VR-SFP Chapter 3: Basic Standards

The VR Standards for Providers (VR-SFP) manual focuses on the business practices, processes, and policies that must be followed for the Texas Workforce Commission (TWC) and the contracted provider to comply with federal and state laws and TWC rules and requirements.

TWC must ensure that taxpayer funds are spent wisely and provide the best value to the taxpayer. The standards that providers must meet ensure that Vocational Rehabilitation (VR) customers receive quality services to help them achieve their vocational rehabilitation goals.

Each provider is expected to be familiar with and comply with the most recently published standards and use the most recently published forms applicable to their contract. Each provider must maintain an updated VR3443, TWC VR Standards for Providers Certification form on file with their regional program specialist and contract manager.

Terms Used in the Manual

Contractor—An entity or individual awarded a contract with TWC to provide goods and services. Sometimes used interchangeably with provider or service provider.

Employment services provider—A provider that has a contract with TWC to provide employment-related services to eligible customers. An employment services provider was previously referred to as a community rehabilitation program.

Provider—Any individual or business from which a VR contractor can obtain goods and services for customers. Providers are also referred to as vendors.

Service provider—Entities or individuals approved to provide services to individuals with disabilities who receive VR or Independent Living Services for Older Individuals Who Are Blind (ILS-OIB). Sometimes used interchangeably with provider or contractor.

Refer to the VR Glossary to ensure familiarity with the key terms used in this manual.

3.1.1 Contractor's Primary Contacts

The contractor's primary TWC contacts include the following:

• Contract manager—the assigned VR contact for assisting with contract-related issues
• OIB worker—the primary contact for customer-related issues and for directing the independent living skills contractor in the provision of services to ILS-OIB customers. The OIB worker coordinates cases, provides counseling and guidance, determines a customer's eligibility, and develops and manages comprehensive independent living plans for ILS-OIB customers.
• Liaison—the VR contact for answering the routine questions posed by contractors and their staff about VR programs and the standards required for providers
• Regional Quality Assurance Specialist or Regional Program Support Specialist (referred to as Regional Program Specialist within this chapter)—the VR contact for answering routine questions about the VR program and the standards for providers, when the liaison is unavailable to help the contractor or when no liaison is assigned
• VR counselor—The primary contact for customer-related issues. The VR counselor provides counseling and guidance, determines a customer's eligibility, and develops and manages comprehensive individual rehabilitation plans for VR customers.

3.1.2 Contract Types

Service Contracts

Service contracts are used when a provider completes tasks or provides services described in the VR-SFP manual, such as when:

• assessing assistive technology designed for the blind and visually impaired;
• providing diabetes education;
• providing employment-related services;
• assessing a customer's work environment;
• providing services for older individuals who are blind;
• providing Orientation and Mobility services;
• providing Post-Acute Brain Injury services;
• providing Pre-Employment Transition Services;
• providing Project Search services;
• providing Supportive Residential Services for Persons in Recovery; and
• developing Wellness Recovery Action Plans.

Goods or Equipment Contracts

Goods or equipment contracts are used when a provider provides a product for the customer, as described in the VR-SFP manual, such as when providing:

• durable medical equipment;
• hearing aids; or
• vehicle modification.

3.1.3 Headquarters

Each provider must have a designated headquarters where customer records are securely stored and where administrative responsibilities are performed, as required by the contract. The provider must maintain the following forms up-to-date and on file with the regional program specialist and contract manager:

• VR3441A, Entity Headquarters Information Part A - Management Team
• VR3441B, Entity Headquarters Information Part B - Services and Goods
• VR3441C, Entity Headquarters Information Part C - Counties

3.1.4 Legally Authorized Representative

Each contractor must have a legally authorized representative to sign contracts, official documents, and verification statements.

3.1.5 Director

Service contracts must designate a director as the primary contact. Goods or equipment contracts do not require UNTWISE Director Credentials to maintain compliance with the contract.

The designated director in each service contract:

• handles routine communication;
• addresses compliance issues;
• ensures that staff qualifications are documented and up-to-date;
• supervises staff and subcontractors, if any; and
• ensures that the contractor meets the requirements explained in the contract, in the VR-SFP manual, and in-service authorizations.

The director is not required to have the job title of director.

The director may be the legally authorized representative. The legally authorized representative may assign a staff member to be the contractor's designated director.

As of September 1, 2017, all designated directors must hold the UNTWISE Director Credential and maintain its effectiveness throughout the contract term. There is no grandfather clause for this requirement. The director credential must be maintained without lapsing. Exception: Contracts for Communication Access, Employment Supports for Brain Injury services, and Supported Residential Services for Persons in Recovery.

For more information, see UNTWISE.

The contractor must keep a completed VR3455, Provider Staff Information Form, for the director on file at the contractor's headquarters, and must provide copies on request to the TWC contract manager and the VR or OIB regional program specialist. The VR3455 must fully document that the required qualifications of the director are met.

A director's qualifications must be reviewed by TWC staff during contract monitoring reviews. TWC staff may request verification of the director's qualifications at any time. Payment made for services provided during periods without an approved credentialed director may be subject to recoupment or other penalties under the contract. Failure to maintain the qualifications is not in compliance with the terms of the contract and may result in the contract being suspended or terminated.

3.1.6 Staff of the Contracted Provider

A contractor may hire employees or use independent subcontractors. If the contractor uses subcontractors, refer to the contract for the subcontracting requirements.

A contractor's employees and subcontractors who are under contract to provide VR and/or ILS-OIB services are not TWC employees, are not eligible for TWC employee benefits, and must not represent themselves as state employees. The contractor must provide all legally required unemployment insurance and workers' compensation insurance.

3.1.6.1 Subcontractors

The contractor accepts liability and retains responsibility for the performance of subcontractors that provide services under the terms of the contract. Subcontractors providing services under the contract must meet the requirements and qualifications required in the standards.

No subcontract may relieve the contractor of the responsibility of ensuring that the contracted services are provided according to the standards. The provider accepts responsibility for compensating any party with which the provider enters a subcontract relationship.

3.1.6.2 Staff Credentialing

TWC has partnered with UNTWISE and the Center for Social Capital to ensure that providers are fully equipped to offer the highest quality services to Texans with disabilities.

UNTWISE has developed:

• a director credential for all standards-related service contracts, excluding services related to post-acute brain injury and supported residential services for individuals in recovery;
• credentialing and training processes for the staff of providers' that offer employment services such as job coaching, job placement, supported employment services, and Vocational Adjustment Training; and
• endorsements for areas of specialization to work with various disability groups, such as groups for individuals with autism or with blind and visual impairments.

For additional information about the UNTWISE credentialing and endorsement processes, see Texas Credential Training.

The Center for Social Capital has developed credentialing and training processes for contractors' staff that provide self-employment services.

For information on the qualifications required of contractors' staff and the premiums TWC pays for services, see the chapters in the VR-SFP manual that are related to each service.

3.1.6.3 Staff Required Documentation

Each service provider (contractor)—excluding providers of post-acute brain injury or supportive residential services for individuals in recovery—must keep the following information on file for all directors, employees, and subcontractors:

• A VR3455, Provider Staff Information Form
• Supporting evidence that the staff providing services or the appointed director meets all required qualifications under the contract, such as:
  • professional credentials;
  • credentials from UNTWISE or the Center for Social Capital;
  • copies of college transcripts, a high school diploma, or a General Educational Development test;
  • certificates of specialized training; or
  • statements from former employers
• A completed US Department of Justice Form I-9 Employment Eligibility Verification, as applicable (see United States Citizenship and Immigration Services)
• A signed W-4 form from the IRS, unless the staff member is a subcontractor

Each service provider must submit the VR3455 form and the supporting evidence that the staff member meets the required qualifications to both the regional program specialist and the assigned contract manager within 30 days of:

• hiring new staff;
• making a significant change to a staff member's job duties;
• changing staff qualifications; or
• terminating a staff member.

3.1.6.4 Temporary Waiver of Staff Qualifications

When a contractor no longer has qualified or credentialed staff, including directors, a VR3490, Temporary Waiver of Credentials, must be completed and approved by the VR director before services are provided.

The waiver is specific to the contractor and staff members named on the VR3490 and is valid for the period specified on the approved waiver.

The VR director may approve a VR3490 waiver after consideration of:

• the availability of another qualified or credentialed director;
• the availability of a qualified or credentialed staff member who meets the qualifications required by the standards for the contracted service;
• the necessity of the waiver to avoid a break in the essential services being provided to a VR or ILS-OIB customer receiving services from that provider; and
• whether approval of a waiver is in the best interest of VR or ILS-OIB customers and the state.

After a VR3490 is processed, regardless of whether approved or denied, a copy is sent to the contractor and must be kept on file by the:

• contractor;
• assigned VR regional program specialist; and
• assigned TWC contract manager.

A copy of the approved VR3490 must accompany any invoice for services provided by a non-credentialed employee or subcontractor to a VR or ILS-OIB customer.

3.1.6.5 Staff-to-Customer Ratios

Each services-related chapter in the VR-SFP manual describes the required staff-to-customer ratio.

3.3.1 Employment of Qualified Individuals with Disabilities

Each contractor must demonstrate the meaningful efforts made to employ and advance in employment qualified individuals with disabilities.

Contractors must maintain and implement written standards of conduct for the contractor's employees and subcontractors. These standards of conduct must incorporate all professional standards of conduct and ethics required by the licensing or credentialing entity for licensed individuals in positions held by the contractor's employees and subcontractors.

3.3.2 Professionalism

Contractors, their employees, and any subcontractors must perform in a professional manner and dress in business casual attire that is appropriate for the work activity and workplace:

• when interacting with VR customers and staff; and
• when providing services and visiting VR offices.

A professional manner is defined as:

• maintaining the confidentiality of all customer information in full compliance with state and federal regulations;
• obtaining a written confidentiality release when sharing information with others who are not VR staff or are not the customer's legal guardian;
• not misrepresenting oneself as a state of Texas employee;
• not misrepresenting the contractor as a state agency;
• reporting in a timely manner and to appropriate authorities the abuse or neglect of any customer or customer's family member;
• considering the negative impacts of action or inaction on the part of the individual or contractor to the health, safety, or welfare of any customer or customer's family member;
• avoiding relationships with customers or VR staff that would impair the contractor's objectivity in performing his or her duties or that would endanger confidentiality;
• not engaging in activities or relationships with customers that might be misconstrued by the customer; or
• not allowing a third party to be present when meeting with a customer at the customer's home or business, unless the customer has signed a release allowing the third party to be present or unless the third party is a potential employer.

3.3.3 Conflict of Interest

Contractors and potential contractors must not offer, give, or agree to give TWC staff anything of value.

Anything of value includes prepared foods, gift baskets, promotional items, awards, gift cards, meals, or promises of future employment.

If a violation occurs, corrective action is required and may include contract termination or disqualification from receiving a future contract with TWC.

Real or apparent conflicts of interest might occur when a former VR employee becomes an employee or a subcontractor of a TWC contractor.

A contractor must not:

• hire, contract with, or accept as a volunteer any current employees of TWC, VR, or ILS-OIB;
• hire, contract with, or accept as a volunteer any former employees of TWC, VR, or ILS-OIB earlier than 12 months after the separation date, if the former employee will provide contracted services as defined in the VR-SFP manual and/or Texas Government Code §572.069; or
• knowingly request or obtain confidential information from a state employee for the benefit of the contractor, personally or professionally.

The scenarios above do not make up a complete list of real or apparent conflicts of interest. Failure to disclose a conflict of interest can result in contract termination, disqualification from receiving a future contract, and/or recoupment of payments.

Each contractor must have a current VR3444, Conflict of Interest Certification, on file with their contract manager and regional program specialist.

3.3.3.1 Texas Workforce Solutions–VR Customer Providing Services to other Texas Workforce Solutions–VR Customers

A customer is acting in a dual role when the Texas Workforce Solutions–VR (TWS-VR) customer’s IPE supports the customer:

• obtaining employment from an existing contractor to provide services to other TWS-VR customers; or
• becoming a TWC-VR contractor to provide services to TWS-VR customers.

When the TWS-VR customer is in a dual role, for a period of 12 months following the closure of his or her case, the customer:

• is prohibited from providing services to any customer who is assigned to the customer’s same TWS-VR counselor; and/or
• may not receive service authorizations from the office to which the customer’s VR counselor is assigned.

An exception may be granted when a VR3472, Contracted Service Modification Request, is approved for any of the following reasons:

• The customer lives in a rural or other area where no other providers are available to serve the customer(s);
• The contractor has a skill or capability that no other available and accessible provider has. For example, in situations where a customer is not proficient in English, the contractor speaks the customer's language as well as English.

3.3.4 Confidentiality

All contractors, contractor employees, and subcontractors must keep customer and employee information confidential.

The contractor must provide physical safeguards for confidential records, such as locked cabinets or encrypted file storage, and ensure that the records are available only to authorized staff members as needed to provide goods or services. Customer case records must be stored in a secured location where there is maximum protection against fire, water damage, theft, and other hazards.

If a breach of confidentiality is discovered, the contractor must report it immediately to the:

• assigned VR counselor or OIB worker; or
• TWC contract manager.

3.3.5 Data Encryption

VR policy and federal law requires that all email messages that contain confidential information must be sent using the level of encryption required by publication 140-2 of the Federal Information Processing Standard (FIPS).

If a contractor is not equipped to use the FIPS 140-2 level of encryption, the contractor must ask a VR staff member who is equipped to send the email message. The same message can then be used to send encrypted information back to VR, when the directions are followed accurately.

If the contractor fails to use the FIPS 140-2 level of encryption, the contractor must report a breach of confidentiality to the assigned regional program specialist and TWC contract manager.

3.3.6 Sound Fiscal and Business Practices

Contractors must demonstrate business procedures and internal controls that prevent the following practices:

• Abuse—practices that are inconsistent with sound fiscal or business practices and that result in unnecessary costs, such as intentional destruction, diversion, manipulation, misapplication, or misuse of public resources in both financial or nonfinancial settings
• Fraud—any intentional conduct designed to deceive others, resulting in a loss to the victim and/or a gain or benefit to the actor
• Misconduct—intentional wrongdoing or improper behavior or activity
• Waste—the thoughtless or careless expenditure, consumption, mismanagement, misuse, or squander of public resources, such as incurring unnecessary costs because of inefficient or ineffective practices, systems, or controls

Contractors for VR and the contractor's employees and subcontractors must:

• implement and maintain business controls that prevent fraud, waste, or abuse;
• implement, maintain, and strengthen controls over the costs of services; and
• obtain high-quality goods and services that are cost effective for customers.

3.3.6.1 Reporting Abuse, Fraud, Misconduct, and Waste

A contractor is responsible for any abuse, fraud, misconduct, or waste that is committed by the contractor's staff or subcontractors.

If abuse, fraud, misconduct, or waste is reported, the contractor must provide the assigned TWC contract manager or regional program specialist with:

• the name of the individual providing the information;
• the name of the individual submitting the information (if different from the individual providing the information);
• the name of an additional contact person;
• details about whether and when law enforcement was notified;
• the names of witnesses;
• the name of the individual or facility being reported; and
• detailed information about the abuse, fraud, misconduct, or waste.

Contractors must report all allegations of fraud, misconduct, and waste to TWC Fraud Reporting.

3.3.7 Reporting Substance Abuse by Customers

If a customer is observed using alcohol or drugs, or any other evidence of substance abuse by the customer exists, the provider must:

• report the information immediately to the VR counselor or OIB worker; and
• document that the VR counselor or OIB worker was informed of the observations and other evidence.

3.3.8 Referrals to VR by a Provider

A provider may refer an individual with a disability to VR for services.

The provider must inform the individual that:

• the VR counselor or OIB worker determines eligibility for VR services; and
• the VR counselor or OIB worker works with eligible customers to do the following and provide them with the information required to make an informed choice:
  • Develop an individualized plan for employment for VR or an independent living plan
  • Choose the services necessary to meet the individual's goals and objectives
  • Choose the providers of any planned goods or services

Referrals from a provider are not a guarantee that the provider will be selected to work with the referred, eligible customer.

3.3.9 Contract Adherence

TWC contracts only with providers who are in full compliance with all chapters in the VR-SFP manual that relate to the contract. Each contractor is required to undergo a review and comply with periodic monitoring activities to ensure continued compliance with the standards.

Contracted service providers must be in full compliance with:

• the following chapters of the VR-SFP manual:
  • Chapter 1: Introduction to Vocational Rehabilitation
  • Chapter 2: Obtaining a Contract for Goods or Services
  • Chapter 3: Basic Standards
• the chapters associated with the services or goods included in the contractor's contracts;
• service authorizations; and
• all applicable clauses in the contracts.

Revisions to the VR-SFP manual are published at least 30 days before the effective date of the revisions.

It is the responsibility of the contractor to maintain awareness of revisions to the standards and to implement the changes as prescribed.

Failure to follow applicable standards and contract requirements could result in adverse consequences, such as denial of payments, recoupment of payments, suspension as a provider of VR services, or loss of an awarded contract.

If a provider is unwilling or unable to change in a timely manner the provision of services as prescribed, the provider must contact the assigned contract manager and the regional program specialist.

3.3.10 Contractor Required Policy and Procedures

The contractor must develop and adhere to policies and procedures to protect customers, customer interests, visitors, and the contractor's staff.

Contractors must have policies and procedures in place before providing services to customers and must review and update their policies to ensure continued compliance with the standards. Contractors must ensure that their policies and procedures do not conflict with the standards or the requirements of their contract. Contractors must develop a written plan and maintain documentation that staff and customers, as appropriate, have been educated on policies and procedures.

At a minimum, contractors must have written policy and procedures on the following:

• Maintaining confidentiality of customer and employee information (refer to 3.3.4 Confidentiality and 3.3.5 Data Encryption), including:
  • providing physical safeguards;
  • providing authorized access; and
  • reporting a breach of confidentiality
• Managing customer expectations and responsibilities
• Managing customer grievances
• Providing customers with the VR toll-free telephone number (1-800-628-5115) and explaining that the number is for applicants and customers to use to report complaints or compliments about the contractor
• Maintaining the contractor's standards that are explained in 3.3 Contractor Standards–All Contract Types on:
• promoting employment of qualified individuals with disabilities;
  • maintaining professionalism;
  • avoiding conflict of interest;
  • maintaining confidentiality;
  • using data encryption;
  • following sound fiscal and business practices;
  • reporting abuse, fraud, misconduct, and waste;
  • referring customers to VR; and
  • adhering to the terms of the contract
• Meeting the standards published in 3.5 Contractor Standards for Physical Locations, when applicable
• Meeting the standards published in 3.4.1 Customer Satisfaction Surveys
• Meeting the standards published in 3.4.2 Service Delivery Achievements
• Terminating a customer's services (refer to 3.6.5 Termination from Service Delivery)
• Providing customer orientation on the reporting of allegations or incidents of abuse, exploitation, or neglect that involve individuals with disabilities (see 3.6.6 Allegations or Incidents of Abuse, Neglect, or Exploitation and 3.6.1 Customer Orientation).
• Reporting observations or evidence that a customer is using alcohol or drugs (see 3.3.7 Reporting Substance Abuse by Customer)
• Reporting unusual or unexpected incidents that compromise or may compromise the health or safety of individuals or the security of property used by the contractor's employees or VR customers and visitors (see 3.3.11 Safe and Secure Environments), including:
  • how to obtain emergency medical services for customers; and
  • how and when to report incidents.

3.3.11 Safe and Secure Environments

Contractors must provide a safe and secure environment for their employees, VR or ILS-OIB customers, and visitors.

The contractor must report all incidents in accordance with:

• the contractor's policies and procedures;
• the contractor's contract; and
• state and/or federal regulations and laws, as required by the standards.

An incident is an unusual or unexpected event that compromises or may compromise the health or safety of individuals or the security of property.

The contractor must report incidents that involve VR customers, the contractor's employees, or subcontractors.

Examples of incidents include, but are not limited to:

• violence, including domestic violence;
• automobile accidents;
• physical or sexual assault;
• terrorist threats;
• serious medical emergencies, deaths, or suicides;
• breaches of confidential information (refer to 3.3.4 Confidentiality);
• theft or loss of property or mischievous or malicious destruction of property on loan from or purchased by VR;
• negative behaviors displayed by VR customers;
• fires or accidents involving hazardous materials;
• interruption of service that is due to an emergency or disaster;
• threat of harm to oneself or others by personal contact, letter, phone, or email; and
• abuse, neglect, or exploitation of an individual with a disability.

All incidents must be reported within one business day to the:

• VR counselor or OIB worker;
• assigned regional program specialist; and
• TWC contract manager.

VR and ILS-OIB policies and procedures require VR employees to report incidents in writing, as required by Texas law, the appropriate licensure and investigating agencies, the standards, and the provider's contract. See 3.6.6 Allegations or Incidents of Abuse, Neglect, or Exploitation.

Physical location is defined as a location the contractor owns, leases, or uses as dedicated space to provide services to customers and/or attend meetings with customers. The contractor must complete the VR3442A, Provider Physical Location Information Part A - Certification Statement and the VR3442B, Provider Physical Location Information Part B forms for each facility it owns, leases, or uses as dedicated space to provide service to customers.

The contractor must maintain the following records and ensure that a current copy is on file with the assigned TWC contract manager and regional program specialist:

• Occupation permit or building permit
• Fire inspection report from an inspection by the fire marshal with local jurisdiction (if the contractor's local fire department does not conduct inspections, the contractor may request an inspection from the Texas Department of Insurance, State Fire Marshal's Inspection Services Division, 333 Guadalupe Street, Austin, Texas 78701, (512) 305-7900)

The contractor must keep a copy of the Americans with Disabilities Act (ADA) Checklist for Existing Facilities on file and make it available upon request.

The permits, fire inspection reports, and ADA checklist may be obtained from the landlord, if they are not in the possession of the contractor.

Each physical location must have:

• working smoke detectors with visible (flashing) and audible fire warning signals within the facilities where customers receive services;
• fire extinguishers in accessible locations, ensuring that they are up-to-date with annual inspections;
• diagrams posted that show accessible fire escape routes that are free and clear of obstructions and develop a plan to evacuate customers who are in the facility and require physical assistance;
• accessible aisles and work safety zones; and
• secure, safe storage and identification of hazardous or flammable materials.

In addition to providing safety equipment within physical locations, the contractor must have safety procedures and plans on the following, to ensure the safety and health of staff, customers, and visiting public:

• The use of safety equipment and machinery with moving parts
• Fire drills and emergency evacuation drills, which must be held quarterly and with proof of employee and customer participation, when applicable
• How to obtain emergency medical services from a doctor, hospital, or emergency medical service unit
• The availability of assistance for individuals with disabilities to ensure successful engagement in services
• The recording and reporting of incidents, which must include:
  • the date, time, and place of incident;
  • the nature of the incident;
  • the names of VR or ILS-OIB customers, witnesses, or others involved;
  • the name of the individual making the report;
  • a description of the incident; and
  • the actions taken and planned by the contractor as a result of the incident, including reporting the incident to the assigned VR counselor or OIB worker, TWC contract manager, and regional program specialist.

The following incidents must be reported to the customer's VR counselor or OIB worker, TWC contract manager, and regional program specialist by the close of business on the next working day:

• Emergency evacuations
• Emergency medical services
• Emergency room treatment
• Hospitalization
• Death

Exemptions to Physical Locations

Physical locations do not include community sites that are not owned, leased, or used as dedicated space by the contractor, such as state, federal, city, county, or other public meeting spaces.

Headquarters are exempt from this section of policy, unless customers receive services or attend meetings at the headquarter location. Contactors that provide all services at community sites that are not owned or leased by the contractor are not required to maintain a physical location.

Contractors agree to accept TWC authorized rates as payment in full for services provided. Contractors may not collect money from a VR or ILS-OIB customer or the customer's family for any service that costs more than the authorized rate.

When VR and another resource pay for a customer service, the total payment may not exceed the authorized rate.

Premium fees are available to contractors as incentive payments for providing certain services. Premium fees are established to compensate contractors' staff that have specialized skills or work with customers who meet specific criteria.

For details about the criteria and the fees for services, refer to Chapter 20: Premiums.

The application Search State Payments Issued allows contractors and other payees to view their detailed payment information.

TWC recommends that contractors register at TX Comptroller E-Systems.

For resources, see CPA Texas.

For more information, see FAQs from Comptroller, State Payee Payment Resource, and Search State Payments Issued Tutorials.

Upon request, the contractor must make available to VR or ILS-OIB staff (such as assigned monitors, regional program specialists, and contract managers) any documents, papers, and records that are directly pertinent to the goods or services provided to VR customers.

Examples include:

• invoices;
• service authorizations;
• any documentation (such as forms, training materials, or attendance records) that is required in the chapter of the VR-SFP manual that relates to the services referred to in the contract;
• company financials;
• insurance certificates;
• staff information sheets; and
• any documentation required under the contract.

A contractor must not share with a customer documents received from TWC-VR. When a customer requests such documents, the contractor must refer the customer to the customer's VR counselor.

A contractor may share with a customer documents that relate to the services provided by the contractor and that have been signed by the customer or legal guardian.

3.11.1 Documentation and Signatures

When completing forms and/or documentation related to the delivery of services or goods to customers, the contractor must do the following:

• Answer all questions related to the services or goods provided. If a question or section does not apply, enter "Not Applicable" or "N/A" and explain why.
• Write summaries in paragraph form in clear English with adequate details, for questions requiring a narrative response.
• Review the form carefully, leaving no blanks.
• Write the goal in clear, measurable terms, when goals are required.
• Collect required signatures from VR or OIB staff, customers, provider’s staff, and circle of supports (including customer representatives, if any), using encryption when required, through one of the following methods:
  • obtaining handwritten signatures;
  • obtaining digital signature(s) ensuring customer confidentiality on approved software options.

    Examples of approved software to collect digital signatures include:

    • Adobe and
    • DocuSign (when it is an option for a TWC-VR form)

    Signatures can be collected on smart devices (i.e. tablets and phones).

  • sending a copy of the document to the customer when the customer has the equipment necessary to print, sign and return an electronic copy of the signed form (such as a photo or scanned copy).
• Make certain that all standards have been met before submitting any form and/or report with an invoice for payment.

When the provider has attempted to obtain signatures, and has recorded such attempts on the submitted documentation, VR or OIB staff can verify the customer's satisfaction and service delivery as described in the VR-SFP by contacting the customer. The provider must make at least three attempts on three different weeks after the service has been completed.

When forms are completed by a provider, the forms must be submitted by either US mail, hand delivery, fax, or encrypted email, unless otherwise noted.

Information must be accurate and complete. All instructions on the form and in the VR-SFP manual must be followed.

3.11.2 Record Storage

Contractors must keep their financial and supporting documents, statistical records, and any other records that are pertinent to the services for which a claim or report was submitted to the Texas Workforce Commission (TWC):

• safe;
• confidential; and
• available to TWC staff on request.

The records and documents must be kept as follows, whichever is later:

• For three years after the date that the final bill was submitted
• Until all billing-related questions are resolved

Contractors must report lost data within one business day to the:

• assigned contract manager and regional quality assurance specialist; or
• regional program support specialist.

Paper Record Storage

Paper is the preferred method for storing records.

Stored paper documents must be protected:

• as required in 3.3.4 Confidentiality; and
• in a retrievable and organized manner that prevents the documents from being stolen, tampered with, or damaged.

The contractor assumes all business risk associated with lost records. Lost records could result in adverse action against the contractor.

Electronic Storage (Not Cloud-Based or on a Third-Party Server)

Records stored on desktop computers or on portable devices (for example, on laptops, USB flash drives, hard drives, CDs, and DVDs) must be protected as required in 3.3.4 Confidentiality and 3.3.5 Data Encryption.

Portable devices must be protected from theft, tampering, or damage. The contractor is responsible for all data collection and assumes all business risk associated with lost data. Lost data could result in adverse action against the contractor.

Cloud-Based Storage

Records that are stored entirely or partially in the cloud must be stored in compliance with the Federal Risk and Authorization Management Program (FedRAMP), or must be able to be made compliant in a short, defined period of time, as independently verified and validated by a FedRAMP-accredited third-party assessment organization (3PAO).

The contractor must comply with TWC's requirement that all data remain in the United States and meet TWC's stringent privacy and security requirements.

TWC's privacy and security requirements include the following:

• Protecting confidential TWC information, including personally identifiable information, from—at a minimum—unauthorized disclosure, unauthorized access, and misuse in accordance with the National Institute of Standards and Technology's (NIST) Special Publication 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), by establishing controls such as role-based access, encryption at rest, and encryption in transit
• Disposing of data in a manner that complies with NIST Special Publication 800-88, Guidelines for Media Sanitization.
• Complying with TWC's minimum encryption standards, that is, with the Federal Information Processing Standard (FIPS) 140-2, validated 256 bit, Advanced Encryption Standard (AES), and SHA-256 Cryptographic Hash Algorithm
• Complying with TWC's minimum cryptographic protocol Transport Layer Security (TLS) 1.1 (TLS 1.2 preferred) for protecting the security and privacy of communications over a computer network, including over the internet
• Maintaining continuous process improvement and vigilance to assess risks, monitor and test security protection, and implement changes needed to protect TWC data
• Cooperating fully with TWC's chief information security officer to detect and remediate vulnerability of the hosting infrastructure and/or the application
• Giving TWC access to the contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases, to the extent required to carry out FedRAMP assessments and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of the nonpublic TWC data that are collected and stored by the contractor

  The contractor must notify TWC about new or unanticipated threats or hazards or about safeguards that cease to function, as the issues are discovered.

• Complying with any additional FedRAMP privacy requirements
• Understanding that TWC has the right to perform manual or automated audits, scans, reviews, or other inspections of the IT environment being used to provide or facilitate services for TWC

In accordance with Federal Acquisition Regulation 52.239-1, the contractor must do as follows:

• Obtain the contract officer's written consent before publishing or disclosing the details of safeguards that the contractor designs, develops, or otherwise provides to TWC under contract (exception: disclosures to a consumer agency for the purposes of certifying or verifying authorization)
• Give TWC access within 72 hours to the contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases, to the extent required to conduct an inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of TWC data

  Inspections include vulnerability scans of authenticated and unauthenticated:

  • operating systems and networks;
  • web applications; and
  • database applications.

  Automated scans can be performed by TWC personnel (or agents acting on behalf of TWC) using equipment operated or authorized by TWC and using TWC-specified tools.

• Notify TWC immediately, if new or unanticipated threats or hazards are discovered, or if safeguards cease to function

If the contractor chooses to run its own automated scans or audits, results from the scans or audits may, at TWC's discretion, be accepted in lieu of vulnerability scans performed by TWC; however:

• the scanning tools and their configurations must be approved by TWC; and
• the complete results must be provided to TWC.

3.11.3 Record Retention

The contractor retains financial and supporting documents, statistical records, and any other records pertinent to the services provided under the contract for which a claim or report was submitted to TWC-VR.

Records and documents must be kept for three years after the final bill is submitted or until all billing-related questions are resolved, whichever is later.

TWC may suspend a contractor from providing services, goods, and equipment on a temporary basis for reasons such as:

• suspected fraud;
• suspected customer abuse;
• failure to meet contract specifications; or
• failure to perform according to the terms and conditions of the contract.

Depending on the type and severity of the noncompliance, TWC may require the contractor to take corrective action to return to compliance, before the contractor can resume providing services.

TWC may impose adverse actions along with, or instead of, requesting a corrective action plan. For example, TWC may recoup overpayments from a contractor as part of a corrective action plan. Some situations may require TWC to impose more serious adverse action, such as contract termination and debarment, without allowing the contractor to take corrective action.