Hearing Q & A.doc

We would like to request written clarification regarding the definition of “HSS data” or “computers operated on behalf of the Department” in terms of providing computer compliance with the Federal Desktop Core Configuration (FDCC) requirements in section H.11 of the RFP 2009-N-11203 entitled “Audiometry Test Frequency”. We will not be accessing or interfacing with any federal government databases, computers or systems in our project proposal, we will only be storing protected health information (hearing tests) from research participants that will be summarized and provided to NIOSH in an excel spreadsheet on dedicated and secure stand-alone laptop computers. We would appreciate your assistance in helping us understand the scope of the H.11 Standard Security Configuration Language stipulated on page 20 of the RFP.

Q1. What is considered to be “HSS data”?

ANSWER: It is my understanding that this refers to data which is considered sensitive because it contains human subject personally identifiable information. As such, the data must be protected and secured in the same manner as typical clinical information from a patient's medical examinations/tests. Data which do not contain human subject personally identifiable information do not apply to this requirement.

Q2. Do the computers used only for the research hearing testing and data storage component of the RFP have to be in compliance with section H.11?

ANSWER: Only those computers used to store data with human subject data that contain personally identifiable information must be secure. Typically, local IT staff can ensure computer security is satisfactory..

Q3. Do other computers at the university level used for invoicing and/or accounting for the RFP contract have to be compliant or all computers on campus regardless of involvement in the research project?

ANSWER: No.

Q4. Do you have an inclusive list of all requirements that need to be complied with? It appears that there are at least 143 checklists with multiple levels in each. One consolidated list of configurations would be most helpful to our effort to assure compliance.

ANSWER: No such list is available. That said, it is my understanding that the requirements for computer security are likely to be met and assurances may be concisely stated by local information technology staff.