PWS_Lab_Testing__11-4-15__DRAFT.pdf

Performance Work Statement (PWS)

Lab Testing

11/04/2015

Version 1.0

Vision Statement

1.0 Introduction

1.1 Scope

1.2 Mission

2 General Requirements

2.1 Non-Personal Services

2.2 Business Relations

2.3. Contract Management

2.4 Training Requirements

2.5 Contract Administration

2.6 Contractor Personnel, Disciplines, and Specialties

2.7 Period and Place of Performance

3 Performance Requirements / Tasks

3.1 The contractor shall collect specimens located throughout the NIH campus;

3.2 The contractor shall perform specimen tests on-site at DLM Lab or off-site at contractor facility

3.3 The contractor shall provide value-added customer service

3.4 The Contractor shall maintain Standard Operating Procedures (SOP)

3.5 The Contractor shall maintain qualified and trained staff to perform services as required in the PWS

3.6 The Contractor shall submit recurring reports as described in the Deliverable Section of the PWS

3.7 The Contractor shall maintain hard and soft copies of test results and procedures

4.2 Transition

4.3 Government Furnished Equipment / Service

4.4 Contractor Furnished Equipment / Service

5 Deliverables

6.0 Quality

6.1 Quality Control Plan

6.2 Quality Assurance Surveillance Plan (QASP)

7.0 Safety and Security

7.1 Security

7.2 Safety

8.0 Laboratory

9.0 Health and Immunization Requirements

10.0 General Information

11.0 Applicable Directives

Performance Work Statement (PWS)

Lab Testing

Vision Statement

Timely collection and testing of Lab Specimens

1.0 Introduction

The National Institutes of Health (NIH) is a 234-bed biomedical research hospital with an active outpatient component. The Department of Laboratory Medicine (DLM) processes standard, esoteric and specialized laboratory tests at the NIH/Clinical Center (CC). The laboratories housed within the CC process and report approximately one million and seven hundred thousand (1,700,000) test results per year. The NIH has a unique research role, currently, the off-site reference laboratory performs approximately 31,000 tests per year. Off-site laboratory services support ongoing clinical research and clinical trials through the performance of unique or unusual tests. Because of the research focus, each sample requires a high degree of methodological and reference range uniformity to ensure consistency over time.

1.1 Scope

The scope of this contract is to obtain commercial laboratory services to test patient specimen as delineated in attachment A. To ensure the continuity and uniformity required for long-term clinical studies, the efficient use of patient specimens and DLMs resources are critical to the success of NIH.

The contractor shall perform commercial tests for various types of specimens off-site using prescribed methodologies at approved laboratories as listed in attachment A. This list is only an estimate of the programmatic requirement. Attachment A is subject to reduction or expansion based on program need. Due to the unknown variables associated with research and patient care, the exact testing requirements cannot be determined, therefore, attachment A is subject to change. Any new tests required to meet the programmatic need shall be added to the contract through a bi-lateral modification. Newly added tests shall receive the same price reduction/discount as the contract pricing list. The contractor shall collect, document, and ship specimens off-site to a contractor or subcontractor approved laboratory facility for testing. Note it is imperative that changes in reference ranges and methodologies be limited during the length of the contract because the laboratory results will be used in clinical trials.

1.2 Mission

NIH’s mission is to seek fundamental knowledge about the nature and behavior of living systems and the application of that knowledge to enhance health, lengthen life, and reduce illness and disability.

The goals of the agency are:

to foster fundamental creative discoveries, innovative research strategies, and their applications as a basis for ultimately protecting and improving health;

to develop, maintain, and renew scientific human and physical resources that will ensure the

Nation's capability to prevent disease;

to expand the knowledge base in medical and associated sciences in order to enhance the

Nation's economic well-being and ensure a continued high return on the public investment in research; and to exemplify and promote the highest level of scientific integrity, public accountability, and social responsibility in the conduct of science. In realizing these goals, the

NIH provides leadership and direction to programs designed to improve the health of the Nation by conducting and supporting research:

in the causes, diagnosis, prevention, and cure of human diseases;

in the processes of human growth and development;

in the biological effects of environmental contaminants;

in the understanding of mental, addictive and physical disorders; and in directing programs for the collection, dissemination, and exchange of information in medicine and health, including the development and support of medical libraries and the training of medical librarians and other health information specialists.

2 General Requirements

The Contractor shall perform commercial tests for various types of specimens off-site using prescribed methodologies at approved laboratories as listed in attachment A. The contractor shall collect, document, and ship specimens off-site to a contractor or subcontractor approved laboratory facilities for testing. The requirement also requires operation of a system of patient records. Thus, the Privacy Act requirements are applicable. The Contractor and its employees are subject to criminal penalties for violations of the Privacy Act (5 U.S.C.552a (I). Hence, the

Contractor shall assure that its employees abide by prescribed rules of the Privacy Act.

2.1 Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are of the nature of personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, it shall be the contractor's responsibility to notify the Contracting Officer immediately.

2.2 Business Relations

The Contractor shall successfully integrate and coordinate all activity needed to execute the requirement. The Contractor shall manage the timeliness, completeness, and quality of problem identification. The Contractor shall provide corrective action plans, proposal submittals, timely identification of issues, and effective management of subcontractors. The contractor shall seek to ensure customer satisfaction and professional and ethical behavior of all contractor personnel.

2.3. Contract Management

The Contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to the requirement. The Contractor must maintain continuity between the support operations on-site at NIH and the Contractor's corporate offices.

2.4 Training Requirements

The Contractor shall ensure that each contract employee completes any mandatory

Government or other unique training requirements in accordance with NIH procedures.

Government Unique Training: The Government may elect to provide unique Government training to contract employees that are performing services under this contract. If the

Government elects to provide such training, the Government will provide such training at no additional expense to the contract employee. When directed by the Contracting Officer, (CO), the contract employee shall attend all such training in a paid status as part of the normal services required and billed under the contract. Such training shall require a performance commitment by the contract employee and the contractor shall reimburse the Government (by means of a credit on the next months invoice) if a contract employee fails to satisfy the performance commitment after the contract employee receives the unique Government training.

The amount of the reimbursement shall be the prorated cost of training and the number of months by which the contract employee fails to complete the performance commitment. The length of the performance commitment shall be 12 months or until the end of performance under the contract/task order, whichever first occurs. Contract employees that require access to

Government Information Systems with access to a government information system must successfully complete the Federal Governments Information Assurance Awareness training prior to access to the information systems and then annually thereafter.

Computer Training - Contract employees who have any interaction with the federal Government computer systems must receive training for the applicable system(s). The Contracting Officer’s

Representative (COR) will coordinate the necessary computer training. The training will be on-site and during normal duty hours. This training will be at no cost to the contractor.

Hours for attending any of the above shall be compensated at the regular hourly rate established in the contract/task order.

2.5 Contract Administration

The Contractor shall establish processes and assign appropriate resources to effectively administer the requirement. The Contractor shall respond to Government requests for contractual actions in a timely fashion. The Contractor shall have a single point of contact between the Government and Contractor personnel assigned to support contracts or task orders. The Contractor shall assign work effort and maintaining proper and accurate time keeping records of personnel assigned to work on the requirement.

2.6 Contractor Personnel, Disciplines, and Specialties

The Contractor shall accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience. The contractor shall match personnel skills to the work or task with a minimum of under/over employment of resources. The Contractor shall ensure the proposed labor categories meets or exceeds the

Staffing Qualifications defined below necessary to accomplish the tasks.

Staffing Qualifications:

Labor Category: Clinical Laboratory Technician

Education: Minimum High School Diploma, GED or Equivalent

Experience: Minimum of 1 year experience working in a laboratory or hospital setting, speak and write English proficiently, possess good communications skills, computer skills and a working knowledge of Medical Terminology

Unauthorized Services

The Contractor shall not undertake any action that will increase the price of the contract without the written approval of the Contracting Officer. Any such unauthorized action taken by the contractor or any Contractor employee, which might be construed to be approved by the

Government, shall be the responsibility of the Contractor and shall be resolved by the

Contractor at no expense to the Government. Third party claims resulting from such unauthorized actions shall also be resolved by the Contractor without expense to the

Government.

Smoking Policies within NIH Campus

The Contractor shall ensure that all employees comply with NIH’s Tobacco Free Campus smoking policies while performing services under this contract. The use of all tobacco products

(including cigarettes, cigars, pipes, smokeless tobacco, or other tobacco products) is prohibited at all times in all buildings and on all outside property or grounds, including parking areas on the

NIH Bethesda Campus.

2.7 Period and Place of Performance

The period of performance shall be 60 months from

Base: 03/01/2016– 02/29/2017;

Opt I: 03/01/2017– 02/28/2018;

Opt II: 03/01/2018 – 02/28/2019

Opt III: 03/01/2019 – 02/28/2020;

Opt IV: 03/01/2020 – 02/28/2021;

Packaging of specimens will take place on-site at the National Institutes of Health, Warren G.

Magnuson Clinical Center:

Department of Laboratory Medicine

Building 10, Room 2C324

10 Center Drive

Bethesda, Maryland 20892-1508

Regular work hours: The Contractor shall provide the services of two (2) on-site personnel not to exceed a 40-hour week consisting of an average of 8-hour workdays plus a 60 minute, lunch break. These uninterrupted coverage hours are normally from 7:30 AM to 5:00 PM. In the event the on-site contract personnel are required to work beyond the normal duty hours, their hours will be adjusted within the subsequent five days of performance by mutual agreement between the Contractor and the COR. The COR will provide the contractor a minimum of 5 calendar days advance notice if and when the normal hours are changed.

Absences: When anticipated contract personnel have not reported for duty, have become ill, or are unable to work during a scheduled shift, they must contact the Contractor and the designated Government official (COR). Absences due to emergency shall be called into the

COR and the Contractor within the first 2 hours of each duty day that he is unable to report to work.

Replacements: Absences such as vacations shall be coordinated and approved at least 30 days in advance and mutually agreed upon by the COR and the Contractor. Scheduled absences shall be limited to two (2) weeks. If requested by the COR, the Contractor shall provide replacements for all absences.

Contract employees working under this contract shall be paid only for hours actually worked at the hourly rates established in the contract. Payment to theContractor will not be made for temporary work stoppage due to circumstances beyond the control of the agency, such as acts of God, inclement weather, power outages, or temporary closing of facilities.

Overtime Service: This is defined as over 80 hours within a 10-day, Mon. Fri. period. The CO will authorize all overtime for the on-site personnel. The Overtime rate will be paid for hours worked at the hourly rate established in the contract.

Facility/Building Closures: During anticipated closure of the facility/building due to declared training holidays, administrative leave granted to the entire Government staff, or other closure, contract employees may not be required to perform services, unless specifically scheduled. In the event of unplanned closure of the facility due to natural disasters, emergency, or severe weather, contract on-site personnel who are scheduled to work, shall not report to work unless notified differently by the COR.

Federal Holidays: The following is a list of legal federal holidays as referred to elsewhere in the contract/task order. Contract employees may be required to work on legal holidays as determined by the COR.

New year’s Day, January 1st

Martin Luther King’s Birthday, 3rd Monday in January

Presidents Day, 3rd Monday in February

Memorial Day, Last Monday in May

Independence Day, July 4th

Labor Day, 1st Monday in September

Columbus Day, 2nd Monday in October

Veterans Day, November 11th

Thanksgiving Day, 4th Thursday in November

Christmas Day, December 25th

3 Performance Requirements / Tasks

The following section specifies the Performance Objectives and Performance Elements for the contract.

3.1 The Contractor shall collect specimens located throughout the NIH campus;

Performance Standards

a) Standard: safety procedures meeting or exceeding industry standards

Acceptable Quality Level (AQL): 99%

b) Standard: collect specimens for testing as delineated in Attachment A

Acceptable Quality Level: no more than 1 missed pick-ups per month

3.2 The contractor shall perform specimen tests off-site at the Contractor facility.

Deliverables

A001 Turn-Around Time (TAT) Report

A002 Quality Indicator Electronic Report

A003 Test Utilization Electronic Report

A004 Test Procedure Report

3.2.1 The Contractor shall conduct specimen tests off-site at an approved

Contractor or subcontractor Laboratory;

Performance Standards

a) Standard: Accurate, timely and testing methodology in accordance with Attachment A and turn-around within twenty four (24) hours dependent upon the test methodology; there is no flexibility in test methodology

AQL: 97%

Deliverables

A001 Turn-Around Time (TAT) Report

A002 Quality Indicator Electronic Report

A003 Test Utilization Electronic Report

A004 Test Procedure Report

A007 Quality Control Plan

3.3 The Contractor shall provide value-added customer service.

3.3.1 The Contractor shall provide on-site liaison customer service Monday through Friday.

Performance Standards

a) Standard: prompt, courteous, and professional customer service

Acceptable Quality Level: respond to questions within one (1) hour 95% of the time;

3.3.2 The Contractor shall provide remote technical advice, consultation, and/or customer service;

Performance Standards

a) Standard: In a timely manner, a well-qualified physician trained in laboratory medicine/pathology/medicine or a Board certified PhD with knowledge concerning the question is accessible for consultation 24 hours per day, seven days a week, 365 days a year.

Acceptable Quality Level: respond to questions within thirty (30) minutes 95% of the time;

3.4 The Contractor shall maintain Standard Operating Procedures (SOP).

Performance Standards

a) Standard: SOPs are up-to-date and accurate within thirty (30) days’ notice.

Acceptable Quality Level: Accurate SOPs with minimal to zero (0) re-work;

3.5 The Contractor shall maintain qualified and trained staff to perform services as required in the PWS.

Performance Standards

a) Standard: Contract employees are fully trained and qualified.

Acceptable Quality Level: Contract employee qualifications meet or exceed minimum qualifications requirement; refer to section 2.6 in PWS and complete mandatory NIH training requirements on time with no gap in service;

Deliverables

A006 New Employee Report

3.6 The Contractor shall submit recurring reports as described in the

Deliverable Section of the PWS.

Performance Standards

a) Standard: Thorough, accurate, and timely reports

AQL: minimal to zero re-work 99% of the time.

Deliverables

A001 Turn-Around Time (TAT) Report

A002 Quality Indicator Electronic Report

A003 Test Utilization Electronic Report

A004 Test Procedure Report

A005 Health and Immunization Report

A006 New Employee Report

A007 Quality Control Plan

3.7 The Contractor shall maintain hard and soft copies of test results and procedures

Performance Standards

a) Standard: SOPs are up-to-date and accurate within thirty (30) days notice.

AQL: minimal to zero re-work

4.2 Transition

The Contractor shall follow the transition plan submitted as part of the proposal and keep the

Government fully informed of status throughout the transition period. Throughout the phase-in/phase-out periods, it is essential that attention be given to minimize interruptions or delays to work in progress that would impact the mission. The Contractor must plan for the transfer of work control, delineating the method for processing and assigning tasks during the phase-in/phase-out periods.

4.3 Government Furnished Equipment / Service

The Government will provide the use of all available NIH facilities and support services, materials, publications and forms, and equipment required for contract performance. Contract employees shall keep Government furnished supplies, equipment and work areas in a safe, orderly and clean condition. Contract employees shall notify the Government whenever maintenance of equipment is required or whether equipment or items necessary for performance are missing or outdated and should be replaced. Contract employees shall abide by all NIH requirements for physical security of government property and equipment.

Telephones, facsimile machines, copiers and computer equipment are authorized for transaction of official Government business only and shall not be used for personal business.

Personal long distance calls are not authorized and the cost of all personal long distance calls made may be deducted from the contractors invoice payments. Telephones, facsimile machines and computer equipment are subject to communications security monitoring at all times.

Space used by Contract employees in performance of services may be used for other purposes during their absence. Items of clothing, personal effects, or equipment cannot be secured during their absence. The Government will not incur any liability for theft, damage to, or loss of personal items.

Contract employees may be issued keys. The Contract employees shall safeguard the keys from loss, theft or destruction, and must present for accountability purposes all keys signed for at scheduled or unscheduled key control inspections. The contractor shall be required to reimburse the Government for lost keys, or lockset (if locksets are required to be replaced) as a result of lost keys. The cost of replacement of keys/locksets may be deducted from payments to the contractor.

Cellular Phone and other communication devices - If cellular phone or other communication devices are provided, the Contract employees shall safeguard the items from loss, theft or destruction, and must present them for accountability purposes for a scheduled or unscheduled control inspection. The contractor shall be required to reimburse the Government for lost items.

The cost of replacement of lost items may be deducted from payments to the contractor.

4.4 Contractor Furnished Equipment / Service

SPECIMEN CONTAINERS:

The Contractor shall provide all specimen containers as well as the containers that will be used to pack the specimens. The Contractor shall also supply any dry ice or cool packs to maintain proper temperatures for shipping. The Contractor shall allow DLM to submit primary tubes for testing unless the ordered test requires special handling procedures. Aliquots will not be required except in those special circumstances. The Contractor shall provide all refrigerators and freezers including computers, monitors, printers or FAXs necessary to perform services delineated in the PWS.

INTERFACE COMPATIBILITY:

The Contractor shall supply evidence of high quality compatibility with SOFT Computer System

(SCC). Data security confidentiality must be demonstrated. Systems that interconnect, exchange, or share sensitive information need to meet the OMB A-130 requirement that "written management authorization (often in the form of a Memorandum of Understanding or

Agreement) be obtained prior to connecting with other systems and/or sharing sensitive data/information. The written authorization shall detail the rules of behavior and controls that must be maintained by the interconnecting systems. To meet this requirement it is imperative that a System Interconnection Security Agreement (ISA) and Memorandum of Understanding

(MOU) be focused on protecting the data exchanged.

The contractor may be required to design and build an interface with the government's SOFT computer System (SCC) currently in use.

If proposing a new interface, the contractor's proposed system must be compatible and interface with SOFT CLIENT Laboratory technology. The Contractor shall assume total ownership to provide cradle-to-grave service to include all costs, equipment, and labor for building the interface into the SOFT Computer System (SCC). Costs may include Validation test, IT Support, software upgrades, and transmission of laboratory results shall be borne by the contractor. The Contractor shall also provide IT support for solving any IT related issues after receipt of the award for the duration of the contract of 60 months.

The system must be ready for 'Live' Implementation no later than forty five (45) days after receipt of contract award. Technical information regarding this electronic system for management of laboratory data can be obtained from SOFT Computer Consultants, 5400 Tech

Data Drive, Clearwater Florida 33760, and www.softcomputer.com. The phone number is 1-

800-763-8522. Computer hardware and software systems utilized by the Contract laboratory must be compatible with SOFT technology. The Contractor shall maintain its system to ensure

100% operability.

The Contractor shall also provide a remote terminal and accession the test requests into their computer system. The Contractor shall transmit the test requests from the SOFT Computer LIS to the Contractor laboratory’s LIS. All tests that are not interfaced will have their results sent via an electronic format, such as a PDF. The interface from the Contractor’s LIS to the SOFT

Computer LIS shall be via secure VPN connection. The Contractor shall provide the data entry of all test results into the DLMs computer.

The turn-around time (TAT) for test result entry will be based on the Contractor’s standards and methodologies. The Contractor shall transmit result data from the Contractor’s LIS to the SOFT

Computer LIS and perform manual data entry for tests not interfaced.

5.0 Deliverables

The contractor shall provide deliverables as follows:

Number Name Frequency Quantity

A001 Turn-Around Time (TAT) Report monthly 66

Report demonstrating turn-around times of test results perform off-site. The report shall be composed of the client’s account number, the test names in alphabetical order, the test code, the CPT code, the name of the

Performing lab, the list fee, the client fee, the

Month to Date (MTD) charges, the MTD volumes, the Year to Date (YTD) charges, and the YTD volumes. The protocol for correcting any deficiencies.

A002 Quality Indicator Electronic Report monthly 66

Interface results of DLM's SOFT Computer

Laboratory Information System (LIS) with http://www.softcomputer.com/

Contractor's LIS are accurate to ensure prompt communication of test results. Report also includes the number of cancelled tests, the reason for each cancellation, the number of QNS specimens, and number of revised tests.

A003 Test Utilization Electronic Report monthly 66

Itemization of all MTD test volumes & charges, and YTD volumes & charges, with client prices and a Test Ordering Analysis

Report (TOA)

A004 Test Procedure Report as Required

Notification of test changes such as, reference range, methodology, test status, test delay, referral lab fee.

A005 Health and Immunization Report As Required 66

Health and Immunization Requirement

A006 New Employee Report monthly 66

Report of new employees.

A007 Quality Control Plan (QCP) Annually 5

Contractor's annual Quality Control Plan

(QCP);

6.0 Quality

6.1 Quality Control Plan

The Contractor shall develop a Quality Control Plan (QCP) and maintain an effective quality control program to ensure services are performed in accordance with the contract and this

PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which he assures himself that his work complies with the requirement of the contract.

The finalized QCP will be accepted by the Government at the time of the award of the contract.

The Contracting Officer may notify the Contractor of required modifications to the plan during the period of performance. The Contractor then shall coordinate suggested modifications and obtain acceptance of the plan by the Contracting Officer. Any modifications to the program during the period of performance shall be provided to the Contracting Officer for review no later than 10 working days prior to effective date of the change. The QCP shall be subject to the

Governments review and approval. The Government may find the QCP "unacceptable" whenever the Contractors procedures do not accomplish quality control objective(s). The

Contractor shall revise the QCP within 10 working days from receipt of notice that QCP is found

"unacceptable."

6.2 Quality Assurance Surveillance Plan (QASP)

Authority for issuance of this Quality Assurance Surveillance Plan (QASP) is provided under

Part 46 of the Federal Acquisition Regulation, Inspection of Services clauses, which provides for inspection, acceptance and documentation of the service called for in the contract or order. This acceptance is to be executed by the contracting officer or a duly authorized representative.

The QASP provides a systematic method to evaluate performance for the stated non-personal services contract. This QASP explains the following:

What will be monitored?

How monitoring will take place.

Who will conduct the monitoring?

How monitoring efforts and results will be documented.

This QASP does not detail how the contractor accomplishes the work. Rather, the QASP is created with the premise that the contractor is responsible for management and quality control actions to meet the terms of the contract. It is the Government's responsibility to be objective, fair, and consistent in evaluating performance. In addition, the QASP should recognize that unforeseen and uncontrollable situations may occur.

This QASP is a "living document" and the Government may review and revise it on a regular basis.

7.0 Safety and Security

7.1 Security

Security Requirements

NIH Information and Physical Access Security

NOTE: When security requirements relevant to the acquisition need to be included, the Project Officer (PO), I/C Information Systems Security Officer

(ISSO), and I/C Privacy Officer will assist the acquisitions staff in selecting the appropriate language

1. FEDERAL INFORMATION AND INFORMATION SYSTEMS

SECURITY:

Include when contractor/subcontractor personnel will (1) develop, (2) have the ability to access, or (3) host and/or maintain Federal information and/or Federal information system(s). For additional information, see:

HHS Information Security Program Policy at:

http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Progr am_Policy.pdf and

HHS Contractor Oversight Guide:

http://intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guid e.pdf

2. PERSONALLY IDENTIFIABLE INFORMATION (PII):

Include when contractor/subcontractor personnel will have access to, or use of, Personally Identifiable Information (PII), including instances of remote access to or physical removal of such information beyond agency premises or control. For additional information, see:

http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf http://intranet.hhs.gov/infosec/docs/policies_guides/ISPP/Information_Security_Program_Policy.pdf file:///C:/Users/zunigalu/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/0RQLXCZB/%09%09%20%20%20%20%20%20%20%20%20%20%20%20%20%20http:/intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guide.pdf file:///C:/Users/zunigalu/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/0RQLXCZB/%09%09%20%20%20%20%20%20%20%20%20%20%20%20%20%20http:/intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guide.pdf file:///C:/Users/zunigalu/AppData/Local/Microsoft/Windows/Temporary%20Internet%20Files/Content.Outlook/0RQLXCZB/%09%09%20%20%20%20%20%20%20%20%20%20%20%20%20%20http:/intranet.hhs.gov/infosec/docs/policies_guides/COG/Contractor_Oversight_Guide.pdf

OMB Memorandum M-06-15, Safeguarding Personally Identifiable

Information (05-22-06):

http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf

OMB Memorandum M-06-16, Protection of Sensitive Agency

Information (06-23-06):

http://www.whitehouse.gov/OMB/memoranda/fy2006/m06-16.pdf

OMB Memorandum M-06-19, Safeguarding Against and Responding to the Breach of

Personally Identifiable Information:

http://www.whitehouse.gov/omb/memoranda/fy2006/m06-19.pdf

Guide for Identifying Sensitive Information, including Information in Identifiable Form, at the NIH:

https://ocio.nih.gov/InfoSecurity/ISSO/Documents/NIH_Sensitive_Info_Guide.pd f

3. PHYSICAL ACCESS TO A FEDERALLY-CONTROLLED FACILITY:

Include when contractor/subcontractor personnel will have regular or prolonged physical access to a “Federally-controlled facility,” as defined in FAR Subpart 2.1.

For additional information, see:

Homeland Security Presidential Directive/HSPD-12, Policy for a Common

Identification Standard for Federal Employees and Contractors (08-27-04):

http://www.gpo.gov/fdsys/pkg/WCPD-2004-08-30/pdf/WCPD-2004-08-30-Pg1709.pdf

OMB Memorandum M-05-24, Implementation of Homeland Security Presidential

Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal http://www.whitehouse.gov/omb/memoranda/fy2006/m-06-15.pdf http://www.whitehouse.gov/OMB/memoranda/fy2006/m06-16.pdf http://www.whitehouse.gov/omb/memoranda/fy2006/m06-19.pdf https://ocio.nih.gov/InfoSecurity/ISSO/Documents/NIH_Sensitive_Info_Guide.pdf https://ocio.nih.gov/InfoSecurity/ISSO/Documents/NIH_Sensitive_Info_Guide.pdf http://www.gpo.gov/fdsys/pkg/WCPD-2004-08-30/pdf/WCPD-2004-08-30-Pg1709.pdf

Employees and Contractors (08-05-05):

http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf

Federal Information Processing Standards Publication (FIPS PUB) 201-1 (Updated

June 26, 2006): http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf

ARTICLE H. . NIH INFORMATION AND PHYSICAL ACCESS SECURITY

This acquisition requires the Contractor to [select all that apply from the drop down box] develop, have the ability to access, or host and/or maintain Federal information and/or Federal information system(s).

access, or use, Personally Identifiable Information (PII), including instances of remote access to or physical removal of such information beyond agency premises or control.

have regular or prolonged physical access to a “Federally-controlled facility,” as defined in FAR Subpart 2.1.

The Contractor and all subcontractors performing under this acquisition shall comply with the following requirements:

NOTE: Based on information provided by the ISSO and PO, select the appropriate general information type(s) below, AND list the specific element(s) within http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf those information types that are relevant to the acquisition. For additional information, see:

- For Administrative, Management, and Support Information, use NIST SP

800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, APPENDIX C, Table 3, at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-

Rev1.pdf

- For Mission Based Information, use NIST SP 800-60, Volume II:

Appendices to Guide for Mapping Types of Information and Information

Systems to Security Categories, APPENDIX D, Table 5, at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-

Rev1.pdf ) ****

a. Information Type

[ ] Administrative, Management and Support Information:

[ X] Mission Based Information:

_____PHI/PII_________________________

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

**** (INCLUDE THE FOLLOWING IN ACQUISTIONS AND SOLICITATIONS WHEN

PRESCRIPTIONS 1 AND/OR 2 ABOVE APPLY TO THE ACQUISITION. NOTE:

Based on information provided by the ISSO and Project Officer, select the Security

Level for each Security Category and the Overall Security Level, which is the highest level of the three factors (Confidentiality, Integrity, and Availability).

For additional information, see NIST SP 800-60, Volume II: Appendices to Guide for

Mapping Types of Information and Information Systems to Security Categories, Appendices C and D, at http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-

60_Vol2-Rev1.pdf ; and Table 1: Security Categorization of Federal Information and

Information Systems, at https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Pages/table1.aspx )

b. Security Categories and Levels

Confidentiality Level: [ ] Low [x] Moderate [ ] High

Integrity Level: [ ] Low [ ] Moderate [x] High

Availability Level: [ ] Low [x] Moderate [ ] High

Overall Level: [ ] Low [ ] Moderate [x] High

**** (INCLUDE THE FOLLOWING IN ACQUISITIONS AND SOLICITATIONS WHEN

PRESCRIPTIONS 1, 2, AND/OR 3 ABOVE APPLY TO THE ACQUISITION. NOTE:

Based on information provided by the ISSO and Project Officer, check all levels http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Pages/table1.aspx that apply. For additional information, see Table 2, Position Sensitivity Designations for

Individuals Accessing Agency Information at:

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Pages/table2.aspx)

c. Position Sensitivity Designations

The following sensitivity level(s), clearance type(s), and investigation requirements apply to this contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to

Level 6 positions shall undergo a Suitability Determination and Background Investigation (BI).

[X] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to

Level 5 positions with no previous investigation and approval shall undergo a Suitability

Determination and a Minimum Background Investigation (MBI), or a Limited Background

Investigation (LBI).

[ ] Level 1: Non-Sensitive Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Agency Check and Inquiry

Investigation (NACI).

The Contractor shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under this acquisition where the

Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Project Officer, with a copy to the Contracting

Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The

Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability

Investigations," is available for contractor use at https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_

10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Pages/table2.aspx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx

Suitability Investigations are required for contractors who will need access to NIH information systems and/or to NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH ID Badge. Each contract employee needing a suitability investigation will be contacted via email by the NIH Office of Personnel Security and Access

Control (DPSAC) within 30 days. The DPSAC email message will contain instructions regarding fingerprinting as well as links to the electronic forms contract employees must complete.

Additional information can be found at the following website:

http://idbadge.nih.gov/background/index.asp

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

d. Information Security Training d.1 Mandatory Training

All employees having access to (1) Federal information or a Federal information system or (2) personally identifiable information, shall complete the NIH Information Security and Privacy

Awareness Training course at http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, employees having access to the information identified above shall complete an annual NIH-specified refresher course during the life of this contract. The

Contractor shall also ensure subcontractor compliance with this training requirement.

d.2 Role-based Training

HHS requires role-based training when responsibilities associated with a given role or position, could, upon execution, have the potential to adversely impact the security posture of one or http://idbadge.nih.gov/background/index.asp http://irtsectraining.nih.gov/ more HHS systems. Read further guidance at: Secure One HHS Memorandum on Role-Based

Training Requirement“

For additional information see the following:

https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.

aspx

The Contractor shall maintain a list of all information security training completed by each contractor/subcontractor employee working under this contract. The list shall be provided to the

Project Officer and/or Contracting Officer upon request.

e. Rules of Behavior

The Contractor shall ensure that all employees, including subcontractor employees, comply with the NIH Information Technology General Rules of Behavior, which are available at https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/NIH_IT_GeneralRu lesofBehavior.aspx .

f. Personnel Security Responsibilities

1. The Contractor shall notify the Contracting Officer, Project Officer, and I/C ISSO within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this contract. The Government will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

2. The Contractor shall provide the Project Officer with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and suitability determination level held by the former incumbent.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

3. The Contractor shall provide the Project Officer with the name, position title, and suitability determination level held by or pending for departing employees.

http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html http://intranet.hhs.gov/infosec/docs/policies_guides/RBT/Definition_of_SSR_Security_RBT_Implementation_FINAL_(3).html https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.aspx https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/rolebasedtraining.aspx https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/NIH_IT_GeneralRulesofBehavior.aspx https://ocio.nih.gov/aboutus/publicinfosecurity/securitytraining/Pages/NIH_IT_GeneralRulesofBehavior.aspx

Perform and document the actions identified in the Contractor Employee Separation

Checklist (https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf) when a Contractor/subcontractor employee terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting

Officer upon request.

g. Commitment to Protect Non-Public Departmental Information and Data

1. Contractor Agreement

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or

Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential

Information)

- Public Law 96-511 (Paperwork Reduction Act)

2. Contractor Employee Non-Disclosure Agreement

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non-Public Information –

Contractor Employee Agreement A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under this acquisition.

3. System Interconnection Security Agreement (ISA) and Memorandum of Understanding

(MOU)

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf http://irtsectraining.nih.gov/NIH_Non-Disclosure_Agreement.pdf http://irtsectraining.nih.gov/NIH_Non-Disclosure_Agreement.pdf

Systems that interconnect exchange or share sensitive information need to meet the OMB A-

130 requirement that "written management authorization (often in the form of a Memorandum of

Understanding or Agreement,) be obtained prior to connecting with other systems and/or sharing sensitive data/information. The written authorization shall detail the rules of behavior and controls that must be maintained by the interconnecting systems." To meet this requirement it is required a System Interconnection Security Agreement (ISA) and Memorandum of

Understanding (MOU) focused on protecting the data exchanged.

An MOU and/or ISA will be required for any remote vendor access the NIHnet in order to ensure adequate security and the protection of the NIHnet.

NIH ISA Template and NIH MOU Template are available at https://ocio.nih.gov/InfoSecurity/Policy/Pages/NIH_ISA_Templates.aspx

NIH security policies and standards are reflected in the NIH Information Security Policy

Handbook, April 29, 2015. This system, device, and/or interconnection must comply with these policies and standards.

h. NIST SP 800-53 Assessment

This contract requires the Contractor to develop, host, and/or maintain a Federal information system at the Contractor’s or any subcontractors’ facility. The Contractor shall submit an annual information security assessment using NIST SP 800-53, Recommended Security Controls for

Federal Information Systems. The assessments shall be due annually within 30 days after the anniversary date of the contract, with the final assessment due at contract completion. The assessments shall be based on the Federal IT Security Assessment Framework and NIST SP

800-53 at:

NIST SP 800-53, Rev. 4 http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf https://ocio.nih.gov/InfoSecurity/Policy/Pages/NIH_ISA_Templates.aspx http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

The Contractor shall ensure that all of its subcontractors (at all tiers), where applicable, comply with the above reporting requirements.

i. Information System Security Plan (ISSP)

The Contractor shall update the acceptable ISSP submitted in their proposal every three years following the effect date of the contract or when a major modification has been made to its internal system. One copy each shall be submitted to the Project Officer and

Contracting Officer.

j. Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data

Breach

The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident

Response Team via email (IRT@mail.nih.gov) within one hour of discovering the incident. The

Contractor shall follow-up with IRT by completing and submitting one of the following two forms within three (3) work days:

https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_IT_Security_Incident_Response_Plan.p df

NIH PII Spillage Report https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_PII_Spillage_Proced.doc

NIH Lost or Stolen Assets Report http://ocio.nih.gov/docs/public/Lost_or_Stolen.doc

k. Data Encryption mailto:IRT@mail.nih.gov https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_IT_Security_Incident_Response_Plan.pdf https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_IT_Security_Incident_Response_Plan.pdf https://ocio.nih.gov/InfoSecurity/Policy/Documents/NIH_PII_Spillage_Proced.doc http://ocio.nih.gov/docs/public/Lost_or_Stolen.doc

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the Project Officer, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Information Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/groups/STM/cmvp/

2. The Contractor shall secure all mobile devices, including non-HHS laptops and portable media that contain sensitive HHS information by using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted information can be decrypted and accessed by authorized personnel. Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by “OMB Guidance to Federal Agencies on Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

Encryption key management shall comply with all HHS and NIH policies

(http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store information shall be encrypted until it is sanitized or…