Sample_Task_Order_Attachment_B.pdf

REQUEST FOR QUOTATIONS

(THIS IS NOT AN ORDER)

THIS RFQ IS IS NOT A SMALL BUSINESS SET-ASIDE.

PAGE OF PAGES

1 10

1. REQUEST NO.

2017-N-18133

2. DATE ISSUED

3. REQUISITION/PURCHASE REQUEST NO.

4. CERT. FOR NAT. DEF.

UNDER BDSA REG. 2

AND/OR DMS REG. 1

RATING

5a. ISSUED BY

Centers for Disease Control and Prevention (PGO)

Acquisition and Assistance Branch 1

2920 Brandywine Road, MS E-15

Atlanta GA 303415539

6. DELIVERY BY (Date)

5b. FOR INFORMATION CALL (No collect calls)

NAME TELEPHONE NUMBER

AREA CODE NUMBER

Germaine Mullins (770) 488-1938 x

8. TO: 9. DESTINATION

a. NAME b. COMPANY a. NAME OF CONSIGNEE

c. STREET ADDRESS b. STREET ADDRESS

c. CITY

d. CITY e. STATE f. ZIP CODE d. STATE e. ZIP CODE

10. PLEASE FURNISH QUOTATIONS TO

THE ISSUING OFFICE IN BLOCK 5a ON OR BEFORE CLOSE OF BUSINESS (Date)

IMPORTANT: This is a request for information, and quotations furnished are not offers. If you are unable to quote, please so indicate on this form and return it. This request does not commit the Government to pay any costs incurred in the preparation of the submission of this quotation or to contract for supplies or services.

Supplies are of domestic origin unless otherwise indicated by quoter. Any representations and/or certifications attached to this Request for Quotations must be completed by the quoter.

11. SCHEDULE (Include applicable Federal, State and local taxes)

ITEM NO.

(a)

SUPPLIES/SERVICES

(b)

QUANTITY

(c)

UNIT

(d)

UNIT PRICE

(e)

AMOUNT

(f)

SAMPLE TASK ORDER

ATTACHMENT B

12. DISCOUNT FOR PROMPT PAYMENT

a. 10 CALENDAR DAYS

b. 20 CALENDAR DAYS

c. 30 CALENDAR DAYS

d. CALENDAR DAYS

NUMBER PERCENTAGE

NOTE: Additional provisions and representations are are not attached.

13. NAME AND ADDRESS OF QUOTER 14. SIGNATURE OF PERSON AUTHORIZED TO

SIGN QUOTATION

15. DATE OF

QUOTATION

a. NAME OF QUOTER

b. STREET ADDRESS 16. SIGNER

a. NAME (Type or print) b. TELEPHONE

c. COUNTY AREA CODE

d. CITY e. STATE f. ZIP CODE c. TITLE (Type or print) NUMBER

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 18 (REV. 6-95)

Previous edition not usable Prescribed by GSA FAR (48 CFR) 53.215-1(a)

7. DELIVERY

FOB

DESTINATION

OTHER

(See Schedule)

Line Items

Base Period Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED

PRICE

0001 CDA Implementation Guide

12 Months

0002 Reporting 12 Months

The Government anticipates a Firm Fixed Price type task order.

SAMPLE TASK ORDER

Development and Maintenance of Clinical Data Architecture (CDA) Implementation Guides, Vocabularies, and Related Toolsets for Healthcare Associated Infection (HAI)

Reporting to the National Healthcare Safety Network

Background

The National Healthcare Safety Network (NHSN) is a web-based information system designed for the purpose of improving patient and healthcare personnel safety. The principal goal of the NHSN is to improve safety by creating and disseminating knowledge necessary to detect and respond to current and emerging healthcare safety threats. The public health importance of healthcare-associated infections

(HAIs) has prompted an increasing number of States to enact laws requiring hospitals to report HAI data to the health department or another State agency. In the 33 States that have enacted mandatory reporting requirements as of December 2015, state statutes or implementation plans call for hospitals to report HAI data to the health department or another State agency using the NHSN. The number of healthcare facilities participating in NHSN has grown to more than 18,000 facilities. A substantial additional increase in NHSN participation is anticipated as more States enact mandatory healthcare-associated infection (HAI) reporting requirements or complete data use agreements (DUAs) that enable access to HAI data. In addition, the

Centers for Medicare and Medicaid Services’ (CMS’) use of NHSN data for its public reporting and quality incentive programs is driving increased participation as well. This project supports the need for facilities to migrate to reporting data electronically, reducing manual data entry burden and improving quality.

In addition, the Centers for Disease Control and Prevention (CDC) works closely with healthcare facilities to prevent HAIs, monitor antibiotic use (AU), and track antibiotic resistance (AR). A broad-based partnership between CDC and healthcare facilities is an integral part of national efforts aimed at preventing

AR. Data needed to measure HAIs, AR, and AU—all of which can be reported to electronically to

NHSN—are collected, analyzed, summarized, and made available through NHSN. The White House strategy for Combatting Antimicrobial-Resistant Bacteria (CARB), announced in September 2014, places a premium on strengthening surveillance capacity:

http://www.whitehouse.gov/sites/default/files/docs/carb_national_strategy.pdf

The FY2016 budget enacted in December 2015 includes a substantial increase in funds for CDC’s work on preventing AR. Assuring that HAI, AR, and AU data are up to date and available through NHSN in a timely way for the purpose of preventing AR calls for new commitments aimed at optimizing use of healthcare data in electronic form, facilitating use of interoperability standards for reporting data to NHSN, assuring the quality and completeness of data submitted to NHSN electronically and manually via to

NHSN’s web interface, and coordinating electronic surveillance activities with state and local health department efforts to advance electronic laboratory reporting of communicable disease data.

http://www.whitehouse.gov/sites/default/files/docs/carb_national_strategy.pdf

Purpose

The purpose of this requirement is to develop and maintain existing Clinical Data Architecture (CDA) implementation guides, and associated artifacts in support of HAI and AU/AR reporting to NHSN.

Scope of Work

Independently, and not as an agent of the Government, the Contractor shall furnish all necessary personnel, facilities, supplies, materials and equipment to provide support in the scope includes level 1 and level 2 user support, technical architecture and design, electronic messaging processing and support exclusive of

Clinical Document Architecture (CDA) Implementation Guide development, deployments, system documentation and other deliverables consistent with the CDC Enterprise Project Life Cycle (EPLC) guidelines.

The contractor shall conduct an in-depth review of current ICD-10-PCS and CPT Procedure Codes that are assigned to the 39 NHSN Operative Procedure Categories, analyze mapping rules/conventions, and update all procedure code discrepancies within the 39 NHSN Operative Procedure Categories. The contractor shall provide an in-depth review and assessment of the new FY 2017 & 2018 CMS operative procedure code updates for inclusion in the NHSN operative procedure categories. Additionally, the contractor shall assess infection codes and provide recommendations regarding the possible use of these for enhanced infection case finding.

Technical Requirements

The Contractor shall perform the following tasks:

Task 1. Maintain all existing CDA schematron and implementation guides in use by NHSN including providing updates, bug fixes or clarifications as directed by the COR. Provide extensions to the current IG as new changes or event types become pertinent as determined by the COR, in a format compatible with existing guides . Assist NHSN CDA support team with technical issues they are unable to address. For all new event types, in addition to CDA Implementation guidance, create associated FHIR profiles as well.

The COR will view the extensions prior to final implementation to the IG.

Task 2. Provide Statistical and Analytics support for Analysis of NHSN Data

The data submitted to NHSN via electronic reporting and manual data entry are combined in a single database for analysis, and use of the NHSN database for focused studies of HAIs and other project calls for statistical and analytic support. This support is needed to frame analytic questions in accordance with a thorough knowledge of the available NHSN data and the HAI or other problems at hand, adapting statistical methods to solve specific problems, analyzing and interpreting NHSN data using statistically sound methods, summarizing statistical results in text, tabular, and graphic forms, and presenting the results in written and oral formats for professional and public audiences. This task involves interaction with

NHSN subject matter experts—epidemiologists, infection preventionists, and health scientists—and NHSN statisticians.

Task 3. Informatics support for NHSN Antimicrobial Use and Resistance reporting

Provide informatics subject matter expertise and technical support to information technology vendors, NHSN users in healthcare facilities, state and local health departments for purposes of extending use of the

NHSN Antimicrobial Use and Resistance (AUR) Module. This work is comprised of consultative support for implementations of AU and AR reporting by healthcare facilities and systems, dual use of electronic messaging infrastructure in healthcare facilities for reporting AR data to NHSN and ELR data to state and local health departments, and strategic development of informatics solutions designed to establish or enhance AU and AR surveillance coverage by NHSN. As such, it will be important to liaise with other

CDC programs and state and local health department staff on strategies and activities to enhance AU and

AR surveillance.

Task 4: Review and Update: Review and update the 39 NHSN Operative Procedure Categories. Analyze mapping rules/conventions and update all procedure code discrepancies within the 39 NHSN Operative

Procedure Categories. Use the sub-task below to prioritize.

Subtask

The Contractor shall do the following:

a. Review and update the COLO & HYST surgical procedure code list, and include explanation of the coding convention.

b. Review and updated CRAN surgical procedure code list, and include an explanation of the coding convention.

c. Review and update the HPRO & KPRO surgical procedure code list, and include a detailed mapping for primary, revision, total and partial replacement.

d. Review and update CARD, CBGC, CBGB, and PVBY surgical procedure code list, and include an explanation of the coding convention.

Review and Validate: Review and validate new FY 2017 & 2018 CMS operative procedure code updates for inclusion in one of the NHSN operative procedure categories.

Assess and Recommend: Assess ICD-10-CM diagnosis codes for possible use for enhanced infection case finding. Provide recommendations for additional diagnosis codes for specific operative procedure categories.

Customized Training: Contractor shall provide training for CDC staff with a focus on coding conventions used by hospital based coding professionals for the 39 NHSN Operative Procedure Categories and shall provide written aids/guidance to assist NHSN personnel with interpreting typical NHSN user questions.

Deliverables

The Contractor shall provide the following deliverables:

TASK # Deliverable Quantity/Format Due Date Delivered to

Task 1 Maintain all existing CDA schematron and implementation guides

1 electronic copy Within 3-5 days of changes or event types

Contracting Officer’s

Representative

Task 2 Provide Statistical and Analytics support for Analysis of NHSN Data

Monthly updated grid of project status

15th of each month Contracting Officer’s

Representative

Task 3 Provide informatics support

Monthly updated grid of project status

15th of each month Contracting Officer’s

Representative

Task 4 Provide analysis of semantic and technical aspects of Antimicrobial Resistance

Reporting

Monthly updated grid of Project status

15th of each month Contracting Officer’s

Representative

Submit Monthly Reports Electronic report that includes summary of work completed, difficulties encountered, remedial action(s) taken and personnel and management changes

15th of each month Contracting Officer’s

Representative

Conference Calls Monthly (as needed) To Be Determined Contracting Officer’s

Representative and

CDC points of contact

Monthly reports

The monthly reports shall include the following:

1. Accomplishments during the reporting period

2. Difficulties during the reporting period

3. A brief summary of activities anticipated during the upcoming reporting period

4. Changes within contractor personnel management and staff.

Reporting Schedule

The Contractor shall participate in monthly conference calls with the Contracting Officer’s Representative and the Centers for Disease Control points of contact. Additional conference calls may be scheduled as needed to ensure effective communication in Statement of Work compliance.

Period of Performance

The estimated Period of Performance for this task order is 12 months from Date of Award

Special Considerations

52.227-17 RIGHTS IN DATA—SPECIAL WORKS (DEC 2007)

(a) Definitions. As used in this clause—

“Data” means recorded information, regardless of form or the media on which it may be recorded. The term includes technical data and computer software. The term does not include information incidental to contract administration, such as financial, administrative, cost or pricing, or management information.

“Unlimited rights” means the rights of the Government to use, disclose, reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, in any manner and for any purpose, and to have or permit others to do so.

(b) Allocation of Rights.

(1) The Government shall have—

(i) Unlimited rights in all data delivered under this contract, and in all data first produced in the performance of this contract, except as provided in paragraph (c) of this clause.

(ii) The right to limit assertion of copyright in data first produced in the performance of this contract, and to obtain assignment of copyright in that data, in accordance with paragraph (c)(1) of this clause.

(iii) The right to limit the release and use of certain data in accordance with paragraph (d) of this clause.

(2) The Contractor shall have, to the extent permission is granted in accordance with paragraph (c)(1) of this clause, the right to assert claim to copyright subsisting in data first produced in the performance of this contract.

(c) Copyright—

(1) Data first produced in the performance of this contract.

(i) The Contractor shall not assert or authorize others to assert any claim to copyright subsisting in any data first produced in the performance of this contract without prior written permission of the

Contracting Officer. When copyright is asserted, the Contractor shall affix the appropriate copyright notice of 17 U.S.C. 401 or 402 and acknowledgment of Government sponsorship (including contract number) to the data when delivered to the Government, as well as when the data are published or deposited for registration as a published work in the U.S. Copyright Office. The Contractor grants to the Government, and others acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license for all delivered data to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government.

(ii) If the Government desires to obtain copyright in data first produced in the performance of this contract and permission has not been granted as set forth in paragraph (c)(1)(i) of this clause, the

Contracting Officer shall direct the Contractor to assign (with or without registration), or obtain the assignment of, the copyright to the Government or its designated assignee.

(2) Data not first produced in the performance of this contract. The Contractor shall not, without prior written permission of the Contracting Officer, incorporate in data delivered under this contract any data not first produced in the performance of this contract and that contain the copyright notice of 17 U.S.C. 401 or

402, unless the Contractor identifies such data and grants to the Government, or acquires on its behalf, a license of the same scope as set forth in paragraph (c)(1) of this clause.

(d) Release and use restrictions. Except as otherwise specifically provided for in this contract, the

Contractor shall not use, release, reproduce, distribute, or publish any data first produced in the performance of this contract, nor authorize others to do so, without written permission of the Contracting

Officer.

(e) Indemnity. The Contractor shall indemnify the Government and its officers, agents, and employees acting for the Government against any liability, including costs and expenses, incurred as the result of the violation of trade secrets, copyrights, or right of privacy or publicity, arising out of the creation, delivery, publication, or use of any data furnished under this contract; or any libelous or other unlawful matter contained in such data. The provisions of this paragraph do not apply unless the Government provides notice to the Contractor as soon as practicable of any claim or suit, affords the Contractor an opportunity under applicable laws, rules, or regulations to participate in the defense of the claim or suit, and obtains the

Contractor’s consent to the settlement of any claim or suit other than as required by final decree of a court of competent jurisdiction; and these provisions do not apply to material furnished to the Contractor by the

Government and incorporated in data to which this clause applies.

(End of clause) http://uscode.house.gov/ http://uscode.house.gov/ http://uscode.house.gov/

The below information complies with HHSA Security compliance requirements for the

EGovernment Act of 2002 (FISMA)

Security Compliance

The contractor must have the ability to host and maintain a system for data collection, management, use, and reporting to support activities funded by the federal government. We provide the following information to assist in the preparation of documents necessary for the Security Assessment and

Authorization (SA&A)of an Information System. The EGovernment Act of 2002, (Federal Information

Management Act) and the below federal policies dictate the framework for assuring information security for data systems operated by or on behalf of the Federal government. These are summarized below.

OMB Circular A-130 (http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/) establishes policy for the management of Federal information resources, pursuant to a number of laws and regulations, including the Paperwork Reduction Act of 1980 (amended in 1995), the Computer Security Act of 1987, and other laws. Circular A-130 requires all federal information systems to have security plans, emergency response capabilities, designated individuals who are responsible for security, security awareness training, and regular review of the system. Appendix III of Circular A-130, entitled “Security of Federal Automated

Information Resources,” establishes a minimum set of controls to be included in Federal automated information security programs; assigns Federal agency responsibilities for the security of automated information; and links agency automated information security programs (such as the DHHS AISSP) with

OMB Circular No. A-123

The Federal Information Security Management Act of 2002 (P.L. 107-347) (FISMA) http://csrc.nist.gov/drivers/documents/FISMA-final.pdf

Requires each agency to develop, document, and implement an agency-wide information security program to safeguard information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (including sub-contractor), or other source. The National Institute of Standards and Technology (NIST) has issued a number of publications that provide guidance in the establishment of minimum security controls for management, operational, and technical safeguards needed to protect the confidentiality, integrity, and availability of a Federal information system and its information.

Pursuant to Federal and HHS Information Security Program Policies the following standards and guidelines apply:

FIPS Publication 200, Minimum Security Requirements for Federal Information and Information

Systems (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf), FIPS Publication 199, Standards for Security Categorization of Federal Information and

Information Systems (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf)

NIST Special Publication 800-18, Guide to Developing Security Plans for Federal Information

Systems http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf

NIST Special Publication 800-60, Guide for Mapping Types of Information and Information

Systems to Security Categories Vol. 1 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v1r1.pdf and Vol. 2 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf

NIST Special Publication 800-53, Recommended Security Controls for Federal Information

Systems and Organizations http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-

53Ar4.pdf http://www.whitehouse.gov/omb/Circulars_a130_a130trans4/ http://csrc.nist.gov/drivers/documents/FISMA-final.pdf http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-18r1.pdf http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-60v2r1.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf

NIST Special Publication 800-63, Electronic Authentication Guideline http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf

The System Security Plan (SSP) is part of the Security Assessment and Authorization (SA&A) process required by the EGovernment Act of 2002 and NIST Special Publication 800-18, 800-37, and will include selected mandatory controls required by NIST Special Publication 800-53, and NIST Special Publication

800-60 Volume I & II. The successful contractor in conjunction with the NCHHSTP Information System

Security Officer (ISSO) will submit SA&A documentation to the CDC Chief Information Security Officer

(CISO). The successful completion of the SA&A documents will result in an award of an Authority To

Operate. Based on guidance in FIPS 199 and NIST SP 800-60 the system will be assigned an overall security category (SC) of LOW or MODERATE based on (confidentiality, LOW/MODERATE), (integrity, LOW/MODERATE), and (availability, LOW/MODERATE) impact levels. These impact levels will be initially determined by the NCHHSTP ISSO and confirmed by the CDC OCISO Certifying

Authority as part of the Certification and Accreditation process.

The successful contractor is responsible for providing pertinent security information to the NCHHSTP

ISSO and Security Staff and assisting in completing the below CDC Certification and Accreditation documents to include Annual Assessments, Annual Business Continuity Plan, Re-Certifications and applicable significant/non-significant change requests. Appropriate security templates will be provided to the successful Contractor by the NCHHSTP Security Staff.

Completed documents will be sent to the CDC Chief Information Security Office (CISO) for review, approval and subsequent issuance of an Authority To Operate (ATO)

Baseline System Information (BSI)

Privacy Impact Assessment (PIA)

System Security Plan (SSP)

Business Continuity Plan (BCP)

Risk Assessment Report (RAR)

Deliverable Table

BSI, PIA, SSP, BCP, RAR

(SA&A)

Completed Documents due to

NCHHSTP ISSO 75 days prior to desired System Production date

Completed Documents Due to

CDC Chief Information Security

Office 60 days prior to desired

System production date

Recertification (required every 3 years or when significant change occurs

Completed Documents due to

NCHHSTP ISSO 75 days prior to current ATO expiration date

Completed Documents Due to

CDC Chief Information Security

Office 60 days prior to current

ATO expiration date

Annual Assessment/Business

Continuity Plan (BCP)

Completed Documents due to

NCHHSTP ISSO 15 days prior to date of annual renewal

Completed Documents Due to

CDC Chief Information Security

Office 1 day prior to date of annual renewal

Non Significant Change Requests

(OS or application version change, change in data variables)

Completed documentation due to

ISSO for signature prior to change implementation

Completed documentation due to

OCISO for approval prior to change implementation

The Contractor shall respond to the following seven security–associated requirements in the application:

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf

(1) Position Sensitivity Designations

CDC requires a Public Trust Level 5 for the following:

The following position sensitivity designations and associated clearance and investigation requirements apply under this licensing contract:

Level 5: Public Trust - Moderate Risk (Requires Suitability Determination with NACIC, MBI or LBI).

Licensor employees assigned to a Level 5 position with no previous investigation and approval shall undergo a National Agency Check and Inquiry Investigation plus a Credit Check (NACIC), a Minimum

Background Investigation (MBI), or a Limited Background Investigation (LBI).

Upon award, the Licensor will be required to submit a roster of all staff (including sub-contractor staff) working under the contract that will have the ability to access sensitive NCHHSTP information from the system. The roster shall be submitted to the Project Officer/technical monitor, with a copy to the

Contracting Officer, within 14 calendar days of the effective date of the contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The

Contracting Officer shall notify the licensor of the appropriate level of suitability investigations to be performed, but Licensor employees and subcontractors who have met investigative requirements within the last five years may only require an updated or upgraded investigation. An electronic template, “Roster of

Employees Requiring Suitability Investigations,” is available for contractor use at:

http://ais.nci.nih.gov/forms/Suitability-roster.xls. Upon receipt of the Government’s notification of applicable suitability investigations required, the Licensor shall complete and submit the required forms within 30 days of the notification.

Non-Disclosure Agreements

The Contractor and any sub-Contractors or employees are forbidden from sharing any technical or logistical information they may gain in conjunction with matters related to this task order that could jeopardize the physical or information security of CDC or its employees, projects, or information systems.

The following apply to Licensor employees and their subcontractors associated with the project:

1) Personnel may not begin work under the contract until the contractor has submitted the employee roster and non-disclosure agreements as described above.

2) Personnel without necessary background investigations will not have access to sensitive project data.

3) Violation of these conditions may lead to termination of the contract.

It is the Contractor's responsibility to ensure that all employees have met CDC and federal requirements, such as, for example, completion of background checks, before gaining or utilizing access to CDC information technology resources.

(2) Privacy Compliance

Licensor in conjunction with CDC Center ISSO shall conduct and maintain an initial Privacy Impact

Assessment (PIA) as defined by Section 208 of the E-Government Act of 2002. Periodic reviews shall be conducted by the system owner, with assistance from the CDC Center ISSO and contractor, to determine if a major change to the system has occurred, and if a PIA update is needed.

(3) Contractor’s Official Responsible for Information Security

The contractor shall include in the “Information Security” part of the Technical Proposal the name and title of its official who will be responsible for all information security requirements should the contractor be selected for an award.

http://ais.nci.nih.gov/forms/Suitability-roster.xls

(4) Rules of Behavior

The contractor’s employees and subcontractors shall comply with the HHS Information Technology

General Rules of Behavior.

(5) Information Security Training

HHS policy requires that contractors and subcontractors shall receive security training commensurate with their responsibilities for performing work under the terms and conditions of their contractual agreements.

The successful contractor shall be responsible for assuring that each employee, including subcontractors, has completed the HHS Computer Security Awareness Training course (or another course designated by

CDC) prior to performing any contract work, and thereafter completing the HHS-specified annual refresher course during the period of performance of the contract. This would be provided at the Contractor's expense and would be the Contractor's responsibility to plan and arrange.

The successful contractor shall maintain a listing of all individuals who have completed this training and shall submit this listing to the project officer.

(6) HSPD-12 Compliance

Federal Information Processing Standard 201 (FIPS-201) (vii) compliant, Homeland Security Presidential

Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

(7) Encryption

All sensitive CDC-funded data stored on desktop computers used on behalf of HHS shall be secured either through a FIPS 140-2 compliant encryption solution or through adequate physical security and operational controls at the desktop’s residing location.

All mobile devices, portable media and transfer data files that contain sensitive CDC- data shall be encrypted using FIPS 140-2 compliant algorithms.

Section 508 of the Rehabilitation Act (29 USC 794d)

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment

Act of 1998, and the Architectural and Transportation Barriers Compliance Board Electronic and

Information (EIT) Accessibility Provisions (36 CFR part 1194), require that, unless an exception applies, all EIT products and services developed, acquired, maintained, or used by any Federal department or agency permit:

(1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

Accordingly, any vendor submitting a proposal/quotation/bid in response to this solicitation must demonstrate compliance with the established EIT accessibility provisions. Information about Section 508 provisions is available at http://www.section508.gov/. The complete text of Section 508 Final Provisions can be accessed at http://www.access- board.gov/sec508/provisions.htm.

The Section 508 standards applicable to this solicitation are identified in the Statement of

Work/Specification/Performance Work Statement. In order to facilitate the Government’s evaluation to determine whether EIT products and services proposed meet applicable Section 508 accessibility standards, offerors must prepare an HHS Section 508 Product Assessment Template, in accordance with its http://www.section508.gov/ http://www.access-board.gov/sec508/provisions.htm completion instructions, and provide a binding statement of conformance. The purpose of the template is to assist HHS acquisition and program officials in determining that EIT products and services proposed support applicable Section 508 accessibility standards. The template allows vendors or developers to self-evaluate their products or services and document in detail how they do or do not conform to a specific

Section 508 standard. Instructions for preparing the HHS Section 508 Product Assessment Template may be found at http://508.hhs.gov.

Respondents to this solicitation must also provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products and/or services that are incidental to the project, which would constitute an exception to Section 508 requirements. If a vendor claims its products and/or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 standards in its completed HHS Section 508 Product

Assessment Template, and it is later determined by the Government – i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility in the Product

Assessment Template, remediation of the products and/or services to the level of conformance specified in the vendor’s Product Assessment Template will be the responsibility of the Contractor at its expense.

The applicable provisions of this solicitation are: 1194.21, .22, .24, .31, and .41.

http://508.hhs.gov/