Q-A 4.25.22 (2).pdf

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

7. ADMINISTERED BY (If other than Item 6) CODE

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

FACILITY CODE

9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBER

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

12. ACCOUNTING AND APPROPRIATION DATA (If required) copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15C. DATE SIGNED

15A. NAME AND TITLE OF SIGNER (Type or print)

16C. DATE SIGNED

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

PAGE OF PAGES

6. ISSUED BY CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X)

CODE

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

Previous edition unusable

This Amendment is hereby issued to:

1) Update Section C (Section 3, task 5 and Section 4, task 7(a)), see tracked changes All other terms and conditions of the original solicitation and amendments issued to date remain unchanged and in full force and affect.

Centers for Disease Control and Prevention (CDC) Office of Acquisition Services (OAS) 2900 Woodcock Blvd, MS TCU-4 Atlanta, GA 30341-4004

75D301-22-R-72124

1 23

04/25/2022

04/13/2022

75D301-22-R-72124

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION C - DESCRIPTIONS AND SPECIFICATIONS

The following have been modified:

PERFORMANCE WORK STATEMENT

Project Title: Surveillance of Acutely Ill Adults with Respiratory Viruses, including SARS-CoV-2

SECTION 1 – BACKGROUND

The World Health Organization declared coronavirus disease 2019 (COVID-19) a pandemic on March 11, 2020. As of February 11, 2022, over 400 million confirmed cases and 5.7 million deaths from COVID-19, cumulatively, have been reported worldwide. Currently, there are three COVID-19 vaccines in the United States (U.S.) that have received either full FDA approval or FDA Emergency Use Authorization: (1) BNT162b2 from Pfizer BioNTech; (2) mRNA-1273 from Moderna; and (3) Ad26.COV2.S from Johnson & Johnson/Janssen.

Although, initial estimates of real-world vaccine effectiveness (VE) against COVID-19 have demonstrated high effectiveness of these vaccines against hospitalization and severe COVID-19 illness, ongoing assessments of vaccine effectiveness are needed. There remains limited information about the protection of these vaccines against emerging variants of concern, duration of protection, correlates of protection, disease attenuation, and vulnerable subgroups such as immunosuppressed persons who might be at higher risk of vaccine failure and virus evolution.

Additionally, as new variants emerge, the trajectory of the pandemic remains unclear and SARS-CoV-2 may co-circulate with influenza, respiratory syncytial virus (RSV), and other respiratory viruses, which cause substantial burden each year.

Improving the effectiveness of vaccines against severe acute respiratory illness (ARI) from SARS-CoV-2 and influenza is a top priority. Understanding whether vaccines attenuate disease severity against SARS-CoV-2 and influenza viruses is also important. With new vaccines against RSV currently in Phase 3 trials, which are expected to be licensed soon, there is also an immediate need to establish RSV burden among adult patients with ARI prior to RSV vaccine introduction to assess potential impact of new RSV vaccines for adults.

To effectively monitor VE against COVID-19, RSV and influenza, CDC requires an observational, multicenter, prospective public health surveillance network of nationally representative geographic and demographic populations coordinated through the Contractor. The network should include no fewer than 15 and up to 30 nationally recognized hospitals, medical centers and universities (collectively called the “healthcare facilities”) that meet minimum requirements specified herein (“Surveillance Network”).

SECTION 2 – PURPOSE

The purpose of this contract is to use the Surveillance Network to evaluate the effectiveness of vaccines against COVID-19, influenza, and eventually, RSV, among U.S. adults with severe acute respiratory illness. The primary aim is to monitor effectiveness against COVID-19-associated and influenza-associated hospitalizations, including effectiveness against emerging variants of concern and duration of protection and to conduct RSV surveillance among inpatients with ARI. These efforts will build on prior efforts to understand severe ARI, severity scores, Period of Performance:

9/01/2022–8/31/2023 9/01/2023-8/31/2024 9/01/2024-8/31/2025 susceptibility to infection, mechanisms of disease attenuation, and vaccine failures. Optional work, that may be exercised at the CDC’s discretion, is included if the CDC requires the evaluation of potential therapeutics on outcomes such as ICU admission, length of hospital stay, and death resulting from COVID-19, RSV and influenza.

SECTION 3 – SCOPE OF WORK

The Contractor shall perform all work (including collection of any required data or specimens, testing or sequencing of any specimens collected, and provide results for all tasks) related to completion of the specific goals of this project which are to:

1) Evaluate effectiveness of vaccination against laboratory-confirmed, symptomatic, hospitalized SARS-CoV- 2 and influenza as well as to expand surveillance to include RSV. CDC’s goal is to continue enrollment with an increased focus on variant-specific vaccine effectiveness, duration of protection, risk factors for vaccine failure, and disease attenuation of COVID-19 vaccines.

2) Enroll hospitalized patients with acute respiratory illness (ARI) as either cases (i.e., PCR-confirmed SARS- CoV-2, influenza, or RSV) or controls (i.e., negative PCR test results for SARS-CoV-2, influenza, or RSV), using a case-control design and routine respiratory virus testing.

3) Evaluate vaccine effectiveness of SARS-CoV-2 vaccination against COVID-19-associated hospitalization by vaccine product and assess the duration of protection of these vaccines.

4) Ensure that key sub-populations disproportionately affected by COVID-19 (e.g., African Americans, Hispanics, persons ≥65 years, persons with immunosuppression as well as chronic medical conditions including diabetes and/or obesity) are adequately represented.

5) Access documented results of SARS-CoV-2, influenza, and RSV testing performed for clinical purposes, and collect and test (by PCR) respiratory specimens for SARS-CoV-2, influenza, RSV and other respiratory viruses. Submit Sequence all eligible SARS-CoV-2 respiratory specimens for sequencing to allow for sentinel genomic surveillance of hospitalized patients.

6) Conduct interviews or surveys, medical record reviews, and verify vaccination status of cases and controls to allow for refining and validating COVID-19 and influenza-specific severity scores that can be applied for evaluating vaccine effectiveness against disease progression.

7) For a subset of inpatients, collect biospecimens (blood and an additional respiratory specimen) from SARS- CoV-2, influenza, and RSV positive and negative patients of varying gradients in severity to facilitate understanding of COVID-19, influenza, and RSV severe ARI, including vaccine failures, virus evolution, evaluation of strains and immune responses, antibody kinetics, cellular responses, correlates of protection, and microbiome differences.

8) Provide analytic dataset (and samples as appropriate) to CDC in a timely manner using data tools that CDC has existing access to (i.e., REDCap) and provide support as needed to CDC with data analysis.

Special Skills and Requirements:

The Contractor must have demonstrated experience:

1) Acting as a coordinating center for an observational, multicenter, prospective public health surveillance network comprised of nationally representative geographic and demographic populations;

2) Identifying and recruiting the type and number of healthcare facilities with the “minimum requirements” identified in Section 1 – Background;

3) Performing similar type of surveillance work as described in Section 4 – Tasks to be Performed; and

4) Meeting the critical timelines outlined in the contract, specifically those included in Section 9 –

Deliverables/Reporting Schedule.

SECTION 4 – TASKS TO BE PERFORMED

The Contractor shall complete the tasks outlined below in accordance with any applicable delivery dates reflected in Section 9 – Deliverables/Reporting Schedule:

1) Task 1: Annual Meeting. The Contractor shall schedule a virtual (teleconference) Annual meeting within fourteen (14) business days from the beginning of the performance period (“Start Date”). The Contractor shall send a meeting link and a meeting agenda to the Contracting Officer (CO), the Contracting Officer’s Representative (COR) and CDC Technical SMEs within seven (7) business days from the Start Date. The purpose of the meeting is to review and clarify the scope of work and delivery schedule for tasks, to delineate roles and responsibilities, and to establish communication protocols for the associated performance period. (Deliverable 1: Annual Meeting Agenda)

2) Task 2: Project Communication. The Contractor shall communicate (via telephone and/or email) as needed to support successful performance of this contract. The primary point of contact for technical discussions related to this contract are the CDC Technical SMEs and primary point of contact for contractual aspects of this project are the CO and the COR.

The Contractor shall also schedule regular bi-weekly conference calls with the Contractor, CDC and all healthcare facilities where the evaluation will occur. The Contractor shall schedule and lead these calls and provide an agenda and meeting minutes for each call within five (5) days after each scheduled call.

(Deliverable 2: Meeting Agendas and Minutes)

ALL PHASES AND ACTIVITIES REPEAT DURING EACH PERFORMANCE PERIOD

PHASE I – ANNUAL PARTICIPATING HEALTHCARE FACILITIES AND PROTOCOL

3) Task 3: Annually identify and present recommendations for existing healthcare facilities enrolling patients for VE evaluations and recommend a list of healthcare facilities for this project. The Contractor shall identify and recommend a list of 15 to 30 healthcare facilities from which patients are enrolled for ongoing VE evaluations and recommend a list of healthcare facilities that should support this contract. The healthcare facilities that the Contractor recommends must:

a. provide care to patients who are representative of the healthcare facility’s included catchment area and be able to capture all microbiologically confirmed viruses of interest at that hospital, medical center or facility;

b. be geographically diverse and representative of the U.S. population, have a diverse population of patients with respect to sex, age, race, ethnicity, and underlying conditions, and be a healthcare facility operating and enrolling patients for this surveillance within one of the fifty (50) states of the United States or the District of Columbia (Washington, D.C); and

c. demonstrate an ability to actively collect respiratory specimens from enrolled participants or obtain residuals from clinically obtained respiratory specimens for subsequent respiratory viral panel (RVP) testing.

The Contractor shall submit to CDC its list of recommended healthcare facilities (Deliverable 3:

Recommendation of Healthcare Facilities) for this contract within fourteen (14) business days from the Start. The recommendation list shall include:

a. Name, location, healthcare facility type, and geographic distribution of healthcare facilities; and

b. Characteristics of patient population available for enrollment in designated facilities, including age, sex, and racial and ethnic distribution.

CDC will review the Contractor’s recommendation for healthcare facilities and advise which healthcare facilities may participate under this contract. CDC must approve all healthcare facilities before they are included in this project. The approved healthcare facilities collectively constitute “Healthcare Facilities” and individually be a “Healthcare Facility” under this contract. In the event that an approved Healthcare Facility leaves or is removed from the project, CDC reserves the right to require that the Contractor replace the Healthcare Facility using the criteria stated above to ensure that the number of facilities stays within the identified range.

4) Task 4: Annually update existing CDC-approved case-control protocol to measure vaccine effectiveness in adults and expand to include RSV surveillance.

a. Task 4(a): In the base period, the Contractor shall update the current CDC-approved, case-control protocol developed under CDC #75D30121F00002 to measure vaccine effectiveness in hospitalized patients for COVID-19 and influenza and add surveillance for RSV. In all Option Periods, the Contractor shall update the CDC-approved, case control protocol approved in the preceding performance period. Patients with symptoms suggestive of COVID-19/influenza/RSV who meet a CDC-approved case definition shall be enrolled under this contract. Patients who meet the case definition and have PCR-confirmed SARS-CoV-2 (or influenza or RSV) will serve as cases. Controls for SARS-CoV-2 vaccine effectiveness analysis will be patients with symptoms of COVID-19 with negative SARS-CoV-2 PCR testing. Similar approaches will be taken for case and control enrollment for influenza vaccine effectiveness analysis.

The Contractor shall measure the following outcomes using standard case definitions as agreed upon by CDC and the Contractor for this evaluation:

i) PCR-confirmed, symptomatic COVID-19, influenza, and RSV

ii) Severe COVID-19, influenza, and RSV

The Contractor shall enroll sufficient cases and controls and collect necessary information to assess COVID-19 and influenza (and, subsequently, RSV) vaccine effectiveness by time since vaccination and in subgroups including but not limited to: age-groups, race/ethnicity, disease severity groups, prevalent underlying conditions (e.g., immunosuppressed; cardiovascular; chronic respiratory diseases), and vaccine type.

Within thirty (30) days from the performance period’s start date, the Contractor shall update a CDC-standard protocol and provide a revised draft to CDC for its review and approval.

(Deliverable 4: “Draft” Updated Case Control Protocol). The Contractor shall incorporate CDC’s comments into a final version (Deliverable 5: “Final” Updated Case Control Protocol) no later than seven (7) calendar days from receipt of the CDC’s comments.

b. Task 4(b): The Contractor shall annually submit, after it has been reviewed and updated, the final CDC-approved protocol for this project for IRB approval or exemption within five (5) calendar days of finalizing Deliverable 5 and provide confirmation of submission to CDC. (Deliverable 6:

Submission of IRB Approval or Exemption and Confirmation of Submission) The Contractor shall provide notification to CDC of IRB’s approval or exemption within two (2) calendar days after receiving IRB’s final approval or exemption of Final Updated Case Control Protocol. (Deliverable 7: IRB Response)

PHASE II – ANNUAL ENROLLMENT

5) Task 5: Annually enroll patients who meet the case definition as cases and controls for VE evaluation or surveillance, collect and test upper respiratory specimens by PCR, and provide weekly enrollment updates.

a. Task 5(a): The Contractor shall annually enroll patients who meet the case definition as cases and controls for VE evaluation or surveillance following updated IRB approvals. Enrollment for this contract shall begin no later than October 1st of each performance period and shall end no sooner than the time required to complete Task 9(a) below. The Contractor shall notify CDC via e-mail when the protocol has been updated and approved and confirm enrollment has begun on the required date. (Deliverable 8: Enrollment Protocol Notification)

b. Task 5(b): The Contractor shall aim to collect upper respiratory specimens (residual or active collection) on all patients with ARI and test them at a centralized facility or facilities, in two week batches. (Deliverable 9: Upper Respiratory Specimen Collection Testing)

c. Task 5(c): The Contractor shall provide weekly enrollment updates (Deliverable 10: Weekly Enrollment Updates) to CDC with the following information:

i. Number of patients tested for SARS-CoV-2 (and influenza/RSV when circulating), including number and percent positive and negative; and

ii. Number of patients enrolled for each potential category of patients (cases [including SARS-CoV-2, influenza, and RSV] and test-negative controls) by basic demographic information (e.g., age group, sex, race/ethnicity groups).

6) Task 6: Annually collect data on enrolled cases and controls using updated and CDC-approved data collection forms.

a. Task 6(a): The Contractor shall collect data on enrolled cases and controls by conducting interviews, medical record reviews, and verifying vaccine administration using various sources of information (medical record, vaccine registry, etc.). The Contractor shall use a data collection form that CDC has reviewed and approved (Deliverable 11(a): CDC-Approved Data Collection Form), and includes at a minimum the collected data elements that follow:

i. Clinical symptoms;

ii. SARS-CoV-2, influenza, and RSV test type, date, and results, including Ct values;

iii. COVID-19 (and influenza and RSV when circulating) severity, including medical care received for COVID-19, influenza, and RSV and signs of severe illness;

iv. Demographics, including age, race and ethnicity;

v. Underlying medical conditions;

vi. SARS-CoV-2 and influenza (and, subsequently, RSV) vaccine information, including dates of vaccination, vaccine type (product name, manufacturer), number of doses, and source of vaccine information;

vii. Information on other vaccines that are recommended for adults; and

viii. Information related to potential risk factors for SARS-CoV-2 infection (e.g., occupation, prior laboratory-confirmed SARS-CoV-2 infection).

b. Task 6(b): From a subset of sites, the Contractor shall also annually collect data on each of the healthcare facilities’ market share for provision of inpatient care or “source population” that will serve as the denominator (at-risk population) for estimating population-based rates of laboratory-confirmed hospitalizations from influenza, RSV, and SARS-CoV-2. Source population data will be extracted from EMRs and must include demographic data, clinical test results, antiviral medication prescriptions, health care visits (outpatient, ED, and inpatient) in the previous year and associated ICD-10 codes with each of those visits. (Deliverable 11(b): CDC-Approved Data Collection Form)

7) Task 7: Annually collect biospecimens on enrolled cases and controls

a. Task 7(a): For a subset of vaccinated and unvaccinated patients, the Contractor shall annually collect an additional respiratory specimen (nasopharyngeal, tracheal aspirates and/or bronchioalveolar lavage) as well as blood specimens (sera and/or plasma, PBMCs) at pre-specified time points during hospitalization based upon scientific guidance from CDC. Approximate sample sizes and sample types include:

i. Acute sera at 0 (target: 1000 participants), 3, 7, and/or pre-discharge or death (target: 400 participants)

ii. Convalescent sera at 30 days (maximize enrollment on same participants with acute sera at 0)

iii. PBMCs at 0, 3, 7, pre-discharge (target: 200 participants), and at convalescent sera collection (target: 50 participants).

iv. Nasal swabs collected every 2-4 weeks until the end of the contract from a subset of patients (target: 250 participants) at a subset of sites for evaluation of intrahost virus evolution.

The Contractor shall use Tthese specimens will be used to evaluate susceptibility to severe infection and mechanisms of disease attenuation (e.g., antibody kinetics, correlates of protection, proteomics) as well as vaccine failure and intrahost virus evolution. The Contractor will continue annually building the biospecimen repository that provides CDC with access to the specimens and ensures shipment to CDC or a CDC-approved laboratory for appropriate testing. (Deliverable 12:

Specimen Shipment for Testing).

b. Task 7(b): The Contractor shall annually update the current IVY Network’s Standard Operating Procedures on specimen collection and shipment as needed to address all specimen types being collected under this contract. (Deliverable 13: Specimen Collection SOP).

8) Task 8: Annual Data and Analysis

a. Task 8(a): The Contractor shall maintain complete password protected database in secure locations according to applicable local, state or federal regulations. The Contractor shall develop a Site Data Management Plan in collaboration with the Healthcare Facility site Principal Investigators (PIs) and CDC within three (3) weeks of initiating enrollment and thereafter update it annually for each performance period. (Deliverable 14: Site Data Management Plan). The Site Data Management Plan will consider the requirements for the CDC-required Data Management Plan set forth in Section H of this contract.

b. Task 8(b): The Contractor shall transmit to the CDC Technical SME individual-level data via a secure system every two (2) weeks. (Deliverable 15: Biweekly Individual-Level Data Transmission) Data collection for each patient shall be completed within two (2) weeks of patient discharge or death. The Contractor shall ensure that the CDC Technical SME has access to data real-time through a secure data management system.

c. Task 8(c): The Contractor shall perform data quality checks and data cleaning on an ongoing basis.

PHASE III: ANNUAL PROJECT ARTIFACTS

10) Task 9: Annual Project Artifacts

a. Task 9(a): The Contractor shall transmit a final, complete dataset to CDC within two (2) weeks of completing enrollment and data collection and before the end of each period of performance.

(Deliverable 16: Final Complete Dataset).

b. Task 9(b): Writing manuscripts for publication will be the shared responsibility of CDC and the Contractor. Authorship will be granted based on scientific contribution in accordance with CDC authorship policy (http://www.cdc.gov/maso/Policy/Authorship.pdf). At least one manuscript will be developed annually during each performance period. (Deliverable 17: Manuscripts)

11) OPTIONAL TASK (if exercised, separately funded via Optional CLIN *0002 series) Task 10:

Evaluation of Therapeutics. The Contractor shall investigate the effectiveness of therapeutics on outcomes such as ICU admission, length of hospital stay, and death resulting from COVID-19, RSV or influenza. In performing this task, the Contractor shall complete the following annually for each performance period in which the option is exercised:

a. Update the protocol in a manner approved by CDC to accommodate evaluation of therapeutic interventions and obtain IRB approval or exemption from all participating healthcare facilities supporting this task;

b. Update all data collection instruments, including forms and databases;

c. Draft any standard operating procedures necessary for healthcare facilities to implement this task;

d. Revise reports used to provide enrollment updates to CDC so that data for this task are included;

and

e. Facilitate coordination of this activity alongside evaluations of vaccine effectiveness and RSV surveillance.

(Deliverable 18: Updated Protocol, Data Collection Forms, Report Revision for Evaluation of Therapeutics)

SECTION 5 – REFERENCE MATERIALS

1. World Health Organization. WHO Coronavirus Disease (COVID-19) Dashboard [Internet]. [cited 2021 Feb 14]; Available from: https://covid19.who.int/

2. Polack FP, Thomas SJ, Kitchin N, et al. Safety and Efficacy of the BNT162b2 mRNA Covid-19 Vaccine. N Engl J Med 2020;383(27):2603–15.

3. Baden LR, El Sahly HM, Essink B, et al. Efficacy and Safety of the mRNA-1273 SARS-CoV-2 Vaccine. N Engl J Med 2021; 384(5): 403-16.

4. Sadoff, J. et al. Safety and Efficacy of Single-Dose Ad26.COV2.S Vaccine against Covid-19. N. Engl. J. Med.

(2021) doi:10.1056/NEJMoa2101544

5. REDCap. [Internet]. [cited 2019 Jul 24]; Available from: https://www.project-redcap.org/

6. Office for Human Research Protections. Activities Deemed Not to Be Research: Public Health Surveillance 2018 Requirements. [Internet]. [cited 2020 Sep 12]; Available from: https://www.hhs.gov/ohrp/regulations-and-policy/requests-for-comments/draft-guidance-activities-deemed-not-be-research-public-health-surveillance/index.html

SECTION 6 – GOVERNMENT FURNISHED MATERIALS

1. If the Contractor has to access to the Government’s Intranet for the purpose of accessing and downloading program data from the secure online application referred to as the CBA Tracking System, the Contractor will be responsible for meeting all Government security requirements to acquire this access. Upon meeting all Government security requirements for access, Government will provide a Smart Card and Smart Card reader for contractor staff directly responsible for performing data retrieval and data transfers tasks.

2. Upon award and signature of any required nondisclosure agreements, CDC will provide the Contractor with (a) the most current CDC-approved, case-control protocol developed under CDC #75D30121F00002 to measure vaccine effectiveness in hospitalized patients for COVID-19 and influenza as well as surveillance for RSV, and

(b) current IVY Network’s Standard Operating Procedures on specimen collection and shipment as needed (also developed under CDC #75D30121F00002) to address all specimens types being collected under this contract.

3. Contractor Request for Government Furnished Materials. If the Contractor needs any additional government-furnished items to perform the work described in this PWS, the Contractor should identify such additional government-furnished items in the Contractor’s proposal.

SECTION 7 – PERIOD OF PERFORMANCE

The performance period for this requirement is:

Base Period (12 Months) 09/01/2022-08/31/2023

Option Period 1 (12 Months) 09/01/2023-08/31/2024

Option Period 2 (12 Months) 09/01/2024-08/31/2025

SECTION 8 – PLACE OF PERFORMANCE

1. The work to be performed under this contract will be performed at the Contractor’s facility and associated academic, healthcare or research facilities as required.

2. No CDC onsite work is required.

SECTION 9 – DELIVERABLES/REPORTING SCHEDULE

All deliverables shall be in written form (i) delivered electronically, or such other manner as the contract requires, to the CDC Technical SME (see Section 12 below), the COR and such other parties as included below, or to whom the COR may designate to the Contractor in writing; and (ii) be formatted in Microsoft WORD, EXCEL or other editable formatting approved by the COR. All deliverables must be prepared in consideration of all applicable security, confidentiality, and architecture compliance requirements.

This Deliverables Chart is aligned to annual performance of all tasks. “Start,” as used in the Deliverables Chart, means the “start of each performance period.” The Contractor shall deliver the following in accordance with the

PWS:

# Task Reference Deliverable Quantity and/or

Frequency

Due Date Deliver To

1 Task 1 – Annual Meeting

Annual Meeting Agenda & Meeting Link

1 per performance period Within seven (7) business days of the Start of each performance period

CDC Technical SME

COR

2 Task 2 – Project Communication

Meeting Agendas and Minutes

Every two (2) Weeks with the first call being scheduled after approval of the Healthcare Facility

List (see Task 3)

Within five (5) business days after each scheduled call

CDC Technical SME Healthcare Facilities

COR

3 Task 3 – Healthcare Facility Identification

Recommendation of Healthcare Facilities

1 Within fourteen (14) business days of the Start

CDC Technical SME

COR

4 Task 4(a) – IRB

Protocol Updates and Approval

“Draft” Updated Case Control Protocol

1 Within thirty (30) days of the Start

CDC Technical SME

COR

5 Task 4(a) – IRB Protocol Updates and Approval

“Final” Updated Case Control Protocol

1 Within seven (7) days of the receipt of CDC’s comments to Deliverable 4

CDC Technical SME

COR

6 Task 4(b) – IRB Protocol Updates and Approval

Submission of IRB Approval or Exemption and Confirmation of Submission

1 Submission for IRB approval or exemption within five (5) business days after finalizing Deliverable 5

Submitted to IRB with confirmation of submission provided to CDC Technical SME

COR

7 Task 4(b) – IRB

Protocol Updates and Approval

IRB Response

1 Within two (2) business days of receipt of IRB’s final approval or exemption of Final Updated Case Control Protocol

CDC Technical SME

COR

8 Task 5(a) – Enrollment Enrollment Protocol Notification

1 Following IRB approval and with enrollment beginning on October 1st of each performance period

CDC Technical SME

COR

9 Task 5(b) - Specimen Collection

Upper Respiratory Specimen Collection Testing

Every two (2) Weeks Starting two (2) weeks from initial enrollment and upper respiratory specimen collection

Specimen Testing Facility

10 Task 5(c) – Enrollment Weekly Enrollment Updates

Weekly Starting one (1) week from initial enrollment and ending and shall end no sooner than the time required to complete Task 9(a)

CDC Technical SME

11(a) Task 6(a) – Data Collection

CDC Approved Data Collection Form

1 Within thirty (30) business days of the start

11(b) Task 6(b) – Data

Collection CDC Approved Data Collection Form

1 Within thirty (30) business days of the start

12 Task 7(a) –

Biospecimen Collection

Specimen Shipment for Testing

Target: 1000 serum specimens, 200 PBMCs, 100 nasal swabs

Periodically as sufficient numbers of specimens are collected

CDC or CDC- Approved Laboratory

SECTION 10 – TRAVEL

This contract does not include travel.

SECTION 11 – SPECIAL CONSIDERATIONS (CLEARANCE REQUIREMENTS)

1. Information Security and Privacy.

Information Security and Privacy (ISSO Clearance Required Language):

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

13 Task 7(b) – Biospecimen Collection

Specimen Collection SOP

1, updated as required Prior to conducting specimen collection and shipment

CDC Technical SME

14 Task 8(a) – Data and Analysis

Site Data Management Plan

1 Within three (3) weeks after initiating enrollment during each performance period

CDC Technical SME

COR

15 Task 8(b) – Data and Analysis

Biweekly Individual-Level Data Transmission

Every two weeks after work begins under Task 8

Every two (2) weeks after work begins under Task 8

CDC Technical SME

16 Task 9(a) – Data and Analysis

Final Complete Dataset

1 Within two (2) weeks of completing enrollment and data collection and prior to the end of each performance period

CDC Technical SME

17 Task 9(b) – Final Report

Manuscripts At least 1 per performance period

Due after identification of the manuscript topic and collaborative draft

CDC Technical SME

18 OPTIONAL TASK

Task 10 – Evaluation of Therapeutics

Updated Protocol, Data Collection Forms, Report Revision of Therapeutics

1 Within thirty (30) days after exercising this optional task (optional task may be exercised for any or all performance period)

19 Section H – Special Contract Requirement Deliverable 19 Section H – Special

Contract Requirements Data Management Plan - Final

1 Four (4) weeks prior to the end of the each performance period

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High

Integrity: [ ] Low [X] Moderate [ ] High

Availability: [ ] Low [X] Moderate [ ] High

Overall Risk Level: [ ] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [X] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [X] Moderate [ ] High

4) Sensitive but Unclassified (SBU). Sensitive but Unclassified information is any information which the loss, misuse, or unauthorized access to of modification of which could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Title 5 U.S.C Section 552a, but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of the national defense or foreign policy. All sensitive information that has been identified as SBU by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800- 88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract.

The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents as outlined in CDC polices to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR prior to performing any work on behalf of HHS. (Deliverable 19(a): Written Copy of Cryptographic Module Validation Program Documentation)

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract. (Deliverable 19(b): Encryption Key)

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition. (Deliverable 19(c): NDA)

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the CDC SOP or designee with completing a PIA for the system or information within 7 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the OpDiv SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role- Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request. (Deliverable 19(d): Training Records)

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and CDC Implementation of the HHS Rules of Behavior for Use of HHS Information Technology Resources.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by CDC Computer Security Incident Response Team (CSIRT) within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send CDC approved notifications to affected individuals within 30 days. (Deliverable 19(e): CDC-Approved Notifications)

3) Report all suspected and confirmed information security and privacy incidents and breaches to the CDC Computer Security Incident Response Team (CSIRT) at 866-655-2245 and CSIRT@cdc.gov, COR, CO, CDC SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable CDC and HHS policy and procedures, NIST standards and…