Based Programs

3.2.1 Please describe and provide visuals how and Outcomes based program (reward for health screening results) would render on the UI. Specifically please show how the following would render on the UI:

Health screening activity and range a participant’s result must fall

Participant’s screening result and where it falls in range (within or outside of)

Actions a participant can take if they fall outside of range

Reward values of activities possible and earned (where applicable)

Change in status (i.e. someone’s screening results were outside of range and time later new results indicate they are in range)

Yes Within the member’s program design, they see that a screening must be completed and will be shown the ranges in which they need to fall within for each metric. Viverae’s recommended metrics for outcomes programs include BMI/Waist Circumference, Blood Pressure, Glucose/Hemoglobin A1c, and Total Cholesterol.

Within the member’s program design, they will be shown where they received credit for their metric(s) falling within the appropriate range. This will be indicated by a check mark and visual that they earned points for each metric.

Reasonable alternatives may include completing a Targeted Program, Online Course, and/or Coaching Session. These options are listed within the program design on the Incentives Page.

Rewards can be driven by points or completion. Reward levels are displayed on the Incentives Page as well as the Home Page. Participants will be shown if they have or have not achieved each reward level.

Page 43 of 116

D FUNCTIONAL REQUIREMENT

UI/UX, Web, Mobile

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Participants who fall within the appropriate range(s) will be awarded credit for the associated metric(s). If the member does not fall within the appropriate range, they will have access to reasonable alternatives in which they can receive credit for each metric. Through the member portal’s biometric tracking capabilties, participants can enter revised values and see the updated risk level, however, only the primary screening data will be evaluated for the program design.

SCREENSHOT PROVIDED: Group D 3.2 Outcomes-based Programs

4.0 HIPAA UI Flows

4.1 HIPAA Customization

4.1.1 Please provide evidence Vendor’s UI can support multiple renderings of HIPAA authorization as defined by KP and the Customer, customized at the Customer level. Renderings would include but not limited to:

single page HIPAA content & electronic authorization button

multi-page HIPAA content with electronic authorization button at end

customized HIPAA content and page layout Workflow has three different flow configurations. For each client one configuration has to be chosen. The default setting is 1-Page-HIPAA

Partial VHMS is configurable in content, UI, and client/member eligibility. HIPAA authorization can be built as a KP specific process and made available to all KP Customers and participants as a requirement.

VHMS will support multiple renderings of the member specific HIPAA authorization as mutually defined by KP and the Client. This multi-faceted application / solution will be customized at the Client level. Renderings may include but not limited to:

• Single page HIPAA content & electronic authorization button

• Multi-page HIPAA content with electronic authorization button at end

• Customized HIPAA content and page layout

4.2 HIPAA As Required First Action

4.2.1 Please provide evidence Vendor’s UI jumps to HIPAA authorization page upon a participant’s first login and requires action prior to engagement with the remainder of the site and content.

Partial VHMS already supports access and restrictions based on Terms of Use acceptance. Adding HIPAA authorization can be supported similarly.

The user’s HIPAA authorization will utilize a wizard-style on-boarding process already in place to move the user straight from the initial login page to the required action, secondary prompt HIPAA authorization mechanism prior to engagement with the remainder of the site and content.

5.0 UI Best Practices

5.1 Optimal Participant Experience

5.1.1 Please provide evidence Vendor’s UI design follows industry best practices for optimal participant

Yes The Viverae member portal is designed to adhere to best practice standards for participant experience and usability.

Page 44 of 116

D FUNCTIONAL REQUIREMENT

UI/UX, Web, Mobile

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

experience including but not limited to the following design concepts:

Clear calls to action

Confirmation messaging

Contrast/ distinction

Cross links

Distortion

Easy to find “Exit/ sign out”

Easy to find “Return home”

Easy to find “Settings”

Error messages/ feedback

Feedforward

Formatting content

High resolution

Hit targets (buttons)

Link treatments & anchors

Meaning

Merged functions

Organization

Personalization

Placement

Simple layout

Targeted messaging

Text size

Text spacing

Visual consistency

SCREENSHOT PROVIDED: Group D 5.1 Optimal Participant Experience

5.2 ADA Compliance For Optimal Participant Experience

5.2.1 Interface (web and mobile) adheres to all ADA WCAG compliance guidelines at level AA and usability standards such as screen readers and color contrast. This website outlines requirements for all levels: http://www.w3.org/TR/WCAG20/

Yes The Viverae member portal meets the basic Section 508 compliance standard such that all users have access to their health information, even if the user lives with any kind of a disability. However, the Viverae member portal specifically does not pass all of 508 web application technical checkpoints. Over the last ten months, Viverae has taken great strides to increase accessibility, including the following: digital content is now easy to access for users with motor impairments; content presentation was enhanced for users with visual impairments; and content was modified to increase understandability. The primary area in which the digital tools lack compliance is accessibility through the use of a screen reader. Viverae is investing in the tools and resources required to meet full Section 508 compliance in 2016.

Page 45 of 116

D FUNCTIONAL REQUIREMENT

UI/UX, Web, Mobile

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

5.3 Interactive User Interface For Optimal Participant Experience

5.3.1 Please describe participant interactivity with the user interface. For example, users ability to upload evidence as proof of completion of an activity e.g. pdf, free form text box e.g. setting a personal health goal, etc.

Yes Users have the ability to upload proof of participation in and completion of activites such as Healthy Events (i.e., Fun Runs).

Page 46 of 116

Group E – Reports & Extracts

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 General

1.1 Reporting Model

1.1.1 Does the vendor provide data that has been processed through the rules engine back to the health (KP) plan for aggregate (across all customers) and customer-specific reporting purposes? Directly to each customer? Please describe process flow.

Yes Aggregate results for all customers can be accessed through the portal. Data can be sent via external file feed to vendors if requested.

1.1.2 Vendor shall apply rules to biometric results outcome data to translate into Pass/Fail criteria. Which will be displayed on report vs. displaying actual values.

Yes Incentive reporting at participant-level.

1.1.3 Please describe vendor’s reporting model and whether reports produced can be accessed through a self-service administrative tool.

Yes Reporting is available 24/7 through the portal. Reports outside the portal are delivered according to due dates associated with program year dates.

1.1.4 If vendor’s reporting capabilities do not match above requirements, please explain your reporting model and how you typically share reporting data with the KP (KP) and customer.

N/A Viverae can meet all KP’s requirements mentioned above.

1.1.5 How current is the data in your system from which reports are generated? Are there any exceptions to this data processing schedule?

Yes Data is live or available within 24 hours.

1.2 Intake

1.2.1 Please describe vendor’s capability and process for capturing KP and each customer’s reporting requirements and whether they can be passed to your organization via the Internet.

Yes Viverae has a standard reporting package for all Customers and can accommodate ad-hoc requests as needed. Reporting is available through the portal 24/7, and includes ability to select specific criteria to generate a report.

1.3 Change Requests

1.3.1 Please describe vendor’s capability and process for KP or each customer’s reporting change requests and whether they can be passed to your organization via the Internet

Yes Change requests can be accommodated and tracked in the portal and/or a CRM tool.

2.0 Reporting Suite

Page 47 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.1 Aggregate Participation Reports

2.1.1 Please provide samples of vendor’s standard template for customer-level aggregate reports of participant engagement and which elements can be customized per customer request including data content and date ranges (look back periods). Please describe how they are generated and data lag time. The following program elements included but not limited to are: Demographics, HIPAA Authorizations, Program Completions (or max value completion, as defined by customer), Biometric Completions, Cancer Screenings Completions, Activity Completions (list each activity and count of number who have completed each). A data dictionary should accompany each report generated.

Yes Viverae has standards for HRA and biometric data extracts. The activity engagement extract can be pulled based on an ad-hoc basis and can be cusotomized based on client needs.

Attachment: Standard Reports

2.2 Individual Level Data Extracts

2.2.1 Please provide samples of vendor’s standard template for individual-level data extracts of participant demographics and activity engagement, produced for each customer or third party administrator, and which elements can be customized per customer request including data content and date ranges (look back periods)... Please describe how they are generated and data lag time. The following program elements included but not limited to are: Demographics, HIPAA Authorizations, Program Completions (or max value completion, as defined by customer), Biometric Completions, Cancer Screenings Completions, Activity Completions (list each individual and has completed each activity), biometric values (test results for biometric screenings). A data dictionary should accompany each report generated.

Yes Viverae provides standard data extracts which can be either downloaded from the Viverae Employer Portal by the client or delivered via SFTP. The reports which are delivered via SFTP include the standard outbound Biometric, Biometric and HRA, Standard Incentive/Activity Roll up Files. The data for all these reports are real time.

Attachments:

Viverae Outbound Biometric File Feed Layout

Viverae Outbound HRA_Biometric Layout

Viverae Roll-Up Incentive File Feed

2.3 Rewards Redemption Reports

Page 48 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.3.1 Please provide samples of vendor’s summary-

level reward redemption report to KP across all customers and to each individual customer for their program. Report fields should include, but not be limited to: Reward Points/Dollars Earned, Reward Points/Dollars Redeemed, and Reward Points/Dollars Banked (pending redemption). A data dictionary should accompany each report generated.

Partial

KP will receive an incentive report, which details the participants information plus point totals.

Viverae partners with a comprehensive rewards redemption and fulfillment partner who will provide reporting to achieve 3.8 Group E 2.3.1 requirements.

2.4 Individual Level Communication Reports

2.4.1 Participant-level communication report within a given employer’s eligible population, a segmented list of individuals and their contact information (email address, mailing address, etc.) to target for communication campaign (e.g. all those in a program who have not yet completed their Health Assessment activity) A data dictionary should accompany each report generated.

Yes The Viverae Health Management Systems holds employer and member eligibility information (email, address, mailing address, contact information) based on what is provided in the Census/Eligibility file or what is inputted for the member by the Employer in the Employer Portal. Each member information is marked with statuses for all their Health Assessment, Screening activity or any other activity for the participants program. This information is available on the portal as reports to be downloaded by the Employer or can be provided as a file(data extract) to the employer in a custom format the client is requesting.

2.5 Error Reports

2.5.1 Please provide samples of reports of system, program, Customer and participant-level errors and remediation status provided to KP. A data dictionary should accompany each report generated.

Yes Viverae provide error reports for the inbound files. Eligibility and Screening error reports are provided on the FTP site for all unprocessed and held records during processing for files. A data dictionary is provided during the implementation of inbound files.

2.6 Custom Report Requests

2.6.1 How do you intake any report element, content or frequency customizations outside vendor’s defined parameters? What are the cost or other implications to customers requesting customization outside these parameters? Please provide request process, turnaround time, and pricing model. Are there any defined boundaries or accommodations you cannot make?

Yes Analyst team meets wth client to consult and gather requirements. The request is scoped by analytic and development teams. Turnaround time from scoping to availability is < 90 days.

Page 49 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.7 Other

2.7.1 Please provide samples of any additional reports vendor produces for KP and/or customer and describe the contents and process for generating each.

Yes Most of the reports are generated through the portal. Reports outside of the portal are delivered via email or secure FTP.

3.0 Report Service

3.1 Reporting Questions

3.1.1 How do you manage reporting questions from customers, Third Party Vendors and from KP?

Yes Team of analysts and subject matter experts (SMEs) support internal and external Customers.

3.1.2 Provide a reporting-specific ticketing system to work through issues with KP, the Customer.

Yes Viverae offers Customers external access to a full-featured case management system which includes configurable service level agreements, escalation alerts, data security as well as extensive reporting and KPI measurements. Each case can be assigned to a specific category for identification and tracking purposes.

4.0 Report Schedule

4.1 Frequency

4.1.1 Please describe vendor’s report production frequency parameters by customer by report and flexibility in report frequency schedule.

Yes Based on program year and assessment period dates, and client needs - daily, weekly, monthly, quarterly, semi-annually, and annually.

5.0 Report Delivery Model

5.1 Methodology

5.1.1 Please describe vendor’s report production frequency parameters by customer by report and flexibility in report frequency schedule.

Yes Self-service reporting is on-demand. Standard reports outside the system are delivered according to assessment period and program year end dates. Frequency can be modified by changing reporting period end dates.

5.2 Administrative Self-Service

5.2.1 Are any of the reports generated through a self-service tool/ secure administrative site? Describe administrative self-service tools specific to reporting that are made available to each audience (KP, Customer, third party administrators).

Yes Various reporting (eligibility, participation, risk, self-reported, and incentive) available through the portal.

Page 50 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

5.3 Access Management

5.3.1 Describe user authentication processes for administrative staff to make program changes, updates and edits specific to reporting functionalities within the self-service tools.

Yes All users that access the Viverae member portal must provide a unique username and password, or be authenticated through SSO. Once they have entered the portal, access to different areas is controlled using role based access. Employer admin users have access to update various demographic attributes for their employer group, access self-service reporting for incentives, challenges, activity completion, as well as gggregate population risk and participation. Updates to the incentive programs and aspects of the program and completed by internal configuration team members in the Viverae organizarion.

5.4 Report Servicing Capability

5.4.1 Describe capability to generate a query that provides KP the number of reports produced in a given timeframe, and timing of delivery by report type.

Partial Viverae has the capability to provide KP with the number of reports produced in a given time frame if the reports/file feeds are developed and scheduled. This can be done for all file feed/data extract reports.

However, this request cannot be met for pdf or aggregate reports which are requested adhoc. The capability is not there for KP to run a query to generate these type of reports.

5.5 Compliance

5.5.1 Please describe Vendor’s security measures used to deliver reports with individual-level PHI in accordance with HIPAA and NIST 800-53 v4 standards. What encrypted channels do you have available?

Yes While Viverae Information Security Policies and Standards are based on ISO 27000 Series and CoBiT, it is highly aligned with NIST 800 which includes many of the same controls that are mapped to different control objectives in the NIST 800 series.

Our Policies and Standards state that all Data at Rest and Data in Transit shall be encrypted using state-of-the-art commercially available encryption tools.

Viverae provides a SaaS application accessible via a browser. Integration of networks and applications are not applicable to this solution.

Encrypted channels: TLS.

5.6 Notification

5.6.1 Please describe the vendor’s report delivery notification channels and audiences. How are recipients notified that a report is ready for pick up (e.g. from sFTP or secure web)?

Yes Viverae can deliver reports via SFTP or secure email. All reports/file data extracts which are delivered via SFTP will have a notification provided to the recepients who are scheduled to pick up.

Page 51 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

5.6.2 Please describe vendor’s capabilities to manage report generation, content or delivery notification errors to ensure errors are resolved and appropriate parties are notified.

Yes Viverae can provide reports based on custom request. The details for the reports will be outlined in a specification document which will also contain the report format, notification email addresses, delivery dates, and rules for the report. In case there is an error during delivery of a report which needs to be corrected by Viverae, the Viverae error email notification notifies the internal teams on the error and the team corrects and resends the report. If there is an external error which needs correction, the email notification will be set accordingly to notify the 3rd party vendor or client.

5.6.3 Provide delivery notification errors and resolution rates to KP.

Yes Viverae can provide KP with delivery notification for errors. Internal Vievrae errors for reports will be resolved within 1 -2 business days depending on whether a third party vendor or client requires correction.

6.0 Reports Quality Management

6.1 Quality Assurance/Quality Control

6.1.1 Please describe the vendor’s QA/QC processes to ensure reports are accurate and complete.

Yes Viverae follows an internal quality check process starting with requirements gathering. There are internal reviews done after drafting spec doc and client is required to sign off to approve the request. Development of reports go through a Unit testing process by the developer and Quality check is done by both a Data Quality Developer and the Business Data Analyst to confirm against the requirements. Client is provided with a test file to approve, validate what is being requested before the reports are scheduled for production delivery.

Attachement: Viverae Custom Outbound Feed Quality Check Process

6.1.2 Please describe the vendor’s QA/QC processes to ensure reports contain the most current data available.

Yes Viverae follows an internal quality check process starting with requirements gathering. There are internal reviews done after drafting spec doc and client is required to sign off to approve the request. Development of reports go through a Unit testing process by the developer and Quality check is done by both a Data Quality Developer and the Business Data Analyst to confirm against the requirements. Client is provided with a test file to approve, validate what is being requested before the reports are scheduled for production delivery.

Attachement: Viverae Custom Outbound Feed Quality Check Process.

Page 52 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

6.1.3 Please describe the vendor’s QA/QC processes to ensure Data Accuracy that confirmed against the following, but not limited to, fields: Source data, cumulative vs. changes-only, region, group & subgroup, family tier, custom fields, report name, activity dates, program activities, eligibility data, column counts, reports with the same base data and date ranges are congruent (i.e., Individual-level Report matches the aggregate customer’s reports).

Yes Viverae follows an internal quality check process starting with requirements gathering. There are internal reviews done after drafting spec doc and client is required to sign off to approve the request. Development of reports go through a Unit testing process by the developer and Quality check is done by both a Data Quality Developer and the Business Data Analyst to confirm against the requirements. Client is provided with a test file to approve, validate what is being requested before the reports are scheduled for production delivery.

Attachement: Viverae Custom Outbound Feed Quality Check Process

6.1.4 Please describe the vendor’s QA/QC processes to ensure Report Schedule is confirmed against, but not limited to, the following fields: Date range parameters, internal & external delivery schedules, report frequency.

Yes The specification document provided and signed off by Custsomers outlines the delivery schedule. The schedule is developed and deployed based on the signed specification document. The schedule is monitored for delivery accuracy.

6.1.5 Please describe the vendor’s QA/QC processes to ensure Report Format is confirmed against the requested formats, including but not limited to: Excel, HTML, XML, TXT, CSV, PDF, Fixed Width, etc.

Yes The file format and layout for a report is documented in the specification document Customers approve and sign off. The files/reports are developed based on the signed specification document. During the quality check process the report format is validated and confirmed with the client before production runs.

6.1.6 Please describe the vendor’s QA/QC processes to ensure that activity data trends meet expectations from previous reporting periods.

Yes The business rules for the report and any historical data checks are outlined in the specification document Viverae create for the client. There are test cases which are used to confirm accuracy of data and delivered based on the specification document.

6.1.7 Please describe the vendor’s QA/QC processes to ensure historical reports remain unchanged in an accessible repository for future reference by KP staff, customer or Third Party Administrator staff.

Yes Historical data for reports are stored in a repository for Viveare based on the requirements for the report. The historical data can be provided to as reference based on an as need basis.

6.1.8 Provide QA/QC processes to ensure client reports are accessible to KP staff for report servicing and research.

Yes All client reports which are provided via the FTP can be made available for KP staff. These reports will go through the same QA/QC process outlined in 6.1.1.

6.2 HIPAA Authorization

Page 53 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

6.2.1 Please describe the vendor’s processes to ensure HIPAA Authorizations have been accurately captured before individual’s data can be included on any report. What measures do you take to ensure compliance that all data released is contingent upon having a HIPAA authorization on file?

Yes Viverae follows an Internal ‘Data Extract Policy’ before delivering all reports. There is a tiered review which happens for all requests with an internal and client approval on data release documents for participants. In case there is a data release which needs to happen to a third party on behalf of a client, the client is requested to sign an authorization legal form.

Compliance Officer and/or legal team approves all HIPAA related data and ensures compliance and data is released based on HIPAA authorization on file.

7.0 Change Management

7.1 Change Management

7.1.1 Describe your change management processes specific to reporting. For example, a simple change request may be to change from monthly to weekly or change employer group numbers. Complex changes may include a report formatting or field order change/addition.

Yes A formal change control process governs the request to change an existing business process, data standard, system features or application. A change request will be logged, the change control management team will review, approve, prioritize and assign the change control item. The assignee will do an impact analysis for all changes to understand the impact on reporting and other impacted areas. The team will also identify training needs and updates to documentation plus reports. Change is then rolled out and key stakeholders notified.

7.1.2 Provide change management processes specific to change management tools and processes. For example, a new product feature is added to the reporting suite that wasn’t available before, which results in an update to the reporting request user interface.

Yes A formal change control process governs all changes. Change requests are logged in the enterprise-wide issue and request management system (CRM Microsoft Dynamics). If the requests are approved, it moves to the development backlog and the initiative is managed in the enterprise-wide project management agile tool (Rally). All business and technical impacts are identified and user stories developed to update data models, data standards, reports and other impacted areas. User stories are tested and user acceptance testing done before change is rolled-out. Post-launch audits and measures are in place to ensure change control item has been properly executed.

7.2 Development

7.2.1 Provide processes to accommodate new report development work.

Yes Development of Reports go through a development life cycle.

Attachement:Custom File Feed Process

Page 54 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

7.2.2 Provide access to data "sandbox" for report development and testing purposes.

Partial Viverae will develop and test reports for KP.A “sandbox” for report development and testing cannot be provided.

7.2.3 Provide ad hoc data extracts to validate data changes before and after the development fixes are applied, i.e., matching activity counts, matching eligibility counts, etc.

Yes Viverae can provide adhoc data extracts based on client needs. Adhoc reporting will follow Viveraes Custom Outbound File delivery process with some minor modifications to meet KP business needs.

Attachement: Custom File Request process

8.0 Service Level Agreements (SLA)

8.1 Report Generation

8.1.1 Provide a service level agreement that Vendor's systems can support generation and delivery of reports and extracts with the following volume demands:

25 customized reports/ Customer

300 reports (across all Customers) / day

Yes Viverae will work with KP to define a SLA related to system support generation and delivery of reports and extracts related to certain volume demands.

8.1.2 Provide a service level agreement that Vendor’s system will support generation of customizable reports with no less than 300 configurable attributes (data elements). Attributes included in each report will be defined by the Customer.

Yes Viverae will work with KP to define a SLA related to system support generation of customizable reports.

8.2 Report Accuracy

8.2.1 Provide a service level agreement of 100% reporting data and format accuracy.

Yes Viverae will work with KP to define reporting data/accuracy SLA. Viverae will guarantee 100% accuracy in data and format accuracy, assuming same accuracy in source (input) data.

8.3 Report Support

8.3.1 Provide a service level agreement specific to reporting questions being responded to within 24 hours.

Yes Viverae will provide SLA agreeing to respond to specific reporting related questions within 24-hour timeframe.

8.3.2 Provide a service level agreement specific to reporting adjustments (without design changes) and incorrect reports being fixed and posted within 4 business hours.

Partial Viverae will work with KP to define mutally agreeable incorrect report resolution SLA timeframes.

Page 55 of 116

E FUNCTIONAL REQUIREMENT

Reports & Extracts

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

8.3.3 Provide a service level agreement specific to

report adjustments (with design changes) and providing an LOE estimate within 48 hours.

Yes Vierae will agree to provide SLA to provide LOE on report adjustments within 48 hours.

8.3.4 Provide a service level agreement specific to reporting errors to ensure they are remedied within 48 hours of notice.

Yes Viverae will provide SLA to remedy reporting errors within 48 hours.

8.4 Report Utilities

8.4.1 Provide a service level agreement specific to report scheduling to ensure reports are delivered according to schedule 100% of the time, with the exception of previously communicated maintenance.

Yes Viverae will provide SLA committing to delivery of scheduled reports 100% of the time.

8.5 Report Delivery

8.5.1 Provide a service level agreement specific to quality control reporting, which will enable KP to maintain quality checks on completed reports.

Yes Viverae will work with KP to define SLA around quality control reporting around completed reports.

8.5.2 Provide a service level agreement specific to providing LOEs to KP within 48 hours.

Yes Viverae will work with KP to define SLA around providing LOEs to KP within 48 hours.

8.5.3 Provide a service level agreement specific to change management processes. Specific timelines to be agreed upon between parties.

Yes Viverae will work with KP to define SLA around change management processes.

8.5.4 Provide a service level agreement specific to report development work. Specific timelines to be agreed upon between parties.

Yes Viverae will work with KP to define SLA around report development work.

Page 56 of 116

Group F – Quality Control Management

F FUNCTIONAL REQUIREMENT

Quality Control Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 System Capabilities

1.1 Data Monitoring & Reporting System

1.1.1 What are the monitoring features/information you currently have/support? How do you plan to share this information with KP?

Yes For data monitoring Viverae utilizes in-house tools to monitor data processing and delivery of files is are monitored through scheduling tools.

Internal notifications are used to notify internal teams in case there is a failure. Customers will be provided access to the Viverae Employer Portal to access the file processing status and File Errors. The Customer can use the errors to correct and provide a new file to reprocess.

SCREENSHOTS:

Data Processing and Quality Check 1

Data Processing and Quality Check 2

Data Processing and Quality Check 3

1.1.2 Ability to monitor data and report to KP (for data tracing, fixing, and tracking purposes) the following QC information:

Program types by Customer and across all Customers

HIPAA authorization status (accept, decline, no action) by Customer and across all Customers

Eligible participant counts by Customer and across all Customers

Activity types and number of activities/ program by Customer and across all Customers

Activity completion counts by Customer and across all Customers

Region, Group, Subgroup (RGS) combinations (a KP employer group identifier provided in eligibility files) used by Customer

Participant counts within each Region, Group, Subgroup (RGS) (including 0) by Customer and across all Customers

Snapshot and history of errors generated by each quality check implemented on the system by Customer and across all Customers

List of system error types.

Partial Viverae can pull all of 1.1.2 except for HIPAA authorization status.

Customers may review the Program types, Member Activities, File Load Status and Error reports via the Viverae Employer Portal.

SCREENSHOTS:

Data Processing and Quality Check 1

Data Processing and Quality Check 2

Data Processing and Quality Check 3

Viverae can meet 1.1.2 requirements as requested, but will perform a system modification to VHMS to handle HIPAA authorization status.

Page 57 of 116

F FUNCTIONAL REQUIREMENT

Quality Control Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Count of records by error type

detailed list of error records by error type, by Customer, and across all Customers

Program types

1.2 ETL Traceability

1.2.1 Describe Vendor’s monitoring of the ETL process and how traceability reporting will be provided to KP of the following:

inbound file reception status: Received, Late/Missing, Load Failure

outbound file status: Sent, Late/Missing, Load Failure

QCM results of data within files, general.

Yes The Viverae member portal will have a view to the statuses of files received and processed for the Census Eligibility files. The View provides Customers visibility to not only the files processed but also to total records processed, rejected and held with reasoning. The UI screen also shows which files are processed, rejected or onhold.

SCREENSHOTS:

Data Processing and Quality Check 1

Data Processing and Quality Check 2

Data Processing and Quality Check 3

For Outbound files, a notification will be send when a file is processed and based on the schedule date.

The Outbound files can be either downloaded from the portal or can be custom developed based on the client need. The format and layout can be modified based on client requirements.

QCM results can be included within files on an as need basis.

1.3 Remediation

1.3.1 Describe Vendor’s remediation process and how reporting of remediation activity will be provided to KP. Information in reports should include but not be limited to: Eligibility, Activity completion, Rewards, Rewards delivery, Waivers, etc.

Yes For Eligibility files, the issues will be reported back to the Employer via the Employer Portal or can be provided in a file to the Customer. Any issues related to correction of points or rewards can be corrected by members contacting the Viverae Health Center member support line.

1.3.2 Ability for KP staff, QCM Agents, and Customer Service agents to submit eligibility and activity remediations, as well as activity waivers.

Yes The Eligibility and activity remediations can be submitted either via Viverae Health Center member support phone line, Contacting Viverae CRM or via a File with the results posted to Viverae FTP for processing and correction.

1.3.3 Ability to process remediations in an automated manner within 24 hours.

Yes If the issue is related to Eligibility, Screening, Activity files, these can be processed via Viverae’s automated process within 2-3 business days.

Page 58 of 116

F FUNCTIONAL REQUIREMENT

Quality Control Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.3.4 Ability for QCM staff to process submitted

remediations both individually and in bulk (up to 1,000 records at a time).

Yes VHMS has a self managed option if required for QCM staff may upload bulk eligibility, screening and activity corrections via a file to Viverae FTP site for processing.

1.3.5 Ability to provide KP staff, QCM Agents, and Customer Service staff to track remediations requests through to completion to ensure with confidence each item has been fixed.

Yes Viverae’s case management system provides the ability to search, access and review the current status of all remediation’s submitted to Viverae.

1.4 Issue Management

1.4.1 Ability for Vendor, KP, and 3rd parties to enter and track QCM issue investigations.

Yes Viverae does not currently allow third-party vendors to enter issues, these are received either by the Health Center, MSR or CRM and logged internally into Microsoft CRM for issue resolution. Viverae may use the Service Delivery portal to track and receive requests submitted by the client in future.

1.5 Future Tool Accommodation

1.5.1 Please describe how the Vendor plans to work with KP to develop the QCM tools necessary as new product features and enhancements are launched. Please provide assurance that any future development should not impact existing functionality or support.

Yes Viverae’s Product team would work closely with the KP team as new product features or enhancements are launched to make sure that the business requirements includes the QCM tools necessary.

Viverae’s Product and Business Operations teams complete detailed departmental impact analysis in tandem with business requirements using the BRD document and process. This insures that functionality is maintained or improved, process updates are identified and put in place and effective support teams are trained and engaged prior to the the product release.

Viverae’s Product team also includes a specialized launch team focused solely on assisting the organization in launching new releases effectively to Customers.

2.0 Information

2.1 Program-Level Detail

2.1.1 What is the program information that can currently be reported to KP about a given Customer’s program? Please provide list of information that can be provided at the Customer level, including but not limited to program design details that are loaded in the system. Please include QCM error report samples that would be provided to KP and/or screenshots or demos

Yes Through Viverae’s Employer Portal, KP will have detailed insight to the Customer’s program including aggregate participant demographic data, program design and details, participant engagement, challenge participation, upcoming event list, access to forms and information posted for participants.

Page 59 of 116

F FUNCTIONAL REQUIREMENT

Quality Control Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

of administrative tool KP would be provided, where applicable.

Reporting can be reviewed and generated within the employer portal covering customer’s billable population, assessments completed by type, member information, and Metrics On Demand or (MoD).

Metrics on Demand provides up-to-date aggregate risk and participation reporting that can be stratified by census data fields including location, employee class, gender, age etc. This information can be filtered and formatted into custom reports as often as required.

Finally, Viverae’s Employer Portal also provides each customer a Program Year view with aggregate data covering population participation summary and health trends (aggregate Health Score yr over yr, Health Index yr over yr) and all of the activity points captured within the participant portal including all Biometric and Health Assessment actions (completed, alternative options requested), online activity completed (education courses by type, quizzes etc) and other general activity sets (forms submitted, passwords rest etc). The data available for each customer is related to the products deployed/implemented.

For additional report information please review the Reports Inventory document.

Screenshots of the Employer Portal have been provided. QCM internal error report samples have been provided.

SCREENSHOTS PROVIDED: Group F 2.1.1

2.2 Participant-Level Detail

2.2.1 Please provide evidence of the Vendor‘s ability to display a complete list of all KP Customer’s programs configured on the system. Please provide list of information that can be provided at this “global” level including but not limited to:

list of programs configured on system.

associated program detail.

program status, including but not limited to: inactive, UAT testing, Production, data run-out period, closed

Please include QCM error report samples that would be provided to KP with this information and/or screenshots or demos of administrative tool KP would be provided, where applicable.

Yes Viverae’s Partner Portal would provide the “global” view of all KP’s Customers. Through this view, KP would be able to:

View a list of all Customers / programs configured in the system

Select a specific Customer for program detail

Program detail view provides the same access to data as the customer level including: program status and all dates associated with program design, all reporting options including access to Metrics on Demand, and Program Year participation data

As a SaaS model, UAT testing & Production status are N/A. Customers will have access to Soft Launch feature to preview program design prior to release

Page 60 of 116

F FUNCTIONAL REQUIREMENT

Quality Control Management

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Screenshots of the Partner Portal View included

QCM error report samples have been provided.

SCREENSHOTS PROVIDED: Group F 2.2.1

2.2.2 Ability for QCM staff to display, filter, and export a list of the KP Customer’s programs that correspond to inputted program details criteria.

Partial This specific request has not been made by our current Customers. Viverae’s platform currently incorporates the majority of features noted, and enhancements would allow Viverae to fulfill this requirement.

Viverae would seek to understand the scope and requirements associated with this to deliver an effective solution that displays, filters and exports a list of KP customers programs that correspond to inputted program details criteria.

3.0 System Service Level Agreements (SLA)

3.1 Service Architecture Documentation

3.1.1 Please provide documentation of your QCM service architecture, including but not limited to business logic, rules management, new features, user guides, data dictionaries, etc.

Partial Viverae will work with KP to create this.

3.1.2 Please provide updated documentation for any changes in the service platform logic and/or architecture and how this information will be communicated and in what timeframe.

Yes Viverae’s Product, Development, and Business Operations teams all complete required documentation as it relates to product enhancments to the VHMS. Historically, Viverae has effectively communicated these updates to Customers with 30 days notice, with a select number of the client population serving as Client Advisors providing input and feedback on changes that may require additional lead time. Understanding KP’s requirements will be key to effectively supporting these updates to the system.

3.2 QCM Service Issues

3.2.1 Please confirm Vendor will dedicate time and resources to investigate service issues reported by participants or KP concurrently with implementation and launches.

Yes Confirmed as these resources are in place today. Viverae’s internal process ensures that support requests or issues reported are electronically tracked through to issue resolution/ completion with high visibility for the cross-functional support team.

Page 61 of 116

Group G – Onboarding

G FUNCTIONAL REQUIREMENT

Onboarding

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 UI/UX Configuration

1.1 Custom Settings

1.1.1 During onboarding each customer’s preferred custom UI/UX settings unique to their program are captured. Customer-specific custom capabilities include but are not limited to:

Design (i.e. employer logo, color scheme,)

Web text (i.e. Language in Program Description, Contacts, FAQ, HIPAA authorization, etc.)

Hyperlinking to KP SSO internal and external websites

Type, description and order of rewardable activities listed & when they show (i.e. additional activities show up as available over time, or expire and disappear)

Type, description and order of health resources and tools listed

Show or hide reward type tracking by activity and/or total earned reward amount(i.e. $, points , check mark, lottery eligibility)

Show or hide reward cash-out capability (if applicable)

URL (redirecting OK)

Add additional customer specific content (e.g. health fair announcements or calendar)

Yes

Yes

Yes

Yes

Yes

Yes

Partial

Yes

Yes

VHMS can be configured to support a wide range of customer-specific capabilities including design, logo, URL, and content.

A system modification to support visibililty to reward cash-out will be made. KP approval for design will be required.

1.2 Default Settings

1.2.1 Across all customers UI/UX default standard settings that are fixed for all clients include:

Login landing page

Authentication mechanism for KP members (kp.org credentials) and non-member eligible participants

HIPAA authorization process required before participant can enter site. Ability for participant to change this authorization at any time.

Use appropriate HIPAA authorization based on program design (i.e. HIPAA for activity-based program different than outcome-based program)

Yes

Yes

Partial

VHMS includes various standard settings that persist across all client instances.

System modifications to be built to support the following;

HIPAA authorization process required before participant can enter site. Ability for participant to change this authorization at any time.

Use appropriate HIPAA authorization based on program design (i.e. HIPAA for activity-based program different than outcome-based program)

Page 62 of 116

G FUNCTIONAL REQUIREMENT

Onboarding

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Kaiser Permanente logo persists across all pages

Distinct areas users can easily find following information:

- Program information (dates, rules, rewards etc.)

- Individual-level tracking of Rewardable activities and status

- FAQs - Contact info for questions - Health resources (embedded or linked) - Individual’s demographic / contact

information and communication preferences

Logout functionality

Time out functionality with messaging

No

Yes

Yes

Yes

Yes

1.3 Activity Completion Notification

1.3.1 Display notification to participant when an activity has been completed

Yes The Viverae member portal clearly displays the completion of participant activities.

1.4 Program Completion Notification

1.4.1 Display completion notification to the member as soon as participant reaches maximum reward possible, as defined by customer for their program.

Yes The Viverae member portal dashboard displays the achievement of a targeted goal as soon as a points reward level is met.

2.0 Rewards

2.1 Type of Reward

Page 63 of 116

G FUNCTIONAL REQUIREMENT

Onboarding

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.1.1 Vendor shall support (through direct fulfillment or data extract) a number of incentive rewards types including but not limited to:

gift cards

Contribution to HRA or HSA_

Merchandise

Premium differential

Payroll credit

Health plan options

Charitable donations

Discounts (Rx, meals, gyms)

Lotteries

No co-pay

Yes

Yes

Yes

Partial

Yes

Partial

Partial

Yes

Partial

Yes

Partial

Viverae supports clients in managing the incentive portion of their program. Regardless of reward type, Viverae tracks, manages and reports on participant qualification. This can include tiered incentive levels. Viverae’s clients utilize the incentive report or reports for Premium Differentials, Payroll Credit, Health Plan Options, and even Contribution to HRA pr HSA, No Co-Pay and Lotteries. Through a third party rewards provider, Viverae has partnered to support fulfillment of gift cards, merchandise, charitable donations

Viverae can further enhabce its capabilities to provide a highly scalable, integrated solution to support merchandise, gift cards, charitable donations and discounts. Additional integrations through payroll solutions can be scoped for seamless reward qualifications for health plan related rewards.

3.0 Activities

3.1 Type of Activity

3.1.1 Rewardable activities include but are not limited to:

Kaiser Permanente’s health risk assessment (Total Health Assessment)

KP-performed Biometric screenings* (clinical data from Kaiser Permanente’s health connect)

KP-performed Preventive (i.e. cancer) screenings* (clinical data from Kaiser Permanente’s health connect)

KP-performed vaccines*

Kaiser Permanente’s Digital health coaching (healthy lifestyle programs)

Kaiser Permanente’s Telephonic health coaching (clinical data from Kaiser Permanente’s health connect)

Other KP-performed clinical or condition management engagements (clinical data from Kaiser Permanente’s health connect)

Customer-defined health activities (data feeds from third parties, other vendors)

Customer-defined physical activity tracking (self-report or wearable integration)

Customer-defined Topic-specific engagements (i.e. smoking, physical activity, stress

Yes The Viverae member portal can be configured to support a wide variety of rewardabe participant activities.

Page 64 of 116

G FUNCTIONAL REQUIREMENT

Onboarding

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

management, financial management, weight management, etc.)

Self-reported customer-defined activities *Vendor allows KP to define activity rules capabilities (i.e. age and gender demographic triggering to follow established clinical guidelines)

3.2 Activity Rules

3.2.1 Vendor shall support various activity configurations that are dynamic, including but not limited to:

activities available as standalone,

Parent Child relationship,

Grandparent relationship

Nesting

series level completion,

gateways Autocomplete functionality should also be supported to minimize redundant end user input required.

Yes Viverae can provide mulitiple activity configurations.

3.3 Activity Frequency

3.3.1 Vendor shall provide a method for setting up the number of times the activity is allowed to be completed for a member.

Yes Programs can be configured to limit the number of activities and times an activity can be completed.

3.4 Activity Name

3.4.1 Vendor shall provide the ability for customer to name each activity.

Yes Viverae allows for Customer-defined activity naming.

3.5 Activity Dates

3.5.1 Vendor shall provide a method for customers to define activity start and end date with the exception of any Kaiser Permanente activities that follow clinical guidelines.

Yes Programs can be configured to allow Customers to define specific start and end dates for activities.

4.0 Data Configuration

4.1 Unique Setup Configurations

Page 65 of 116

G FUNCTIONAL REQUIREMENT

Onboarding

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

4.1.1 During onboarding, please describe methodology

in which Customer’s defined unique data configurations for setup are gathered. Please describe how the system is setup with this information and can distinguish each segmentation for rendering and reporting. Data setup configurations in following areas are required:

Customer name

Family Tier (subscriber, spouse, domestic partner, dependent)

KP Member Region/Group/subgroup

Program type (activity or outcomes)

Activity type

Grace period Program start and end dates

Yes Programs can be structured and implemented to allow Customers to define a variety of content presentation and reporting capabilities.

4.2 Concurrent Customer Programs

4.2.1 Please describe onboarding process and system handling to support customer’s request to have multiple unique programs running concurrently (program overlap) with the same members participating in these dual programs.

Yes Viverae’s platform is designed to be configureable for program designs. Ensuring Customers have considered all aspects of the program design prior to launch is a critical step. Through the implementation or relaunch process, Viverae guides the client through a validated process of establishing program design(s) along with associated start/end dates, eligibility, requirements, and program descriptions that will be seen on the incentives page by participants. Once the client has signed-off of their launch/relaunch plan, the Viverae configuration team builds the program(s) in the Viverae member portal. Customers can view the program design pre-launch through the “Soft Launch” feature. Once live, participants will only be able to view the program(s) in which they are eligible.

5.0 End to End Onboarding Process

5.1 Lead Time

5.1.1 Please describe the lead time required before a Customer’s program can go live. What is involved end-to end to set up a Customer and how much time does this onboarding process take end to end, for each solution (data, portal plus data, bulk cards)?

Yes After the specific KP system build is complete during the intial (master) implementation, KP team will have direct access to onboard customers of all types. The process entails defining customer program design, configuration, reporting deliverables, incentive types, and member communications. Based on comparable direct to employer Viverae experience, individual implementations range from as little as 60 to 180 days. This timeframe will ultimately be determined by the KP team in conjunction with customer timeframes.

Page 66 of 116

Page 67 of 116

Group H – Fulfillment Requirements

H FUNCTIONAL REQUIREMENT

Fulfillment

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 Reward Types

1.1 Gift Card - Portal Solution

1.1.1 Vendor shall provide both US mail and electronic delivered gift cards with customer-defined dollar value available as a reward, including but not limited to these types:

“valid anywhere” cash equivalent (e.g. Visa

prepaid gift card)

specific merchants (KP-reviewed and

approved e.g. only healthy merchants)

Participant receipt of gift card must be within 5 business days of participant activity completion.

Partial Viverae has partnered to provide multiple types of gift cards (pre-loaded debit cards for valid anywhere and specific vendor gift cards) and timely fulfillment through both mail and email.

Viverae can extend its capabilities to include a highly scalable integration for gift card fulfillment for specific merchants, including merchants hand picked by KP

1.1.2 Vendor shall provide ability for eligible participant to select from different types of gift cards and fulfill reward. (E.g. Visa card, merchants, pharmacy etc.)

Partial Viverae has partnered to provide multiple types of gift cards (pre-loaded debit cards, specific vendor gift cards).

Viverae can expand its vendor capabilities and level of integration to support additional gift card types. Viverae will scope the requirements to provide pharmacy related gift cards.

1.2 Bulk Gift Cards- Standalone Solution

1.2.1. Vendor can support managing and processing of KP direct orders for bulk gift cards. On behalf of a Customer, KP would submit order in which card denomination (monetary value on card), volume (number of cards) and shipping instructions were included for transaction.

Partial Viverae has partnered to support bulk gift card order fulfillment where gift cards were 1) shipped in bulk to a single location and 2) to multiple locations.

Pending detailed requirements additional level of integration may more effectively support this offering.

1.3 Data Files Generation

1.3.1 Vendor shall provide the ability to generate customized data files (cumulative and snapshot) to Third Party Administrators (TPA), direct to customers, and/or internal KP vendors for their processing and fulfillment of rewards, such as payroll credits, HRA/HSA_ contributions, or premium differentials. Please provide file samples and specify degree in which included data elements, file layout, and file formats can be customized.

Partial Viverae provides data files to external partners for processing and fulfillment of rewards.

SCREENSHOT PROVIDED: Group H 1.0 Reward Types – Data Files Generation 1.3

Data elements and file formats can be further customized to meet KP vendor and customer specifications.

1.4 Data Files Secure Transfer

Page 68 of 116

H FUNCTIONAL REQUIREMENT

Fulfillment

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.4.1 Vendor shall provide capability to transfer data

flies including PHI in secure, encrypted channel(s). Please describe channel(s) available.

Yes Viverae can accept files via an SFTP channel. The site is secured and there will be a dedicated username and password provided. The files transmitted can be encrypted using wither Viverae or vendors keys.

1.5 Raffle

1.5.1 Vendor shall provide ability to support reward raffles for eligible population that have completed the necessary activities and are eligible to be part of a reward raffle.

Yes Viverae provides a “lottery” type process for incentive distribution. This includes building a randomization process through an algorithm and creating interactive notifications. Winners will be selected through a randomization process and alerted of win/loss upon the completion a specified activity (i.e. HRA, Biometric Screening).

1.5.2 “Lottery” system functionality will exist to reward subset of eligible participants with raffle prize based on a random process. Describe your notification capabilities to eligibles within this reward design.

Yes All participants will receive an engaging notification within VHMS, but only winners will receive instructions for redeeming their prize. This lottery can run throughout the entirety of the program year, or within a specified date range (i.e. Assessment Period, Complete by Date).

Viverae can develop KP/Client specific messaging for this feature.

2.0 Reward Tracking and Fulfillment

2.1 Points

2.1.1 Vendor shall provide functionality to assign points in the system for users to use as currency. Needs to be configurable based on value selected by customer for each activity within a program as well as the max total can earn within a program.

Yes Viverae supports configurable points management, which the external partner would convert to currency.

2.2 Redemption

2.2.1 Vendor will provide functionality for participants to redeem points for self-selected incentive (e.g. gift card); redemption frequency as defined by customer (e.g. as accumulate throughout program, or only at end of program). Once reward is redeemed, vendor will send email confirmation to participant alerting them that reward is on its way.

Partial Viverae’s reward partners offer point reward and redemption frequency as defined by the customer. Viverae’s rewards provide notification that award has been sent.

Viverae will assess business requirements and evaluate enhancements to ensure additional points redemption options are fully supported based on customer / KP specifications.

2.3 Tracking Support

Page 69 of 116

H FUNCTIONAL REQUIREMENT

Fulfillment

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.3.1 Vendor will provide the ability for KP to track

status, delivery support, logistical information (address delivered, date delivered etc.) for rewards. Please describe process, tools and resources vendor will provide KP to accomplish these objectives.

Partial Viverae will assess business requirements and evaluate enhancements to KP’s Employer Portal functionality to support expanded reward tracking capabilities.

Viverae will assess business requirements and evaluate enhancements to KP’s Employer Portal functionality to support expanded reward tracking capabilities

2.3.2 In the case Customer has limited maximum number or rewards available to earn within a given eligible population, please describe vendor’s ability to provide KP status of reward earnings over time.

Partial Viverae’s reward partners have provided administrative Employer access for rewards reporting and status of reward earnings over time.

Viverae will assess business requirements and evaluate enhancements to KP’s Employer Portal functionality to support reward reporting and status of reward earnings over time.

2.4 Self-Serve Administrative Portal

2.4.1 Vendor shall provide the ability for defined KP Team members to access information about the status of delivery of reward items at customer and individual levels.

Partial Viverae’s reward patners have provided administrative Employer access for reward fulfillment data.

Viverae will assess business requirements and evaluate enhancements to KP’s Employer Portal functionality to support reward fulfillment data

Page 70 of 116

Group I – Customer Support Requirements

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 Customer Service Model

1.1 Customer Service Model

1.1.1 Please describe your Customer Service model, including but not limited to handling and resolving of:

Questions from KP (as your client)

Questions directly from Customers (e.g. HR or wellness program manager)

Questions directly from program participants

Yes Viverae’s primary assumption is that KP will provide Tier 1 level of support for their Customer admin support, and participant support. In this assumption, Viverae’s service model for KP will consist of strategic relationship management (ensuring service delivery and meeting SLA’s), application technical support (for KP users accessing the system), issues helpdesk, reporting support, and data integration support.

1.2 Customer Service Activity Reporting

1.2.1 What Customer Service information would you report to KP for tracking? Please provide a list of the information typically provided and sample report(s).

Yes Viverae’s case management solutions contains the following standard reports and metrics but can also be configured to add custom metrics as required:

Active cases by type, agent, priority, category, etc.

All cases by SLA status (In progress, overdue, completed)

Case creation trend by type, agent, priority, category, etc.

Case resolution trend by type, agent, priority, category, etc.

Overdue cases by type, agent, priority, category, etc.

Average days to close by type, agent, priority, category

2.0 Data Information Access for Customer Service

2.1 Customer Service Agent Lookup Tools

2.1.1 Please describe Vendor’s lookup tools and resources available to Customer Service agents and information available to them for direct participant issue resolution/ remediation, including but not limited to:

Yes

The Viverae Health Center tools will be made available to KP Customer Service, which includes issue resolution/remediation capabilities to support these items except where noted that require system modifications.

System modifications will be made to support the following:

Participant authorization status (HIPAA) and history

Page 71 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Each customer’s program design information

(activities, reward types, reward amounts, dates, etc.)

Participant eligibility by customer

Participant authorization status (HIPAA) and history

Participant activity completion history (including access to original data source files and data after system processing through rules engines)

Participant reward earning status and redemption history, including reward fulfillment tracking

End-to-end activity trace: program, source file name (if applies), Source, code, description, completion date, process date, Reception date, redemption value

Ticket identification and tracking (e.g. Remediation forwarded date, forwarding status/error description &code, request information date and type/description)

Data dictionaries

Yes

Partial

Yes

Partial

Yes

Partial

Yes

For ticket identification: Viverae’s case management system provides Customers the ability to search, access and review the current status of all remediation’s submitted to Viverae. Standard case attributes include but are not limited to the following: created on, created by, status, description, error code, error text, and category. Additional custom fields can be configured as required.

Data dictionaries can be provided with delivery of Customer reports.

Participant reward earning status and redemption history, including reward fulfillment tracking

Ticket identification and tracking (e.g. Remediation forwarded date, forwarding status/error description &code, request information date and type/description)

2.2 Program Design Detail View

2.2.1 Please provide detailed list of all data points available to the customer Service team and respective data dictionaries, to support program participant inquiries and issue resolution/remediation regarding their program. Details should include but not be limited to:

Unique Program ID

Customer Group Name

Customer or TPA or other relevant contact information

Program name

Product/Program type

Program activities

Activity definition: Incentive period/program, Start & End dates, Activity codes, Activity Description, Activity reward value, Gatekeeper Activities, Activity parent/child relationships

Reward type (Gift Card, HSA/HRA, Data Extracts, etc.)

Reward design (rules for earning, amount can earn by activity and in total)

Program reward maximum value

Yes Viverae application/portals employer user access provides a set of reports which can be readily downloaded and consumed for usage (attached).

Page 72 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

HIPAA Acceptance Status and Dates

Program start and end dates

Region/Group/Subgroup (RGS)

Family Tier

Eligibility/COBRA status

Relationship code on health plan (subscriber, spouse, domestic partner, dependent)

Family reward maximum value

Other

2.3 Member Information View

2.3.1 Vendor shall have capability for Customer Service team to search for a participant and their related program information and attributes using a variety of inputs. Individual’s information should be searchable in master database without program information identified, but once found, tagged to relevant eligibility and program(s). Please provide detailed list of all data points about an individual participant available to the Customer Service team to input for search/ lookup and issue resolution (with or without provision of program or customer information), including but not limited to:

Participant name (first, middle, last)

Participant demographics (e.g. DOB/age, gender—please list all)

Participant contact information (address, phone number, email, etc.)

Unique ID numbers including SSN, KP Member/ medical record number, UUID, their employer ID number, etc.

Eligibility (including dual coverage)

Partial Viverae’s platform includes a participant support portal which provides detailed participant data, program description, eligibility, etc., that is searchable across multiple identification inputs (First Name, Last Name, Employer, Member ID, Date Of Birth plus address related fields). This information is pulled from Census file data as well as information self reported by the participant.

Once the participant is chosen, Customer Service would be able to review any of the following fields including:

Member ID, Name

Relationship (EE, Spouse, Dependant)

Gender, Date of Birth

Preferred Language

Eligibility, Location, Department, Union, Division (if applicable)

Health Plan, EE Class

Race/Origin

Education Level, Maritial Status

Hearing / Vision Impaired

Contact Info (Home, Work, Cell, Other Phone, Email, alternate Email

Contact Method Preferred, Call Time Preferred

Employer, Employer Phone,

VIP designation

Spouse/Partner

HRA or Biometric Data status (add or review current)

While detailed capabilities already exist, Viverae would need to scope requirements around the following to assess how to best support these requests:

Unique ID numbers including SSN, KP Member/ medical record number,

UUID,

Employer ID number, etc.

Page 73 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Program Design, Descriptions and Incentive Program

information and Plan Year Options

Eligibility by product (if applicable)

Participation Summary

Forms that have been uploaded

3.0 Remediation

3.1 Remediation

3.1.1 Capability to ingest remediated activities and eligibility record changes.

Yes Viverae has the ability to accept bulk remediations records via a file for Eligibility.

3.1.2 Capability for customer service agents have full access to (activity & eligibility) remediations after processing.

Yes The client Customer service agents who have access to Viverae portal should be able to access all remediated records after processing.

3.2 Single/Bulk Remediation

3.2.1 Provide KP Customer Service Agents capability to upload remediations in bulk aggregate (up to 1,000 at a time).

Yes Files can be uploaded to Viverae SFTP site for pick up and processing.

3.3 Automated Remediation

3.3.1 Process activity and eligibility remediations in a non-manual, automated manner within 24 hours.

Yes This is possible and can be processed within 1- 2 business days.

4.0 Remediation Fields

4.1 Eligibility

4.1.1 Capability for Customer Service agents to remediate the following Eligibility fields:

Customer name

Participant ID

KP health plan member ID/ medical record number First Name

Middle Name

Last Name

SSN

Date of Birth

Gender

Yes Data Elements available via census file feeds can be updated.

Page 74 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

Relationship code (Subscriber, Spouse,

Dependent...)

KP health plan Region

KP health plan Group

KP health plan Subgroup

KP health plan Employer Group

KP health plan Subscriber ID

KP health plan Benefit Start Date

KP health plan Benefit End Date

Address

Address 2

City

State

Zip

Email

Home phone

Work phone Notes added to the remediation

4.2 Activities

4.2.1 Capability for Customer Service agents to remediate the following Activity fields:

Activity code

Outcome activity value (e.g. BMI or blood pressure screening results)

Activity completion date

Add notes to the remediation request

Reasonable alternative(s) activity identification, override or remediation

Activity waived identification, override or remediation

Self-reported activity identification, override or remediation

Yes Data elements provided in the census file are available for remediation.

5.0 Waivers

5.1 Submission

Page 75 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

5.1.1 Capability for Customer Service agents to submit a waiver on behalf of an eligible participant who needs to be waived for completing an activity which would pass to the system for processing and an update in participant’s activity completion status.

Yes All of Viverae’s programs include a program or activity waiver to ensure that participants who are, for example, under the care of a primary physician for their condition and are not recommended to participate in a specific activity or activities, unable to participate in a physical activity due to limitations, pregnancy, or unable to meet set goals or requirements, have the opportunity to submit their waiver for review and approval. Viverae’s review process includes evaluation by the Chief Clinical Officer and Chief Medical Officer. Viverae’s platform accommodates the requirement to update the participants’ activity completion status once the waiver has been received, reviewed and approved.

6.0 Issue Detection

6.1 Flagging at Participant Level

6.1.1 When error(s) detected with a given participant (e.g. issues in activities, eligibility, or rewards), a flag or indicator should be tagged to their appropriate profile and include drill down details about the error(s) and resolution status. Customer service agents should have access to review error detail at the participant level and make notes or status updates if appropriate.

Yes All Viverae MSR’s and Health Center staff have access to interaction notes in VHMS to be able to document any unique aspects about a participants’ account. If there is an error with a member’s account, a case is opened to notify the appropriate tech team.

6.2 Eligibility Issues

6.2.1 Ensure the following Eligibility errors can be detected, flagged, and appropriate systems/ parties notified through an online tool and ideally updated in real time or within one hour. If research required, vendor will begin remediation and notify progress within 24 hours of initial error detection for the following scenarios:

Duplicate participant record: same participant is present under 2 different IDs

Missing participant record

Incomplete/incorrect profile information (preventing Activity record processing)

Incomplete/incorrect profile information (preventing reward)

Incomplete/incorrect address information (for gift card programs)

Yes Duplicate Participant records and incomplete profile information based on census processing can be reported back via the Employer Portal.

6.3 Activity Issues

Page 76 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

6.3.1 Ensure the following Activity errors can be

detected, flagged, and appropriate systems/ parties notified through an online tool and are updated within one hour. If research required, vendor will begin remediation and notify progress within 24 hours of initial error detection for the following scenarios:

Missing activity record for participant

Duplicate activity record for participant

Incomplete/incorrect activity record (date complete, status, etc.)

Incorrect activity data tagged to participant

Yes Duplicate Participant records and incomplete profile information based on census processing can be reported back via the Employer Portal.

6.4 Rewards Issues

6.4.1 Ensure the following Reward errors can be detected, flagged, and appropriate systems/ parties notified through an online tool and are updated within one hour. If research required, vendor will begin remediation and notify progress within 24 hours of initial error detection for the following scenarios:

Rewards earned not processing

Rewards earned not received

Rewards earned incorrect

Rewards earned duplicated

Yes Rewards earned and which are in the activity file can be processed via the file automation process.

7.0 Export Capability

7.1 Search Results

7.1.1 Capability to export search results, program information, and participant information from database into real-time generated individual and aggregate reports or dashboard in various formats (please list the formats available)

Yes PDF, Excel, CSV

8.0 Ticket Management

8.1 Ticket Management Tool

8.1.1 Vendor shall provide a ticket management tool to track issues reported to them, prioritize resolution, triage to any other parties (internal or external) requiring involvement, and remediate in compliance with agreed upon SLAs. Please include list of all data

Yes Viverae offers Customers external access to a full-featured case management system which includes configurable service level agreements, escalation alerts, data security as well as extensive reporting and KPI measurements. External access to case management can be granted to Viverae customers and specified third party agents or providers.

Page 77 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

fields available for lookup in ticket management tool to support remediation.

Service Level Agreements – Individual service level agreements can be configured for warning or failure actions against either “First Response By” or “Resolve By” timeframes. Service levels agreements can be applied individually based on values within the ticket such as type, customer, priority, category, etc.

Case Lookup fields – Viverae’s case management system contains the following standard lookup fields, but can be configured to add custom fields are required:

Customer

Type (Question, problem, request, other)

Title

Description

Category

Sub Category

Created By

Resolved By

Resolve By

8.2 Tracking Reporting

8.2.1 Vendor shall provide ticket management tool that supports ad-hoc reports on the following items, but not limited to:

number of tickets,

open tickets,

closed tickets,

time to resolution,

average time to resolution,

avg. min. max resolution time,

count of escalated tickets,

ticket count by tier

Trend analyses (number of tickets segmented: by root cause, by time to resolution, by resolution status, by assignment, etc.)

other (please list)

Yes Standard Reporting Metrics – Viverae’s case management solutions contains the following standard reports and metrics but can also be configured to add custom metrics as required:

Active cases by type, agent, priority, category, etc.

All cases by SLA status (In progress, overdue, completed)

Case creation trend by type, agent, priority, category, etc.

Case resolution trend by type, agent, priority, category, etc.

Overdue cases by type, agent, priority, category, etc.

Average days to close by type, agent, priority, category, etc.

9.0 Service Level Agreements

Page 78 of 116

I FUNCTIONAL REQUIREMENT Customer Support

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

9.1 Priority 1 Ticket

9.1.1 For “Priority 1” issues (critical, systems down), Vendor shall take immediate action and provide resolution or status toward resolution (workaround and full resolution) every 15 minutes after issue identified, until remediated. Full issue resolution date must be provided at this time.

Yes Viverae agrees to KP communication and resolution request for Priority 1 issues.

9.2 Priority 2 Ticket

9.2.1 For “Priority 2” issues (impact to an individual or group, but systems still running, does not require immediate fix), Vendor shall provide workaround or communication within 24 hours and full resolution within 5 business days and within the next record processing cycle. Full issue resolution date must be provided at this time.

Yes Viverae agrees to KP communication and resolution request for Priority 2 issues.

9.3 Duplicate Records

9.3.1 Vendor shall provide full resolution of “duplicate record” tickets within 4-6 hours of issue being identified by system or through Customer Service inquiry.

Yes Viverae agrees to KP communication and timeframe request for identified “duplicate tickets.”

9.4 Member Unable to Login

9.4.1 Vendor shall provide full resolution of login tickets within 4-6 hours of issue being identified by system or through Customer Service inquiry (assuming KP systems are functioning correctly for login and authentication)

Yes Viverae follows the below process in resolving member related issues.

1. Member calls in Viverae Health Center, Member Support Representative (MSR) attends call.

2. MSR confirms the information provided by Member for accuracy. MSR tries to resolve the issue based on Tier 1 (resolved within 1 hr) validation steps.

3. If MSR unable to resolve issue, Ticket routed for Tier 2 evaluation, Technical Support team, for identifying root cause (if issue is unrelated to password reset, 3-4 hrs turnaround) – Issue identified and corrected by Technical Support team.

4. Issue resolution reported back to MSR

Page 79 of 116

Group J – Business Processes Requirements

J FUNCTIONAL REQUIREMENT

Business Processes

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

1.0 Participant Communication – Distribution

1.1 Email

1.1.1 Please describe vendor’s capabilities to send program email communications to both entire eligible population and segmented audiences within a given customer throughout program, including but not limited to:

Program announcement (general)

Program reminders (general)

Reminder to complete activity (targeted)

Program completion certificate (only to those who have completed program and are eligible to earn reward(s))

Reward on its way (if reward card selected?)

Raffle announcement (targeted)

All emails must provide opt out feature and backend processing of collected preferences and provide feedback loop to KP via data file so that KP can in turn update preferences in KP systems.

Partial Viverae can develop and execute targeted member e-mail campaigns based on participation reports that can be run for specific programs, activities, and challenges. These engagement campaigns can be executed as often as needed by the client.

System modifications will be made to support the following:

Reward on its way (if reward card selected?)

Raffle announcement (targeted)

Viverae will provide the ability to send to KP the opt-in/out settings that are available today for participants.

1.2 Text Messages

1.2.1 Please describe vendor’s capabilities to send

program test message communications to both entire eligible population and segmented audiences within a given customer throughout program, including but not limited to:

Program announcement

Program reminders (general)

Reminder to complete activity (targeted)

Program completion certificate (only to those who have completed program and are eligible to earn reward(s))

All text messages must provide opt-in feature to collect mobile phone numbers, opt out feature and backend processing of collected preferences.

Yes Viverae offers SMS Text Messaging to further member engagement by providing reminders and alerts at key points during the member’s program. Participants who have opted-in to receive SMS Text Messages through the Viverae member portal will receive these messages.

2.0 Participant Communication – Development

2.1 Email

Page 80 of 116

J FUNCTIONAL REQUIREMENT

Business Processes

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

2.1.1 Please describe vendor’s capabilities to provide

creative services to customize design and write copy for each given customer’s email campaigns. To what degree is design and copy templated with variable fields and what are the implications for customer-level customization requests? KP logo must be included in each email. Comps must be reviewed and approved by KP and Customer.

Yes Viverae has robust tempated e-mail templates that can accommodate variable KP content. Customization requests can be accommodated based on scoping.

2.2 Text Messages

2.2.1 Please describe vendor’s capabilities to provide creative services to write copy for each given customer’s text message communications. All text messages must be reviewed and approved by KP and Customer.

Yes Viverae has robust templated test messages that can accommodate variable KP content. Customization requests can be accommodated based on scoping.

3.0 List Management

3.1 Eligible Participant List Loading (Data Feed)

3.1.1 Please describe vendor capabilities in ingesting data file feeds and once loaded, processing all information and updates captured within system.

Yes Viverae can process data files which are posted to SFTP site. The file processing is automated and monitored for accuracy of data. The file processing goes through several stages for quality check before its updated into the Viverae System. The results of processed records will be reflected in the Viverae Portal.

3.2 Manage Contact Information And Preference Changes

3.2.1 Vendor will allow participant to update or change Program communication preferences (e.g. email, phone number, address and cell phone number) as well as change their preferred method(s) of contact for their rewards program and ensure preference changes are honored throughout program.

Yes Viverae currently offers participants the ability to identify their preferred method of communication, through their preferred contact point (work email, personal email, work phone, home phone, cell phone and alternative phone and even best time of day to be reached.

3.3 Unsubscribe List

3.3.1 Vendor will provide ability for participants to opt out of email or text communications related to the incentive program that are generated by the vendor and backend processing so updated preferences.

Yes Viverae’s communications to participants includes opt out language, and participants are able to manage their email or text communications preferences at any time on the Viverae member portal to ensure communication type and frequency match participant preference.

Page 81 of 116

J FUNCTIONAL REQUIREMENT

Business Processes

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

4.0 Billing

4.1 Monthly Invoicing to KP Across All Customers

4.1.1 Ability to prepare invoices and send monthly to KP, broken out with the following information:

Solution (e.g. portal, data only, bulk gift cards)

Customer

Region

Group

Subgroup

Itemized charges Region, group and subgroup information originally provided by KP to Vendor in eligibility file.

Yes Viverae’s billing capabilities are flexible and custom billing solutions can be created based on final product agreement. Viverae currently provides both solution, Customer, itemized charges to Customers, but any information provided on client’s census can be incorporated into the billing process.

5.0 Sales And Training Support

5.1 Site Demonstration Capabilities

5.1.1 Vendor shall provide demo of site capabilities available for KP customer facing team to demo the product to prospective customers.

Yes Viverae has provided demo access logins for the sake of showcasing the product to customers. Additionally, Viverae has created a microsite designed to simulate from KP’s perspective the offerings Viverae can provide as a portal.

To visit the microsite please visit: http://viverae.com/kaiser/.

To visit the demo login please go to www.myviverae.com. Login: joesmith138; password: c.

Page 82 of 116

3.9 Technical Requirements

The Technical Requirements have been organized into functional groups, the requirements are listed in both statement and question form. If in statement form, please provide your description/response in support of your statement. A narrative response is required for each requirement/question. Yes/no answers will be considered an incomplete response.

Each functional group is identified with a letter, with the requirements being numbered from 1 within that group. This is to facilitate a unique identity for each requirement, and should be used as a reference point going forward. For example, the 1st requirement in the 1st group will be known as requirement A1.

Page 83 of 116

Group A – General Technology

Group A

TECHNICAL REQUIREMENT General Technology

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe the technical architecture of the product suite, clearly distinguishing the various software components and how they integrate across the various architectural "Tiers"/"Service-Layers" Provide supporting documents (white papers, architecture schematics, etc.:

Topological Description - Please describe and diagram where the technology/application fit within the physical environment.

Network – Please describe interface(s) and sizing.

Hardware – Please provide model numbers, physical location, sizing, etc.

Application/Infrastructure Software – Please identify version and location(s).

Middle Ware - Please identify version and location(s).

System Software - Please identify version and location(s).

Utilities - Please identify version and location(s).

Yes Viverae has thoughtfully developed and applied technology to all areas of health management where cost effective scale and automation can be provided to the business, a first class experience provided for the consumers within a reliable secure operating environment for all parties.

As a full spectrum health management provider, our health management platform is the underlying technology supporting every health management component including Biometrics, Population Health and Outreach, Operations, Program Administration, Data Integration, Clinical Engagement, and Reporting.

Our holistic approach through technology delivers a consistent, constant and reliable source of truth across all aspects of the health management spectrum delivering contextual views creating the perfect combination of data process and experience to the right user.

VHMS is an enterprise health management system and has the following primary architectural areas:

Web App

Data integration

Batch

Event Streaming

Social Network

The platform design patterns promote strong resuse of code through core services, business logic, controllers, data access code, queries stored together, utility code, UI components and others.

The tiers communicate through different mechanisms depending on the scenario, it would be one of: message bus, REST apis, consolidated builds and event streams.

The system is primarily built with Java and associated technologies and runs in JBoss EAP on RHEL.

All systems run at Rackspace.

Page 84 of 116

Group A

TECHNICAL REQUIREMENT General Technology

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

02 What were the most recent major technology changes, upgrades, or enhancements incorporated into the product?

Yes Recent technology enhancements include:

Incorporated message queueing to support backend asynchronous processing

Incorporated a circuit breaker design pattern for interactions over the network

Expanded use of RESTful services

Incorporated non-sql data stores for unstructured data

Expanded high availability architecture

Expanded Disaster Recovery architecture

03 What are the technological/architectural changes that have been planned for the foreseeable future (over the next two years)? How might these changes impact the user?

Yes Viverae currently has a few major technological/architectural changes underway:

Migrate UI to SPA using Angular including a scaffolding tool to quickly generate new apps, reuse across desktop and mobile apps, leverage modern browser capabilities such as websockets. Caching of static assests on global CDN.

Create a services tier to support a stateless SPA and mobile app, includes removing any dependencies across tiers, running REST services in a lightweight container, caching of API responses where appropriate.

Event streaming, message queues, and workers are being developed to provide a more distributed architecture, eliminate batching and provide massive scale ability to the overall system.

Finer grained deployments are also on the technology roadmap finer grained deployments provide the ability to upgrade only the parts of the sytem that require it.

Page 85 of 116

Group A

TECHNICAL REQUIREMENT General Technology

Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

04 What are the technological/architectural changes that have been planned for the foreseeable future (over the next two years)? How might these changes impact the user?

Yes Viverae currently has a few major technological/architectural changes underway:

Migrate UI to SPA using Angular including a scaffolding tool to quickly generate new apps, reuse across desktop and mobile apps, leverage modern browser capabilities such as websockets. Caching of static assests on global CDN.

Create a services tier to support a stateless SPA and mobile app, includes removing any dependencies across tiers, running REST services in a lightweight container, caching of API responses where appropriate.

Event streaming, message queues, and wokers are being developed to provide a more distributed architecture, eliminate batching and provide massive scale ability to the overall system.

Finer grained deployments are also on the technology roadmap finer grained deployments provide the ability to upgrade only the parts of the sytem that require it.

05 Do you have 3rd party components embedded in your product?

Yes Viverae’s monthly webinars for 2015 and 2016 feature content licensed by HealthDay.

06 How easy is it to re-configure the product for rapidly changing business needs such as changes in business data or business rules. Is your solution rule based or parameter based?

Yes Viverae’s solution is rule-based and works based off systemic rules that are already built into the product. Any changes to the exisiting rules will need to go through a product enhancement process.

Page 86 of 116

Group B – Availability

Group B TECHNICAL REQUIREMENT

Availability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Availability is defined as ((Planned

Availability – Outage) / Planned Availability). KP operates with a planned availability of 24 * 7 * 365. Please advise what level of availability you are prepared to commit to. What benchmarks have you conducted to test the availability or your application? Please provide documentation on the results of your benchmarks to supplement your responses. Please describe how you monitored and calculated availability in these scenarios. What design/architecture features support high availability?

Yes Viverae provides a 98% SLA and currently operates at 99.98% availability. This is calculated excluding planned maintenance which occurs as needed on Saturdays between 12:00 am and 2:00 am central time. Most maintenance windows take less than 30 minutes, many much quicker. Viverae does not use every maintenance window - an average would be between 12-20 per year.

Viverae uses Dynatrace to test and track uptime. Dynatrace executes tests from Customers across the globe. The tests range from simple pings tests to deeper functional testing.

VHMS has been designed to have zero single points of failure, running at least two of everything with an N+1 mentality. There is no single hardware or software component that when experiencing fatal error(s) can bring the system down.

The Viverae system can scale out by adding commodity hardware, including the transactional database.

02 Does your system support the ability to recover from unexpected failures? Please provide a narrative and block diagram showing system redundancy, failover and backup. Please address both system and application components.

Yes Viverae has a designated Privacy Officer, General Counsel Nisha Mascarenhas and adheres to all regulatory compliance industry standards as mandated. She, along with Chief Technology Officer Dave Smith, oversees Viverae’s disaster recovery/catastrophic response protocol which addresses the following: data redundancy, web security, back-up security, software and tape technology, tape life and tape destruction, and back-up network security.

03 What is the system reliability design goal? How is the product designed/architected to meet this reliability goal? This includes error detection and recovery. Are all error conditions addressed accurately?

Yes The reliability goal is to never go down, zero single points of failure, be a reactive system as defined in the reactive manifesto. To meet failure with elegance rather than disaster.

The system is designed to have a healthy separation of concerns where components can be loosely-coupled. Through use of a circuit breaker design pattern, components or core services can go down without bringing down the entire system.

Our system has never gone down as the result of any error, software component failure or hardware failure.

All known error conditions are addressed accurately.

Page 87 of 116

Group B TECHNICAL REQUIREMENT

Availability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

04 Please describe the method for tracking

and reporting incidents and errors in a reliable and fool proof manner.

Yes System incidents are tracked and reported using incident response software All system logs and events are consolidated into an elastisearch container, critical errors and other salient logs are monitored, aggregated and reported on.

05 Describe the expected uptime based on actual customer experience. Refer to customers that are using your applications in a similar technical environment as Kaiser Permanente.

Yes The normal guaranteed uptime is 98%, exclusive of regular maintenance windows (Saturdays, from 12-2 a.m.).

06 Describe how faults or failures in each of your system components are handled, including automated recovery mechanisms, and the resulting impact on the user.

Yes All Viverae system components have duplicilty or N+1. For online production systems hardware failures on network equipment such as the loadbalancer will invoke an auto failover to a hot backup. Servers running our software have many instances, some are loadbalanced and some are clustered. There is no single machine or error state that can bring our system down. An individual user might see an in application error message if something failed or they might notice that a particulare feature is currently not available. All issues are recoverable, the user can continue to use the application.

07 What assumptions will you make about Kaiser Permanente applications, systems, and common infrastructure systems with respect to availability?

Yes The only dependency in the context of availability will be the KP network LAN and WAN. The Viveare system runs in the cloud and can only be accessed with a valid connection.

08 Describe any necessary planned downtime as well as administrative and operational tasks that require downtime. Describe the impact to user during this downtime.

Yes The portal has regular maintenance Saturdays from 12-2 a.m. In addition, Viverae issues 2-4 major releases per year. Prior to issuing new or changed functionality that impacts customers, Viverae executes a communications chain to inform all necessary parties.

09 What is the "down-time" associated with upgrading an instance of your system in production?

Yes The portal has regular maintenance Saturdays from 12-2 a.m.

In addition, Viverae issues 2-4 major releases per year. Prior to issuing new or changed functionality that impacts customers, Viverae executes a communications chain to inform all necessary parties.

Page 88 of 116

Group C – Performance

Group C TECHNICAL REQUIREMENT

Performance Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Please describe the response time

performance that you are prepared to guarantee under the scenarios described below. Response time is defined as the elapsed time from when the Enter key is depressed until all required data is retrieved and displayed. An example guarantee might read that ‘nn% of these transactions will have a response time of n.n seconds over n month period of time’.

Trivial Forms – These Forms (Screens) are simply a retrieval of screen formatting information with no data required. E.g. data entry forms.

Simple Data Retrieval – These Forms (Screens) require the retrieval of database information in addition to screen formatting information, but the data retrieval is simple in nature such as a single row of data.

Complex Data Retrieval – These Forms (Screens) require the creation of a complex data structure for this instance, such as the ARM process.

Reporting – Please describe the method to be used for tracking and reporting the above performance metrics in a reliable and foolproof manner.

Yes Viverae can provide a guarantee for the components of response time that are within our control and a guarantee on Time To First Byte (TTFB) or overall response times with caveats on network latency and asynchronous activity.

A series of automated tests can be configured to monitor and report on response times for agreed upon pages in the categories within the question.

Viverae can provide a guarantee for the components of response time that are within our control and a guarantee on Time To First Byte (TTFB) or overall response times with caveats on network latency and asynchronous activity.

A series of automated tests can be configured to monitor and report on response times for agreed upon pages in the categories within the question.

We are prepared to put a guarantee on the different categories of pages with a range of <4 seconds to <11 seconds depending on the page type or an orverall average of < 11 seconds.

02 Describe, including configuration description, how the system would be implemented to support anticipated maximum number of users and usage characteristics described above. Describe potential performance or capacity constraints.

Yes Every component that KP users will access have scale out (horizontal scale) capability. The system has no bottlenecks that prevent Viverae from adding commodity servers as usage increases, providing a consistent experience regardless of number of users, including the transactional database. This is accomplished through load balancing, clustering and advanced HA algorithms at the database level via Clustrix technology.

Page 89 of 116

Group C TECHNICAL REQUIREMENT

Performance Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

03

Describe options for attaining maximum performance including replication, caching, load balancing, and migration of resources.

Yes As mentioned above, the system has horizontal scale capability, every component that KP users will access can be scaled out to support any level of usage. Currently there are internal caching mechanisms used to alleviate unnecessary loads and static asset and API response caching via CDN are in development. Certain parts of the system where appropriate an “eventually consistent” model is used (such as social posts) where the heavy lifting can be completed across many workers responding to messages.

04 Describe all support for gathering metrics to identify performance and capacity issues.

Yes VHMS is operated and deliverd as a SaaS. All performance issues are dealt with internally using log analysis tools and profiler which can hook into every aspect of the system.

05 What is the expected on-line response time for a user transaction during peak and non-peak hours (assume a T1 connection speed transporting web pages weighing 50Kbytes)? Describe the factors that impact on-line response time? Describe an organization from your customer base with similar characteristics as Kaiser Permanente.

Yes Viverae’s six-month average page generation across all types of pages was < 4 seconds and no longer than 8 seconds.

06 Provide references for organizations with similar transaction volume and sizing characteristics as KP’s.

Yes Please see references provided above in 3.2.2 (Client Base/References).

Page 90 of 116

Group D – Scalability

Group D TECHNICAL REQUIREMENT

Scalability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe how your product will be

scalable to support Kaiser Permanente’s customer growth. What is the minimum and optimum system configuration?

Yes VHMS is archtectured and runs in an environment that can scale out to support any level of volume. Based on the expected volume of KP users, commodity servers can be deployed to accomadate the anticpated peak loads.

02 Which platform provides the greatest scalability and performance reliability?

N/A VHMS is operated and delivered as a SaaS.

03 Describe how dynamic load balancing is achieved at the various tiers/layers of the product architecture (e.g. database, application server, web server, messaging service level, etc.)

Yes Load balancing is used at every tier of the online system including using an F5 with a round robin algorithm. Devices are automatically taken out of the pool if the LB is unable to proxy the request to a particular device or if a health check fails. The database also uses an F5 load balancer but has a more complex algorithm.

04 Provide a suggested system configuration for the scale of KP-IT operations. Provide detailed description of products, services, model numbers, version numbers, etc., as applicable, using diagrammatic representation, where necessary. Provide the number of servers required and your recommendations regarding the types of servers. Additional performance parameters: [a] User Interface response times should be between 1 and 5 seconds for 95 % of the time; [b] Standard/Ad-Hoc query response times should be in the order of seconds. Provide detailed information on when these targets cannot be met and what the expected targets will be.

N/A VHMS is operated and delivered as a SaaS.

05 Provide references for organizations with similar transaction volume and sizing characteristics.

Yes Please see references provided above in 3.2.2 (Client Base/References).

06 Describe the largest production installation to date in terms of transaction volumes and number of registered users, concurrent users, and unregistered users (anonymous browsers).

N/A VHMS is operated and delivered as a SaaS.

Page 91 of 116

Group D TECHNICAL REQUIREMENT

Scalability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

07 Describe your largest customer with

respect to the following metrics:

Number of transactions per day

Number of named users

Number of peek concurrent users and tasks

Average System Response Time

N/A VHMS is operated and delivered as a SaaS.

08 Describe your theoretical maximum volume for:

Transactions

Users

Concurrent users and tasks

Yes VHMS is archtectured and runs in an environment that can scale out to support any level of volume. Based on the expected volume of KP users, commodity servers can be deployed to accommodate the anticpated peak load.

Page 92 of 116

Group E – Adaptability

Group E TECHNICAL REQUIREMENT

Adaptability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe how your system will support

Java, LDAP, Web services and Kaiser Permanente’s other open, standards-based infrastructure, including preferred databases, web application development platforms and middleware components. (need input from EA on this one)

Yes VHMS is operated and deliverd as a SaaS.

02 Describe your system’s ability to leverage shared services and infrastructure.

Yes VHMS is operated and deliverd as a SaaS although the system and engineering team is experienced with integration to services via third party vendors.

03 Can the product be run in a "Shared Server" environment (Like IBM Regatta).

N/A VHMS is operated and delivered as a SaaS.

04 Describe how the product can be configured to accommodate client-specific business rules and user-preferences. Please specify if the business rules are embedded in application code or maintained in DBMS tables.

Yes VHMS is highly configurable, all customer implementation and business rules are stored via configuration in the database.

05 Describe the capabilities of the tools provided to configure the product. Describe the technology environment required by the configuration tools. Describe how client-specific configurations are propagated when product upgrades/updates are installed. Describe how configuration changes are versioned.

N/A VHMS is operated and delivered as a SaaS.

06 Describe the development environment used to customize/configure the product. What tools does the development environment integrate with (e.g., modeling tools, versioning tools).

N/A VHMS is operated and delivered as a SaaS.

07 Describe the development environment’s productivity features (e.g., debugging tools, on-line help, screen painter, group development). Describe the development environment in terms of its ease of learning.

N/A VHMS is operated and delivered as a SaaS.

08 Does your development environment include its own version control features and/or does your development environment integrate with Rational ClearCase.

N/A VHMS is operated and delivered as a SaaS.

Page 93 of 116

Group E TECHNICAL REQUIREMENT

Adaptability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

09 Does your product integrate with testing

tools, specifically Mercury WinRunner and LoadRunner.

N/A VHMS is operated and delivered as a SaaS.

10 Describe how a developer can customize/configure the business logic and user interface of the product. Describe how the developer can integrate new fields and entities into the product’s data, business logic, and user interface tiers.

N/A VHMS is operated and delivered as a SaaS.

11 Describe the customizable/configurable workflow and routing capabilities of the product. Does your workflow engine allow for “localization” (e.g., within different regions).

Yes Configuration is completed in system using provided web-based tools. Configuration is done for entities such as tenants, organizations or employers. Configurations, where applicable, have a publish date in which it becomes visible or actionable to users. The system is integrated with third party translation services that automates text translation.

12 Describe the product’s architecture that provides customization/configuration without impairing the customer’s ability to upgrade to new releases.

Yes All customization/configuration is carried forward for every release.

13 How does "localization" impact core application logic and data schemas?

Yes Core application logic is not impacted by localization. All text is stored in a resource bundle in the database and is translated automatically using third party translation services.

14 Describe your development methodology in regards to enhancing the product to meet the functional requirements. Describe your company’s role in each phase of the software development life cycle. Describe your role in user acceptance, performance and scalability testing.

Yes Viverae uses agile methodologies for all development. Depending on the type of request or part of the system it will be developed using Scrum or KanBan.

VHMS is operated as a SaaS, Viverae will drive all acceptance, performance, and scalability testing.

15 Describe how your product will leverage clinical data.

Yes Viverae’s platform was built clinical first. This includes participant condition self-identification through the HRA, a detailed section within the member portal dedicated to chronic conditions included additional self-reporting options, condition overview and information, and if Disease Management is an elected product, participant facing Condition Specific Care Plans. Viverae’s platform is also utilized by Viverae’s Clinical Team, and they have access to the participants care plan activities, additional RN related actions to suppor the participant. Viverae’s Disease Management program also includes Medical and Rx claims, which enables Viverae’s clinical team to gain insite to the participants level of compliance, or additional conditions not yet reported.

Page 94 of 116

Group F – Integration

Group F TECHNICAL REQUIREMENT

Integration Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Does your product support Lightweight

Directory Access Protocol (LDAP) to facilitate interoperability between applications and systems and facilitate centralized access by distributed applications? If yes, describe in detail how. Include which versions of LDAP are supported?

Yes Viverae supports many different LDAP providers for authentication purposes.

02 Does your product support additional LDAP extensions from other vendors? If yes, explain which extensions and how they are used?

Yes Viverae supports many different LDAP providers for authentication purposes.

03 Does your product provide the tools to manage back-end data stores? If yes, list the tools and describe in detail.

N/A VHMS is operated and delivered as a SaaS.

04 Does your product provide hooks for C, C++, Visual Basic, PERL, JAVA/JAVA Beans, XML, and DSML for development of any of the content management and targeting tools? If yes, list the hooks and the tools and describe them in detail.

N/A VHMS is operated and delivered as a SaaS.

05 Describe the application’s independence from the underlying operating system and server platforms. Which platform do you use for primary development? Describe your schedule for releases on platforms other than your primary development platform.

Yes The application has no dependence on the underlying operating system. Development is done on Windows and MacOS. Production operates on RHEL.

06 Do any of your products contain licensed or borrowed code from another source? If yes, do you continue to use this technology? Describe any enhancements or changes made. Describe any other ways your product may have been influenced by other sources.

Yes Viverae’s system uses some open source code/libraries. Viverae avoids changes to this code if possible, although Viverae has made very minor changes to pieces of it.

07 What tools and solutions will be provided in the event of interoperability problems or problems with other applications?

N/A VHMS is operated and delivered as a SaaS.

Page 95 of 116

Group F TECHNICAL REQUIREMENT

Integration Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

08 Identify the language in which the system

is written. Describe in detail all development tools included.

Yes The bulk of the platform is written in Java with the UI using HTML and Javascript. PHP is also used for certain REST APIs. The development tools are:

Eclipse

GitLab

Perforce

JRebel

Vairous standard editors

09 Does a third party have to be involved to provide the tools or hooks to manage any of your component products? If yes, explain.

No VHMS is proprietary and is owned and managed by Viverae.

10 Describe how your system will integrate seamlessly with legacy, mainframe and web-based systems, and access functionality from other applications. Describe your product’s system integration features in regards to the following questions.

For Tightly Coupled Collaborations: Describe mechanisms for tightly coupled (synchronous) collaborations (API access, use of SOAP, etc.). For API access, include the supported languages. Does the product support application integration using Web Services? Does the product support application integration using XML message / document standards?

For Loosely Coupled Collaborations: Describe mechanisms for loosely coupled (asynchronous) collaborations (use of HL7, EDI X12, use of MQ, use of interface engines, etc.).

Yes VHMS can integrate using many different methods, API’s can be used for tightly coupled collaborations using a specification determined by the third party system. Loosely coupled collaborations can leverage MQ or virtually any type of file that is machine readable which connects into our automated data integration system via SFTP.

11 Describe all interface services and API's offered with your product. Also indicate if they conform to any industry standards.

Partial Viverae is willing to work with KP to build out an API that is mutually beneficially to both KP and Viverae.

12 Does the product suite include an API development tool?

Partial VHMS is operated and delivered as a SaaS. VHMS is operated and delivered as a SaaS.

13 What techniques, standards, tools, products and services does your product use for real-time integration with other application systems? Please describe in detail diagramming where necessary.

N/A VHMS is operated and delivered as a SaaS.

Page 96 of 116

Group F TECHNICAL REQUIREMENT

Integration Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

14 For batch interfaces, what techniques,

standards, tools, products and services does your product use for data extraction, transformation and loading of data between application databases?

Yes The data that Viverae integrates in this context includes:

Census

Claims

Biometrics

Particpation

All of this data is integrated through Viverae’s automated data integration system, the provider of the data sends files which are mapped by Viverae using Pervasive, once an implementation is complete the file feed is configured in the system and promoted to automation. The data is sent on a regular basis to our secure FTP server (GlobalScape), it is swept automatically into a DIMA, processed using a combination of commercial (Pentaho) and internally developed code. After the initial state of the automation which loads the data into staging and runs encryption.

15 Describe the product's ability to synchronize track, and maintain historical data with effective dates, its master data with external (within Kaiser Permanente) systems-of-record (e.g. employee, organization, facility).

Yes All operable constructs such as organization, employee(member), tenant, claims have the notion of eligibility or effective/end dates as applicable. These are modeled after a typical payer construct.

16 Describe the protocols, formats and industry standards used by your system to define templates and their merge fields (e.g. FOP <Formatting Objects Processor>, MSWord .dot files).

N/A VHMS is operated and delivered as a SaaS.

17 Describe the protocols, formats and industry standards used by your system to define the dynamic data (schemas) that can be merged with templates.

N/A VHMS is operated and delivered as a SaaS.

18 Can your system produce MSWord, Excel and PDF form documents from merged templates and dynamic data?

Partial Viverae is willing to discuss with KP requirements needed for MSWord, Exce, and PDF form documents from merged templates and dynamic data.

19 Please describe how your product integrates with MS Outlook.

Partial Viverae can send out calendar invites for event sign-ups. Viverae is willing to discuss with KP requirements for Outlook integration.

20 Please describe how your product integrates with any other SMTP-compliant email service?

N/A VHMS is operated and delivered as a SaaS.

21 Please describe how your product integrates with reporting solutions.

Yes Viverae’s platform can import and export a wide variety of data sets including HRA/Biometric, activity data, etc.

Page 97 of 116

Group F TECHNICAL REQUIREMENT

Integration Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

22 Describe your product’s ability to

integrate with CRM products (e.g., Oracle, PeopleSoft, Siebel, Salesforce.com).

Partial Currently integrated with Microsoft Dynamics internally. The Viverae member portal’s Health Coach, Member Support/ Outreach, and Clinical views offer the back participant support required to effectively outreach to participants.

External integrations would be built on the required set of APIs. Would need to scope to understand the need.

Page 98 of 116

Group G – Managability

Group G TECHNICAL REQUIREMENT

Managability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe your system’s monitoring and

reporting capabilities. Yes The portal tracks all forms of engagement and participation,

Viverae has the ability to effectively track all member activity including, but not limited to the following:

Health challenge program logging, tracking and reporting for individual or team competitions

Preventive care compliance

Website utilization

Secure messaging

Goal setting

Outbound calls

Inbound calls

Webinar participation

Coaching sessions

Targeted programs completion

HRA completion

Screening completion

Supplemental questionnaires completed

Viverae offers Customers extensive reports that allow them to gather insight on their employee populations, track improvements, understand incentive success and review metrics surrounding engagement through a combination of aggregate reports across all of its programs, many of which are available in real-time. An incentive report can be generated on a predetermined schedule mutually agreed upon by the Customer.

The Employer Portal homepage includes various types of aggregate statistics available at the click of a button, daily via Metrics on Demand. These statistics regarding the current member population include demographic information, participation statistics as well as many other types of information most commonly requested by Customers through custom reports. Viverae tracks all member activity including, but not limited to, website utilization, secure messaging, goal setting, outbound calls, inbound calls, and program participation.

Page 99 of 116

Group G TECHNICAL REQUIREMENT

Managability Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

02 Is your product capable of being

monitored by Tivoli Event Adapters and Tivoli Distributed Monitors? What additional / native capabilities, tools, features have been built with the product to enhance Kaiser Permanente's abilities to manage/monitor the product's systems operations?

N/A VHMS is operated as a SaaS and Viverae is responsible for managing and monitoring systems operations.

03 Describe in detail how your product will meet appropriate Disaster Recovery/Business Resumption plan requirements, which will address continued operation of certificate revocation services within 48 hours of the unanticipated emergency.

Yes Viverae has a comprehensive Business Continuity Management plan that includes an extremely robust datacenter, Rackspace in TX. In addition, data are replicated to another Rackspace datacenter in Virginia. Plus, data are backed up daily and stored offsite at Iron Mountain. Data restoration tests are conducted twice annually to ensure validity of the backup. Restoration of the TX Datacenter at another Rackspace location is projected to be less than 48 hours.

04 Does your product provide a suite of system management reporting tools? If yes, list the suite of system management reporting tools that are provided and describe in detail how each tool works.

N/A VHMS is operated as a SaaS and Viverae is responsible for managing and monitoring systems operations.

05 Does your product provide a suite of statistical reporting tools? If yes, list the suite of statistical reporting tools that are provided and describe in detail how each tool works.

N/A VHMS is operated as a SaaS and Viverae is responsible for managing and monitoring systems operations.

06 Is Systems Administrator access to the product permitted through a Web Browser or does it require "client" software to be installed on dedicated workstations?

Yes Kaiser’s System Administrator access is done through the Viverae Employer Portal via the internet. No “Customer” software is installed on dedicated workstations.

07 Please describe the tools, technologies and procedures to be used by KP National Operations (NOPS) in the operation of your proposed system.

N/A VHMS is operated as a SaaS and Viverae is responsible for managing and monitoring systems operations.

Page 100 of 116

Group H – Data Quality

Group H TECHNICAL REQUIREMENT

Data Quality Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe how your system can prevent

unintended and unauthorized modification to business data and program code.

Yes Users (internal) and participants (external) are controlled through a role based hierarchy that defines the roles users may possess. This is based on least privilege.

02 Does your product include mechanisms for ensuring the integrity of data within the repository? Explain.

Yes All the data that is received and processed goes through a set of business rules and validation before it’s updated in the production system.

03 Does your product include mechanisms to prevent data corruption, inaccuracy and loss? If yes, list the mechanisms and describe in detail how they prevent data corruption and loss.

Yes Viverae system go through periodic auditing, cross-referencing and validating to ensure that quality is maintained. There are predefined user roles set for data activities which eliminates inaccuracy in data entry.

Confirmity and integrity checks along with reasonablesness DQ checks are being followed and mainted by Data Analysts and Architects within the organization.

Page 101 of 116

Group I – User Interface (UI)

Group I TECHNICAL REQUIREMENT

User Interface Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe how the user interface permits

attachment of files of any format during data entry.

Yes Viverae member portal provides participants the ability to upload a form for data entry processing for certain member activities sich as Preventive Care Vallidation and Physician Lab Form. This proess includes options for the client to accept the form as self-reported and auto-validated as well as validated by the client (non-PHI such as a Healthy Event).

02 Please provide examples of forms (screens) included as a standard capability in the proposed system.

Yes Attachments:

Pregnant Member Physician Form

Standard Physician Form

Program Alternative Waiver

03 Please describe the GUI Client used by this system, what level of maintenance is required and how that maintenance is applied.

N/A In its entirety VHMS is delivered through a WUI.

04 Please describe the WUI capabilities of the proposed system. If the WUI forms/screens are not 100% functionally compatible with the GUI forms/screens, please describe where differences may exist and why.

N/A In its entirety VHMS is delivered through a WUI.

05 Please describe the flexibility available at the local level to create and/or enhance forms/screens and what tool(s) is used to provide that flexibility.

N/A VHMS is operated and delivered as a SaaS.

Page 102 of 116

Group J – Implementation

Group J TECHNICAL REQUIREMENT

Implementation Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe the assumptions your company

would make regarding the time involved with a typical implementation of Kaiser Permanente’s size and complexity.

Yes Assumptions for KP implementation:

KP support models for products are known and documented

KP support resources are hired and available for training

Resources are available when required

File formats are known and documented

Report requirements are known and documented

Customer program designs are known and documented

Training locations and resources are available

KP and KP third party systems are documented and integration capabilities defined

02 What assumptions are you making about the key roles, responsibilities, and staff of Kaiser Permanente?

Yes Viverae’s assumption is that KP will be providing Tier 1 customer and member support, with Viverae supporting KP’s usage of the Viverae platform. As such, we envision KP would provide direct administrative Implementation and ongoing Client Support, and direct Member support. KP would need to determine appropriate tier 1 service levels to develop staffing ratios. Viverae would be happy to share best practices within our own direct to employer model to partner with KP to ensure overall success.

03 Would you subcontract some or all of the implementation?

No Viverae would not subcontract any of the implementation process.

04 Do you provide a sample test suite or suggested guidelines that we should follow when testing your product?

Yes Viverae can provide environements to enable KP to show/demo the system to Customers as well as see a “preview” of an individual client’s design build.

05 Describe your QA process including unit, integration, volume, load, regression, user acceptance testing.

Yes Given that Viverae is a SaaS model, the QA process would run through a User Acceptance Testing prior to implementing the client.

06 What’s the total number of implementations you have done with your product/s in the last 12 months?

Yes Viverae has completed 89 implementations within the last 12 months.

Page 103 of 116

Group J TECHNICAL REQUIREMENT

Implementation Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

07 Please describe the systems,

environments, and internal resources in place to support concurrent customer programs and product releases/ enhancements simultaneously. Please describe your operating procedures and priority scales during such concurrent implementations and measures taken to avoid or mitigate down time, system errors or crashes.

N/A VHMS is operated and delivered as a SaaS.

08 Please describe the impact to resources and your system(s) when launching concurrent customer programs and product releases/enhancements simultaneously. What measures do you take to avoid or mitigate down time, system errors or crashes?

N/A VHMS is operated and delivered as a SaaS.

09 What is your project methodology approach?

Yes Viverae follows all of the artifacts in the SDLC. Agile methodology is being followed for Software Development. For operational enhancements KanBan is followed. Certain projects with set timeline follow the traditional waterfall methodology.

10 How would you ramp resources at the beginning, mid-way and towards the end of implementation?

Yes Viverae uses a resource management tool based on client needs and project size to ramp up and down resources. The project plan is shared with the client during implementation.

11 What is the minimum skill-set of Kaiser Permanente employees needed for implementation? Give your best estimate of the number and types of personnel needed to successfully implement (i.e. on time, within well-planned budget parameters) your system.

Yes The minimum skill set for KP employees implementing Viverae’s system would be 2-3 years customer service or implementation experience with benefits, HR, or related software user experience. Personnel required for Implementation (estimate):

• 1 Project Leader

• 5-10 Customer Service/Implementation Support personnel to build the client configurations in the Viverae system

• 1-2 Business Analysts to define KP specific customer workflows and process flows

• 2-3 Data integration engineers to support and build data maps, feeds, and integrations

12 Would staff be local? If not what geographies?

Yes The Implementation Team is based at Viverae’s headquarters in Dallas, Texas.

13 How would knowledge be transferred? Yes Viverae uses a number of internal systems where all client information is housed and accessible by any support staff.

14 Who is responsible for documenting modifications and customizations?

Yes The Viverae Implementation Team is responsible for documenting modifications and customizations.

Page 104 of 116

Group J TECHNICAL REQUIREMENT

Implementation Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

15 Provide professional service

descriptions, including the number of years of experience of the staff proposed for implementation.

Yes Viverae’s Implementation Team works cooperatively internally and externally to design and launch client wellness programs on time and within scope.

The Implementation Specialist will provide consistent hands-on oversight of the implementation process and will work closely with KP’s team, Viverae internal resources, third-party vendors, and health plan providers as necessary to launch the program. This dedicated specialist will specifically manage the coordination of initial data imports, screening plan design, customization of program components, incentive design and reporting, program compliance with Viverae’s in house counsel and multiple other items to help take the work load off of the Kaiser’s wellness team.

16 Give your best estimate of the numbers and type of personnel required for support of the product, following implementation.

Yes Viverae’s assumption is that KP will be providing Tier 1 customer and member support, with Viverae supporting KP’s usage of the Viverae platform. As such, we envision KP would provide direct administrative Implementation and ongoing Client Support, and direct Member support. KP would need to determine appropriate tier 1 service levels to develop staffing ratios. Viverae would be happy to share best practices within our own direct to employer model to partner with KP to ensure overall success.

Page 105 of 116

Group J TECHNICAL REQUIREMENT

Implementation Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

17 Do you have an implementation plan

template that lists necessary tasks with their dependencies? If yes, please provide sample.

Yes Viverae will work with KP in three phases:

1. Architect

2. Deliver

3. Enhance

Architect

Bring together project team and kickoff implementation project

Business process modeling

Outline project and milestones

Align roles and responsibilities

Data Integration Planning

Report & File Feed Inventory

Deliver

Build

o Configuration

o Product Enhancements

o Deployment of reports and data integration

o Support and operations process implementation

Validate

o Full data integration validation

o End to end system validation

o Training and process validation

o User Acceptance Testing

Deploy

o End user training

o Go live support

Enhance

Continuous Improvement

Page 106 of 116

Group K – Deployment

Group K TECHNICAL REQUIREMENT

Deployment Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe what constitutes a single

deployment instance of the product. N/A VHMS is operated and delivered as a SaaS.

02 Describe your approach for deploying multiple instances of the product, indicating techniques for coordination/collaboration between instances.

N/A VHMS is operated and delivered as a SaaS.

03 Given Kaiser Permanente’s operating environment, describe your recommended deployment strategy.

N/A VHMS is operated and delivered as a SaaS.

Page 107 of 116

Group L – Release Management

Group L TECHNICAL REQUIREMENT

Release Management Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 How do you differentiate between an

upgrade release and the release of a new product?

N/A VHMS is operated and delivered as a SaaS.

02 Discuss the approach to manage product releases for upgrades/updates. How often? Impact on system? Software changes, data model changes, etc.

N/A VHMS is operated and delivered as a SaaS.

03 Specify the code generation and deployment methodology/process to development, QA, and production environments.

N/A VHMS is operated and delivered as a SaaS.

04 Specify the database and deployment methodology/process to development, QA, and production environments.

N/A VHMS is operated and delivered as a SaaS.

05 Specify the process your company follows in advance of discontinuing support of a version so as to migrate to a version you continue to support.

N/A VHMS is produced and delivered as a SaaS.

Page 108 of 116

Group M – Training

Group M TECHNICAL REQUIREMENT

Training Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Describe in detail the different training

levels and requirements for end users , administrators, developers, and technical operations staff and the number of Kaiser Permanente staff expected to attend.

Yes Viverae has an internal operational training needs matrix similar to an impact assessment. As part of all training needs are being assessed, Viverae works with all business units to recommend best approach for training. There are four levels for training for Viverae internal support today: Global, Client Specific, Operational Enhancements, and Internal Program Only. As part of this matrix, Viverae also determines the effort behind the training support that is needed, which includes a communication strategy. Viverae success is strongly rooted with the Train-the-Trainer model when multiple layers of training is needed.

Viverae’s training approach for KP can include multiple tiers allowing training to be appropriate in breadth and depth for various stakeholders and support groups. Viverae can support webinar-based and in-person training as well as train-the-trainer where appropriate to scale. Viverae will work with KP to build the appropriate agenda and format. Viverae can be flexible to support multi-location and various levels staff attendance.

02 Provide a listing of the training and training locations.

Yes Viverae provides a Viverae University classroom style facility in the Dallas Headquarters. Viverae will work with KP to determine other location needs based on the training strategy to be developed.

Viverae University training is cataloged in one of four ways: Platforms, Products, Process/Policies, and Enrichment courses. Viverae courses can be delivered in the traditional instructor led session, e-courses for self-paced learning (if applicable), How To snippets, and on-the-job-training with shadowing when better suited for the topic or content needing to be delivered. Viverae has the capability to conduct remote training on qualified material via Go-to-Training.

Page 109 of 116

Group M TECHNICAL REQUIREMENT

Training Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

03 Describe in detail a preferred method of

knowledge transfer. Are there other methods available from your company? How do you measure the success of your knowledge transfer effort? Can you provide references specific to successful knowledge transfer? Provide separate answers to these questions for end users, administrators, developers, and technical operations staff.

Yes A preferred method of knowledge transfer for end- users is shadowing with hands- on application. Viverae relys on internal SME’s (Subject Matter Experts), while leveraging an Operational Playbook that contains Service Deliver Owners, Process/Policies, Best Practices, Training Material, and Training Owners. Viveae follows Kirkpatrick’s evaluation model focusing on level 2 and 3 as a key measure of success with all training and knowledge transfer. Viverae can distribute surveys and quizzes within its CRM application platform and track all student records. With regards to the style for which we measure specifically can be broken down to two categories: Process and Technical training, and General Knowledge and System Navigation. An assessment quiz can be delivered in phases and/or post training for technical and process related training. Mock scenarios are better suited for our general knowledge and systems training when applicable.

04 What type of training product/s documentation do you provide? Provide samples of your system documentation.

Yes Viverae provides an online technical documentation resource for system and product documentation. Additionally, Viverae maintains a playbook, which allows to document all training material such as PowerPoint Overviews, Internal and External FAQs, Reference Guides, Visual Handouts (when applicable), Process Documents, Workflows, and Worksheets.

SCREENSHOTS PROVIDED: 3.9 Group M 04

Page 110 of 116

Group N – Support

Group N TECHNICAL REQUIREMENT

Support Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

01 Please describe what maintenance is

included with the price included in this proposal. This description should include a Service Level Agreement (SLA) and an attendant escalation process in support of that SLA. Indicate if your technical support and maintenance includes access to your knowledge database.

Yes As Viverae is a SaaS platform, all maintenance is included in the monthly fees. As referenced earlier in 3.8 Group E, section 8, Viverae will work with KP to develop specific system and reporting SLA’s based on KP requests.

02 What are the hours of coverage for technical support? If less than 24x7, can coverage be upgraded? Describe.

Yes 7 a.m. – 7 p.m. CT. Viverae will work with KP on expanding the support hours based on scope and requirements.

03 Define your severity levels and indicate the target response times and supplier restoration actions to customer issues by severity level.

Yes Critical – First Response Time – 30 mins

High – First Response Time – 1 -4 hrs

Medium – First Response Time – 1 business day

Low – First Response Time – 1 – 3 business days

(see attachment – Technical Issue Response Details for exmaples of severity levels and restoration actions)

04 Provide a flow chart and describe your problem escalation procedure. Would you provide a single point of contact for technical and product support?

Yes Viverae will be utilizing a ticketing system for Technical Support Issues. ( See attachment Support Issue Notification Process for flow chart).

05 What is your current product version? How long has it been in production?

N/A VHMS is operated and delivered as a SaaS.

06 Do you have a regular release schedule? If yes, provide it. How often do you meet your scheduled release dates?

Yes As a SaaS solution, we strive for 2-4 major feature releases per year enabled Viverae to iteratively release new features regularly with high quality using Agile methodology. Scope is managed appropriately to achieve target release dates. KanBan is used for unplanned work so not to disrupt planned releases.

07 How many releases back do you provide support under maintenance, stated as both the number of releases and time (number of months, for example, 18 months)?

N/A VHMS is operated and delivered as a SaaS.

Page 111 of 116

Group N TECHNICAL REQUIREMENT

Support Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

08 When will the next version of your

product be released? What new functionality will the next version offer? What are the differences between the current product version and the upcoming version?

Yes The next planned major release is March, 2016 which will include the following:

Refreshed UX for member registration, onboarding and profile building

Refreshed member portal UX across all pages (header, footer and background)

Provide partricipants a biometric tracking tool to encourage sustained health improvement, while allowing Customers to maintain year-over-year reporting on health risk factors

Challenges will provide the ability to tier program incentive levels based on activity goals/levels reached by the member.

Iterative development of Viverae’s social engagement based on Viverae usability studies and client feedback

Administration hierarchy to allow restricted access and views based on organizational filters (location, departments)

DM Expansion to include 22 qualifying and supported chronic conditions and UX update to the participants My Care page.

09 Describe current system limitations; include known defects and a completion timeframe for resolution.

Yes Defects found in the release cycle are typically resolved within the same release cycle’s hardening period. Production issues and worked as received through KanBan and scheduled for the next release. It is Viverae’s goal to not carryforward known defects across releases. Viverae’s SaaS model allows Viverae to achieve this.

10 How are enhancement requests handled and priorities established?

Yes Enhancement requests are submitted through Viverae’s Product team, and evaluated based on the client requesting, size, scope and difficulty of the request, strategtic alignment of the request and benefit to the participant or customer.

11 How are updates, enhancements, and bug fixes provided? How are your customers notified of the updates, enhancements, and bug fixes? Describe in detail.

Yes Viverae utilizes normal maintenance windows (Saturdays 12:00am to 2:00am) for routine defect resolution. Defects are typically resolved with only an internal communication. Viverae CRMs are responsible to follow up with affected Customers when specific to their program/experience.

Prior to issuing new or changed product functionality that impacts customers, Viverae executes a communications chain to inform all necessary parties.

A specific communication/notification plan will be created to support KP, especially regarding KP specific development work.

Page 112 of 116

Group N TECHNICAL REQUIREMENT

Support Yes/No/Partial

NARRATIVE RESPONSE DEVIATIONS

ENHANCEMENTS SYSTEMS MODIFICATION

12 Are updates, enhancements, and bug

fixes covered under maintenance? Partial As Viverae is a SaaS platform, all updates, enhancements, and

bug fixes are included in the monthly fees.

13 From a release management perspective, describe how customizations are retained when clients migrate to new versions of your product.

Yes The portal is hosted by Viverae. All migrations to new versions are maintained and managed by Viverae.

14 Would you provide source code for the customizations? If not, would you support under maintenance? Royalty free?

N/A VHMS is operated and delivered as a SaaS.

15 Would you agree to not market customizations in the health care vertical for a mutually agreed upon time period?

Yes Viverae would agree to not market our direct to employer solutions to Kaiser customers for the length of our agreement.

16 Specify the process your company follows in advance of discontinuing support of a version so as to migrate to a version you continue to support.

N/A VHMS is operated and delivered as a SaaS.

17 Indicate your product warranty. Is it the same as maintenance?

N/A VHMS is operated and delivered as a SaaS.

18 Does your company have a user group? If yes, describe your company’s direct participation with this group. Provide specific examples of how customer feedback has impacted product enhancements.

Yes Viverae has a Medical Advisory Board who provides clinical insite, thought leadership and guidance related to the delivery of Viverae’s product to participants, a Client Advisory Board providing direct product feedback related to their respective industries and participant needs, and UX testing for major product releases to better understand how the participant is utilizing the system in the expected or unexpected ways.

Viverae’s Client Advisory Board has provided significant guidance related to the release and roll out of Viverae’s enhanced participant dashboard. Client Advisory Board reviewed dashboard comps and unanimously voted on the current version in place today.

19 Are there any third party vendors available to provide additional support for the product? Identify them.

Yes Viverae works with rewards vendors and screening vendors.

Page 113 of 116

20 Describe in detail your company’s 1 year, 3 year, and 5 year plan for product(s).

Yes In simplifying how our clients understand their programs, Viverae’s goal is to continue to bridge the gap between data and understanding through effective member engagement solutions. Our strategy for partnering with the payer market enables us to provide services that achieve total population health management.

In 2014, Viverae acquired OneHealth, which allowed us to fully integrate social technology into the MyViverae platform. In 2015, Viverae leveraged this technology, releasing its integrated social engagement network, Community. Unlike other online social capabilities, Community offers two different and proven engagement strategies. Participants can build a private team of trusted peers for long term support, or they can join public challenges with different groups.

Starting with the launch of affinity groups in Year Two, participants will be able to anonymously connect with other like-minded users outside of their employer group around activity, nutrition or other health related interests. No social engagement is complete without including those who participants value most - family. In year three, family support provides a dedicated digital resource to help connect participants with their family in a healthy and fun way, and tied with social, these elements are scientifically validated engagement drivers.

Viverae’s five year strategic vision encompasses true total well-being. Behavioral health is the underlying barrier to engaging in self-care. Anonymous support groups will allow participants with challenging conditions to connect with those also facing the same challenges, eliminating the sense of isolation and frustration often felt. Through digital peer-to-peer support, Viverae extends traditional health coaching and disease management while also providing visibility to personalized care plans that are not only accessible to nurses, but also to participants themselves, achieving the goal of true total population health management.

Viverae not only meets members where they are in their health, but also in the way they want to be engaged. We understand there’s no one-size-fits-all for the member experience or the approach to engagement. By making the member experience personalized and contextual, we will communicate to them in the ways they want. Because the member experience has to evolve, we have to meet them where they are today by leveraging what we learn about the member through our logic-based model.

Page 114 of 116

Page 115 of 116

3.10 Price Proposal

Provide a detailed 3-year cost proposal based on the requirements of this RFP. Cost of services should be itemized, not presented as single line-item figures.

The attached template provided should be used as a guide for your price proposal and may include but should not be limited to the line items shown. Year one pricing may include setup and configuration costs that may not apply in subsequent years.

RFP Pricing

Template.xlsx

3.10.1 Pricing Considerations

Your proposal solution should separately state (itemize) and include any of the following applicable costs and any other costs associated with supporting the requirements.

Pricing should assume approximately 1.5 million eligible participants and 470 customers for the portal and data options combined in year one

Pricing should include any charges associated with supporting the three product options 1) Data (individual-level report extracts) 2) portal plus data and 3) bulk gift cards

Include the following as appropriate:

Detail all assumptions made in your pricing proposal

Implementation and transition costs

Migration costs associated with migrating users (e.g., data) from the legacy to your system

Third party services or license fees

Fulfillment costs for reward fulfillment and support

Data integration fees

Customization fees

Communication fees (e.g. email, text messaging)

Hourly billing rates and/or unit costs for services that might be provided for the duration of the contract

All necessary software modules, including any third party software or plug-ins that KP must have to use the hosted solution

Training. Indicate the costs and class size for both on-site and off-site classes and if any training discounts apply.

Maintenance. Indicate any and all maintenance costs within your price proposal.

If you are providing any blended volume rates, please describe with individual rates and include this information as a rate card

Travel and expense rates

Include all subscription fees inclusive of support (including updates and upgrades), hardware components used to provide the services and initial set-up fees

Indicate any prompt payment discount or any other discount available for accelerated payment. (Please include your response in Tab 2 of the attached pricing template.)

Regardless of volume, any software or implementation pricing, warranties, benefits and terms reflected in this RFP should be furnished at no less favorable pricing your firm quotes to its most favored customer. Will your firm agree to a "most favored customer" provision in an Agreement, warranting that the total price offered to KP for products and services provided in your proposal response are at most favorable pricing or terms? If not, why not? (Please include your response in Tab 2 of the attached pricing template.)

Page 116 of 116

3.11 Cloud Services Agreement

If you are awarded a contract you will be required to sign a Kaiser Permanente IT (KPIT) Cloud Serivces Agreement. Attached for your review is a copy of this agreement. Bidders must identify any terms and conditions that Vendor cannot accept by providing a mark-up (red-line) of the attached agreement. Any such changes must be returned to KP along with your proposal. Please note that any changes to the agreement are strongly discouraged.

969223v1KPIT_Clou

d_Services_Agreement.docx

3.12 Vendor Security Controls Assessment Questionnaire

In order for Kaiser Permanente to assess vendor security, bidders will complete the attached Vendor Security Controls Assessment Questionnaire. Additionally, successful completion of a security review, including testing, by KP’s IT security group will be required prior to contract award. If you have already completed this questionnaire, you are not required to resubmit it.

KP_Vendor Security

Controls Assessments Questionnaire_ver2.2.xlsx

Year 1 Year 2 Year 3 NotesBaseline Costs Lives Provide an itemized breakdown of costs. Detail any assumptions.

Employer Portal Solution First 100,000 300,000.00$ 300,000.00$ 300,000.00$ Employer groups @ 1st 100k lives billed annual pmpm at $.25. KP provides Tier 1 support. KP sources client & manages billing process. Viverae manages implementation and ongoing account mgmt. Configuration for content and communications included.

Next 400,000 720,000.00$ 720,000.00$ 720,000.00$ Employer groups @ next 400k lives billed annual pmpm at $.20. KP provides Tier 1 support. KP sources client & manages billing process. Viverae manages implementation and ongoing account mgmt. Configuration for content and communications included.

-$ -$ -$ See detail price table on 'Addtl questions tab' for high lives volumeData Aggregation Solution First 750,000 1,620,000.00$ 1,620,000.00$ 1,620,000.00$ Viverae providing data aggregation reporting, incentive qualification reporting, file feed management and health outcome reporting

Next 750,000 1,260,000.00$ 1,260,000.00$ 1,260,000.00$ -$ -$ -$

Total 2,000,000 3,900,000.00$ 3,900,000.00$ 3,900,000.00$

Start-up Costs:

Viverae/KP Partnership Project Build 285,000.00$ -$ -$ Project management, process development, data integration, file feed set up, systems integration, product enhancements, data validation and UAT, team training. Fees for additional product development for partnership after year 1 to be scoped

-$ -$ -$ -$ -$ -$ -$ -$ -$ -$ -$ -$

Total 285,000.00$ -$ -$

Total Baseline & Start-up Costs 4,185,000.00$ 3,900,000.00$ 3,900,000.00$

Customer Specific Costs: Identify any additional customer specific costs such as charges for bulk gift card orders, reports, etc. One Time Implementation Cost per Client tbd/volume -$ -$ $3,500/clientSoftware Development tbd -$ -$ Fees may apply for custom software development per individual client @ $250/hr.Fulfillment and Gift Card Options tbd Fee schedule available per client engagement

Question Response

1 Indicate any prompt payment discount or any other discount available for accelerated payment.

tbd

2

Regardless of volume, any software or implementation pricing, warranties, benefits and terms reflected in this RFP should be furnished at no less favorable pricing your firm quotes to its most favored customer. Will your firm agree to a "most favored customer" provision in an Agreement, warranting that the total price offered to KP for products and services provided in your proposal response are at most favorable pricing or terms? If not, why not?

Yes

PMPM Lives Employer Portal Solution Support Level0-100k 0.25$ KP Tier 1 Support

100-500k 0.20$ KP Tier 1 Support500-1M 0.15$ KP Tier 1 Support

1M+ 0.10$ KP Tier 1 Support

Lives Data Aggregation Solution PMPM 0-750k 0.18$ KP Tier 1 Support

750-1.5M 0.14$ KP Tier 1 Support1.5-3M 0.12$ KP Tier 1 Support

3M+ 0.08$ KP Tier 1 SupportLives Full Service

PMPM 0-100k 1.25$ Viverae Full Service100-250k 0.95$ Viverae Full Service

250k+ 0.75$ Viverae Full Service

Detail on Price Table