Attachment_A.pdf

SOLICITATION: 16-223-SOL-00101

Attachment A

COMPREHENSIVE DATA MANAGEMENT SERVICES

1. INTRODUCTION

The mission of the Food and Drug Administration (FDA) is to protect the health of the American public (www.fda.gov). For more than one hundred (100) years, FDA has been the international leader ensuring safe food, cosmetics, human drugs, biologics, veterinary products, medical and radiological devices, and tobacco products. As part of its mission the FDA receives documents from a variety of public and private entities including regulated industry. Throughout FDA‘s history, document control and records management has played a vital role in the Agency’s regulation process and, ultimately, in the mission to protect public health. This allows FDA to comply with federally mandated document control and record keeping requirements while maintaining a high level of accountability to the citizens of the United States. To ensure proper organization and management of documents and records materials, the FDA complies with regulations set forth in the Federal Records Act per United States Code (U.S.C.), Title 44, Chapters 29 thru 33; Title 36 Code of Federal Regulations (CFR), Chapter 12; and National Archives and Records Administration (NARA) guidance.

2. BACKGROUND

The Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy, and security of all FDA regulated products such as human and veterinary drugs, biological products, medical devices, food and dietary supplements, cosmetics, and products that emit radiation. The FDA receives materials in multiple forms to include but not limited to paper, electronic submissions via online portals, and physical electronic media (diskettes, microfilm, CD, DVD, removable drives). Record materials include but not limited to letters, memoranda, completed forms, statistical and narrative reports, graphics, photographs, and audio / video recordings. In addition, FDA receives physical artifacts such as labels, bottles, syringes, laboratory samples, feed bags, and boxes. FDA records may be stored in a variety of formats including paper, physical electronic, and microform, and server base e-records repositories. FDA receives these reports by electronic submission, mail, phone, fax, email, and via the internet.

The FDA Centers who may participate in this contract include:

Center for Drug Evaluation and Research (CDER) Center for Biologics Evaluation and Research (CBER) Center for Devices and Radiological Health (CDRH) Center for Food Safety and Applied Nutrition (CFSAN) Center for Veterinary Medicine (CVM) Center for Tobacco Products (CTP)

The FDA has many Centers with different responsibilities associated with protecting the public health for the safety, efficacy and security of human and veterinary drugs, biological products, medical devices, tobacco products, food supply, and products that emit radiation. To this goal, the Data Management Program will provide a structure for the Contractor to provide diverse data management services.

Over time, FDA intends to replace multiple current legacy processes and data systems that are used for the receipt, processing, validation, and assessment of received reports. These transitions may require the adoption of new software, new internet portals, revised Standard Operating Procedures (SOPs), and additional staff training under this contract. Additionally, FDA intends to adopt emerging data exchange standards which may impact future electronic submission procedures. As FDA transitions to new technologies, it is expected that tasks under this contract will be impacted. These impacts will be assessed as they occur and modifications to task orders under this contract may need to be considered.

3. OBJECTIVES:

FDA requires a comprehensive solution to best accomplish Center specific mission objectives to satisfy operational data management requirements. These objectives include the following:

• Data entry and record management

• Implement and promote operational and cost efficiencies

4. PROJECT SCOPE

The Government requires data management support services that include:

• Receiving data in a variety of physical and electronic formats

• Document data entry services, data analysis, tracking services, and stakeholder/user support.

• Sorting and routing this data to the correct work area or correct FDA Center that regulates the product described

• Scanning physical documents into electronic formats if neededReviewing electronic submissions and making necessary corrections

• Entering and indexing data into FDA computer system

• Medical coding of reports using various taxonomies (Eg., MedDRA, VeDDRA)

• Performing Quality Assurance and Quality Control on data

• Participating in the testing and validation of new software systems used to support new and more efficient data entry systems

5. TASKS AREAS

The Government requires a comprehensive solution to satisfying the stated objectives which provide all necessary services, qualified personnel, material, equipment, tools and methodologies, not otherwise provided and subject to approval by the FDA, to perform the following tasks:

• Task Area 1: Record Management Maintenance

• Task Area 2: Document Processing, Handling, Correspondence, and Delivery

• Task Area 3: Document Scanning, Photocopy, and Conversion Services

• Task Area 4: Data Management Migration and Process Changes

• Task Area 5: Tracking and Temporary Storage of Government Records

• Task Area 6: Program and Task Order Management Support

• Task Area 7: Process and Procedure Improvement

5.1. TASK AREA 1: MAINTENANCE OF RECORDS MANAGEMENT

As tasked, the Contractor shall upload inventories of documents and records information into Center-specific tracking systems and databases.

Representative activities for Individual Task Orders (ITOs) include but are not limited to:

• Ensure all aspects of processing incoming record materials are accurate, consistent, and complete

• Scan paper reports and upload them into the appropriate FDA repositories

• Process electronic data into FDA repositories

• Prepare and enter metadata elements into information systems

• Conduct data abstraction

• Code and index submittals and other documents

• Correct data entry errors

• Respond and resolve questions from FDA and industry reporters, including those who must register within FDA systems

• Resolve issues related to document control functions for regulatory submissions

• Assign user roles and responsibilities as directed by records managers

• Perform redaction of submittals

• Retroactive cleanup of electronic record material resulting from new FDA procedures

5.2. TASK AREA 2: DOCUMENT PROCESSING, HANDLING,

CORRESPONDENCE, AND DELIVERY

The Contractor shall be responsible for document receiving, handling and delivery of all record material in accordance with standard business procedures. Contractor staff shall receive United States Postal Service (USPS) mail and deliveries via commercial and private couriers. . The Contractor shall be required to sort mail, prioritize, triage, scan, bar-code/track, and distribute record materials to the FDA community or coordinate. The Contractor shall be responsible for tracking all documents to and from the facility and FDA’s various locations.

The Contractor shall provide user support services to internal and external stakeholders. In addition, but not limited to, the Contractor shall perform the following tasks related to document and records information processing:

• Provide courier service to multiple FDA facilities each weekday, as tasked. The Contractor shall have the capability to provide expedited delivery services of FDA materials within the timeframes of the Center specific task orders.

• Possess the capability to deliver records materials after hours. After hours are after normal business hours Monday through Friday, weekends, and holidays.

Contractor is responsible for providing back-up couriers/drivers services.

• Be responsible for providing courier services and distributing mail and stored files between off-site and on-site locations and coordinating pick-up and drop-offs as identified in ITOs.

The FDA distributes documents and records materials to FDA employees, managers, and Contractor staff. New incoming record materials are primarily distributed to the FDA reviewer community.

Representative activities include but are not limited to:

• Processing reports and other documents to include, but not limited to, triaging, registering (logging), tracking, indexing, imaging or scanning, data entry, data entry quality control, updating of data records including resolving duplicates and conflicting information , updating of data records (to include resolving duplicates and conflicting information), reviewing, editing, coding, coding quality control (QC), coding quality assurance (QA), case linking, filing and redacting, distributing, archiving, and disposal of physical media. Specific controlled vocabularies are utilized by each Center to standardize key data elements.

• Processing incoming record material information from follow-up requests as outlined in item number one to include updating and linking to the existing database records.

• Process general correspondence and route to the appropriate Office or Agency as required by each Center.

• Processing CDER/CBER/CVM/CFSAN/CTP adverse event reports,CDRH Manufacturer Device Reports, CDRH premarket regulatory submissions, and providing stakeholder support to industry in to register and list within FDA systems.

• Processing incomplete record material as required by each Center.

• Route record material sent to the FDA to the appropriate Center or Federal Agency.

• Re-route record material sent to the FDA in error to the appropriate Center or Federal

Agency.

• Sending FDA generated letters as required by each Center.

• Processing requests for information such as FOIA requests as required by each

Center.

• Image, store, and load the paper reports into an optical image database as required by each Center

• In the event that an electronic submission portal is unavailable due to technical failure for an extended time, the Contractor shall receive and log physical media containing record material at the direction of the Contracting Officer’s Representative (COR)

• Collaborate with the FDA COR and Representatives to assess current processes and recommend process and technology improvements, including implementation strategies, to improve efficiency while maintaining high quality, timely processing

• Document data entry services, data analysis, tracking services, and stakeholder/user support.

5.3. TASK AREA 3: DOCUMENT SCANNING, PHOTOCOPYING, AND

CONVERSION SERVICES

The Contractor shall furnish the necessary personnel, materials, services, and facility to do all things necessary for or incident to the performance of the work required for off-site scanning.

Scanning services range from digitizing legacy material to processing new physical documents and records material. The majority of scanned services will be paper to electronic images. The Contractor will also be tasked to convert material such as film, videos, microfiche, blowbacks, and physical artifacts into digitized images. Requirements for off-site scanning, photocopying, and conversion services will vary from Center to Center and will be outlined in the ITOs.

• Coordinate and track drop-off and pick-up

• Prepare physical documents/files for imaging Image document/files

• Provide duplicate copies of submission as requested by authorized officials

• Provide photocopying services

• Provide methodology for digitizing images other than paper such as oversized material and physical artifacts

• Provide image standards for black & white or color with a minimum of 300 Dots per

Inch (DPI). Images will adhere to formats (PDF, PDF/a, TIFF, etc.)

• Process images for Optical Character Recognition (OCR)

• Re-assemble documents/files to the pre-image condition

• Index images in specific FDA tracking systems

• Load images to a FDA electronic records repository or copied to other media

• Complete various quality control checks throughout the imaging process ensuring consistent image capture, indexing and repository upload/media transfer

5.4. TASK AREA 4: Data Management Migration and Process Changes FDA reserves the right to replace multiple current legacy processes and data systems that are used for the receipt, processing, validation, and assessment of received reports which may require the adoption of new software, new internet portals, revised SOPs, and additional staff training under this contract. Additionally, FDA intends to adopt emerging data exchange standards which may impact future electronic submission procedures.

As tasked the Contractor will be expected to participate in requirement analysis and user acceptance testing. They will also be expected to help design training programs for their data entry staff to use these systems and to update SOP’s and business rules accordingly.

5.5. TASK AREA 5: TRACKING AND TEMPORARY STORAGE OF

GOVERNMENT RECORDS

The Contractor shall adhere to Center specific retention and disposition rules as directed by the COR. The FDA classifies retention and disposal schedules by the following record types: administrative, program, or Center-Specific. The Agency regularly analyzes, develops, produces, and updates FDA Record Control Schedules (RCS(s)) for the Agency, as well as for the individual Centers.

• Adhere to retention and disposition schedules as part of identifying files to be moved to off-site locations for cataloguing and temporary storage and/or disposition;

• Support off-site storage programs, including the Federal Records Centers (FRC), FRC System, and Agency approved commercial storages vendors;

• Provide temporary storage periods which range significantly and will be contingent on the types of document and records;

• Dispose of records material by prepping documents for disposal, coordinating with

• disposition Contractor for drop off and pick up, shredding, donation, and accession of records to another FDA approved facility;

• Provide certificates of destruction upon request;

• On a real-time basis, update the inventory of documents and records accordingly

The Contractor is responsible for following all Federal Health Insurance Portability and Accountability Act (HIPAA) regulations dealing with the privacy of individuals.

TASK AREA 6: PROGRAM AND TASK ORDER MANAGEMENT SUPPORT

The Contractor shall provide the program management services necessary to plan, structure, coordinate, schedule, manage, communicate, report, and steward all defined ITOs and requirement activities. The Contractor shall provide both Indefinite Delivery Indefinite Quantity (IDIQ) Contract-Level Program Management support and Task Order-level Project Management support to establish control, management, monitoring, and notification mechanisms and shall work with the Government Contracting Officer (CO), Contracting Officer’s Representative (COR) and subject matter experts (SMEs) to ensure that all tasks stay on track and important milestones are met.

Meetings:

The Contractor shall participate in various meetings for the IDIQ contract and, as required, for each task order. If required, the Contractor shall prepare the following: meeting agenda, minutes or notes, issues and action items. Additionally, the Contractor may be required to distribute the related documentation (generally by email), and actively contribute to the meetings.

At a minimum, the Contractor shall convene and participate in the following meetings relating to the overall IDIQ contract:

• Contract Kickoff Meeting – Contractor will coordinate this meeting within 15 working days of contract award. Purpose of this meeting is to introduce Contractor staff to the government staff that will be managing the contract. Additionally, Contractor will begin work with the COR (and, if necessary, the CO) to determine the course of future status update meetings and the government’s expectations for reporting.

• Semi-Annual Update Meetings – Contractor shall coordinate quarterly meetings with responsible government staff (COR, and if necessary, CO) for the purpose of reporting the status of the overall contract and the individual task orders. During these meetings, Contractor shall report on costs and burn rates, schedule, demonstrations, presentations, transitions activities, site visits and any other factors which may impact task orders or the overall contract.

The Contractor shall convene and participate in the following meetings as defined in each Task Order:

• Task Order Kickoff Meeting - Contractor will coordinate this meeting within 10 working days of contract award. Purpose of this meeting is to introduce Contractor staff to the government staff that will be managing the task order. This meeting will include expectations for future work and follow-on meetings to report on task order costs and burn rates, schedule, demonstrations, presentations, transitions activities, site visits, and any factors which may impact the task order.

• Status Update Meetings – Contractor shall coordinate meetings with responsible government staff (Task Order COR, and if necessary, IDIQ COR and/or CO) for the purpose of reporting the status of the task order. During these meetings, Contractor shall provide progress reports on costs and burn rates in various formats such as tables, graphs and statistical reports. Additional information addressed shall include scheduling, demonstrations, presentations, transition activities, site visits, any other factors which may impact the task order.

Non-Data Entry Tasks

• Maintain written and posted standard operating procedures

• Respond to FDA staff and industry questions regarding status of submissions

• E-mail correspondence to establishments via GovDelivery or eMail

• Mail correspondence (by postal mail) to establishments, as directed

• Coordinate response to ad-hoc requests such as extracting and reporting specific data on record materials which have been reported

• Facilitate orientation sessions and/or data entry demonstration tours, not limited to

FDA personnel, as required by each Center with the CORs approval of all Non- Government personnel participation in any orientation and/or data entry demonstration tours

• Conduct off-boarding by ensuring proper exit criteria are followed when Contractor employee leaves projects

Staff Training

• The Contractor shall support and verify that all personnel including new hires have the education, experience and training necessary to perform their duties and successful performance of contract requirements in terms of protocols for data-entry, quality control and various standardized coding technology

• Schedule, participate in and track required FDA training

• Develop implement, and update a Management Plan to include communication plan, quality control plan, quality assurance plan, training plan, contingency plan, IT security plan and staffing plan o Management personnel for the administration and oversight of all phases of ITOs and IDIQ contract o Management Plan to be developed in terms of technical approach, organizational resources and management control o Plan, organize, secure and manage resources with appropriate knowledge and skills o Manage Contractor staff and provide subcontractor management

• Safeguard all FDA confidential information

TASK AREA 7: PROCESS AND PROCEDURE IMPROVEMENT

Process and Procedure Improvements:

The Contractor shall provide ongoing reviews of existing processes and procedures to identify areas where improvements can be made as well as recommend changes that will benefit the quality, efficiency and/or effectiveness of the FDA’s standard operating procedures and business rules The Contractor shall research, plan, collect, analyze, recommend and implement changes to FDA processes and procedures, which may include for example: create and document processes and procedures according to organizational format templates, document as-is and to-be performance baselines, support the development and implementation of performance measures and surveillance methods.

The Contractor will be working closely with FDA software integration teams in User Acceptance Testing (UAT). The Contractor shall work with FDA on quality metrics to measure the effectiveness of new software on existing data entry processes

Some ways in which improvements may be identified and addressed include:

• Participation in FDA working groups

• Reviewing deliverables and providing comments/recommendations as appropriate

• Promoting common or enterprise wide process improvements

• Raising visibility of analysis and recommendations to the IDIQ COR during contract management reviews to promote cross program integration

• Supporting the testing of new software

Transition:

The Contractor shall provide all management, administrative, clerical, and supervisory functions required for the effective and efficient performance of this contract.

A smooth and orderly transition between the Contractor and a predecessor or successor Contractor is necessary to ensure minimum disruption to vital Government business. The Contractor shall cooperate fully in the transition. The Contractor shall adhere to the same professional and ethical standards of conduct required of Government personnel.

The Contractor shall NOT:

• Discuss with unauthorized persons any information obtained in the performance of work under this contract

• Conduct business not directly related to this contract on Government premises

• Use computer systems and/or other Government facilities for company or personal business other than work related to this contract

• Recruit on Government premises or otherwise act to disrupt official

Government business

It is the Government’s intention to perform closeout procedures on an ITO basis as well as for the IDIQ Contract. The Contractor agrees to perform those internal functions necessary to support this process in a timely manner. The task order closeout will occur as soon as possible after required audit and establishment of final rates, as applicable.

6. REQUIREMENTS AND CONTRAINTS

INFRASTRUCTURE AND EQUIPMENT REQUIREMENTS

• All infrastructures must obtain an Authorization to Operate (ATO) certificate from FDA

- which certifies the Contractor’s offsite facility and IT equipment that are proposed to process FDA’s documents - are compatible with FDA’s physical and logical environments.

• Non-Approved equipment not on the MAT List must go through a formal FDA Technical approval process. The FDA has instituted the Information Technology Information Management (ITIM) approval process in order to track technologies across the agency. The introduction of a new technology or a different version of an already approved technology requires the submission and approval of an ITIM request. The Contractor may be responsible for supporting the ITIM process including writing and submitting ITIM requests and tracking them from inception through completion. FDA Center IT Investment Review Boards may need to be included in a coordinated review process. Additionally, the Government may stipulate salient characteristic requirements for vendor-provided equipment coupled with mandatory IT security software installation.

• All activities/tasks performed under this contract shall be monitored and managed in accordance with IT best practices defined in the Health and Human Service Enterprise Performance Life Cycle (EPLC) guidance document.

• The Contractor shall adhere to FDA’s Change Control Procedures to handle all changes software developed and maintained by the Contractor. This will facilitate the efficient and prompt handling of all changes, and maintain the proper balance between the need for change and the potential negative impact of changes as well as ensure traceability and accountability are supported.

• The government will own all software used or developed for the work of this contract.

Any exceptions must be in written form and signed by the FDA COR of the respective task order.

• All records application software, hardware, upgrades, releases, and new interfaces shall be compatible with FDA’s technical environment or be capable of being configured to be compatible.

• 508 Requirements are set forth in Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

The complete text of Section 508 Final Standards can be accessed at http://www.access-board.gov/sec508/standards.htm. Any amendment or modification to the section 508 standards shall be applicable.

6.1. REGULATORY REQUIREMENTS

• Compliance with the Occupational Safety and Health Act (OSHA) and other applicable laws and regulations for the protection of employees is exclusively the obligation of the Contractor,

• FDA Security Authorization Process is the approach FDA follows to fulfill Federal Information Security Management Act (FISMA), Office of Management and Budget (OMB) and Department of Health and Human Services (DHHS) requirements to ensure that information resources have adequate security to protect the confidentiality, integrity and availability of information collected, processed, transmitted, stored, or disseminated by the Agency.

• National Institute of Standards and Technology (NIST) SP800-53 - This publication was developed by the Joint Task Force Transformation Initiative Interagency Working Group with representatives from the Civil, Defense, and Intelligence Communities in an ongoing effort to produce a unified information security framework for the federal government— including a consistent process for selecting and specifying safeguards and countermeasures (i.e., security controls) for federal information systems. Security and Privacy FISMA - The E-Government Act of 2002 recognized the importance of information security to the economic and national security interests of the United States. Title III of the E-Government Act, known as FISMA, states that effective information security programs include:

• Periodic assessments of risk

• Policies and procedures that are based on Risk Assessments (RA), cost-effectively reduce information security risks to an acceptable level, and address information security throughout the EPLC http://www.access-board.gov/sec508/standards.htm http://www.access-board.gov/sec508/standards.htm

• Plans for providing adequate information security for networks, facilities, Information Systems, or groups of Information Systems, as appropriate

• Security awareness training to inform personnel

• Periodic testing and evaluation of the effectiveness of information security policies, procedures, practices, and security controls to be performed with a frequency depending on risk, but no less than annually

• A process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the organization

• Procedures for detecting, reporting, and responding to security incidents

• Plans and procedures for continuity of operations for Information Systems that support the operations and assets of the organization

• NIST - The E-Government Act (Public Law 107-347) recognized the importance of information security to the economic and national security interests of the United States. Title III of FISMA, included duties and responsibilities for the Computer Security Division in Section 303 of the NIST document.

• Controls for Federal Information Systems and Organizations NIST SP 800-53, Rev.

4 (including updates as of 1/15/14). (refer to: http://www.nist.gov/manuscript-publication-search.cfm?pub_id=915447)

7. PHYSICAL ACCESS CONTROLS

Entrance into the Contractor’s off site facilities are to be through controlled entry point(s).

Visitors are required to sign in and out at the entrance and state the purpose of their visit. A log shall be kept of all such visits. Persons that do not have a legitimate business need related to the facility operation shall not be allowed access. All off-site facilities are to be inspected by FDA FISMA inspectors to ensure that physical controls are being met. Any recommendations from these inspections shall be done by the Contractor at no cost to the government

8. NETWORK ACCESS CONTROLS

Contractors accessing FDA’s Virtual Private Network (VPN) from off-site locations to manage records information must be connected to the Network through a FDA authorized secure channel such as Cisco AnyConnect. All Contractors accessing FDA’s network from remote locations are subject to FISMA regulations. The FDA reserves the right to inspect and verify FISMA compliance. Please note the Contractor may not access the network via their personal computers. If a direct connection is required from the Contractor’s off site facilities to the FDA network due to bandwidth or security reasons, the Government shall provide Contractor with all necessary specifications for the Contractor to provide proper connectivity.

9. INFORMATION SECURITY

http://www.nist.gov/manuscript-publication-search.cfm?pub_id=915447 http://www.nist.gov/manuscript-publication-search.cfm?pub_id=915447

The Contractor shall comply with the Federal Information Security Management Act (FISMA) and FDA Staff Manual Guide (SMG) 3251.6 Information Resources Management

– Information Technology Security Management Control Policies, and shall participate in the annual compliance inspection performed by FISMA designated audit teams and respond to inspection findings (H.R. 2458-48 SEC. 301.3545(b)(1)).

(http://csrc.nist.gov/drivers/documents/FISMA-final.pdf).

Non-disclosure Agreements will be required from the Contractor, any proposed persons working on this effort, and between the Contractor and any other contractors, where information may need to be shared in order to perform services under this requirement. All individuals with access to FDA Information must undergo a background investigation initiated through FDA’s Office of Security Operations.

The Contractor shall be responsible for knowledge of and compliance with all applicable federal information technology and information management laws, regulations, policies, and standards at the government-wide, HHS, and FDA levels. At the government-wide level, these include Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and Government Accountability Office (GAO). These can be primarily found at or through the Federal CIO Council website at: http://www.cio.gov/. HHS documents are found at: http://www.hhs.gov/ocio/.

The Contractor must comply with HHS security policies.

The Contractor shall secure and protect sensitive data which may be transmitted electronically between the Contractor and the FDA as required by each Center’s ITO.

http://csrc.nist.gov/drivers/documents/FISMA-final.pdf