4 Real RFTOP South Africa.pdf

Request for Task Order Proposal (RFTOP)

Note: This task will be awarded.

RFTOP NUMBER OR NAME South Africa

This RFTOP incorporates provisions and clauses documented therein in the Indefinite Delivery, Indefinite Quantity (IDIQ) RFP 75D30122R63271.

This RFTOP is a Cost-Reimbursement (Cost Plus Fixed Fee task) type.

ITOPSS 3.0 Request for Task Order Proposal (RFTOP)

1.Required Security Level Level 5 (Public Trust)

2.Type of Task Order Cost Plus Fixed Fee

3. Security Background

Requirements

Contractor is required to perform security/background checks prior to task order performance, based on the security level required.

4. PWS Reference C.3.2.3 Professional Support Services

5. Period of Performance 6/15/2023 to 06/14/2028

7.Number of Option Years, if applicable

Place of Performance South Africa

8.Task Order Administration Not Applicable since this is a RFTOP

AUTHORITY TO OBLIGATE THE GOVERNMENT: The Task Order Contracting Officer is the only individual who may legally commit the U.S. Government to the expenditure of public funds. The Contractor may not incur costs chargeable to this task order before the receipt of either a task order signed by the Contracting

Officer or a specific written authorization from the Contracting Officer.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

Base Year

CLIN SUPPLIES / SERVICES QTY /

UNIT

ESTIMATED

COST

FIXED

FEE

TOTAL

COST PLUS

FIXED FEE

0001 Provide ITOPSS support services per as outlined Section C of the task order.

Service Letter A: Informatics Technical

Advisor

Service Letter B: Data Advisor

Service Letter C: Senior Program Officer

Period of Performance: 6/15/2023 to

6/14/2028

1 Job $ $ $

TOTAL

Note: All labor and non-conference travel will be on the same CLIN.

Option Year 1

UNIT

ESTIMATED

COST

FIXED

FEE

TOTAL COST

PLUS FIXED

FEE

1001 Provide ITOPSS support services per as outlined in Section C of the task order.

Severable Services

Period of Performance: 6/15/2024 to

6/14/2025

1 Job

Option Year 2

UNIT

ESTIMATED

COST

FIXED

FEE

TOTAL COST

PLUS FIXED

FEE

2001 Provide ITOPSS support services per as

Period of Performance: 6/15/2025 to

6/14/2026

Option Year 3

UNIT

ESTIMATED

COST

FIXED

FEE

TOTAL COST

PLUS FIXED

FEE

3001 Provide ITOPSS support services per as outlined Section C of the task order.

Period of Performance: 6/15/2026 to

6/14/2027

Option Year 4

UNIT

ESTIMATED

COST

FIXED

FEE

TOTAL COST

PLUS FIXED

FEE

4001 Provide ITOPSS support services per as

Period of Performance: 6/15/2027 to

6/14/2028

Recapitulation:

CLIN ESTIMATED COST FIXED FEE TOTAL COST

PLUS FIXED FEE

Professional Support Services – South Africa

C. PERFORMANCE-BASED WORK STATEMENT (PWS)

C.1 Background and Need:

South Africa is an upper-middle income country with a gross national income per capita of $6,010 in 2020. In 2022, the country had an estimated population size of 60.8 million, of which approximately 51% (31.1 million) were female. Life expectancy at birth was estimated to be 64.6 years for females (71.3 without HIV/AIDS) and 59.3 years for males (64.8 without HIV/AIDS), and the infant mortality rate was estimated at 24.1 per 1,000 live births.

In 2022, South Africa’s HIV disease burden was an estimated 8,110,600 people living with HIV

(PLHIV), of which more than 4.7 million were women over the age of 25 years (Table 2.1.2). The estimated number of new infections declined by 64% from 2001 to 2022, yet incidence remained high, with an estimated 194,185 new infections in 2022 (Table 2.1.1).

Currently, South Africa suffers from extreme fragmentation in its health management information systems (HIS) and lacks essential functionalities including a national unique patient identifier and a comprehensive electronic medical record (EMR) system. South African currently monitors HIV epidemic and programmatic performance from a variety of existing data sources. (e.g., District

Health Information System (DHIS), Electronic Tuberculosis Registry (ETR.net), Electronic Drug-

Resistant Tuberculosis Registry (EDR.net), South Africa Patient Level HIV Management System =

Tier.Net, Data for Accountability, Transparency, and Impact (DATIM), etc.)

This situation has direct negative impacts on the HIV and TB response in South Africa, on quality of patient care, and on program monitoring for U.S. Government investments (e.g., U.S.

President’s Emergency Plan for AIDS Relief, or PEPFAR) as well as opportunity costs in parallel systems and workarounds by donors and implementing partners. There is also a paucity of qualified personnel who are skilled in the development, implementation, and utilization of health information systems in South Africa.

In 2022, the South African National Department of Health (NDoH) demonstrated unprecedented leadership in addressing this issue. The Director General issued a circular halting all donor investments in health information systems and initiated an assessment of all systems in country.

Fortuitously, health systems are a primary focus for PEPFAR’s new Five-Year Strategy as part of an emphasis on sustainability of the HIV response in South Africa and on sustainability of

PEPFAR investments.

CDC South Africa is using various cooperative agreements (CoAgs) with the following organizations to strengthen and rationalize health information and reporting systems and to achieve the goals outlined by the National Department of Health to reach the UNAIDS 95-95-95 goals by

2030.

Cooperative Agreement Organization Name

GH001937 Council for Scientific and Industrial Research

GH002193 Medical Research Council

GH002194 National Health Laboratory Service

GH002195/GH002362 Health Information Systems Program

GH002191 National Department of Health

GH002302 Human Sciences Research Council

GH002393 Foundation for Professional Development

GH002436 National Health Laboratory Service (NICD)

GH002430 Eastern Cape Provincial Government

GH002395 Kwa Zulu-Natal Provincial Government

GH002379 The Aurum Institute

GH002377 TB/HIV Care Association

GH002381 Wits Health Consortium

GH002378 Trust for Health Systems Planning and Development

GH002135 Johns Hopkins University

GH002137 Right to Care

GH002138 Population Services International

C.2.A Overall Services and Service Information

Strengthening and supporting health systems are a primary focus for PEPFAR’s new Five-Year

Strategy as part of an emphasis on sustainability of the HIV response in South Africa and on sustainability of PEPFAR investments. CDC South Africa’s primary objective will be to support the Government of South Africa to: (1) reduce fragmentation in its health management information systems (HIS) and promote creation of national unique patient identifier and a comprehensive electronic medical record (EMR) system; (2) better utilize data collected from HIS to improve quality of patient care; and (3) strengthen program monitoring of government of South Africa and

PEPFAR investments

Individual Service Tables follow and should correspond with Service Letters and Titles identified in the below table.

All services require full-time, 40-Hour work weeks unless noted otherwise.

Service

Ltr

Service Title Approx. # of

People to

Provide

Services

A Informatics Technical Advisor

B Data Advisor 1

C Senior Program Officer 1

Security Levels -Level 5

Level 1 – NACI (Non-Sensitive) – Includes Name, Fingerprint Checks, and Written Inquiries

(Most candidates will fit into this category.

Level 5 – NACI (NACI + Credit Check) and possible MBI/LBI

Level 6 – Background Investigation - Auditing; Security; Access to data covered by the Privacy

Act; or Access to sensitive, proprietary, or financial information, including access through, and/or control over, automated information systems.

C.2.B Future Services

• Additional services, applicable to this task order, may be required in the future. Additional services within 30% of those originally competed will not be re-competed for the duration of this task order. Services that go beyond the 30% limit will be competed under a new

Request for Task Order Proposal (RFTOP).

Example: 10 labor sources (service letters) are initially competed and awarded o Task Order would allow for No More Than (3) additional labor sources on this task order.

C.2.C Service Table A:

Service Title: Informatics Technical Advisor

Estimated Period of Performance: 6/15/2023 to 6/14/2028

# of Options, if applicable: 4

Place of Performance: Pretoria, South Africa

Embassy Access and Security Level: Level 5

Service Objectives: Through this Task Order Service Letter, the contractor will independently provide Health

Information System (HIS) support services to satisfy the overall operational objectives of CDC South Africa in implementing PEPFAR and supporting the Government of South Africa to: (1) reduce fragmentation in its health management information systems (HIS) and promote creation of national unique patient identifier and a comprehensive electronic medical record (EMR) system; (2) better utilize data collected from HIS to improve quality of patient care; and (3) strengthen program monitoring of government of South Africa and PEPFAR investments

The primary objectives of the contractor are to:

• Provide expert scientific direction and input in the areas of health management information systems design, implementation, and utilization.

• Provide relevant technical support and guidance to existing PEPFAR technical staff and cooperative agreement implementing partners.

• Support the increased availability and quality of data for evidence-based monitoring and development, capacity building and increase data use at the national, sub-national, and facility levels.

• Strengthen data management and quality improvement, aligning PEPFAR and Government of South Africa indicators and reporting systems.

A.1 Task Requirements:

The main tasks assigned under this task order are:

A.1.1. Provide expert scientific advice, consultation, and leadership in designing, coordinating, and maintaining public health informatics project goals, objectives, and priorities.

A.1.2. Build technical informatics capacity within the CDC South Africa team.

A.1.3. Manage projects involved with public health informatics and serves as a subject matter expert in the utilization and implementation of IT systems integrating epidemiologic and other information from a scientific perspective.

A.1.4. Implement scientific policies and procedures on informatics practices and principles.

A.1.5. Assist CDC South Africa with the development of proposals and work plans for implementing Health

Information Management System. Health information Management System (HMIS)-related activities

A.1.6. Conduct site meeting and visits to CDC South Africa and implementing partners to assess, monitor, and evaluate implementation of HMIS programs against goals and objectives.

A.1.7. Develop strategies to meet short and long-range goals for the applicable program and assures that strategies reflect most promising directions in research, preventive, and clinical approaches as it relates to public health informatics.

A.1.8. Coordinate the sharing of health related informational materials so that scientific advice and assistance is shared.

A.1.9. Apply new methods, approaches, and technology to new and unusual situations and these methods have broad applications in the field.

A.1.10. Collaborate and provide expert scientific advice to a variety of nation-wide and international organizations to synthesize and implement informatics policies and directions for future development.

A.1.11. Collaborate with and provide expert advice to all organizational levels with the agency, as well as with various partner organizations.

No new system-level/complex development or server-based implementation of an CDC IT system is planned or anticipated. Should such need become evident, CDC South Africa will coordinate with CGH’s IIRO and IT

Governance team to ensure appropriate evaluation, funding, and performance of any and all EPLC-related activities or expenditures.

Task Deliverables:

Deliverables/Reports Task Requirement Recipient Due Date

Work Plan A.1.1 – A.1.11 COR and relevant CDC

South Africa Branch

Chief

Annually

Progress Report, to include detailed description of activities, meetings attended, deliverables provided.

A.1.1 – A.1.11 COR and relevant CDC

South Africa Branch

Chief

Monthly progress report, due by the 5th workday following the end of the month

Annual Progress Report A.1.1 – A.1.11 COR and relevant CDC

South Africa Branch

Chief

Annually

Minimum Qualifications and/or Certifications:

Graduate degree in informatics, computer science, or other related field; Advanced training in epidemiology and public health evaluation

International experience working with Ministries/Departments of Health, with a strong preference for prior work experience working with South Africa’s National Department of Health.

Experience in analyzing data from PEPFAR information systems including DATIM, Expenditure

Analysis, and SIMS.

Only U.S. citizens or non-U.S. citizens who have lived in the U.S. at least three of the last five years are eligible to provide services under this task order.

The exception to this is an incumbent non-U.S. citizen contractor employee with current, valid security clearance for physical and logical access to CDC and embassy facilities and network. If the exception stated above is used, do not include any contractor employee who is considered an ordinarily resident in your proposal. The definition of an ordinarily resident is listed below.

Ordinarily resident: A U.S. citizen or Third Country National who: (1) is a local resident;(2) has legal, permanent resident status within the host country; and (3) is subject to host country employment and tax laws. This also includes host country citizens.

Travel Amount:

2 trips to international location (including United States) for up to 5 days plus travel.

10 trips within South Africa for up to 5 days plus travel.

Note: Trips include transportation, lodging/M&IE, etc. Personal development (conferences, trainings, etc.

are not allowable) not allowable without prior CO approval.

Travel needs during option periods will be evaluated at the time of task order renewal.

Note- Travel for conferences are not allowed without a formal bilateral modification by the Contract

Officer.

Not-To-Exceed (NTE) $20,000 USD/Per Option Period

(Includes Transportation, Lodging/M&IE, etc.) ***Personal Development is not Allowable***

Government-Furnished Property

CDC issued laptop with appropriate software as determined by CDC South Africa

Phone

Office Space at CDC South Africa

Contractors will be required to use secure CDC IT systems to complete work such as working over VPN, through

CITGO, or accessing programs via M365 tools.

C.2.C Service Table B:

Service Title: Data Advisor

Service Objectives:

CDC South Africa relies heavily on the use of data for decision-making, partner monitoring and program improvement. The primary objective of this Task Order Service Letter is to support CDC South Africa’s program staff in utilizing, triangulating, and visualizing data to improve the program with the goal of achieving HIV epidemic control in South Africa.

The primary objectives of the contractor are to:

• Provide technical assistance to CDC South Africa branches to implement data integration and visualization best practices for high priority projects in accordance with South African Government (SAG) national guidelines and PEPFAR goals and principles.

• Assist CDC South Africa staff with understanding data needs, strengths and weaknesses and provide ongoing guidance and support for data utilization.

• Assist CDC South Africa branch staff with analysis and presentations for key office deliverables (e.g., Country Operational Plan (COP), Quarterly Program Reviews, PEPAR Interagency Oversight/Management

Committee Meetings).

• Serve as the administrator and provide technical support to a variety of Government of South Africa and

PEPFAR electronic systems and online data portals/dashboards.

B.1 Task Requirements:

B.1.1. Oversee data reporting and analysis for national, district and site level activities supported through PEPFAR and CDC South Africa.

B.1.2. Manage users, develop, and maintain dashboards and implement data quality assurance measures within current information platforms used by CDC South Africa.

B.1.3. Serve as the District Profile point of contact for PEPFAR South Africa, the South African Government, (Interagency Collaborative for Program Improvement) ICPI and the third-party contractor. Provide PEPFAR and stakeholder users with active mentorship on the portal to foster proficiency and independence using the system.

B.1.4. Work with the CDC South Africa for access to relevant and up-to-date HIV datasets (e.g., District Health

Information System [DHIS], Expenditure Analysis, Payment Management System (PMS), Site Improvement

Through Monitoring System (SIMS), Human Resources Inventory Database (HRID), District Implementation Plan

(DIP).

B.1.5. Attend and promote the use of the existing datasets and tools in relevant meetings with internal and external stakeholders (e.g., National Department of Health (NDOH) work stream meetings, CDC branch meetings). Work with stakeholders at these meetings to ensure that the data sets are meeting their needs.

B.1.6. Align South Africa National Department of Health (NDOH) and PEPFAR data and standardize data source documents to ensure consistency and accuracy across branches and agencies.

B.1.7. Attend District Implementation Plan (DIP) meetings and work with NDOH counterparts to integrate best practices in data use into the process.

B.1.8. Provide trainings to CDC South Africa staff to improve Excel, Power BI and other data visualization skills throughout the office. Focus on building capacity within the Strategic Information Monitoring and Evaluation Team.

B.1.9. Contribute to branch meetings, technical working groups and work stream meetings.

No new system-level/complex development or server-based implementation of an CDC IT system is planned or anticipated. Should such need become evident, CDC South Africa will coordinate with CGH’s IIRO and IT

Governance team to ensure appropriate evaluation, funding, and performance of any and all EPLC-related activities or expenditures.

Work Plan B.1.1 – B.1.9 COR and relevant CDC South Africa Branch Chief

Annually

Progress Report, to include detailed description of activities, meetings attended, deliverables provided.

B.1.1 – B.1.9 COR and relevant CDC South Africa Branch Chief

Monthly progress report, due by the 5th workday following the end of the month

Annual Progress Report B.1.1 – B.1.9 COR and relevant CDC South Africa Branch

Graduate degree in informatics, computer science, or other related field; Advanced training in epidemiology and public health evaluation.

International experience working with Ministries/Departments of Health, with a strong preference for prior work experience working with South Africa’s National Department of Health.

Experience in analyzing data from PEPFAR information systems including DATIM, Expenditure Analysis, and

SIMS.

Experience in conceiving and updating online portals for data visualization and dissemination.

Only U.S. citizens or non-U.S. citizens who have lived in the U.S. at least three of the last five years are

The exception to this is an incumbent non-U.S. citizen contractor employee with current, valid security clearance for physical and logical access to CDC and embassy facilities and network. If the exception stated above is used, do not include any contractor employee who is considered an ordinarily resident in

Ordinarily resident: A U.S. citizen or Third Country National who: (1) is a local resident;(2) has legal, permanent resident status within the host country; and (3) is subject to host country employment and tax

Contractors will be required to use secure CDC IT systems to complete work such as working over VPN, through CITGO, or accessing programs via M365 tools.

C.2.C Service Table C:

Service Title: Senior Program Officer

Service Objectives:

CDC South Africa plays a significant role in supporting the PEPFAR HIV/AIDS prevention portfolio, including overseeing the implementing of DREAMS and rolling out behavioral and biomedical interventions including PrEP and services designed to reach key populations and adolescent girls/young women. CDC South Africa exclusively implements the PEPFAR Voluntary Male Medical Circumcision (VMMC) program, including working with the

Government of South Africa and our PEPFAR VMMC implementing partners to: (1) strengthen monitoring of services, especially those performed by private service providers; (2) support program quality and roll-out of data quality initiatives; and (3) ensure client safety and adverse event monitoring.

The primary objectives of the contractor are to support the CDC South Africa prevention portfolio, including overseeing VMMC program quality:

Specific objectives include:

• Provide technical assistance to CDC South Africa and Government of South Africa on roll-out of innovations and program adaptations learned from COVID pandemic to PEPFAR-supported HIV prevention activities.

• Assist CDC South Africa in roll-out of innovative demand generation activities for VMMC, such as door-to-door mobilization in hard-to-reach informal settlements and stop-and-talk mobilization at taxi ranks in the metros and high traffic areas.

• Strengthen prevention program monitoring and data quality initiatives, including implementing data integration and visualization best practices for high priority projects in accordance with South African

Government (SAG) national guidelines and PEPFAR goals and principles.

• Assist CDC South Africa staff with understanding data needs, strengths and weaknesses in its prevention portfolio and provide ongoing guidance and support for data utilization.

• Assist CDC South Africa branch staff with analysis and presentations for key office deliverables (e.g., Country Operational Plan (COP), Quarterly Program Reviews, PEPAR Interagency Oversight/Management

Committee Meetings).

• Support alignment of between Government of South Africa and CDC South Africa’s comprehensive

VMMC program quality assurance activities.

C.1 Task Requirements:

C.1.1 - Provide technical assistance in the planning, implementation, monitoring and evaluation of HIV prevention programs in South Africa.

C.1.2 - Recommend/promote/facilitate the maintenance and improvement of standards of VMMC services in South Africa.

C.1.3 - Participate in training programs for the Government of South Africa and PEPFAR implementing partner staff designed to enhance staff skills in HIV prevention programming.

C.1.4 - Assist CDC South Africa implementing partners with the development of proposals and work plans for implementing HIV prevention activities.

C.1.5 - Conduct site meeting and visits to CDC South Africa implementing partners to assess, monitor and evaluate implementation of HIV prevention programming, including VMMC services.

C.1.6 - Assist CDC South Africa in the development of program evaluation strategies and data quality assurance initiatives for VMMC in accordance with standard guideline and protocols.

C.1.7 - Facilitate dissemination of scientific evidence and finding of program assessments, monitoring, and evaluation of HIV programs to Government of South Africa and CDC South Africa implementing partners.

C.1.8 – Support CDC South Africa to roll-out innovative demand generation activities for VMMC services, such as door-to-door mobilization in hard-to-reach informal settlements and stop-and-talk mobilization at taxi ranks in the metros and high traffic areas.

C.1.9 - Work with CDC South Africa and Government of South Africa to develop and disseminate appropriate and client-centered HIV prevention policies and messages that ensure client safety and program integrity.

Work Plan C.1.1 – C.1.9 COR and relevant CDC South Africa Branch Chief

Annually

Progress Report, to include detailed description of activities, meetings attended, deliverables provided.

C.1.1 – C.1.9 COR and relevant CDC South Africa Branch Chief

Monthly progress report, due by the 5th workday following the end of the month

Annual Progress Report C.1.1 – C.1.9 COR and relevant CDC South Africa Branch

Graduate degree in informatics, computer science, or other related field; Advanced training in epidemiology and public health evaluation

International experience working with Ministries/Departments of Health, with a strong preference for prior work experience working with South Africa’s National Department of Health.

Experience in analyzing data from PEPFAR information systems including DATIM, Expenditure Analysis, and

SIMS.

Only U.S. citizens or non-U.S. citizens who have lived in the U.S. at least three of the last five years are

The exception to this is an incumbent non-U.S. citizen contractor employee with current, valid security clearance for physical and logical access to CDC and embassy facilities and network. If the exception stated above is used, do not include any contractor employee who is considered an ordinarily resident in

Ordinarily resident: A U.S. citizen or Third Country National who: (1) is a local resident;(2) has legal, permanent resident status within the host country; and (3) is subject to host country employment and tax

Note: Trips include transportation, lodging/M&IE, etc

Contractors will be required to use secure CDC IT systems to complete work such as working over VPN, through CITGO, or accessing programs via M365 tools.

C.3 Place of Performance

Pretoria, South Africa

C.4 Performance-Based Matrix

C.5 Authority to Obligate Government

The Task Order Contracting Officer is the only individual who may legally commit the U.S.

Government to the expenditure of public funds. The Contractor may not incur costs chargeable to this task order before the receipt of either a task order signed by the Contracting Officer or a specific written authorization from the Contracting Officer.

Service

Required

Measures of

Success Indicators

Standards -

Criteria for

Acceptance

Method of

Surveillance

"Incentives"

Positive or

Negative

All Tasks and

Deliverables from C.

Service Table

A, B & C

Contractor shall perform all tasks/services in accordance with

(IAW) applicable regulatory standards, task order requirements, and procedural guidelines as stated in this task order.

100% of

Services/tasks adhere to applicable regulatory standards, task order requirements, and procedural guidelines as stated in this task order.

In addition, reference the attached Quality

Assurance

Surveillance Plan.

COR

approval and observation.

Positive: Past

Performance and

Evaluation will be used in determining awards for future task orders for similar services;

Negative:

Performance evaluations will include any services that failed to meet acceptable standards and will be used in determining awards for future task orders for similar services

Timeliness –

(1)All tasks, reports, and deliverables completed within due date specified in Section C.2

100% of time –All tasks, reports, and deliverables shall be performed by due date specified in Section C.2 unless delay is approved in advanced by COR.

In addition, reference the attached Quality

Assurance

Surveillance Plan.

COR

approval and observation.

Positive: Past

Performance and

Evaluation will be used in determining awards for future task orders for similar services;

Negative:

Performance evaluations will include any services that failed to meet acceptable standards and will be used in determining awards for future task orders for similar services.

C.6 Security Background Requirements

Contractor employees are required to receive Level 5/NACI security/background checks prior to task order performance. The security process is initiated when contracting organization provides contractor employee’s NACI results to the Office of Safety, Security and Asset Management personnel and personal identifying information to the Headquarters Contracting Officer

Representative.

D. Not Used

E. Refer to Base Contract Section E

F. Refer to Base Contract Section F

F.1 See CLINS for Period of performance.

G. CONTRACT/TASK ORDER ADMINISTRATION DATA

The Clauses found in the IDIQ base shall contract remain in full force and effect for this Task Order.

G.1 See Cover for Contact Information

G.2 CDCA_G01101 Contractor Billing Instructions for Cost-Type Contracts (Mar 2022)

The Contractor shall submit a detailed breakout of costs and supporting backup information and shall place the following signed Contractor Certification on each invoice/voucher submitted under this contract:

I certify that this voucher reflects (fill in Contractor’s name) request for reimbursement of allowable and allocable costs incurred in specific performance of work authorized under Contract

(fill in contract number)/Task (fill-in task order number, if applicable), and that these costs are true and accurate to the best of my knowledge and belief.

(Original Signature of Authorized Official)

Typed Name and Title of Signatory

Introduction

Reimbursement procedures related to negotiated cost-type contracts require that Contractors submit to the Government adequately prepared claims. The instructions that follow are provided for

Contractors’ use in the preparation and submission of invoices or vouchers requesting reimbursement for work performed. The preparation of invoices or vouchers as outlined below will aid in the review and approval of claims and enable prompt payment to the Contractor.

1. Forms to Be Used

In requesting reimbursement, Contractors may use the regular Government voucher form, Standard

Form 1034, “Public Voucher for Purchases and Services Other Than Personal,” and Standard Form

1035, “Continuation Sheet,” or the Contractor’s own invoice form. If the Contractor desires to use the Government’s standard forms, a request for the forms should be submitted to the Contracting

Officer. If the Contractor uses his own invoice, the billing must conform to the instructions set forth herein.

2. Submission of Invoices or Vouchers

Will be conducted in accordance with HHSAR 352.232-71 Electronic Submission of Payment

Requests

3. Preparation of Invoices or Vouchers- All invoices or vouchers must include the following information:

a. Summary of All Costs – typically inserted on the Standard Form 1034

A summary of all current costs must be shown. This summary consists of a list identifying the general categories and the amounts incurred during the period covered by the billing, together with the portion of fixed fee (if any) payable for that period. The reimbursable costs incurred and the dates of the period for which the charges are claimed must fall within the period specified in the contract.

b. Details of Costs Claimed – typically inserted on the Standard Form 1035 (continuation sheet)

A detailed breakdown must be provided to substantiate the categories shown on the summary of costs. The following describes some of the categories that might appear on your billings:

(1) Direct Labor

Direct Labor costs consist of salaries and wages paid for scientific, technical, and other work performed directly for the contract and pursuant to the contract terms. Labor costs, excluding fringe benefits and overtime premium pay, will be billed as follows:

List the titles and amounts for employees whose salaries or wages, or portions thereof, were charged to the contract; show the rate (or hours) worked, and amount for each individual. The cost of direct labor, which is charged directly to the contract, must be supported by time records maintained in the contractor’s office.

(2) Fringe Benefits

If it is the Contractor’s established practice to treat fringe benefits as a direct cost, such costs should be billed separately as a single item.

NOTE: Fringe benefits, bonuses, etc., are usually treated as indirect costs for inclusion in the overhead pool; however, they may be treated as direct labor costs or as an “Other Direct Charge” if such treatment is in accordance with the Contractor’s established accounting procedures.

(3) Premium Pay

Premium pay is the difference between the rates and amounts paid for overtime or shift work and amount normally paid on a straight time basis. Generally such pay is not included in the direct labor base and should not be included in the billing for “direct labor” unless the Contractor has consistently followed this practice in the past as a matter of policy. Premium pay of any kind unless provided for in the contract must be authorized by the Contracting Officer in advance. Billings for unauthorized premium pays have caused frequent delays in payment due to suspensions and exchange of correspondence. Citations of authorization for premium pay will avoid delays in payment. Authorized premium pay may be shown as a single item on the summary of costs.

However, it must be separately itemized for each position, or job category, showing the amount, and a citation of the Contracting Officer’s letter of authorization on the continuation sheet of the invoice or voucher.

(4) Materials and Supplies

Only those items, which the Contractor normally treats as “direct costs”, should be claimed under this heading. Major classifications of material only should be billed separately under appropriate classification. Items costing less than $25.00 may be listed by category of materials or supplies.

Show the description and dollar amount of individual classifications. All such charges must be supported by the Contractor’s office records.

(5) Travel

When authorized in the contract as a direct cost, travel costs that are directly related to specific contract performance may be billed as a direct cost. Travel cost detail should show:

(a) Name of traveler and official title,

(b) Purpose of trip,

(c) Dates of departure and return to starting point (station or airport),

(d) Transportation costs, identified as to rail, air, private automobile (including mileage and rate) and taxi.

(e) If claim for subsistence is on per diem basis, show number of days, rate and amount, as authorized in contract.1 If claim is based on actual cost of subsistence, show, on a daily basis, the amounts claimed for lodging and meals separately.

(f) Reference to Contracting Officer’s letter of authorization if required by contract.

1For purposes of computing per diem charges in lieu of actual subsistence charges, unless otherwise provided in the contract, a day is divided into four quarters that begin at 12 midnight, 6:00 AM, 12 noon, and 6:00 PM. For example, at an authorized per diem rate of $35.00 per day, a traveler who departed at 9:15 AM on July 15 and returned at 6:45 PM on July 18 would be entitled to $131.25.

(6) Consultant Fees

Identify the consultant by name, number of days utilized, and amount of fee.

(7) Equipment

Nonexpendable personal property must be specifically approved in writing by the Contracting

Officer or authorized by the terms of the contract. Billing data should include a description of item, make model, quantity, unit cost, total cost, and date approved by the Contracting Officer, if applicable. A copy of the vendor’s bill may be submitted in lieu of the identifying information.

(8) Burden

Pending establishment of final contract indirect cost rates for each of the Contractor’s fiscal years, the Contractor will be reimbursed based on his submittal of provisional rates as set forth in the contract. The contract may provide for more than one type of indirect cost rate, such as overhead rate, and general and administrative expense rate, in which case the direct cost bases (e.g., direct labor, total direct cost, etc.)

(9) Fixed Fee

Ordinarily the fixed fee is stated in the contract as a lump sum and may be billed in the ratio of incurred costs to total estimated cost as set forth in the contract, with the final 15 percent to be billed on the final invoice or voucher. Contract terms govern the method of payments.

c. Cumulative Amount Claimed – typically inserted on Standard Form 1035 (continuation sheet) separate section/page

The Contractor must show the cumulative amounts claimed by categories from the contract award date through the date of the current invoice or voucher, as well as the estimated cost to complete per category.

QUICK CHECKLIST FOR INVOICE SUBMISSION:

• Standard Forms 1034 and 1035 recommended. If submitting own forms, statement must conform to billing instructions

• Quarterly billing as a minimum

• Vouchers must be collated

• Detail of Cost Claimed

G.3 CDCP_G010 Contract Communications/Correspondence

(Jul 1999)

The Contractor shall identify all correspondence, reports, and other data pertinent to this contract by imprinting thereon the contract number from Page 1 of the contract.

G.4 352.232-71 Electronic Submission of Payment Request

(a) Definitions. As used in this clause—

(1) “ Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Content of Invoices” and the applicable Payment clause included in this contract.

(b) Except as provided in paragraph (c) of this clause, the Contractor shall submit payment requests electronically using the Department of Treasury Invoice Processing Platform (IPP) or successor system. Information regarding IPP, including IPP Customer Support contact information, is available at www.ipp.gov or any successor site.

(c) The Contractor may submit payment requests using other than IPP only when the Contracting

Officer authorizes alternate procedures in writing in accordance with HHS procedures.

(d) If alternate payment procedures are authorized, the Contractor shall include a copy of the

Contracting Officer's written authorization with each payment request.

(End of Clause)

H. Special Provisions

The Clauses found in the IDIQ base shall contract remain in full force and effect for this Task

Order.

Note : The non personal service clause is in Section H of the base contract.

H.1. Ability to Legally Provide Services Overseas

a. The Prime Contractor is responsible for acquiring all legally appropriate work permits and visas, without CDC assistance, to ensure that services are performed in accordance with host country requirements.

b. In the event that the Prime Contractor is unable to acquire all legally appropriate work permits and visas, after reasonable time has been allowed for host country appeals (if necessary), CDC may terminate the task order.

b.1. “Reasonable Time” is relative based upon each country’s circumstances. CDC has not set a timeline for making this decision, but will communicate directly with the Prime Contractor and COR throughout the process of acquiring all legally appropriate work permits and visas.

H.2. Information Security and/or Physical Access Security

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of

Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an

HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS

Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to

Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [X] Low [] Moderate [ ] High

Integrity: [] Low [X] Moderate [ ] High

Availability: [X] Low [] Moderate [ ] High

Overall Risk Level: [] Low [X] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB)

Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with mailto:fisma@hhs.gov

Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified

Information in Nonfederal Information Systems and Organizations if handled by internal

Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The

Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency

Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the

HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport

Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

Document Deliverable

Title/Description

Due Date

Roster Roster By effective date of this contract

Contractor Employee

Non-Disclosure

Agreement (NDA)

Contractor Employee

Non-Disclosure

Agreement (NDA)

Prior to performing any work on behalf of

HHS

Privacy Threshold

Analysis (PTA)/

Privacy Impact

Assessment (PIA)

Assist in the completion of a PTA/PIA form

In conjunction with contract award

Training Records Copy of training records for all mandatory training

In conjunction with contract award and annually thereafter or upon request

Rules of Behavior Signed ROB for all employees

Initiation of contract and at least annually thereafter

Incident Response Incident Report (as incidents or breaches occur)

As soon as possible and without reasonable delay and no later than 1 hour of discovery

Incident Response Incident and Breach

Response Plan

Upon request from government

Personnel Security

Responsibilities

List of Personnel with defined roles and responsibilities

Prior to performing any work on behalf of

HHS

Personnel Security

Responsibilities

Off-boarding documentation, equipment and badge when leaving contract

Prior to performing any work on behalf of

HHS

Background

Investigation

Onboarding documentation when beginning contract

Prior to performing any work on behalf of

HHS

Certification of

Sanitization of

Government and

Government Activity-

Related Files, Information, and

Devices

Form or deliverables required by CDC

At contract expiration

Contract Initiation and

Expiration

If the procurement involves a system or cloud service, additional documentation will be required, such as

Disposition/Decommissi on Plan

At contract expiration

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module

Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS…