This subpart prescribes part of the conditions under which the Department of Health and Human Services will approve the Federal Financial Participation (FFP) at the applicable rates for the costs of automated data processing incurred under an approved State plan for titles IV-B, IV-D, IV-E, XIX or XXI of the Social Security Act. The conditions of approval of this subpart add to the statutory and regulatory requirements for acquisition of Automated Data Processing (ADP) equipment and services under the specified titles of the Social Security Act.

As used in this part, the term:

Acceptance documents means a record of satisfactory completion of an approved phase of work or contract, and acceptance thereof by the State agency.

Acquisition means acquiring ADP equipment or services from commercial sources or from State or local government resources.

Acquisition Checklist means the standard Department checklist that States can submit to meet prior written approval requirements instead of submitting the actual Request for Proposal (RFP), contracts or contract amendments. The Acquisition Checklist allows States to self-certify that their acquisition documents, which include RFPs, contracts, contract amendments or similar documents, meet State and Federal procurement requirements, contain appropriate language about software ownership and licensing rights in compliance with § 95.617, and provide access to documentation in compliance with § 95.615.

Advance Planning Document (APD), Initial advance automated data processing planning or Initial APD means a recorded plan of action to request funding approval for a project which will require the use of ADP service or equipment. The term APD refers to a Planning APD, or to a planning and/or development and implementation action document, i.e., Implementation APD, or to an Advance Planning Document Update. Requirements are detailed in § 95.610, paragraphs (a), (b), and (c).

Advance Planning Document Update (APDU) is a document or record submitted annually (Annual APDU) to report project status and/or post implementation cost-savings, or, on an as-needed (As-Needed APDU) basis, to request funding approval for project continuation when significant project changes are anticipated; for incremental funding authority and project continuation when approval is being granted by phase; or to provide detailed information on project and/or budget activities as specified in § 95.610(c).

Alternative approach to APD requirements means that the State has developed an APD that does not meet all conditions for APD approval in § 95.610, resulting in the need for a waiver under § 95.627(a).

Automated data processing or ADP means data processing performed by a system of electronic or electrical machines so interconnected and interacting as to minimize the need for human assistance or intervention.

Automated data processing equipment or ADP equipment or Hardware means automatic equipment that accepts and stores data, performs calculations and other processing steps, and produces information. This includes:

(a) Electronic digital computers;

(b) Peripheral or auxiliary equipment used in support of electronic computers;

(c) Data transmission or communications equipment, and

(d) Data input equipment.

Automatic Data Processing Services or ADP Services means:

(a) Services to operate ADP equipment, either by agency, or by State or local organizations other than the State agency; and/or

(b) Services provided by private sources or by employees of the State agency or by State and local organizations other than the State agency to perform such tasks as feasibility studies, system studies, system design efforts, development of system specifications, system analysis, programming, system conversion and system implementation and include, for example, the following:

(1) Systems Training,

(2) Systems Development,

(3) Site Preparation,

(4) Data Entry, and

(5) Personal services related to automated systems development and operations that are specifically identified as part of a Planning ADP or Implementation ADP. As an example, a personal service would be the service of an expert individual to provide advice on the use of ADP software or hardware in developing a State automated management information system.

Base contract means the initial contractual activity, including all option years, allowed during a defined unit of time, for example, 2 years. The base contract includes option years but does not include amendments.

Commercial-off-the-shelf (COTS) software means proprietary software products that are ready-made and available for sale to the general public at established catalog or market prices.

Data processing means the preparation of source media containing data or basic elements of information and the use of such source media according to precise rules or procedures to accomplish such operations as classifying, sorting, calculating, summarizing, recording and transmitting.

Department means the Department of Health and Human Service.

Design or system design means a combination of narrative and diagrams describing the structure of a new or more efficient automatic data processing system. This includes the use of hardware to the extent necessary for the design phase.

Development means the definition of system requirements, detailing of system and program specifications, programming and testing. This includes the use of hardware to the extent necessary for the development phase.

Emergency situation is defined as a situation where:

(a) A State can demonstrate to the Department an immediate need to acquire ADP equipment or services in order to continue the operation of one or more of the Social Security Act programs covered by Subpart F, and

(b) The State can clearly document that the need could not have been anticipated or planned for and the State was prevented from following the prior approval requirements of § 95.611.

Enhanced matching rate means the higher than regular rate of FFP authorized by Title IV-D, IV-E, and XIX of the Social Security Act for acquisition of services and equipment that conform to specific requirements designed to improve administration of the Child Support Enforcement, Foster Care and Adoption Assistance, and Medicaid programs.

Enhancement means modifications which change the functions of software and hardware beyond their original purposes, not just to correct errors or deficiencies which may have been present in the software or hardware, or to improve the operational performance of the software or hardware.

Feasibility study means a preliminary study to determine whether it is sufficiently probable that effective and efficient use of ADP equipment or systems can be made to warrant a substantial investment of staff, time, and money being requested and whether the plan is capable of being accomplished successfully.

Federal program office means the Federal program office within the Department that is authorized to approve requests for the acquisition of ADP equipment or ADP services. The Federal program offices within the Administration for Children and Families (ACF) are the Children's Bureau for titles IV-B (child welfare services) and IV-E (foster care and adoption assistance), the Office of Child Support Enforcement for title IV-D (child support enforcement), and the Centers for Medicare & Medicaid Services (CMS) for titles XIX (Medicaid) and XXI (the Children's Health Insurance Program) of the Social Security Act.

FFP means Federal financial participation.

Functional Requirements Specification is defined as an initial definition of the proposed system, which documents the goals, objectives, user or programmatic requirements, management requirements, the operating environment, and the proposed design methodology, e.g., centralized or distributed. This document details what the new system and or hardware should do, not how it is to do it. The Specifications document shall be based upon a clear and accurate description of the functional requirements for the project, and shall not, in competitive procurements, lead to requirements which unduly restrict competition. The Specification document is the user's definition of the requirements the system must meet.

General Systems Design means a combination of narrative and graphic description of the generic architecture of a system as opposed to the detailed architecture of the system. A general systems design would include a systems diagram and narrative identifying overall logic flow and systems functions; a description of equipment needed (including processing data transmission and storage requirements); a description of other resource requirements which will be necessary to operate the system; a description of system performance requirements; and a description of the physical and organizational environment in which the system will operate including how the system will function within that environment (e.g. how workers will interface with the system).

Grantee means an organization receiving financial assistance directly from an HHS awarding agency to carry out a project or program.

Independent Verification and Validation—(IV&V) means a well-defined standard process for examining the organizational, management, and technical aspects of a project to determine the effort's adherence to industry standards and best practices, to identify risks, and make recommendations for remediation, where appropriate.

Implementation APD means a recorded plan of action to request Federal Financial Participation (FFP) in the costs of designing, developing, and implementing the system.

Independent Verification and Validation—(IV&V) means a well-defined standard process for examining the organizational, management, and technical aspects of a project to determine the effort's adherence to industry standards and best practices, to identify risks, and make recommendations for remediation, where appropriate.

Installation means the integrated testing of programs and subsystems, system conversion, and turnover to operation status. This includes the use of hardware to the extent necessary for the installation phase.

Medicaid Management Information System (MMIS) is a commonly accepted term for Mechanized Claim Processing and Information Retrieval System as provided by Section 1903(a)(3) and 1903(r) of the Social Security Act and at 42 CFR 433.110 et seq.

Noncompetitive means solicitation of a proposal from only one source, or after solicitation of a number of sources, negotiation with selected sources based on a finding that competition is inadequate.

Operational APD—An operational APD is a record of no more than two pages to be submitted annually by State programs whose system is not in development. The Operational APD provides a short summary of the activities, method of acquisition, and annual budget for operations and software maintenance.

Operation means the automated processing of data used in the administration of State plans for titles I, IV-A, IV-B, IV-D, IV-E, X, XIV, XVI(AABD), XIX, and XXI of the Social Security Act. Operation includes the use of supplies, software, hardware, and personnel directly associated with the functioning of the mechanized system. See 45 CFR 205.38 and 307.10 for specific requirements for titles IV-A and IV-D, and 42 CFR 433.112 and 42 CFR 433.113 for specific requirements for title XIX.

Project means a defined set of information technology related tasks, undertaken by the State to improve the efficiency, economy and effectiveness of administration and/or operation of one or more of its human services programs. For example, a State may undertake a comprehensive, integrated initiative in support of its Child Support, Child Welfare and Medicaid program's intake, eligibility and case management functions. A project may also be a less comprehensive activity such as office automation, enhancements to an existing system or an upgrade of computer hardware.

Regular matching rate means the normal rate of FFP authorized by titles IV-A, IV-B, IV-D, IV-E, X, XIV, XVI(AABD), XIX, and XXI of the Social Security Act for State and local agency administration of programs authorized by those titles.

Requirements Analysis means determining and documenting the information needs and the functional and technical requirements the proposed computerized system must meet.

Service agreement means the document signed by the State or local agency and the State or local Central Data Processing facility whenever the latter provides data processing services to the former and:

(a) Identifies those ADP services the Central Data Processing facility will provide;

(b) Includes, preferably as an amendable attachment, a schedule of charges for each identified ADP service, and a certification that these charges apply equally to all users;

(c) Includes a description of the method(s) of accounting for the services rendered under the agreement and computing services charges;

(d) Includes assurances that services provided will be timely and satisfactory; preferably through a service level agreement;

(e) Includes assurances that information in the computer system as well as access, use and disposal of ADP data will be safeguarded in accordance with provisions of all applicable federal statutes and regulations, including §§ 205.50 and 307.13;

(f) Requires the provider to obtain prior approval pursuant to § 95.611(a) from the Department for ADP equipment and ADP services that are acquired from commercial sources primarily to support the titles covered by this subpart and requires the provider to comply with § 95.613 for procurements related to the service agreement. ADP equipment and services are considered to be primarily acquired to support the titles covered by this subpart when the human service programs may reasonably be expected to either: be billed for more than 50 percent of the total charges made to all users of the ADP equipment and services during the time period covered by the service agreement, or directly charged for the total cost of the purchase or lease of ADP equipment or services;

(g) Includes the beginning and ending dates of the period of time covered by the service agreement; and

(h) Includes a schedule of expected total charges to the title covered by this subpart for the period of the service agreement.

Service Oriented Architecture (SOA), also referred to as Service Component Based Architecture, describes a means of organizing and developing Information Technology capabilities as collaborating services that interact with each other based on open standards. Agency SOA artifacts may include models, approach documents, inventories of services or other descriptive documents.

Software means a set of computer programs, procedures, and associated documentation used to operate the hardware.

Software maintenance means routine support activities that normally include corrective, adaptive, and perfective changes, without introducing additional functional capabilities. Corrective changes are tasks to correct minor errors or deficiencies in software. Adaptive changes are minor revisions to existing software to meet changing requirements. Perfective changes are minor improvements to application software so it will perform in a more efficient, economical, and/or effective manner. Software maintenance can include activities such as revising/creating new reports, making limited data element/data base changes, and making minor alterations to data input and display screen designs.

State agency means the State agency administering or supervising the administration of the State plan under titles I, IV, X, XIV, XVI(AABD), XIX or XXI of the Social Security Act.

System specifications means information about the new ADP system—such as workload descriptions, input data, information to be maintained and processed, data processing techniques, and output data—which is required to determine the ADP equipment and software necessary to implement the system design.

System study means the examination of existing information flow and operational procedures within an organization. The study essentially consists of three basic phases: Data gathering investigation of the present system and new information requirements; analysis of the data gathered in the investigation; and synthesis, or refitting of the parts and relationships uncovered through the analysis into an efficient system.

Total Acquisition Cost means all anticipated expenditures (including State staff costs) for planning and implementation for the project. For purposes of this regulation total acquisition cost and project cost are synonymous.

Advance Planning Document (APD) refers to an Initial advance automated data processing planning document or Initial APD, providing a recorded plan of action to request funding approval for a project which will require the use of ADP services or equipment, including the use of shared or purchased services in lieu of State acquired stand-alone resources. Requirements are detailed in paragraph (a), (b) and (c) of this section.

(a) Planning APD. (1) A separate planning effort and Planning APD is optional, but highly recommended, and generally applies to large statewide system developments and/or major hardware acquisitions. States with large, independent counties requesting funding at the regular match rate for county systems are strongly encouraged to engage in planning activities commensurate with the complexity of the projected ADP project and to submit a Planning APD to allow for time and to provide funding for its planning activities. Therefore, States must consider the scope and complexity of a project to determine whether to submit a Planning APD as a separate document to HHS or whether to combine the two phases of planning and implementation into one APD covering both the Planning APD and the Implementation APD requirements.

(2) The Planning APD is a relatively brief document, usually not more than 6-10 pages, which must contain:

(i) A statement of the problem/need that the existing capabilities can not resolve, new or changed program requirements or opportunities for improved economies and efficiencies and effectiveness of program and administration and operations;

(ii) A project management plan that addresses the planning project organization, planning activities/deliverables, State and contractor resource needs, planning project procurement activities and schedule;

(iii) A specific budget for the planning phase of the project;

(iv) An estimated total project cost and a prospective State and Federal cost allocation/distribution, including planning and implementation;

(v) A commitment to conduct/prepare the problem(s) needs assessment, feasibility study, alternatives analysis, cost benefit analysis, and to develop a Functional Requirements Specification and/or a General Systems Design (GSD);

(vi) A commitment to define the State's functional requirements, based on the State's business needs which may be used for the purpose of evaluating the transfer of an existing system, including the transfer of another State's General System Design that the State may adapt to meet State specific requirements;

(vii) Additional Planning APD content requirements, for enhanced funding projects as contained in § 307.15 and §§ 1355.50 through 1355.57; and

(viii) An acquisition summary for the upcoming year or development phase that provides the following information on proposed acquisitions:

(A) Type and scope of contract

(B) Procurement strategy

(C) Estimated cost or not to exceed amount

(D) Timeframe of contract

(E) A statement or certification that the proposed acquisition will comply with all State and Federal requirements including the retention of software ownership rights specified in § 95.617.

(b) Implementation APD. The Implementation APD shall include:

(1) The results of the activities conducted under a Planning APD, if any;

(2) A statement of problems/needs and outcomes/objectives;

(3) A requirements analysis, feasibility study and a statement of alternative considerations including, where appropriate, the use of service-orientated architecture and a transfer of an existing system and an explanation of why such a transfer is not feasible if another alternative is identified;

(4) A cost benefit analysis;

(5) A personnel resource statement indicating availability of qualified and adequate numbers of staff, including a project director to accomplish the project objectives;

(6) A detailed description of the nature and scope of the activities to be undertaken and the methods to be used to accomplish the project;

(7) The proposed activity schedule for the project;

(8) A proposed budget (including an accounting of all possible Implementation APD activity costs, e.g., system conversion, vendor and state personnel, computer capacity planning, supplies, training, hardware, software and miscellaneous ADP expenses) for the project;

(9) A statement indicating the duration the State expects to use the equipment and/or system;

(10) An estimate of the prospective cost allocation/distribution to the various State and Federal funding sources and the proposed procedures for distributing costs;

(11) A statement setting forth the security and interface requirements to be employed and the system failure and disaster recovery/business continuity procedures available or to be implemented; and

(12) Additional requirements, for acquisitions for which the State is requesting enhanced funding, as contained at § 307.15 and 42 CFR subchapter C, part 433 or funding for title IV-E agencies as contained at § 1355.52(i) of this title.

(c) Advance Planning Document Update (APDU). (1) The Annual APDU, which is due 60 days prior to the expiration of the FFP approval, includes:

(i) A reference to the approved APD and all approved changes;

(ii) A project activity report which includes the status of the past year's major project tasks and milestones, addressing the degree of completion and tasks/milestones remaining to be completed, and discusses past and anticipated problems or delays in meeting target dates in the approved APD and approved changes to it and provides a risk management plan that assesses project risk and identifies risk mitigation strategies;

(iii) A report of all project deliverables completed in the past year and degree of completion for unfinished products and tasks;

(iv) An updated project activity schedule for the remainder of the project;

(v) A revised budget for the entirety of the project's life-cycle, including operational and development cost categories;

(vi) A project expenditures report that consists of a detailed accounting of all expenditures for project development over the past year and an explanation of the differences between projected expenses in the approved APD and actual expenditures for the past year;

(vii) A report of any approved or anticipated changes to the allocation basis in the APD's approved cost allocation methodology; and

(viii) An acquisition summary for the upcoming year or development phase that provides the following information on proposed acquisitions:

(A) Type and scope of contract

(B) Procurement strategy

(C) Estimated cost or not to exceed amount

(D) Timeframe of contract

(E) A statement or certification that the proposed acquisition will comply with all State and Federal requirements including the retention of software ownership rights specified in § 95.617.

(2) The As-Needed APDU is a document that requests approval for additional funding and/or authority for project continuation when significant changes are anticipated, when the project is being funded on a phased implementation basis, or to clarify project information requested as an approval condition of the Planning APD, Annual APDU, or Implementation APD. The As-Needed APDU may be submitted any time as a stand-alone funding or project continuation request, or may be submitted as part of the Annual APDU. The As-Needed APDU is submitted:

(i) When the State anticipates incremental project expenditures (exceeding specified thresholds);

(ii) When the State anticipates a schedule extension of more than 60 days for major milestones;

(iii) When the State anticipates major changes in the scope of its project, e.g., a change in its procurement plan, procurement activities, system concept or development approach;

(iv) When the State anticipates significant changes to its cost distribution methodology or distribution of costs among Federal programs; and/or,

(v) When the State anticipates significant changes to its cost benefit projections. The As-Needed APDU shall provide supporting documentation to justify the need for a change to the approved budget.

(vi) Changes to the acquisition summary in the following areas:

(A) Type and scope of contract

(B) Procurement strategy

(C) Estimated cost or not to exceed amount

(D) Timeframe of contract

(E) A statement or certification that the proposed acquisition will comply with all State and Federal requirements including the retention of software ownership rights specified in § 95.617.

(F) New acquisitions not summarized in the Annual APDU.

(3) The Operational Advance Planning Document Update (OAPDU) is an annual submission of no more than two pages, including:

(i) Summary of activities;

(ii) Acquisitions; and,

(iii) Annual budget by project/system receiving funding through the programs covered under this part.

(a) General acquisition requirements. (1) A State shall obtain prior approval from the Department which is reflected in a record, as specified in paragraph (b) of this section, when the State plans to acquire ADP equipment or services with proposed FFP at the regular matching rate that it anticipates will have total acquisition costs of $5,000,000 or more in Federal and State funds. States will be required to submit an Operational APDU only if they exceed the threshold requiring Federal approval, and only upon the receipt of a submission request, which is reflected in a record, from the Department. See definition of software maintenance under § 95.605.

(2) A State must obtain prior approval from the Department which is reflected in a record, as specified in paragraph (b) of this section, when the State plans to acquire ADP equipment or services with proposed FFP at the enhanced matching rate subject to one of the following:

(i) If authorized by § 205.35 of this title and part 307 of this title, regardless of the acquisition cost.

(ii) If authorized by 42 CFR part 433, subpart C, if the contract is anticipated to or will exceed $500,000.

(3) A State shall obtain prior approval from the Department, which is reflected in a record, for a sole source/non-competitive acquisition, of ADP equipment or services with a total State and Federal acquisition cost of $1,000,000 or more.

(4) Except as provided for in paragraph (a)(5) of this section, the State shall submit multi-program requests for Department approval, signed by the appropriate State official, to the Department's Secretary or his/her designee. For each HHS agency that has federal funding participation in the project, an additional copy must be provided to the applicable Federal program office and respective Regional Offices.

(5) States shall submit requests for approval which affect only one approving component of HHS (CMS, OCSE, or Children's Bureau), to the applicable Federal program office and Regional Administrator.

(6) The Department will not approve any Planning or Implementation APD that does not include all information required in § 95.610.

(b) Specific prior approval requirements. The State agency shall obtain written approval of the Department prior to the initiation of project activity.

(1) For regular FFP requests.

(i) For the Planning APD subject to the dollar thresholds specified in paragraph (a) of this section.

(ii) For the Implementation APD subject to the dollar thresholds specified in paragraph (a) of this section.

(iii) For acquisition documents, an exemption from prior Federal prior approval shall be assumed in the approval of the Planning, Annual or As-Needed APDU provided that:

(A) The acquisition summary provides sufficient detail to base an exemption request;

(B) The acquisition does not deviate from the terms of the exemption; and

(C) The acquisition is not the initial acquisition for a high risk activity, such as software application development. Acquisitions, whether exempted from prior Federal approval or not, must comply with the Federal provisions contained in § 95.610(c)(1)(viii) or (c)(2)(vi) or submit an Acquisition Checklist.

(iv) For noncompetitive acquisitions, including contract amendments, when the resulting contract is anticipated to exceed $1,000,000, States will be required to submit a sole source justification in addition to the acquisition document. The sole source justification can be provided as part of the Planning, Annual or As-Needed APDU.

(v) If the State does not opt for an exemption or submittal of an Acquisition Checklist for the contract, prior to the execution, the State will be required to submit the contract when it is anticipated to exceed the following thresholds, unless specifically exempted by the Department:

(A) Software application development—$6,000,000 or more (competitive) and $1,000,000 or more (noncompetitive);

(B) Hardware and Commercial Off-the-Shelf (COTS) software—$20,000,000 or more (competitive) and $1,000,000 or more (noncompetitive);

(C) Operations and Software Maintenance acquisitions combined with hardware, COTS or software application development—the thresholds stated in § 95.611(b)(1)(v)(A) and (B) apply.

(vi) For contract amendments within the scope of the base contract, unless specifically exempted by the Department, prior to execution of the contract amendment involving contract cost increases which cumulatively exceed 20 percent of the base contract cost.

(2) For enhanced FFP requests.

(i) For the Planning APD.

(ii) For the Implementation APD.

(iii) For the acquisition solicitation documents and contract, unless specifically exempted by the Department, prior to release of the acquisition solicitation documents or prior to execution of the contract when the contract is anticipated to or will exceed $500,000.

(iv) For contract amendments, unless specifically exempted by the Department, prior to execution of the contract amendment, involving contract cost increases exceeding $500,000 or contract time extensions of more than 60 days.

(3) Failure to submit any of the above to the satisfaction of the Department may result in disapproval or suspension of project funding.

(c) Specific approval requirements. The State agency shall obtain written approval from the Department:

(1) For regular FFP requests.

(i) For an annual APDU for projects with a total cost of more than $5,000,000, and projects with a total estimated cost of less than $5,000,000 only if requested by the Department.

(ii) For an “As Needed APDU” when changes cause any of the following:

(A) A projected cost increase of $1,000,000 or more.

(B) A schedule extension of more than 60 days for major milestones;

(C) A significant change in procurement approach, and/or scope of procurement activities beyond that approved in the APD;

(D) A change in system concept, or a change to the scope of the project;

(E) A change to the approved cost allocation methodology.

(2) For enhanced FFP requests.

(i) For an Annual APDU.

(ii) For an “As needed” APDU when changes cause any of the following:

(A) A projected cost increase of $300,000 or 10 percent of the project cost, whichever is less;

(B) A schedule extension of more than 60 days for major milestones. For Aid to Families with Dependent Children (AFDC) Family Assistance Management Information System (FAMIS)-type projects, in accordance with section 402(e)(2)(C) of the Social Security Act, any schedule change which affects the State's implementation date as specified in the approved APD requires that the Department recover 40 percent of the amount expended. The Secretary may extend the implementation date, if the implementation date is not met because of circumstances beyond the State's control. Examples of circumstances beyond the State's control are:

(1) Equipment failure due to physical damage or destruction; or,

(2) Change imposed by Federal judicial decisions, or by Federal legislation or regulations;

(C) A significant change in procurement approach, and/or a scope of procurement activities beyond that approved in the APD;

(D) A change in system concept or scope of the project;

(E) A change to the approved cost methodology;

(F) A change of more than 10% of estimated cost benefits.

(3) Failure to submit any of the above to the satisfaction of the Department may result in disapproval or suspension of project funding.

(d) Prompt action on requests for prior approval. The Department will promptly send to the approving Federal program offices the items specified in paragraph (b) of this section. If the Department has not provided approval, disapproval, or a request for information which is reflected in a record, within 60 days of the date of the Departmental letter acknowledging receipt of a State's request, the Department will consider the request to have provisionally met the prior approval conditions of paragraph (b) of this section.

(e) Acquisitions not subject to prior approval. If the Department has not specifically requested in a record, the submittal of additional acquisition documentation for those acquisitions summarized in the APD, the approval of the Planning, Annual or As-Needed APDU will constitute an exemption of the acquisition documents from prior Federal approval. States will be required to submit acquisition documents, contracts and contract amendments under the threshold amounts on an exception basis if requested to do so in a record by the Department.

If the Department finds that any ADP acquisition approved or modified under the provisions of § 95.611 fails to comply with the criteria, requirements, and other activities described in the approved APD to the detriment of the proper, efficient, economical and effective operation of the affected program, payment of FFP may be disallowed. In the case of a suspension of the approval of a Child Support APD for enhanced funding, see § 307.40(a). In the case of a suspension of the approval of an APD for a Comprehensive Child Welfare Information System (CCWIS) project and, if applicable the transitional project that preceded it, see § 1355.58 of this title.

(a) General. Procurements of ADP equipment and services are subject to the procurement standards prescribed by part 75 regardless of any conditions for prior approval. The Department retains the authority to provide greater oversight including requiring a State to comply with § 75.328 if the Department determines that the State procurement process is an impediment to competition that could substantially impact project cost or risk of failure.

(b) Those standards, as well as the requirement for prior approval, apply to ADP services and equipment acquired by a State or local agency, and the ADP services and equipment acquired by a State or local Central Data Processing facility primarily to support the Social Security Act programs covered by this subpart. Service agreements are exempt from these procurement standards.

The State agency must allow the Department access to the system in all of its aspects, including pertinent state staff, design developments, operation, and cost records of contractors and subcontractors at such intervals as are deemed necessary by the Department to determine whether the conditions for approval are being met and to determine the efficiency, economy and effectiveness of the system.

(a) General. The State or local government must include a clause in all procurement instruments that provides that the State or local government will have all ownership rights in software or modifications thereof and associated documentation designed, developed or installed with Federal financial participation under this subpart.

(b) Federal license. The Department reserves a royalty-free, nonexclusive, and irrevocable license to reproduce, publish, or otherwise use and to authorize others to use for Federal Government purposes, such software, modifications, and documentation.

(c) Proprietary software. Proprietary operating/vendor software packages which are provided at established catalog or market prices and sold or leased to the general public shall not be subject to the ownership provisions in paragraphs (a) and (b) of this section. FFP is not available for proprietary applications software developed specifically for the public assistance programs covered under this subpart.

ADP systems designed, developed, or installed with FFP shall be used for a period of time specified in the advance planning document, unless the Department determines that a shorter period is justified.

The Department will conduct periodic onsite surveys and reviews of State and local agency ADP methods and practices to determine the adequacy of such methods and practices and to assure that ADP equipment and services are utilized for the purposes consistent with proper and efficient administration under the Act. Where practical, the Department will develop a mutually acceptable schedule between the Department and State or local agencies prior to conducting such surveys or reviews, which may include but are not limited to:

(a) Pre-installation readiness. A pre-installation survey including an onsite evaluation of the physical site and the agency's readiness to productively use the proposed ADP services, equipment or system when installed and operational.

(b) Post-installation. A review conducted after installation of ADP equipment or systems to assure that the objectives for which FFP was approved are being accomplished.

(c) Utilization. A continuing review of ADP facilities to determine whether or not the ADP equipment or services are being efficiently utilized in support of approved programs or projects.

(d) Acquisitions not subject to prior approval. Reviews will be conducted on an audit basis to assure that system and equipment acquisitions costing less than $200,000 or acquisitions exempted from prior approval were made in accordance with part 75 and the conditions of this subpart and to determine the efficiency, economy and effectiveness of the equipment or service.

(e) State Agency Maintenance of Service Agreements. The State agency will maintain a copy of each service agreement in its files for Federal review.

(f) ADP System Security Requirements and Review Process—(1) ADP System Security Requirement. State agencies are responsible for the security of all ADP projects under development, and operational systems involved in the administration of HHS programs. State agencies shall determine the appropriate ADP security requirements based on recognized industry standards or standards governing security of Federal ADP systems and information processing.

(2) ADP Security Program. State ADP Security requirements shall include the following components:

(i) Determination and implementation of appropriate security requirements as specified in paragraph (f)(1) of this section.

(ii) Establishment of a security plan and, as appropriate, policies and procedures to address the following area of ADP security:

(A) Physical security of ADP resources;

(B) Equipment security to protect equipment from theft and unauthorized use;

(C) Software and data security;

(D) Telecommunications security;

(E) Personnel security;

(F) Contingency plans to meet critical processing needs in the event of short or long-term interruption of service;

(G) Emergency preparedness; and,

(H) Designation of an Agency ADP Security Manager.

(iii) Periodic risk analyses. State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur.

(3) ADP System Security Reviews. State agencies shall review the ADP system security of installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices.

(4) Costs incurred in complying with provisions of paragraphs (f)(1)-(3) of this section are considered regular administrative costs which are funded at the regular match rate.

(5) The security requirements of this section apply to all ADP systems used by State and local governments to administer programs covered under 45 CFR part 95, subpart F.

(6) The State agency shall maintain reports of their biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site review.

For ADP equipment and services acquired by a State without prior approval, which is reflected in a record, the State may request reconsideration of the disallowance of FFP by written request to the head of the Federal program office within 30 days of the initial written disallowance determination. In such a reconsideration, the agency may take into account overall federal interests. The Department may grant a request for reconsideration if:

(a) The State submitted to the Department all information required under § 95.611, satisfactorily responded to all concerns raised by the Department and received a final letter of approval from the Department; or,

(b) The State requests reconsideration of a denial by submitting in a record information that addresses the following requirements:

(1) The acquisition must be reasonable, useful and necessary;

(2) The State's failure to obtain prior approval, which is reflected in a record, must have been inadvertent (i.e., the State did not knowingly avoid the prior approval requirements);

(3) The request was not previously denied by HHS;

(4) The acquisition must otherwise meet all other applicable Federal and State requirements, and would have been approved under part 95, subpart F had the State requested in a record, prior approval;

(5) The State must not have a record of recurrent failures, under any of the programs covered by the prior approval regulations, to comply with the requirement to obtain prior approval in a record, of its automatic data processing acquisitions (i.e., submissions under these procedures, from States that have failed in the past to acquire prior approval which is reflected in a record, in accordance with part 95, subpart F, may be denied);

For ADP equipment and services acquired by a State after December 1, 1985 to meet emergency situations, which preclude the State from following the requirements of § 95.611, the Department will consider providing FFP upon receipt of a request from the State which is reflected in a record. In order for the Department to consider providing FFP in emergency situations, the following conditions must be met:

(a) The State must submit a request to the Department, prior to the acquisition of any ADP equipment or services. The request must be reflected in a record, and include:

(1) A brief description of the ADP equipment and/or services to be acquired and an estimate of their costs;

(2) A brief description of the circumstances which result in the State's need to proceed prior to obtaining approval from the Department; and

(3) A description of the harm which will be caused if the State does not acquire immediately the ADP equipment and services.

(b) Upon receipt of the information, the Department will within 14 days take one of the following actions:

(1) Inform the State in writing that the request has been disapproved and the reason for disapproval; or

(2) Inform the State in a communication reflected in a record, that the Department recognizes that an emergency exists and that within 90 days from the date of the State's initial request, the State must submit a formal request for approval which includes the information specified at § 95.611 in order for the ADP equipment or services acquisition to be considered for the Department's approval.

(c) If the Department approves the request submitted under paragraph (b) of this section, FFP will be available from the date the State acquires the ADP equipment and services.

(a) General. FFP is available at enhanced matching rates for the development of individual or integrated systems and the associated computer equipment that support the administration of state plans for titles IV-D and/or XIX provided the systems meet the specifically applicable provisions referenced in paragraph (b) of the section.

(b) Specific reference to other regulations. The applicable regulations for the Title IV-D program are contained in 45 CFR part 307. The applicable regulations for the Title IV-E program are contained in 45 CFR 1355.55. The applicable regulations for the title IV-D program are contained in 45 CFR part 307. The applicable regulations for the title XIX program are contained in 42 CFR part 433, subpart C.

(a) An assessment for independent verification and validation (IV&V) analysis of a State's system development effort may be required in the case of APD projects that meet any of the following criteria:

(1) Are at risk of missing statutory or regulatory deadlines for automation that is intended to meet program requirements;

(2) Are at risk of failing to meet a critical milestone;

(3) Indicate the need for a new project or total system redesign;

(4) Are developing systems under waivers pursuant to sections 452(d)(3) or 627 of the Social Security Act;

(5) Are at risk of failure, major delay, or cost overrun in their systems development efforts;

(6) Fail to timely and completely submit APD updates or other required systems documentation.

(7) State's procurement policies put the project at risk, including a pattern of failing to pursue competition to the maximum extent feasible.

(8) State's failure to adequately involve the State program offices in the development and implementation of the project.

(b) Independent Verification and Validation efforts must be conducted by an entity that is independent from the State (unless the State receives an exception from the Department) and the entity selected must:

(1) Develop a project workplan. The plan must be provided directly to the Department at the same time it is given to the State.

(2) Review and make recommendations on both the management of the project, both State and vendor, and the technical aspects of the project. The IV&V provider must give the results of its analysis directly to the federal agencies that required the IV&V at the same time it reports to the State.

(3) Consult with all stakeholders and assess the user involvement and buy-in regarding system functionality and the system's ability to support program business needs.

(4) Conduct an analysis of past project performance sufficient to identify and make recommendations for improvement.

(5) Provide risk management assessment and capacity planning services.

(6) Develop performance metrics which allow tracking project completion against milestones set by the State.

(c) The acquisition document and contract for selecting the IV&V provider (or similar documents if IV&V services are provided by other State agencies) must include requirements regarding the experience and skills of the key personnel proposed for the IV&V analysis. The contract (or similar document if the IV&V services are provided by other State agencies) must specify by name the key personnel who actually will work on the project. The acquisition documents and contract for required IV&V services must be submitted to the Department for prior written approval.

(a) Application for a waiver. A State may apply for a waiver of any requirement in subpart F by presenting an alternative approach. Waiver requests must be submitted and approved as part of the State's APD or APD Update.

(b) Waiver approvals. The Secretary, or his or her designee, may grant a State a waiver if the State demonstrates that it has an alternative approach to a requirement in this chapter that will safeguard the State and Federal Governments' interest and that enables the State to be in substantial compliance with the other requirements of this chapter.

(c) Contents of waiver request. The State's request for approval of an alternative approach or waiver of a requirement in this chapter must demonstrate why meeting the condition is unnecessary, diminishes the State's ability to meet program requirements, or that the alternative approach leads to a more efficient, economical, and effective administration of the programs for which federal financial participation is provided, benefiting both the State and Federal Governments.

(d) Review of waiver requests. The Secretary, or his or her designee, will review waiver requests to assure that all necessary information is provided, that all processes provide for effective economical and effective program operation, and that the conditions for waiver in this section are met.

(e) Agency's response to a waiver request. When a waiver is approved by an agency, it becomes part of the State's approved APD and is applicable to the approving agency. A waiver is subject to the APD suspension provisions in § 95.611(c)(3). When a waiver is disapproved, the entire APD will be disapproved. The APD disapproval is a final administrative decision and is not subject to administrative appeal.

The conditions of this subpart apply notwithstanding the existence of an approved cost allocation plan. State agencies shall assign and claim the costs incurred under an approved APD in accordance with the following criteria:

(a) Development costs. (1) Using its normal departmental accounting system, the State agency shall specifically identify what items of costs constitute development costs, assign these costs to specific project cost centers, and distribute these costs to funding sources based on the specific identification, assignment and distribution outlined in the approved APD; (2) the methods for distributing costs set forth in the APD should provide for assigning identifiable costs, to the extent practicable, directly to program/functions. The State agency shall amend the cost allocation plan required by subpart E of this part to include the approved APD methodology for the identification, assignment and distribution of the development costs.

(b) Operational costs. Costs incurred for the operation of an ADP system shall be identified and assigned by the State agency to funding sources in accordance with the approved cost allocation plan required by Subpart E of this part.

(c) Service agreement costs. States that operate a central data processing facility shall use their approved central service cost allocation plan required by OMB Circular A-87 to identify and assign costs incurred under service agreements with the State agency. The State agency will then distribute these costs to funding sources in accordance with paragraphs (a) and (b) of this section.

State agencies that acquire ADP equipment and services are subject to the nondiscrimination requirements in parts 80, 84, and 90.

(a) Federal financial participation at the applicable matching rate is available for automated data processing system expenditures that meet the requirements specified under the approved APD including the approved cost allocation plan.

(b) All or part of any costs for system projects that have a major failure to comply with an APD approved under applicable regulation at § 95.611, or for the Title IV-D program contained in part 307, the applicable regulations for the Title IV-E and Title IV-B programs contained in Chapter 13, subchapter G, § 1355.55, or the applicable regulations for the Title XIX program contained in 42 CFR chapter 4 subchapter C, part 433, are subject to disallowance by the Department.

ADP equipment, as well as other equipment acquired under public assistance programs, is subject to subpart G of this part. Among other things, subpart G provides that a State may charge only depreciation or use allowances for equipment with unit acquisition cost of over $25,000. However, for ADP equipment HHS will consider requests for waivers of that restriction. If the acquisition of the equipment is part of an APD that is subject to the prior approval requirements of subpart F, the State may submit the request for a waiver as part of the APD.