PWS_Precision Medicine PLDR_RFI_DRAFT.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Veterans Health Administration (VHA) National Center for Posttraumatic Stress Disorder (NCPTSD)

Precision Medicine

Date: June 10, 2024

VA-24-00060494

PWS Version Number: 0.1

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

5.1.2 REPORTING REQUIREMENTS

5.1.3 MEETINGS

5.1.3.1 KICK-OFF MEETING

5.1.3.2 AD HOC AND MONTHLY MEETING

5.1.3.3 QUARTERLY MEETING

5.2 DATA REPOSITORY DESIGN AND PROVISIONING

5.2.1 DATASET SELECTION

5.2.2 COMMON DATA ELEMENT IDENTIFICATION

5.2.3 DATA USE AGREEMENTS

5.2.4 DATA PROVISIONING

5.2.5 DATA REPOSITORY DESIGN AND GENERATION

5.3 SCRIPT AND CODEBOOK DEVELOPMENT

5.3.1 HARMONIZATION PROCEDURES

5.3.2 INDIVIDUAL AND TREATMENT-LEVEL ANALYSIS PROCEDURES

5.4 TECHNICAL WRITING

5.4.1 TECHNICAL SECTIONS FOR ACADEMIC MANUSCRIPTS

5.4.2 TECHNICAL SECTIONS FOR GRANT PROPOSALS

5.5 TRAINING

5.5.1 TRAINING IN DATA REPOSITORY TECHNICAL DESIGN

5.6 ASSESSMENT, AUTHORIZATION AND CONTINUOUS MONITORING .. Error!

Bookmark not defined.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT

(FICAM)

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

6.1.5 STANDARD COMPUTER CONFIGURATION

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT

LINE MANAGEMENT (PLM)

6.1.7 PROCESS ASSET LIBRARY (PAL)

6.1.8 AUTHORITATIVE DATA SOURCES

6.1.9 SOCIAL SECURITY NUMBER (SSN) REDUCTION

6.1.10 SOFTWARE AND LICENSING REQUIREMENTS . Error! Bookmark not defined.

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

6.2.2 CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION AND INFORMATION SYSTEM

SECURITY/PRIVACY LANGUAGE

1.0 BACKGROUND

The VA, VHA, NCPTSD was created in 1989 within the Department of Veterans Affairs in response to a Congressional mandate (PL 98-528) to address the needs of Veterans with military-related PTSD. The mission of the NCPTSD is to advance the clinical care and social welfare of America's Veterans through research, education, and training in the science, diagnosis, and treatment of PTSD and stress-related disorders. NCPTSD consists of seven VA academic centers of excellence across the United States (US), with the Executive Division serving as headquarters in White River Junction, Vermont.

The NCPTSD’s precision medicine workgroup has identified an overall need to construct a Person-level Clinical Trial Database (PCTD), aggregate datasets from multiple PTSD clinical trials, and carry out Meta-Analysis of Individual Patient Data (MIPD), in order to advance research in precision treatment for PTSD. PTSD treatment is an active area of research with numerous clinical trials currently underway and expected in the future. For precision medicine research conducted by the NCPTSD to stay current with the PTSD treatment evidence base, that repository’s contents and the associated analysis procedures must be designed to accommodate periodic updates with new trial datasets. Because carrying out these tasks appropriately requires close involvement from NCPTSD’s scientific experts, the NCPTSD staff also need to develop scientific and technical understanding of all phases of this process. Therefore, NCPTSD has several associated needs which must be addressed to advance research in this area.

1. A Person-level Clinical Trial Database (PCTD) capable of aggregating and archiving datasets from multiple PTSD clinical trials.

2. Expertise in establishing collaborative relationships and negotiating data use agreements with clinical trial sites for meta-analytic research.

3. Effective processes for data management, administration, and transfer for clinical trial datasets.

4. Technical methods to harmonize PTSD treatment data across trials and perform integrative data analysis (IDA).

5. Technical methods to conduct meta-analysis of individual participant data

(MIPD).

6. Plans and methods for phased updates to the repository to reflect ongoing research.

7. Training to develop NCPTSD internal scientific and technical expertise in the assembling, maintaining and expanding a PCTD, and in carrying out IDA and MIPD procedures.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and

Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and

Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information

Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5,

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed

Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information

Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System

Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6,

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15,

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21,

35. VA Handbook, 6300.1, “Records Management Procedures, “March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information

Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-

12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access, “June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile

Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August

2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote

Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,”

January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol

Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23,

3.0 SCOPE OF WORK

The Contractor shall design and construct a harmonized and updateable individual person-level clinical trial database for PTSD clinical trials, hosted on Government IT systems, which includes development of associated analysis procedures, and training for NCPTSD research staff in using the repository. This shall include the following components:

1. A harmonized and updateable Person-level Clinical Trial Database (PCTD) suitable for archiving and analysis of individual-level patient data from PTSD clinical trials, hosted on Government IT systems;

2. Agreements and procedures for transfer, storage, and use of deidentified clinical trials datasets from both Government and non-Government research sites, which fulfill administrative, organizational, and legal requirements.

3. Harmonization procedures to transform deidentified clinical trial datasets into suitable format for integrative data analysis (IDA) and archiving in the

PCTD.

4. Analysis procedures to carry out integrative data analysis (IDA) and meta-analysis of individual participant data (MIPD) on the PCTD.

5. Plans and procedures to incrementally expand the contents of the PCTD through prioritized selection and incorporation of technically and scientifically valuable clinical trial datasets

6. Training for NCPTSD research staff in the design of the PCTD, analysis procedures used to carry out IDA and MIPD, and technical procedures required for using and adding to the PCTD in a scientifically sound manner.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The Period of Performance (PoP) shall be 12 months from date of award, with four 12-month option periods. The overall PoP shall not exceed 60 months.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

There are eleven (11) Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, four are set by date:

New Year's Day January 1 Juneteenth June 19 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

4.2 PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

4.3 TRAVEL

The Government anticipates NO travel under this effort to perform the tasks associated with the effort.

5.0 SPECIFIC TASKS AND DELIVERABLES

All activities, tasks, and deliverables specified in this section shall be required to be performed and/or delivered in the contract by the Contractor. The Contract Line Item Number(s) (CLIN) shall identify the task number and quantity required. All aspects of any task shall be performed. Any task not indicated shall not be required to be provided by the Contractor. CLINs will be designated with either activity, task, and/or associated deliverables. The activities are the overarching requirements which correlate to tasks and deliverables.

If for any reason the delivery date for a deliverable cannot be met, the Contractor shall submit a written explanation to the COR within three business days before the deliverable date. This notice to the COR shall include the original deliverable due date, cite the reasons for the delay, describe the impact on the overall program, and include a firm commitment of when the work shall be completed. This is intended to be required as part of any deliverable requirement. The COR will then review the facts and discuss with the CO. The COR or CO shall respond to the Contractor acknowledging receipt and communicating any additional concerns within two business days in accordance with applicable regulations.

The Contractor shall also provide all data reports, developments and updates, projections, assumptions, modeling and model validation studies, comparisons, summaries, and any and all documentation at a level of detail appropriate for stakeholders and / or identifies data, assumptions, and methods used with sufficient clarity that qualified analysts, in the same practice area, could evaluate the reasonableness of the work.

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. Monthly Progress Report

5.1.3 MEETINGS

Meetings shall be conducted throughout the performance period to allow for updates and dialogue on aspects, issues, and concerns related to the performance of the Contractor. These meetings shall be coordinated and scheduled weekly, bi-weekly, monthly to quarterly depending on necessity.

Meetings may pertain and include these aspects, but not limited and designed to:

introduce Government and Contractor team members including roles and responsibilities, update contact information of all parties, complete a full review of the PWS along with associated timeframes and deadlines, discuss responsibilities/authorities, discuss plans for clear lines of communication between the Government and the Contractor, identify any potential successes, conflicts, or issues in performance, and provide clear understanding of quality assurance measures of all requirements of the Contractor. Meetings may also serve to facilitate dialogue and discussion of matters pertinent to disputes, process improvement, resolution management, and review of any matters related to specific task completion, deliverable submission, interpretation variances of requirement, and Contractor Performance Assessment Reporting System (CPARS). By having these meetings throughout the process, the goal is to establish a mutual understanding of how to achieve the highest program standards.

5.1.3.1 KICK-OFF MEETING

The Kick-off meeting between the Program Office, Contracting, and the Contractor shall be scheduled within 10 business days after Notice to Proceed is issued to the Contractor. Contracting shall coordinate the date, time, location (in person or virtual) of the meeting. The Contractor shall attend meeting with the appropriate staff, prepare an agenda, presentation materials, and attendee list (with email addresses), which shall be provided to Contracting in PDF format and approved for distribution to all attendees at least five business days prior to the meeting. The Contractor shall also provide meeting minutes in PDF format to all attendees within 15 business days following the meeting.

This meeting shall occur at the beginning of every performance period; duration is estimated at 4 hours per occurrence.

5.1.3.2 AD HOC AND MONTHLY MEETING

The Contractor shall coordinate meetings with the appropriate staff, prepare an agenda, presentation materials, and attendee list (with email addresses), if required by the COR, provided by the Contractor to facilitate discussion on status updates, schedule deviations or barriers, any areas of concern or of interest, introduction of new personnel and positions as well as staff losses, and feedback evaluations. The Government will provide their agenda topics so that the Contractor can consolidate, in order to have a complete agenda, if required. The Contractor shall establish a MS Teams invitation for the monthly meeting calls.

The meeting dates and times shall be coordinated and established at the kickoff meeting, as much as possible. The Contractor shall prepare and submit their agenda in PDF format to the COR in PDF format at least five business days prior to the meeting.

The Contractor shall also provide meeting minutes in PDF format to all attendees within five business days following the meeting. The meeting duration is estimated at 1.5 hours per occurrence.

5.1.3.3 QUARTERLY MEETING

The Contractor shall coordinate quarterly meetings with the appropriate staff prepared to discuss Performance Metrics as they relate to the quarterly evaluated performance of the Contractor by the Government. These areas for discussion primarily include Performance Objectives, Performance Standards, and Acceptable Quality Levels. The Contractor shall prepare, provide/submit, present their independent analysis and participate in the conversation of all facets of performance. A briefing template based on the Performance Metrics will be provided to the Contractor at the first kickoff meeting to be used throughout the contract. The Contractor shall establish a MS Teams invitation for the Quarterly Meeting calls.

The quarterly meeting date and time shall be coordinated and established at the kickoff meeting. The Contractor shall prepare and submit all required materials and agenda to the COR in PDF format at least five business days prior to the meeting. The Contractor shall also provide meeting minutes in PDF format to all attendees within five business days following the meeting. This meeting duration is estimated at 2 hours per occurrence.

5.2 DATA REPOSITORY DESIGN AND PROVISIONING

To support the development of precision treatment for PTSD, VA requires data analysis capable of detecting of differences in response across multiple treatments in connection with variability between patients. Statistically, detecting such evidence requires data from large numbers of patients, measuring outcome trajectories across multiple treatments with high quality and precision. Currently, clinical trials of PTSD treatment constitute the primary source of data with adequate measurement quality. However, individual clinical trial datasets cannot provide adequate variations in treatment or numbers of patients to address precision treatment research needs.

The Contractor shall plan and carry out analyses on individual participant level data aggregated from multiple clinical trials into a single, harmonized database, using techniques known as Integrated Data Analysis (IDA) and Meta-Analysis Of Individual Participant Data (MIPD), in order to prospectively predict Clinically Significant Change (CSC) at the individual participant level within the database.

The Contractor shall identify clinical trial datasets which are suitable for IDA/MIPD analysis procedures, and establish collaborative working relationships with the institutions, stakeholders, and staff associated with each clinical trial. Specific capacities required include drafting institution-specific data use agreements, ensuring consistency of agreements with patient consent, arranging for secure data transmission, and generation of synthetic data in cases where raw data cannot be disclosed. The Contractor shall also identify Common Data Elements, which are clinical trial measures that can be statistically harmonized and whose presence in a clinical trial indicates its suitability for inclusion in the data repository and for use in MIPD analysis.

The objective is to identify suitable datasets for initial population of the repository, identify Common Data Elements for use with the data repository, develop data storage formats, structures, processing pipelines, data use agreements for transition and achieving, procedures for secure transfer, and synthetic simulation for repository data and trails.

5.2.1 DATASET SELECTION

The Contractor shall provide Pilot Phase Trial Selection Report and Expansion Phase Trial Selection Reports, which phases, based on their suitability for incorporation into the repository. Each phase shall include primary and backup list, in case of data unavailability, for datasets on the primary list. The initial set will consist of between 5 and 10 trials for precision treatment hypotheses (i.e., identification of differential treatment response, and predicting CSC at a patient level). In each performance year, an additional set of trials will be selected, prioritized, and grouped using similar criteria for subsequent phases of repository expansion, with the number of trials determined by agreement between VA and the Contractor. To satisfy the requirement, the Trial Selection Report must include the criteria and technical justification used to select each trial, as well as reasons for excluding other trials. Prior to delivering the report, Contractor shall meet to review with COR and Program Manager to ensure appropriate criteria is used during the preparation of the trial list to ensure scientific suitability.

Deliverables:

A. Pilot Phase Trial Selection Report B. Expansion Phase Trial Selection Report

5.2.2 COMMON DATA ELEMENT IDENTIFICATION

The Contractor shall for, this initial feasibility and based on the data from the initial 5 studies, Contractor will prepare a Common Data Elements Report containing a list of:

1. “Essential” Common Data Elements (CDEs), which are methodologically necessary for research projects within the NCPTSD to be suitable for the PCTD;

2. “Recommended” CDEs, which maximize cumulative study value, and all research projects will be encouraged to adopt; and

3. “Optional” CDEs suitable for tailored research interests, given the span of PTSD intervention approaches and population types. Contractor will provide technical justification for inclusion of each CDE, as well as for each measure considered and not included.

A. Common Data Elements Report

5.2.3 DATA USE AGREEMENTS

The Contractor shall pursue all steps needed to establish data use agreements for datasets to be included in the repository, including all possible primary datasets in Task 7, and additional backup datasets necessary, if data use agreements cannot be established for primary datasets. Data use agreements shall address all applicable organizational, ethical, and legal requirements, including ensuring use consistent with trial participants’ informed consent. Contractor shall coordinate with both Center staff and clinical trial sites as needed throughout the preparation of the agreements to ensure their suitability and shall sustain efforts to establish an agreement until the point it is clearly not feasible (for example, legal obstacles, organizational policies, or decisions on the part of the clinical trial site for which no work-around or possibility of modification exists). Data use agreements shall be delivered fully executed, with complete approval signed by all parties identified in the agreements. The Contractor shall also provide a Data Use Agreement Report listing all datasets considered, whether a data use agreement was pursued, and whether it was successfully established. If successful, the report should provide a summary of the data use agreement, If not successful, the Contractor shall detail the steps taken and time spent pursuing the agreement, and the reasons why a data use agreement is clearly not feasible to establish.

Deliverables:

A. Data Use Agreements B. Data Use Agreement Report

5.2.4 DATA PROVISIONING

The Contractor shall successfully execute documented procedures to conduct secure transfer and/or synthetic simulation (to supplement or substitute for individual data which is unavailable) as necessary to incorporate each selected trial dataset into the repository, including all datasets for which data use agreements have been obtained, all primary datasets where original or simulated data can be produced, and additional backup datasets as needed to carry out successful analysis. Procedures for data transfer and/or synthesis shall address all applicable organizational, ethical, and legal requirements, including ensuring use consistent with trial participants’ informed consent.

Synthetic simulation shall be reserved for cases where transfer of some or all original individual-level trial data is infeasible for organizational, legal, or ethical reasons (e.g., lack of participant consent for use, re-identifiability of specific data fields).

Contractor shall carry out all the procedures such that the repository contains the datasets in a form ready for analysis. Contractor shall provide the trial data itself, any executable code used to synthesize or transform the data, and a report documenting of the complete procedure used to obtain the data. Contractor shall coordinate the preparation and execution of the procedures with both Center staff and clinical trial sites as needed during to ensure their feasibility.

Deliverables:

A. Provisioned Datasets B. Data Provisioning Report C. Data Provisioning Executable Codes

5.2.5 DATABASE DESIGN AND GENERATION

PTSD treatment is an active area of research with numerous clinical trials currently underway and expected in the future. For precision medicine research conducted by the NCPTSD to stay current with the PTSD treatment evidence base, that repository’s contents and the associated analysis procedures must be designed to accommodate periodic updates with new trial datasets, data collection, and produce academic technical writings/ manuscripts. The Contractor shall design specifications for the data storage format, data structures, software packages, and basic data processing pipeline scripts needed to integrate clinical trial datasets into an individual-level data repository.

The Contractor shall also update these design specifications as necessary, for each expansion phase of the project. Specifications shall be developed using scientific input from Center Staff and shall be implementable using VA-approved software, infrastructure, and procedures. Specifications shall consist of executable codes necessary to generate a data repository and incorporate trial datasets, along with explanatory documentation describing the repository design and the procedures for generating it. Specifications shall be complete upon passing any necessary reviews.

Deliverables:

A. Initial Data Repository Design and Generation B. Updated Data Repository Design and Generation

5.3 SCRIPT AND CODEBOOK DEVELOPMENT

VA requires meta-analysis of individual participant data from clinical trials using Integrative Data Analysis (IDA), a technical methodology needed to meaningfully combine data across trials. IDA is necessary to address multiple forms of trial non-homogeneity (i.e., variability across trials in populations, treatments, measurement practices and other dimensions).

Aggregating clinical trial data requires considerable specialized data management expertise. One key area of expertise is in understanding and navigating complex policies that apply to secondary use of clinical trial data, which are typically designated as sensitive and confidential even in de-identified form and can be subject to both institution-specific policies and legal requirements for transmission, storage, and use.

The objective is to develop scripts and codebooks to extract harmonized measures from the trial datasets selected for inclusion in the repository, such that they are prepared for individual-level and treatment-level analysis.

5.3.1 HARMONIZATION PROCEDURES

The Contractor shall develop and provide Harmonization Procedures that include scripts and codebooks implementing cross-trial semantic and analytic harmonization procedures while accounting for measurement of non-invariance across studies, measures, populations, time, and reporters for:

1. Outcome measures (i.e., scale scores of PTSD severity, loss of PTSD diagnosis, and remission); and

2. Prospectively measurable patient characteristics of interest (i.e., potential psycho-, socio-, and biomarkers).

Deliverables:

A. Harmonization Procedures

5.3.2 INDIVIDUAL AND TREATMENT-LEVEL ANALYSIS PROCEDURES

The Contractor shall propose hypotheses to be tested using individual and treatment-level analysis procedures; Contractor and VA shall review and agree on a set of hypotheses which Contractor will document in the Treatment-Level Analysis Plan. For each hypothesis, Contractor shall deliver of fully usable procedures for VA to carry out these analyses. Contractor shall also provide interpretation of the corresponding results after the analyses are run. The Contractor shall develop scripts and codebooks to test these hypotheses using individual data analysis / meta-analysis of individual participant data (IDA/MIPD) methodologies with CSC modeling. The Contractor shall confirm that executable codes for these analyses can be executed against the person-level clinical trial database (PCTD). The Contractor shall provide interpretation of the analysis results. The Contractor shall ensure complete delivery when the scripts have been successfully executed using on trial data in the repository to produce valid results, any follow-up analyses necessary to interpret primary findings have been carried out, results have been reviewed, discussed and interpretation coordination and subsequent approval by the COR. Contractor shall provide a report documenting the approved interpretation of the results.

Deliverables:

A. Treatment-Level Analysis Plan B. Treatment-Level Analysis Final Procedure and Interpretation C. Individual-Level Analysis Plan D. Individual-Level Analysis Final Procedure and Interpretation

5.4 TECHNICAL WRITING

VA requires technical sections to be provided by the Contractor, including text, tables and graphics as appropriate, for contributions to academic publications to be prepared and submitted for publication by NCPTSD staff. These manuscripts describe the detailed technical methodologies used in derived data analysis, assumptions, and conclusions to provide ongoing research.

The objective is to contribute and develop technical materials for co-authored academic manuscripts and contribute technical materials for grant preparation.

5.4.1 TECHNICAL SECTIONS FOR ACADEMIC MANUSCRIPTS

The Contractor shall provide sections of academic manuscripts which detail technical methodology. The Contractor shall also contribute revisions for these sections as needed during the peer review and publication process.

At the discretion of the COR, some individual manuscripts described below may be consolidated for scientific reasons and efficiency of publication. In this case, the COR will provide advance notice to the Contractor to provide the relevant sections as a combined document.

Deliverables:

A. Technical Sections – Methodology Manuscript B. Technical Section Revisions – Methodology Manuscript C. Technical Sections – Common Data Elements Manuscript D. Technical Section Revisions – Common Data Elements Manuscript E. Technical Sections – Treatment-Level Findings Manuscript F. Technical Section Revisions – Treatment-Level Findings Manuscript G. Technical Sections – Individual – Level Findings Manuscript H. Technical Section Revisions – Individual – Level Findings Manuscript

5.4.2 TECHNICAL SECTIONS FOR GRANT PROPOSALS

The Contractor shall provide technical sections/elements for at least one (1) grant proposal, which provide details of the data repository and IDA/MIPD/CSC statistical methodologies. For each such grant proposal, the Government will identify the target grant opportunity and an associated grant proposal submission deadline (GPSD) at least two (2) calendar months in advance of the GPSD. The Contractor shall provide draft sections at least one (1) calendar month prior to the GPSD. The Contractor shall provide final sections at least 10 business days prior to the GPSD. Draft and final sections shall include text, tables, and graphics as appropriate.

Deliverables:

A. Technical Elements for Grant Proposal B. Technical Elements for Grant Proposal – Revision

5.5 TRAINING

Contractor shall provide a person-level repository of clinical trial data which represents a unique and valuable resource with numerous potential applications for PTSD-related research questions within and beyond the subfield of precision medicine, for example, in addressing health inequities. To maintain and make full use of this resource, and to design and carry out scientifically and technically sound analyses, NCPTSD research staff will require training in the methodology used for person-level data harmonization and meta-analysis, management of organizational and administrative considerations.

The objective is to provide training to NCPTSD personnel on technical aspects of data repository design, harmonization and analysis.

5.5.1 TRAINING IN DATA REPOSITORY TECHNICAL DESIGN

The Contractor shall provide NCPTSD personnel sufficient training in design, data harmonization and analysis procedures to maintain the data repository and perform planned statistical analyses. The training to be provided by the Contractor shall refer to direct, synchronous interaction (i.e., videoconference meetings) with subject matter experts, accompanied by appropriate documentation (training guides and graphics).

Training hours do not include routine asynchronous interactions such as email correspondence. VA staff will schedule training hours as needed throughout each option year. The Government will provide sufficient time (10 business days) for the Contractor to prepare training materials and instruction prior to the videoconference training. The quantity of hours may be reallocated across training subjects as needed.

The Contractor shall provide availability for relevant training prior to or at the completion of each corresponding component of the project.

Deliverables:

A. Initial training - Dataset selection and common data elements – 4 hours of technical training

B. Initial training – Data Agreements, Transfer, And Synthesis– 8 hours of technical training

C. Initial training - Data Repository Technical Design– 4 hours of synchronous face-to-face technical training (videoconference or in-person)

D. Initial Training - Harmonization Procedures – 8 hours of technical training E. Initial Training - Treatment-Level Analysis & Interpreting Results – 8 hours of technical training F. Initial Training – Individual-Level Analysis & Interpreting Results – 8 hours of technical training G. Supplemental training – Updates to Repository Design, Data Administration, Data Harmonization, Analysis, And Interpretation – 20 hours of technical training

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 VA TECHNICAL REFERENCE MODEL

The Contractor shall support the VA enterprise management framework. In association with the framework, the Contractor shall comply with OIT Technical Reference Model (VA TRM). The VA TRM is one component within the overall Enterprise Architecture (EA) that establishes a common vocabulary and structure for describing the information technology used to develop, operate, and maintain enterprise applications. Moreover, the VA TRM, which includes the Standards Profile and Product List, serves as a technology roadmap and tool for supporting OIT. Architecture & Engineering Services (AES) has overall responsibility for the VA TRM.

6.1.2 FEDERAL IDENTITY, CREDENTIAL, AND ACCESS MANAGEMENT (FICAM)

The Contractor shall ensure Commercial Off-The-Shelf (COTS) product(s), software configuration and customization, and/or new software are Personal Identity Verification (PIV) card-enabled by accepting HSPD-12 PIV credentials using VA Enterprise Technical Architecture (ETA), https://www.ea.oit.va.gov/EAOIT/VA_EA/Enterprise_Technical_Architecture.asp, and VA Identity and Access Management (IAM) approved enterprise design and integration patterns, https://www.oit.va.gov/library/recurring/edp/index.cfm. The Contractor shall ensure all Contractor delivered applications and systems comply with the VA Identity, Credential, and Access Management policies and guidelines set forth in VA Handbook 6510 VA Identity and Access Management, VA Handbook 0735 Homeland Security Presidential Directive 12 (HSPD-12) Program, and align with the Federal Identity, Credential, and Access Management Roadmap and Implementation Guidance v2.0.

The Contractor shall ensure all Contractor delivered applications and systems provide user authentication services compliant with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63-3, VA Handbook 6500 Appendix F, “VA System Security Controls”, and VA IAM enterprise requirements for direct, assertion based authentication, and/or trust based authentication, as determined by the design and integration patterns. Direct authentication at a minimum must include Public Key Infrastructure (PKI) based authentication supportive of PIV card and/or Common Access Card (CAC), as determined by the business need.

The Contractor shall ensure all Contractor delivered applications and systems conform to the specific Identity and Access Management PIV requirements set forth in the Office of Management and Budget (OMB) Memoranda M-05-24, M-19-17, and NIST Federal Information Processing Standard (FIPS) 201-2. OMB Memoranda M-05-24 and M-19- 17 can be found at:

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2005/m05- 24.pdf, and https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf respectively. Contractor delivered applications and systems shall be on the FIPS 201-2 Approved Product List (APL). If the Contractor delivered application and system is not on the APL, the Contractor shall be responsible for taking the application and system through the FIPS 201 Evaluation Program.

The Contractor shall ensure all Contractor delivered applications and systems support:

1. Automated provisioning and are able to use enterprise provisioning service.

2. Interfacing with VA’s Master Person Index (MPI) to provision identity attributes, if the solution relies on VA user identities. MPI is the authoritative source for VA user identity data.

3. The VA defined unique identity (Secure Identifier [SEC ID] / Integrated Control Number [ICN]).

4. Multiple authenticators for a given identity and authenticators at every Authenticator Assurance Level (AAL) appropriate for the solution.

5. Identity proofing for each Identity Assurance Level (IAL) appropriate for the solution.

6. Federation for each Federation Assurance Level (FAL) appropriate for the solution, if applicable.

7. Two-factor authentication (2FA) through an applicable design pattern as outlined in VA Enterprise Design Patterns.

8. A Security Assertion Markup Language (SAML) implementation if the solution relies on assertion-based authentication. Additional assertion implementations, besides the required SAML assertion, may be provided as long as they are compliant with NIST SP 800-63-3 guidelines.

9. Authentication/account binding based on trusted Hypertext Transfer Protocol (HTTP) headers if the solution relies on Trust based authentication.

10. Role Based Access Control.

11. Auditing and reporting capabilities.

12. Compliance with VIEWS 00155984, PIV Logical Access Policy Clarification https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896.

The required Assurance Levels for this specific effort are Identity Assurance Level 3, Authenticator Assurance Level 3, and Federation Assurance Level 3.

6.1.3 INTERNET PROTOCOL VERSION 6 (IPV6)

The Contractor solution shall support Internet Protocol Version 6 (IPv6) based upon the memo issued by the Office of Management and Budget (OMB) on November 19, 2020 (https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf). IPv6 technology, in accordance with the USGv6 Program (https://www.nist.gov/programs-projects/usgv6-program/usgv6-revision-1), NIST Special Publication (SP) 500-267B Revision 1 “USGv6 Profile” (https://doi.org/10.6028/NIST.SP.500-267Br1), and NIST SP 800-119 “Guidelines for the Secure Deployment of IPv6” (https://doi.org/10.6028/NIST.SP.800-119), compliance shall be included in all IT infrastructures, application designs, application development, operational systems and sub-systems, and their integration. In addition to the above requirements, all devices shall support native IPv6 and dual stack (IPv6 / IPv4) connectivity without additional memory or other resources being provided by the Government, so that they can function in a mixed environment. All public/external facing servers and services (e.g.

web, email, DNS, ISP services, etc.) shall support native IPv6 and dual stack (IPv6 / IPv4) users and all internal infrastructure and applications shall communicate using native IPv6 and dual stack (IPv6 / IPv4) operations.

6.1.4 TRUSTED INTERNET CONNECTION (TIC)

The Contractor solution shall meet the requirements outlined in Office of Management and Budget Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative“ (https://www.whitehouse.gov/wp-content/uploads/2019/09/M-19-26.pdf), VA Directive 6513 “Secure External Connections”, and shall comply with the TIC 3.0 Core Guidance Documents, including all Volumes and TIC Use Cases, found at the Cybersecurity & Infrastructure Security Agency (CISA) (https://www.cisa.gov/publication/tic-30-core-guidance-documents). Any deviations must be approved by the VA TIC 3.0 Working Group at vaoisesatic30team@va.gov.

6.1.5 STANDARD COMPUTER CONFIGURATION

The Contractor IT end user solution that is developed for use on standard VA computers shall be compatible with and be supported on the standard VA operating system, currently Windows 10 (64bit), Edge (Chromium based), and 365 Apps for enterprise. Applications delivered to VA and intended to be deployed to Windows 10 workstations shall be delivered as a signed .msi package with switches for silent and unattended installation and updates shall be delivered in signed .msp file formats for easy deployment using Microsoft Endpoint Configuration Manager (CM) VA’s current desktop application deployment tool. Signing of the software code shall be through a vendor provided certificate that is trusted by VA using a code signing authority such as Verizon/Cybertrust or Symantec/VeriSign. The Contractor shall also ensure and certify that their solution functions as expected when used from a standard VA computer, with non-admin, standard user rights that have been configured using the United States Government Configuration Baseline (USGCB) and Defense Information Systems Agency (DISA) Secure Technical Implementation Guide (STIG) specific to the particular client operating system being used.

6.1.6 VETERAN FOCUSED INTEGRATION PROCESS (VIP) AND PRODUCT LINE

MANAGEMENT (PLM)

The Contractor shall support VA efforts IAW the updated Veteran Focused Integration Process (VIP) and Product Line Management (PLM). The major focus of the new VIP is on Governance and Reporting and is less prescriptive, with a focus on outcomes and continuous delivery of value. Product Line Management (PLM) is a framework that focuses on delivering functional products that provide the highest priority work to customers while delivering simplified, reliable, and practical solutions to the business, medical staff, and our Veterans. The VIP Guide is a companion guide to the PLM Playbook and can be found at:

https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371 and the PLM Playbook can be found at https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946. The PLM Playbook pivots from project-centric to product-centric delivery and contains descriptive practices that focuses on outcomes. The PLM Playbook contains a set of “plays” that implement Development, Security, and Operations (DevSecOps) principles and processes such as automated development, continuous integration/continuous delivery, and release on demand. The PLM Playbook details how product lines implement Lean-Agile principles, methods, practices, and techniques through levels of maturity. VIP and PLM are the authoritative processes that IT projects must follow to ensure development and delivery of IT products.

6.1.7 PROCESS ASSET LIBRARY (PAL)

The Contractor shall perform their duties consistent with the processes defined in the OIT Process Asset Library (PAL).