3_06202018_-_ATTACHMENT_B__SOW__V2.docx

ATTACHMENT B - STATEMENT OF WORK

06/20/2018 I. PROJECT TITLE: Sickle Cell Disease Treatment Demonstration Regional Collaborative Program National Coordinating Center

II. BACKGROUND:

The American Jobs Creation Act of 2004, Section 712 of P.L. 108-357 authorized a demonstration program to develop and establish systemic mechanisms for the prevention and treatment of sickle cell disease. The legislation requires the demonstration program be carried out through two mechanisms: a grant program known as the Sickle Cell Disease Treatment Demonstration Regional Collaborative Program (SCDTDRCP) and a contract known as the National Coordinating Center. A link to the legislation authorizing the SCDTDRCP can be found here: https://www.congress.gov/bill/108th-congress/senate-bill/874/text and pertinent information regarding the National Coordinating Center can be located in Section 4 (c) National Coordinating Center.

Sickle cell disease is an inherited red blood cell condition. Patients with sickle cell disease have abnormal red blood cells that break easily and clog blood vessels to block blood flow to organs and tissues. This process results in anemia, periodic pain episodes (at times severe), and ultimately can damage tissues and vital organs which leads to increased infections and early death. In the United States, most cases of sickle cell disease occur among people of African ancestry (one in 400 African American births) but those of Mediterranean, Middle Eastern, or Indian background who have migrated are also affected. It is estimated that more than two million Americans are carriers of heterozygote for sickle cell disease and over 70,000 have the disorder. Annually approximately 1,000 newborns are identified with sickle cell disease through state newborn screening programs. Early diagnosis of sickle cell disease is critical so that children who have the disorder can receive proper interventions. Access to care for individuals with sickle cell disease is uneven. Comprehensive care for children with sickle cell disease is generally more available than for adults because there are relatively fewer clinicians with expertise and willingness to care for adults with sickle cell disease.

The Maternal and Child Health Bureau (MCHB) funds five grantees through the Sickle Cell Disease Treatment Demonstration Regional Collaborative Program. The goal of the program is to improve health outcomes in individuals with sickle cell disease; reducing morbidity and mortality caused by sickle cell disease; reduce the number of individuals with sickle cell receiving care only in emergency departments, and improve access to coordinated and comprehensive services for individuals with sickle cell disease and their families. It is expected that the National Coordinating Center will work collaboratively with grantees to carry out the goals, purpose and scope of the program.

III. PURPOSE/SCOPE:

The purpose of this procurement is to establish the National Coordinating Center (NCC) to collect, coordinate, monitor, and distribute data, best practices, and findings with the Sickle Cell Disease Treatment Demonstration Regional Collaborative Program (SCDTDRCP) grantees.

IV. PERIOD OF PERFORMANCE/PLACE OF PERFORMANCE:

The period of performance shall be for twelve (12) months from the effective date of contract (EDOC) and two (2) twelve (12) month option periods. Work shall be performed off-site at the Contractor’s office space.

V. SPECIFIC TASKS

The Contractor shall provide the personnel and services necessary to perform the following tasks.

Task 1. Federal Records Management. Task 1 applies to the Base and all the Option Periods.

The Contractor shall:

· Manage and maintain Federal records, including electronic records, ensuing from this contract in accordance with all applicable records management laws and regulations, including; but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate recordkeeping systems for electronic records & 1236.22. What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

· Manage the records includes, maintaining records to retain functionality and integrity throughout the records’ full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

· All transferring of official records shall be processed through the Federal Bureau/Office Records liaison through the Agency Records Official.

Task 1.1 Provide documentation on maintaining Federal Records to include Records Management Schedule and Disposition Plan to the COR, 30 Days after the effective date of the contract (EDOC). For the Option Periods, provide updated documentation, 30 days after EDOC.

Task 1.2 Ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HRSA Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract.

The training can be requested by emailing the records management team at recordsmgmt@hrsa.gov.

The listing of all employees who completed the training shall be included in the first progress report. Any revisions to this listing, because of staffing changes, shall be submitted with next required progress report.

Task 2: Project Management and Administration – The Contractor shall:

Task 2.1 Kickoff Meeting: Task 2.1 applies to ONLY the Base Period.

Meet with the Contracting Officer Representative (COR) and MCHB staff, within 7 days of the EDOC, via a conference call. The COR will discuss the following at the kickoff meeting:

· Authorizing legislation and its specific requirements

· Activities and deliverables necessary for planning and execution of the contract

· Proposed timeline for the completion of each contract deliverable

· Elements of the timeline, requirements of monthly progress updates, final reports, the Report to Congress, and Executive Summary for the Report to Congress

· Roles of the HRSA COR, Contractor Project Director and Contractor, as a whole

· Potential challenges as related to the work to be performed and other activities of the contract

Task 2.2 Monthly Progress Reports, Conference Calls and Timeline: Task 2.2 applies to the Base and all the Option Periods

· Hold monthly conference calls with the COR.

· An agenda shall be sent to the COR one day before the monthly conference call.

· Monthly progress reports and monthly conference call minutes shall be sent to the COR three (3) days after each conference call.

· The first monthly progress report for each option period shall also discuss what worked and did not work in the previous contract period. (Also, see Task 1.2.)

· Maintain a timeline, including the list of tasks with all sub-tasks, a list of Contractor staff that are responsible for each task, and estimated completion date of each task.

· The timeline shall be updated regularly and used by the Contractor to evaluate progress toward completion of activities in the contract. The timeline shall be included in the monthly progress report.

Task 3: Data Collection and Analysis – Task 3 applies to the Base and all the Option Periods The Contractor shall:

Task 3.1 Maintenance of Data Base and Program Evaluation Improve on the data collection strategies developed in previous rounds of the program. This includes making modifications to the tools to collect various data types from grantees to meet program goals.

· Meet by conference call with the COR, HRSA’s Office of Information Technology, and other HRSA staff to maintain and discuss security requirements.

· Submit and update all required documentation to ensure that the database maintains all government standards and security requirements for Contractor’s database.

· Ensure the database is functional and meets the needs of the Sickle Cell Disease Treatment Demonstration Program. The tasks include:

1. Configuration Plan

2. E-Authentication Risk Assessment

3. Privacy Impact Assessment

4. Security Assessment Report

5. Contingency Plan

6. CP Test Report

7. Plan of Action and Milestones (POAM)

8. Risk Assessment

9. Implementing POAM

10. Project Oversight

· Maintain a strategy for collecting and analyzing grantee submitted data. The Contractor shall be responsible for aggregating data from performance measures and the Quality Improvement data collected by the grantees through various means.

· Collect data annually for the performance measures and quarterly for the Quality Improvement data, beginning at the 6th month of the base period through a web-based data collection platform.

· The data collection platform shall meet all HRSA and HHS Office of Information Technology security requirements.

· The data collection strategy shall also include qualitative information including any educational tools and provider recruitment strategies developed by the grantees.

· Revise data collection strategies in collaboration with the SCDTDRCP grantees and MCHB to optimize data collection and improve data collection efforts, during each contract period Grantee Data Below are the measures grantees will report on for the program. The Provider Survey will be distributed to providers within each region and collected by the Regional Coordinating Center and aggregated. The Regional Coordinating Centers will submit the aggregate data to the National Coordinating Center through a web-based data collection mechanism.

Performance Measures Data (required)

1. Number of providers in the SCDTDP Network - stratified by provider type (primary care physician, hematologist, Nurse Practitioner, Physician Assistant, other), Region, State, and zip code.

2. Number of sickle cell patients seen by a SCDTDP Network provider in the past year - stratified by patient age (Children age <18 and Adults age 18+) and genotype (Hg SS or S-Beta 0 and Hg S + Other), as well as provider type (primary care physician, hematologist, Nurse Practitioner, Physician Assistant, other), Region, State, and zip code.

3. Number of providers in the SCDTDP Network participating in telementoring activities in the past year - stratified by provider type, Region, State, and zip code.

a. Percent of providers in the SCDTDP Network participating in telementoring activities in the past year that report they feel comfortable treating sickle cell patients - stratified by provider type, Region, State, and zip code.

4. Number of providers in the SCDTDP Network that saw at least one sickle cell patient in the last year - stratified by provider type, Region, State, and zip code

a. Percent of providers in the SCDTDP Network that saw at least one sickle cell patient in the last year, that prescribed hydroxyurea to an eligible sickle cell patient in the past year - stratified by provider type, Region, State, and zip code.

5. Number of eligible sickle cell patients seen by a SCDTDP Network provider that had a hydroxyurea prescription in the past year - stratified by patient age (Children age <18 and Adults age 18+) and genotype (Hg SS or S-Beta 0 and Hg S + Other), as well as provider type (primary care physician, hematologist, Nurse Practitioner, Physician Assistant other), Region, State, and zip code.

Quality Improvement Data

6. Number of eligible sickle cell patients seen by a SCDTDP Network provider that had a hydroxyurea prescription in the past year. (required)

7. Number of eligible patients with documented recommended pneumococcal vaccinations at least annually. (optional)

8. Number of eligible patients with documented Transcranial Doppler Ultrasound (TCDs) at least annually. (optional)

9. Number of eligible adolescent patients with a documented transition plan. (optional) Grantees will collect this data from other data sources such as Electronic Health Records (EHR) and submit the data to the NCC through a web-based system. All grantees are required to collect data on Measures 1 – 6 and they must collect data on at least one of the other measures listed above.

Task 3.2 Standardize Data Collection from Grantees:

The Contractor shall:

· Collect, coordinate, monitor and distribute data, best practices and findings regarding the activities funded under this demonstration program.

· Ensure that the grantees’ data collection strategies are effective in addressing priorities from Task 3.1 and meet requirements for the Report to Congress.

· Provide guidance to grantees on how to collect data from regional partners and provide advice and recommendations on how grantees can improve their data collection and analysis to ensure that all data collected by the various grantees are standardized and harmonized at a national level.

· Collect data measures from Task 3.1 to demonstrate type of health resources utilized as required by legislation for the program from the grantees and work with the grantees to analyze the data and submit the data and the analysis to the COR in the Annual Report (see Task 3.4).

· Prepare the data and the data analysis for the Report to Congress (see Task 4.1).

Task 3.3 Data Dictionary:

The Contractor shall:

· Develop a data dictionary that defines each of the measures listed above to ensure that all grantees are collecting uniform data, so appropriate comparisons can be made and national level outcomes can be ascertained. This will be done in collaboration with the COR, SCDTDRCP grantees and the program’s Oversight Steering Committee.

· Develop data definitions for measures listed above and additional measures as determined by the COR to include in the data dictionary.

· The data dictionary shall be delivered to the COR by the 11th month of each period (base + Options, if exercised). The data dictionary shall be submitted to the COR in the Annual Report.

· In collaboration with the COR, develop and submit the Office of Management and Budget (OMB) clearance package for the collection of data for this program. This shall include any documentation required to retain OMB clearance for data collection.

· Update the data dictionary to ensure that grantees are collecting consistent data regarding the goals of the SCDTDRCP. This subtask applies to Option Periods 1 and 2.

· Develop new data definitions for additional measures, as determined by the COR.

Task 3.4 Annual Report to the COR:

The Contractor shall:

· Provide an annual report to the COR at the end of the 11th month of each contract period. The annual report shall include an overview of program accomplishments and challenges, the data dictionary, data collected by the grantee and an analysis of the data with recommendations for the next period, if applicable.

Task 4: Model Protocol, Compendium of Tools and Materials, Report to Congress and Maternal and Child Health Bureau (MCHB) Presentation – Task 4 only applies to Option Period 2.

Task 4.1 Model Protocol

The Contractor shall:

· Develop a model protocol for the prevention and treatment of Sickle Cell Disease.

· Collect information from grantees to develop a Model Protocol for implementing programs to achieve outcome measures.

· The Model Protocol should include program design, strategies, data collection design and other information important for replicating efforts of the SCDTDRCP at other institutions to achieve similar results.

· This shall include the model protocols/best practices and strategies, reports, articles, tables, algorithms, posters or other materials that may be used by providers and patients to improve sickle cell care.

· It shall be delivered to the COR as a component of the Report to Congress one (1) month prior to the end of Option Period 2.

Task 4.2 Compendium of Tools and Materials The Contractor shall:

· Collect educational materials regarding the prevention and treatment of Sickle Cell Disease from the grantees of the SCDTDP.

· Collect tools, materials for best practices created by grantees.

· The Compendium of Tools and Materials for the SCDTDP shall be easily accessible by stakeholders, families and the public.

· It shall be delivered to the COR as a component of the Report to Congress one (1) month prior to the end of Option Period 2.

· Ensure all tools and materials created by the grantees can be posted on the web and accessible by all stakeholders.

· Identify existing structures for possible placement of SCDTDP tools and materials.

Task 4.3 Report to Congress

· The Congressional Report shall include all the activities of the SCDTDRCP from base period onwards.

· Create a Report to Congress that summarizes the work of the grantees. The report shall also include recommendations regarding the effectiveness of the SCDTDRCP.

· The report shall include direct outcome measures from Task 3.1 to document the number and type of health care resources utilized among the sickle cell population within grantees’ regions, the number of individuals served by the program and the outcomes achieved by the quality improvement activities undertaken by the grantees as required by the authorizing legislation (see The American Jobs Creation Act of 2004, Section 712 of P.L. 108-357).

· A draft of the Report to Congress shall be provided to the COR for review and comments three months prior to the Contractor submitting the report to Congress.

· Make the Report to Congress available to the sickle cell community and to public for at least 6 months after the report is submitted to Congress.

· This Report to Congress and Model Protocol is strictly required. The Report to Congress and Model Protocol shall be delivered directly to Congress at the end of the Option Period Two. One electronic copy of the Report to Congress and Model Protocol shall be delivered to the COR one month prior to the Contractor submitting the Report to Congress.

Task 4.4 Presentation to MCHB Staff

The Contractor shall:

· Schedule and conduct one presentation via a webinar on the Report to Congress to HRSA staff and other federal partners and stakeholders prior to submission to the Congress.

· The presentation shall include a summary of the data analysis and quality improvement projects for the Sickle Cell Disease Treatment Demonstration Regional Collaborative Program (SCDTDRCP).

· Present to MCHB staff one month prior to the Contractor submitting the Report to Congress.

· Email electronic copy of the Report to Congress and Model Protocol to the COR prior to the last day of this contract.

Task 5. Enterprise Performance Life Cycle (EPLC)

For each development, modernization, and enhancement (DME) project, the Contractor shall perform integrated project management following HRSA Enterprise Project Life Cycle (EPLC) policies, procedures, and processes. The Contractor shall prepare comprehensive documentation supporting all activities. This includes preparing a design and implementation document, maintaining data models, maintaining business rules documents, preparing testing plans and recording results, as well as all code developed for the system.

The EPLC deliverables for all phases are under the Schedule of Deliverables (Section VI). The Project Process Agreement (PPA) will be provided at kick-off to tailor the EPLC requirements in terms of justifications for selection, substitution or omission of specific reviews, deliverables, and other EPLC components relevant to this project.

Task 6. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any sub-Contractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any sub-Contractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any sub-Contractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ X ] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ X ] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any sub-Contractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any sub-Contractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any sub-Contractor) by HHS or collected by the Contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and sub-Contractors shall be under the supervision of the Contractor. Each Contractor employee or any of its sub-Contractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or sub-Contractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6). .

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any sub-Contractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information (PHI), proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and HRSA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program (http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm) to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any sub-Contractor) employee having access to non-public government information under this contract shall complete the HRSA non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the HRSA Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the HRSA SOP or designee with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the HRSA SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

Task 7. Training

a) Mandatory Training for All Contractor Staff. All Contractor (and/or any sub-Contractor) employees assigned to work on this contract shall complete the applicable HHS/HRSA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete the HRSA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

b) Role-based Training. All Contractor (and/or any sub-Contractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c) Training Records. The Contractor (and/or any sub-Contractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Task 8. Rules of Behavior

a) The Contractor (and/or any sub-Contractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior (included in the HRSA Information Security and Privacy Awareness Training), and any applicable system-level rules of behavior.

b) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HRSA Information Security Awareness Training. If the training is provided by the Contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

Task 9. Incident Response Reporting of suspected and confirmed information security and privacy incidents and breaches under this Task shall be determined based on Contractor’s review of such incidents and breaches and shall extend to any incident or breach that represents material risk to HRSA or HRSA systems.

For awareness purposes, report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Security Operations Center (SOC) via email (soc@hrsa.gov) or telephone (301-443-3333), COR, CO, and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible as applicable within 4 hours and without unreasonable delay. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised.

In addition, the Contractor shall:

a. effectively manage or mitigate a suspected or confirmed breach and communicate periodic status to HRSA;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

Task 10. Position Sensitivity Designations All Contractor (and/or any sub-Contractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

Task 11. Homeland Security Presidential Directive (HSPD)-12 The Contractor (and/or any sub-Contractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Roster. The Contractor (and/or any sub-Contractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

Task 12. Contract Initiation and Expiration General Security Requirements. The Contractor (and/or any sub-Contractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the Contractor shall follow the HHS EPLC framework and methodology or (https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Web%20Pages/EPLC%20Overview.aspx)and in accordance with the HHS Contract Closeout Guide (2012).

1) System Documentation. Contractors (and/or any sub-Contractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

2) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any sub-Contractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

3) Notification. The Contractor (and/or any sub-Contractor) shall notify the CO and/or COR and system ISSO within two weeks before an employee stops working under this contract, unless the Contractor was immediately terminated.

4) Contractor Responsibilities Upon Physical Completion of the Contract. The Contractor (and/or any sub-Contractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or HRSA policies.

5) The Contractor (and/or any sub-Contractor) shall perform and document the actions identified in the HRSA Clearance Form for Separating Employees and Contractors (Form-419) when an employee terminates work under this contract within two weeks of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

Task 13. Requirements for Procurements Involving Privacy Act Records It has been determined that this contract is subject to the Privacy Act of 1974, because this contract provides for the design, development, or operation of a system of records on individuals.

The System of Records Notice (SORN) that is applicable to this contract is: 09-15-0068.

Task 14. Security Requirements for GOCO and COCO Resources

1) Federal Policies. The Contractor (and/or any sub-Contractor) shall comply with applicable federal laws that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P); Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

2) Security Assessment and Authorization (SA&A). A valid authority to operate (ATO) certifies that the Contractor’s information system meets the contract’s requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any sub-Contractor) shall work with the agency and supply the deliverables required to complete the ATO 30 days prior to the EPLC Operational Readiness Review (ORR). The Contractor shall conduct the SA&A requirements in accordance with HHS IS2P, NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (latest revision).

HRSA’s acceptance of the ATO does not alleviate the Contractor’s responsibility to ensure the system security and privacy controls are implemented and operating effectively.

a. SA&A Package Deliverables - The Contractor (and/or any sub-Contractor) shall provide an SA&A package within 30 days prior to the ORR to the CO and/or COR. The following SA&A deliverables are required to complete the SA&A package:

· System Security Plan (SSP) – Initial draft version due within 30 days of the EPLC Performance Baseline Review. Final draft due 120 days prior to the Operational Readiness Review. Final version due 30 days prior to the Operational Readiness Review. The SSP shall comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Federal Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS and HRSA policies and other guidance. The SSP shall be consistent with and detail the approach to IT security contained in the Contractor’s bid or proposal that resulted in the award of this contract. The SSP shall provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor shall update the SSP at least annually thereafter.

· Security Assessment Plan/Report (SAP/SAR) – due 30 days prior to the Operational Readiness Review. The security assessment shall be conducted by HRSA’s Security Assessment Team and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and HRSA policies. The assessor will document the assessment results in the SAR.

Thereafter, the Contractor, in coordination with HRSA shall assist in the assessment of the security controls and update the SAR at least annually.

· POA&M – due within 7 days after the Security Control Assessment Report is delivered. The POA&M shall be documented consistent with the HHS Standard for Plan of Action and Milestones and HRSA policies. All high-risk weaknesses must be mitigated within 30 days and all moderate weaknesses must be mitigated within 180 days from the date weaknesses are formally identified and documented. HRSA will determine the risk rating of vulnerabilities.

Identified risks stemming from deficiencies related to the security control baseline implementation, assessment, continuous monitoring, vulnerability scanning, and other security reviews and sources, as documented in the SAR, shall be documented and tracked by the Contractor for mitigation in the POA&M document. Depending on the severity of the risks, HRSA may require designated POAM weaknesses to be remediated before an ATO is issued. Thereafter, the POA&M shall be updated at least quarterly.

· Contingency Plan – due within 120 days prior to the Operational Readiness Review. The Contingency Plan must be developed in accordance with NIST SP 800-34, latest revision, and be consistent with HHS and HRSA policies. The Contractor shall review/update the Contingency Plan at least annually thereafter.

· Contingency Plan Test – due within 60 days of acceptance of the Contingency Plan by the System Owner. Upon acceptance by the System Owner, the Contractor, in coordination with the System Owner, shall test the Contingency Plan and prepare a Contingency Plan Test Report that includes the test results, lessons learned and any action items that need to be addressed. The Contractor shall conduct a Contingency Plan Test at least annually thereafter.

· E-Authentication Questionnaire – The Contractor (and/or any sub-Contractor) shall collaborate with government personnel to ensure that an E-Authentication Threshold Analysis (E-auth TA) is completed to determine if a full E-Authentication Risk Assessment (E-auth RA) is necessary. System documentation developed for a system using E-auth TA/E-auth RA methods shall follow OMB 04-04 and NIST SP 800-63, Rev. 2, Electronic Authentication Guidelines.

Based on the level of assurance determined by the E-Auth, the Contractor (and/or sub-Contractor) must ensure appropriate authentication to the system, including remote authentication, is in-place in accordance with the assurance level determined by the E-Auth (when required) in accordance with HHS policies.

b. Information Security Continuous Monitoring. Upon the government issuance of an Authority to Operate (ATO), the Contractor (and/or sub-Contractor)-owned/operated systems that input, store, process, output, and/or transmit government information, shall meet or exceed the information security continuous monitoring (ISCM) requirements in accordance with FISMA and NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, and HHS IS2P. The following are the minimum requirements for ISCM:

· Annual Assessment/Pen Test - Assess the system security and privacy controls (or ensure an assessment of the controls is conducted) at least annually to determine the implemented security and privacy controls are operating as intended and producing the desired results (this may involve penetration testing conducted by the agency or independent third-party.) In addition, review all relevant SA&A documentation (SSP, POA&M, Contingency Plan, etc.) and provide updates by specified due date.

· Asset Management - Using any available Security Content Automation Protocol (SCAP)-compliant automated tools for active/passive scans, provide an inventory of all information technology (IT) assets for hardware and software, (computers, servers, routers, databases, operating systems, etc.) that are processing HHS-owned information/data. It is anticipated that this inventory information will be required to be produced within 30 days of the EPLC Performance Baseline Review. Final version due within 30 days prior to the Operational Readiness Review and reviewed and updated on a monthly basis thereafter. IT asset inventory information shall include IP address, machine name, operating system level, security patch level, and SCAP-compliant format information. The Contractor shall maintain a capability to provide an inventory of 100% of its IT assets using SCAP-compliant automated tools.

· Configuration Management - Use available SCAP-compliant automated tools, per NIST IR 7511, for authenticated scans to provide visibility into the security configuration compliance status of all IT assets, (computers, servers, routers, databases, operating systems, application, etc.) that store and process government information. Compliance will be measured using IT assets and standard HHS and government configuration baselines prior to the EPLC Operational Readiness Review. The Contractor shall maintain a capability to provide security configuration compliance information for 100% of its IT assets using SCAP-compliant automated tools.

· Vulnerability Management - Use SCAP-compliant automated tools for authenticated scans to scan information system(s) and detect any security vulnerabilities in all assets (computers, servers, routers, Web applications, databases, operating systems, etc.) that store and process government information. Contractors shall actively manage system vulnerabilities using automated tools and technologies where practicable and in accordance with HHS policy. Automated tools shall be compliant with NIST-specified SCAP standards for vulnerability identification and management. The Contractor shall maintain a capability to provide security vulnerability scanning information for 100% of IT assets using SCAP-compliant automated tools.

· Patching and Vulnerability Remediation - Install vendor released security patches and remediate critical and high vulnerabilities in systems processing government information in an expedited manner, within vendor and agency specified timeframes:

· 30 days for Critical and High risk vulnerabilities

· Critical and High vulnerabilities identified by an application scan are required to be remediated prior to the EPLC ORR.

· 90 days for Moderate risk vulnerabilities; and

· 180 days for Low risk vulnerabilities.

· Secure Coding - Follow secure coding best practice requirements, as directed by United States Computer Emergency Readiness Team (US-CERT) specified standards and the Open Web Application Security Project (OWASP), that will limit system software vulnerability exploits.

· Boundary Protection - The Contractor shall ensure that government information, other than unrestricted information, being transmitted from federal government entities to external entities is routed through a Trusted Internet Connection (TIC).

3) Government Access for Security Assessment. In addition to the Inspection Clause in the…