693JJ925RQ000228 Draft SOW.pdf

SECTION C - DESCRIPTION, SPECIFICATIONS, WORK STATEMENT (Draft)

C.1. INTRODUCTION

The National Highway Traffic Safety Administration’s (NHTSA) mission is to save lives, prevent injuries, and reduce economic costs due to road traffic crashes, through education, research, safety standards and enforcement. Working with our Federal partners, NHTSA's Office of Emergency Medical Services (OEMS) advances a national vision for EMS through projects and research; fosters collaboration among federal agencies involved in EMS planning;

measures the health of the nation's EMS systems; and delivers the data EMS leaders need to help advance their systems.

C.2. BACKGROUND

The U.S. Department of Transportation’s (DOT) NHTSA OEMS, pursuant to its authority under 23 U.S.C. 401, et Seq., supports national programs and products designed to support ongoing development and enhancement of EMS systems at the State and local level. Highway safety systems across the country depend on the delivery of effective and timely post-crash emergency medical and trauma care. The nation’s EMS systems are designed to provide effective emergency medical care for those injured in motor vehicle crashes, other forms of traumatic incidents and medical emergencies.

The Emergency Medical Services Agenda for the Future (NHTSA, 1996) articulated the critical need for EMS data. In October 2001, the General Accounting Office published a report entitled:

“Emergency Medical Services – Reported Needs are Wide-ranging, With Growing Focus on Lack of Data (GAO-02-28). This report identified the need for consistent information to: (1) improve EMS performance at the local level, (2) set and monitor national level policy, and (3) improve the ability to assess EMS outcomes.

NHTSA, in cooperation with the Health Resources and Services Administration (HRSA), funded a Cooperative Agreement with the National Association of State EMS Directors (NASEMSD) to develop the National EMS Information System (NEMSIS). It was the intent of the NASEMSD that a more comprehensive and systematic approach to standardizing EMS patient care reporting across the country, through NEMSIS, would better serve local, state, and national level EMS information needs. This new effort was a huge step forward from the original 1994 Uniform Prehospital EMS Data Standard (Version 1) that had 81 data elements and no mechanism for collecting the information nationally. As a result of this Cooperative Agreement, NASEMSD developed and finalized a NHTSA Uniform Prehospital Dataset (Version 2), a comprehensive data dictionary, and a physical database schema mapped to the NEMSIS dataset, with XML linkage. This was an important first step in standardizing EMS patient care documentation nationwide.

To promote national implementation of NEMSIS, in 2005 NHTSA entered into a Cooperative Agreement with the University of Utah School of Medicine (Utah) to support the NEMSIS Technical Assistance Center (TAC). Subsequently, in 2010, NHTSA awarded a second five-year Cooperative Agreement to Utah with a performance period that extended through

September 2015. Since September 2015, NHTSA has funded a contract with Utah to operate the TAC and host the National EMS Database (NEMSD).

The TAC is essential to providing technical assistance to Federal, State, local, territorial, tribal, and the District of Columbia’s EMS agencies and EMS software vendors. Services offered through the TAC aid EMS operational programs as they convert or crosswalk to the NEMSIS standard; execute version updates; maintain the secure infrastructure to collect and manage data submitted by the States and Territories; sustain and enhance the NEMSIS national reporting system; and successfully coordinate the NEMSIS dataset with the Health Level 7 (HL7) Standard Development Organization, the American National Standards Institute (ANSI), and the International Organization for Standardization (ISO) to assure interoperability with other health data systems. This “health information exchange” works because software packages used by EMS clinicians to collect patient encounter information are tested for compliance to the NEMSIS data standard every year (California) or two years (all other States and territories). As a result, all collected data elements share the same definitions and values across the U.S. These software packages are also tested for adherence to a data transmission standard so that data exchange is not disrupted. Great care is taken to ensure the data collected and reported are as clean as possible. All data submitted to the national EMS dataset by States, territories, tribes, and the District of Columbia (STTDC) must comply with an XML standard and are exposed to several hundred validation rules.

The NEMSIS system facilitates quality data submissions by EMS agencies through a national standardized EMS dataset. A NEMSIS dictionary describing elements contained in the NEMSD has been produced and regularly updated. A subset of the patient encounter data (in each record) is submitted to the NEMSD, including motor vehicle crash information. The NEMSD includes 155 data elements collected by EMS clinicians during the patient encounter. Elements include patient demographics (e.g., age, race/ethnicity), reason for the encounter, injury/illness characteristics, injury/illness severity, medications/procedures given, patent acuity and final patient disposition. Although protected health information (PHI) and personally identifiable information (PII) data elements are identified in the data dictionary, no traditional PHI or PII is collected at the National level, rendering it a HIPAA Limited Dataset.

State EMS Offices utilize their statutory authorities to require all EMS patient care reporting software to be compliant with the NEMSIS standard. NEMSIS data are reported to NHTSA from all 50 states, three territories (Northern Marianas, Virgin Islands and Guam), tribal nations, and the District of Columbia. In 2024, more than 59 million EMS activations were submitted by approximately 15,000 EMS agencies to the NEMSD. In 2024, the total number of reported motor vehicle crash (MVC)-related EMS activations in the National Database was approximately

1.6 million. Overall, the NEMSD contains approximately 485 million records, dating back to calendar year 2010. EMS agency submissions to STTDC databases can occur within minutes after the EMS activation. At the National level, 85% of EMS activations occurring on any given day, are in the NEMSD in approximately 72 hours. An annual report characterizing the NEMSD may be found at: https://nemsis.org/using-ems-data/articles-and-publications/ . The injury-related elements in the NEMSIS data standard have been “harmonized” with related elements contained in the National Trauma Data Bank (NTDB), maintained by the American College of Surgeons and the cardiac arrest data elements aligned to the Cardiac Arrest Registry to Enhance https://nemsis.org/using-ems-data/articles-and-publications/

Survival (CARES).

NEMSIS is critical to the EMS community, EMS researchers, other public stakeholders, and the Federal government. The collection of relevant prehospital patient care information is of value to NHTSA, and other modes of the USDOT, to enhance our understanding of serious injury following a motor vehicle crashes (MVC) and the post-crash care delivered by EMS.

C.3. PURPOSE

The purpose of this contract is to continue to support and maintain the National Emergency Medical Services Information System (NEMSIS) and the Technical Assistance Center (TAC).

The NEMSIS is a framework that provides a national standard for patient care reporting by emergency services personnel in the out-of-hospital setting. The NEMSD defines data elements, values, and established a national standard for data exchange in collaboration with State, territorial, tribal and the District of Columbia (STTDC) EMS offices, software vendors, national partners, and industry experts. Data from patient care reports completed by all EMS clinicians at the point-of-care in the out-of-hospital setting are sent from their local agency to STTDC level data repositories before being submitted to the NEMSD. Data quality is maintained through electronic patient care report (ePCR) software vendor compliance testing and the adoption of national case definitions and schema language. This patient care reporting and data exchange system is maintained by NHTSA OEMS.

This contract continues maintenance, further development, ongoing implementation of NEMSIS, the NEMSD, and TAC to harmonize NEMSIS with electronic health record initiatives.

Integration with regional, Federal, State, and local Health Information Exchanges (HIEs), Qualified Heath Information Networks (QHINS), registries (e.g., trauma, cardiac and stroke), other national data sets such as the Model Minimum Uniform Crash Criteria (MMUCC), Fatality Analysis Reporting System (FARS), provide information to other healthcare providers that see the patient after EMS delivers initial care, transport, and/or interfacility transfer.

C.4. GENERAL REQUIREMENTS

C.4.1 Within six (6) months of award, the Contractor shall operate the NEMSIS TAC, hosting center, NEMSD, website (www.NEMSIS.org ), and all related functions for the period of performance of the Contract. The Contractor shall begin to provide NEMSIS related technical assistance and support. This may include site visits, webinars, and other technical assistance, including programming or other special requests from system users.

C.4.2 The Contractor shall operate all related systems to ensure uninterrupted collection, management, and reporting of EMS data received from STTDC EMS agencies. This work shall be accomplished in tandem with maintenance of an AWS Cloud [Federal Information Security Management Act (FISMA) Moderate] NEMSIS information technology (IT) infrastructure instance. The NEMSIS shall be available 24 hours a day, 7 days a week, 365 days a year unless a scheduled maintenance period or mitigation of an unexpected event is required, uptime of 99.9% shall be maintained throughout the period of performance.

http://www.nemsis.org/

C.4.3 The Contractor shall implement all approved architecture, structure, and artifacts associated with the NEMSIS 3.5.x and future standard releases.

C.4.4 The Contractor shall provide support for additional tasks designed to facilitate data connectivity and stakeholder utilization of the NEMSIS standard data, to include, but not limited to, customer service and support for EMS researchers, medical researchers, DOT, NHTSA, CDC, other Federal partners, the States, and EMS software vendors.

C.5. SPECIFIC REQUIREMENTS

C.5.1 Operation of NEMSIS TAC, the NEMSD, and related functions

C.5.1.1 Conduct Kickoff Meeting

Within two (2) weeks of contract award, the Contractor shall meet with the Contracting Officer (CO), Contracting Officers Representative (COR), and other NHTSA representatives at NHTSA Headquarters in Washington, DC. The meeting’s purpose is to discuss the technical and administrative requirements of the contract and to respond to any questions posed. The Project Work Plan submitted as part of the Contractor’s original technical proposal will be discussed, as well as any recommendations to be made to that plan.

C.5.1.2 Project Work Plan

Within two (2) months of contract award, the Contractor shall provide the NHTSA COR with an updated Project Work Plan that may be based on the submitted Technical Proposal and Kickoff meeting. The plan shall be inclusive of all tasks, including General Requirements, Specific Requirements, and Additional Requirements. The plan will reflect any lessons learned while performing the first two months of the contract plus any questions, concerns or related discussion held at the Kickoff meeting. Within ten (10) weeks after contract award, the NHTSA COR will review, approve and/or comment on the plan and return it to the Contractor. Within three (3) months post award, the Contractor shall submit a final Project Work Plan to the COR. Any changes to the terms and conditions of the contract resulting from the acceptance of a revised Project Work Plan are only authorized after the CO and the Contractor have executed a bi-lateral modification to the contract.

C.5.1.3 Monthly Report

Beginning two (2) months of contract award and each month throughout the contract’s period of performance, the Contractor shall produce a Monthly Report for distribution to State/Territory Data Managers, EMS Directors, and the broader audience of NEMSIS Stakeholders. The Monthly Report will be posted on NEMSIS.org for public access. This monthly report will provide one location for stakeholders to track NEMSIS updates and review highlights of work, collaboration, and current initiatives. This report should include links to V3 Implementation calls, the monthly public trainings (archived on the NEMSIS YouTube channel, recent research publications, and identifies information that may have changed on the website. The report should also include a summary of ePCR, and agency counts related to state version 3.5 data submissions, highlight the progress of software vendor compliance, and state transitions to the V3.x data standard.

C.5.1.4 Advisory Committee

Within two (2) months of contract award and continuing through the contract’s period of performance, The Contractor will maintain and update an Advisory Committee to guide issues of importance to the collection and use of national EMS data.

The Contractor will leverage concurrent experience and knowledge of the EMS industry using various SME groups to inform the decision-making process utilized at the NEMSIS TAC and NHTSA COR. These SME groups shall include an EMS Billing Stakeholder Group, an ePCR Vendor Group, a Receive and Process Vendor Group, and an ePCR Users Group/EMS Provider Agency group. Members will serve 2-year terms and constitute subject matter experts in different systems and delivery models related to EMS.

Each year the Contractor will organize two (2) virtual meetings and one in-person meeting for the SME Committee to be held quarterly at a location approved by the NHTSA COR. The in-person meeting will be held in the continental United States at a location selected by the contractor and approved by the COR, C.5.1.5 Defined List Committee

Within two (2) months of contract award and continuing through the contract’s period of performance, the Contractor will organize and maintain a Defined List Committee that will meet virtually multiple times per year (as determined by NHTSA) to review and make recommendations regarding additions or replacement values for the various (national standard) NEMSIS Defined Lists. The Contractor will build and maintain all supporting documentation for the national standard, including the Data Dictionary, Defined Lists, Custom Element Guides and Best Practice Guides, DataSet Guides, and version transition/translation tools necessary to meet the needs and aspirations of the stakeholders. This committee will include a NASEMSO liaison, a member of the NEMSIS TAC, an EMS Medical Director, a representative from the State Office of EMS, an EMS Biller, an ePCR Vendor, and two EMS Field Clinicians or Operational leaders.

C.5.1.6 Version 3 Subject Matter Expert Panels

Within two (2) months of contract award and continuing through the contract’s period of performance, the Contractor shall, in coordination with the COR, re-establish two NEMSIS Subject Matter Working Groups to serve as a resource to the TAC and provide SME support regarding issues of importance to national EMS data collection.

NEMSIS Subject Matter Expert Panel - Includes at a minimum: COR, NHTSA NEMSIS System Owner, NASEMSO State Data Manger, State EMS Director, State EMS Medical Director, Agency Medical Director, Researcher, representatives from the ePCR Vendor community, an active paramedic or EMT, and an active 911 telecommunicator. The group would meet utilizing quarterly webinars and have one in-person meeting annually.

NEMSIS Federal Coordination Committee - Includes at a minimum: COR, NHTSA NEMSIS System Owner, a representative from the NHTSA National Center for Statistics and Analysis, a representative from the Federal Interagency Committee on EMS Data Standards and Exchange Technical Working Group, a representative from the National EMS Advisory Committee, a representative from the U.S. Fire Administration, a representative from the Health and Human Services Office of the National Coordinator, a representative from the Center for Medicare and Medicaid Innovation, a representative from the Centers for Disease Control and Prevention, a representative from the National EMS Quality Alliance EMS, and a representative from the Prehospital Guidelines Consortium, (three (3) quarterly webinars and one in-person meeting). The group would meet utilizing quarterly webinars and have one in-person meeting annually.

C.5.1.7 State Data Use Agreements and Data Sharing Agreements

Within two (2) months of contract award, the Contractor shall coordinate with NHTSA COR, and Office of the Chief Information Officer (OCIO) to determine whether new Data Use Agreements (DUAs) or Data Sharing Agreements (DSAs) are necessary with the STTDC EMS Offices. If new DUAs or DSAs are required, it is important to make these changes with the least interruption of data submission and related services as possible. The agreements shall include what data will be provided, how it will be reported, and how it will be secured. This task shall be an integral part of the transition strategy, all new data use agreements with the EMS offices identified above shall be executed within eighteen (18) months of the contract award.

C.5.1.8 Draft Transition Plan

Within two (2) months of contract award, the Contractor shall develop and submit to the NHTSA COR, in coordination with the NEMSIS TAC and NHTSA, a Draft Transition Plan that summarizes the overall concept of how the transition of NEMSIS TAC activities shall be carried out, and the methodologies and procedures necessary to address any questions. The TAC, in coordination with NHTSA, shall transfer the ownership access of the NEMSIS Standard and NEMSD to the new Contractor. At a minimum, the Transition Plan shall include the transition of ownership of the NEMSD, the NEMSIS data standard, the identification of a proposed hosting location of the NEMSD, the transfer of the website domain name, a process and timeline for the re-negotiation of State Data Use Agreements or Data Sharing Agreements, and how services and components of NEMSIS system will be managed without interruptions. The Contractor shall develop and maintain Federal records in accordance with the National Archives and Records Administration (NARA) and NHTSA guidance and standards.

This must include retention and disposition procedures to support NARA approved schedules.

Details of the hosting location, operation, and security shall be included in Transition Plan. The Contractor shall work with NHTSA to determine the physical location of the NEMSD. The Contractor shall maintain a secure infrastructure to collect local EMS data through the STTDC and shall maintain current Federal Information Security Management Act (FISMA) (44 U.S.C. § 3541, et seq.) moderate-level certification. The Contractor’s system shall include reliable back-up systems and security control testing to assure integrity of the system. Records of such Certification must be filed with NHTSA COR and Office of the Chief Information Officer (OCIO). The Contractor shall maintain an active Authority to Operate (ATO) through DOT NHTSA.

Within two (2) weeks from the time NHTSA receives the draft Transition Plan, the COR will provide feedback on the plan.

C.5.1.9 Federal and National Surveillance Projects

Within two (2) months of award, the Contractor shall assume the maintenance and continued development of existing Federal partnerships to provide NEMSIS data, in various formats (i.e., single data requests, APIs, and/or dashboards), to meet the ongoing needs of our Federal partners. The work associated with these agreements range from providing real-time surveillance data, through APIs and dashboards, to providing performance data upon which to calibrate Federal funding or healthcare cost reimbursement. Examples of these partnerships (past and current) include work with CMS (ET3 Project), ARPA-H (HEROS Project), CDC (Data Hub Project) and, HRSA (EMS for Children Project). Dedicated resources will be required to service the requests from these projects on a daily, weekly, and monthly basis.

The following Federal dashboards shall be maintained through existing MOUs, IAAs, or other agreements between NHTSA and the Federal partner:

o Health Resources and Services Administration (HRSA) HRSA has received ongoing statistical and data support through prioritized data requests.

o HRSA Emergency Medical Services for Children (EMSC) and other HRSA programs receive support for data requests as needed in addition to an ongoing dashboard project. The dashboard project is developing evidence-based measures to improve pediatric EMS measures have currently been identified for development.

o Office of National Drug Control Policy (ONDCP) Currently provide ongoing statistical and research support for ONDCP, as well as IT support for the ONDCP dashboard.

Support involves a weekly meeting with ONDCP to identify concerns, as well as future areas for research.

Additional data are provided as requested or required such as population data, additional exploratory analysis, or answer questions posed by

ONDCP.

o Centers for Disease Control and Prevention

C.5.1.10 Infrastructure Setup and Management

Within two (2) months award, the Contractor shall maintain a secure Cloud instance for EMS data systems, obtain an Authority to Operate (ATO) and provide NHTSA with ongoing recommendations for system improvement. The Contractor shall ensure compliance with all laws, regulations, and Federal guidance for data system operation.

The Contractor will be expected to present a detailed plan for Cloud infrastructure setup and management that encompasses network architecture (including virtual private clouds and network subnets), computing resources (e.g., virtual machines and function-as-a-service offerings), storage options (such as object storage, block storage, and file storage), and database solutions (both SQL and NoSQL databases). The plan should address load management and dynamic scaling strategies to maintain optimal performance and reliability. The Contractor will be required to outline their methodology for infrastructure deployment, ongoing management, and scalability considerations.

The Contractor must exhibit a robust capability for data collection and processing, designed to support a wide range of data sources, including direct file uploads, application programming interfaces (APIs), and streaming data. The proposed solution must be adept at handling and processing large datasets in various formats and structures, with a focus on scalability and dependable performance. The submission should clearly explain the vendor's strategy for managing these processes, including the employment of any specific tools or technologies. Additionally, proposals must be designed to meet Federal Information Security Management Act (FISMA) Moderate security requirements, ensuring that all aspects of the infrastructure and data handling practices are compliant with federal security standards (see NIST SP 800-53).

C.5.1.11 Final Transition Plan

Within three (3) months of contract award, the Contractor shall submit a final Transition Plan to the COR.

C.5.1.12 Draft Stakeholder Outreach and Communications Plan

Within three (3) months of contract award, the Contractor shall develop a draft Stakeholder Outreach and Communications Plan. NHTSA will assist the Contractor in the development of this plan to ensure consistency with agency messaging and priorities.

The Communications Plan shall be updated annually and guide the communications and outreach activities of the TAC during the performance period. Stakeholder meetings must be a part of the Communications Plan and consistent with the overall communications strategy. Travel and per diem may be paid from this contract to participate in site visits, attend meetings, conferences summits and/or seminars at the discretion of the COR. The draft plan should include:

Stakeholders The Contractor shall include the process for maintaining communications with all https://csrc.nist.gov/Projects/risk-management/sp800-53-controls stakeholders to build consensus and facilitate the collection, cataloging, and vetting of all EMS Stakeholders' thoughts and opinions regarding the NEMSIS Standard, as well as the tools and educational material that could be developed to assist with the use and understanding of the EMS standard data. The Contractor will maintain regular email correspondence with state data managers, ePCR and software vendors, EMS agencies, and others. Information will be routinely distributed to these groups about resources, trainings, and upcoming events.

The Contractor will dynamically update a national NEMSIS Standard that represents all EMS Stakeholders, by consensus through surveys, polls, discussions and invitations for input and comment.

Research Requests The Contractor shall include the process for reviewing research requests as they are received by phone, email, or through the NEMSIS website (within 48 hours) and either direct the requester to the appropriate resource, answer questions, or provide the needed datasets. Requests may be as simple as providing static data to a researcher or more complex custom/masked datasets or tables. The NEMSIS TAC may be requested to perform upon request, statistical analysis where the requester is unable. In 2023, the NEMSIS TAC received and supported 359 separate dataset requests.

Data requests that require analysis, linkage, masking, randomization, or additional support should be reviewed for relevance and complexity; entered into a statistician queue; and completed within 2-weeks from the time of the request.

Media Requests The Contractor shall include the process for reviewing media requests as they are received by phone, email or through the NEMSIS website and direct the requester to the appropriate resource, most often the COR. Responses to media requests must be approved by the COR or appropriate NHSTA communication authority prior to release of the response. The Contractor shall support reporter’s requests with context on how EMS data are collected when appropriate and approved by the COR.

NEMSIS.ORG Website The Contractor shall include the process to maintain all appropriate world wide web domain name(s) and licenses in coordination with the NHTSA. The Contractor shall ensure management and maintenance of the www.nemsis.org website without disruption of service to end users. The NEMSIS TAC maintains the NEMSIS website, ensuring it serves as a resource for comprehensive and up-to-date information on the national standard. As the landscape of emergency medical services evolves and with the NHTSA COR approval the website is regularly updated with fresh content to meet the growing needs for education and information dissemination. This includes the latest research findings, updates on data collection methodologies, and upcoming events and webinars.

http://www.nemsis.org/

Social Media The Contractor shall include the plan for managing social media for the NEMSIS TAC and include a social media strategy that defines how this is to be done across Facebook, LinkedIn, You Tube, Twitter, and other social media platforms. The strategy shall schedule various content types, each tailored to the specific characteristics of the audience. This includes disseminating research papers featuring NEMSIS data, celebrating milestones such as states initiating the collection of V3.x data, and announcing major developments like the Public- Release Research Dataset.

The strategy should also promote the annual meeting and ensure timely dissemination of information regarding team members' conference presentations.

Posts will also include promoting online webinars, sending out holiday greetings, and advertising job openings, all while maintaining consistent, brand-aligned messaging. The Contractor shall develop an annual Social Media Report by 1 March of each year throughout the period of performance that characterizes web traffic to the website and social media outlets, identifies high performing posts and proposes modifications to enhance and improve traffic to the sites.

Implementation webinars The Contractor shall include hosting a V3 Implementation webinar 6 months award and twice each month thereafter, to create a forum for discussion around improving and implementing the latest NEMSIS data standard. The Contractor will be available, during business hours, for one-on-one meetings, phone calls, and email, creating tickets in a workflow using a public facing help desk. The Contractor will distribute pertinent information through social media accounts, including Facebook, LinkedIn, YouTube, and Twitter.

NEMSIS Infographic Development The Contractor shall include the process for rebranding the NEMSIS TAC. The Contractor will pinpoint the infographic's primary objective and the specific audience. The Contractor will collect and scrutinize pertinent data related to emergency services and NEMSIS standards, ensuring accuracy and relevance.

This information will be distilled to the most significant pieces of information and this core content will be used to create visually compelling layouts that represent the mission and purpose of the NEMSIS strategy. This will involve selecting a color palette, typography, and graphical elements that not only align with our brand identity but also effectively convey the intended message.

After finalizing the design, the Contractor will adapt the infographic for various mediums, ensuring it is suitable for digital platforms, print materials, or presentations. The Contractor will finally develop a process for the strategic distribution of the infographic. The Contractor will focus on channels that best reach our target audience, such as our website, social media platforms, and industry conferences, to ensure the infographic achieves its intended educational and communicative impact.

Partnerships and Maintaining Existing Alliances The Contractor shall include how they will forge new partnerships with national EMS organizations and maintain existing alliances with the National Registry of Emergency Medical Technicians (NREMT); the U.S. Fire Administration and national fire service organizations developing and implementing the National Emergency Response Information System (NERIS); and the National EMS Quality Alliance (NEMSQA) as they update and improve the National EMS Quality Alliance Measure Set. The Contractor will also continue to support a liaison position between the National Association of State EMS Officials (NASEMSO) and NEMSIS to improve partnerships and projects shared between the two organizations.

Within four (4) weeks from the time NHTSA receives the draft plan, the COR will provide feedback to the Contractor.

C.5.1.13 Data Ingestion and Processing

Within three (3) months award and throughout the contract period of performance, the Contractor is required to implement robust data validation processes to ensure all incoming data conforms to predefined XML schemas. The solution should automatically identify and flag any discrepancies in data structure, accuracy, or completeness. Vendors must describe their validation processes, including how non-conforming data are handled, to maintain the integrity of the data pipeline and ensure the reliability of datasets for analysis.

The Contractor must provide a detailed approach for data cleaning and preparation, employing techniques to ensure data accuracy, consistency, and readiness for analysis.

This includes deduplication, normalization, and error correction processes. The proposal should outline the methodologies and tools used for data cleaning, highlighting how these practices contribute to the overall quality and usability of the data. The Contractor should also demonstrate an understanding of the importance of this phase in preparing data for meaningful analysis and insights.

C.5.1.14 Security and Compliance

Within three (3) months award and throughout the contract period of performance, the Contractor will be required to demonstrate a robust security framework that encompasses identity and access management (IAM), security groups, network ACLs, and encryption practices. The Contractor should also address detail the measures in place to ensure data protection and privacy. The Contractor must also describe methodologies for continuous security assessment and compliance monitoring.

The framework shall include a detailed security and compliance plan that adheres rigorously to FISMA Moderate criteria as detailed in NIST SP 800-53, with additional adherence to Department of Transportation (DOT) specific security mandates. The Contractor must showcase technical proficiency and commitment to upholding the highest standards of security and compliance throughout the project's duration.

An Information Systems Security Officer (ISSO) at the awardee’s institution will assume a critical role in ensuring compliance, managing security operations, and fulfilling all necessary reporting and regulatory responsibilities. This comprehensive security management approach includes, but is not limited to:

Identity and Access Management (IAM) The Contractor must elaborate on IAM strategies, detailing mechanisms for access control, authentication, and authorization, including multi-factor authentication (MFA), role-based access control (RBAC), and adherence to the principle of least privilege to minimize unauthorized access risks.

Security Groups and Network Access Control Lists (ACLs) Descriptions must include how security groups and network ACLs will be configured to manage and enforce rules for inbound and outbound traffic, securing network interfaces, subnets, and virtual private clouds (VPCs), critical for deterring unauthorized network access and ensuring secure communication pathways.

Data Protection and Privacy The Contractor shall outline encryption methodologies for both data-at-rest and data-in-transit, employing industry-standard encryption protocols and key management practices to protect sensitive data from unauthorized interception and access.

Continuous Security Assessment and Compliance Monitoring Methodologies for continuous security evaluations and compliance monitoring should be detailed, highlighting regular security audits, vulnerability scanning, and threat assessments to identify and mitigate risks in a timely manner. Proposals should also describe the use of automated tools and processes for continuous monitoring and reporting to maintain an updated security posture.

C.5.1.15 Development and Deployment of Workflows

Within four (4) months award, the Contractor must outline the development and deployment workflows, including the use of code repositories and CI/CD pipelines.

Vendors should demonstrate their capacity for supporting modern development practices and their approach to continuous integration and delivery to facilitate rapid and reliable software releases.

C.5.1.16 Monitoring and Management Practices

Within four (4) months award, the Contractor should emphasize the integration of monitoring and management practices into a cohesive strategy that supports the detection and resolution of issues before they impact operations. In addition to daily operational and maintenance requirements, the Contractor shall also perform as-needed updates and or modifications to application, network, data flow, communications, hardware, and documentation to include any process flow diagrams to support any/all design concepts adopted and approved for NEMSIS infrastructure, architecture, data collection and any other NEMSIS life cycle tasks and activities.

C.5.1.17 Final Stakeholder Outreach and Communications Plan

Within five (5) months after contract award, the Contractor shall submit a final Communications Plan to the COR and obtain NHTSA approval before implementing the plan.

C.5.1.18 Networking Strategy

Within five (5) months of award, the Contractor must articulate a detailed networking strategy that ensures high availability, performance, and scalability for cloud-hosted applications and services. This includes a comprehensive approach to DNS management and API management, focusing on robust, scalable, and secure networking solutions that support seamless global access and efficient operation.

C.5.1.19 Data Analytics and Business Intelligence Strategy

Within five (5) months of award, the Contractor must present a comprehensive data analytics and visualization strategy that focuses on leveraging advanced reporting tools and dashboards, such as Tableau and other equivalent platforms, to extract meaningful insights from robust datasets. This strategy should emphasize the integration of these tools into the overall data management framework, ensuring that data-driven decision-making is accessible, intuitive, and efficient for users across the organization.

The Contractor should also consult with the Enterprise Data Management Analytics Services (EDMAS) subject matter experts to select elements appropriate for feature engineering feeds into a repository for machine learning and artificial intelligence usage.

The Contractor should also work with the EDMAS group to select elements for the data warehouse, dashboards, and reporting, as well as provide datasets on the Datahub to comply with the Open Data Act. MVCs and ejections datasets and reports are just two (2) examples of the analytics requirements of NHTSA.

C.5.1.20 Cost Management Strategy

Within five (5) months of award and throughout the contract period of performance, the Contractor must outline a comprehensive strategy for managing and optimizing cloud costs, leveraging industry-standard tools and methodologies for cost monitoring, reporting, and optimization. This strategy should aim to ensure that the project remains within budget while maximizing resource efficiency across any cloud platform.

C.5.1.21 EMS Data Linkage Demonstration

Within six (6) months award, the Contractor will collaborate with ACS-COT, FARS, CDC, NERIS, and others to identify and implement tools that facilitate the use of NEMSIS UUID to link deidentified records at the registry level. The purpose will be to identify potential mechanisms for better linkage between crash, EMS, and hospital records.

The Contractor will also develop educational tools and data use agreement language to facilitate the continued implementation of the NEMSIS UUID among local State, Federal EMS agencies and professional organizations. These tools will be tailored to address the missions of organizations such as: the National Association of State EMS Officials (NASEMSO), the American College of Surgeons, the Association of State Transportation Information Professionals (ASTIP), and other stakeholders that would benefit from potential use of the NEMSIS UUID to improve state- and national-level linkages between EMS, electronic hospital/medical records, and various local, State, and national registries.

C.5.1.22 Data Submission Support

Within six (6) months of contract award and continuing through the Contract’s period of performance, the Contractor shall provide 24 hour a day, 7 day a week, 365 day a year support for data submission from the STTDC through web services as they transition through versions of the NEMSIS standard and assure timely data validation/error reporting for inclusion of STTDC submitted data to the NEMSD.

C.5.1.23 Technical Support for ePCR Vendors

Within six (6) months of award and continuing through the Contract’s period of performance, the Contractor shall provide limited (between the hours of 0800 and 1800 EST) software technical support for system end users and monitor any system/software problems to expedite solutions related to the operation of NEMSIS. The Contractor shall assist EMS software developers as needed with NEMSIS compliance.

C.5.1.24 Technical Support States, Territories, Tribes, and the District of Columbia performance, the Contractor shall provide Help Desk Services for State EMS Data Managers between the hours of 0800 and 1800 EST to assist with any system issues that may be impacting compliance or implementation.

The Contractor will support STTDC Offices of EMS Directors and Data Managers by providing onboarding training and continued support as they submit EMS records to the national repository. The Contractor will also provide quarterly meetings for STTDC EMS Directors to discuss topics of national interest. The Contractor will provide 24 hour a day, 7 day a week, 365 days a year support through one-on-one meetings, to help State data managers and vendors to trouble shoot failing records, working closely with states as they implement a new NEMSIS data standard, based on an established revision cycle.

The Contractor will maintain a help desk where stakeholders can submit tickets and questions.

The Contractor shall offer tools facilitating the application, by States, for Federal EMS-related grant funding. These tools should include grant guidance documentation, ideas for documenting and benchmarking grant objectives and tracking grant specific milestones.

C.5.1.25 Technical Assistance to NHTSA in Ongoing Projects performance, the Contractor shall provide to NHTSA ongoing technical assistance related to NEMSIS and EMS patient care data and, when requested, its local and STTDC partners. This may include participation in meetings, webinars, and conference calls to provide expert advice on NEMSIS and EMS patient care data communicating with governmental and non-governmental organizations on behalf of NHTSA (and with prior approval of NHTSA).

C.5.1.26 State Data Manager Education Program performance, the Contractor shall maintain a virtual education program, made available to all new STTDC EMS Data Mangers, that provides an orientation to the NEMSIS project, outlines the needed tasks to establish and maintain a NEMSIS V3 compatible STTDC EMS data collection system and orients new STTDC employees to the data quality, community surveillance and clinician performance metrics available for use through the NEMSIS website. The contactor must update the education program as appropriate for each NEMSIS update and new version.

C.5.1.27 State Datasets and State Schematron Files Report

Within six (6) months of award and weekly throughout the Contract’s period of performance, the Contractor will develop and maintain a feed-back report for State EMS Data Managers that highlights training (or program reconfiguration) opportunities that will result in the reduction of national Schematron warning violations encountered with record submission. These reports will be “pushed” to State EMS Data Managers and routinely reviewed during a planned webinars to discuss the findings.

C.5.1.28 Monthly Stakeholder Training performance, the Contractor shall provide monthly on-line training through the NEMSIS TAC on topics relevant to state data managers and vendors. Trainings shall be recorded and posted on the NEMSIS YouTube channel and website for public access. Topics for trainings should be selected with input from stakeholders and NHTSA COR approval.

C.5.1.29 National Association of State Emergency Medical Services Officials (NASEMSO) Data Managers Council Meetings performance, the Contractor shall partner closely with NASEMSO and attend their monthly Data Manager Council (DMC) and sub-committee and regional meetings. The Contractor will be prepared to offer education and feedback on topics suggested by the DMC, such as suggested changes to the data standard, updates to data definitions and other topics of State and national interest.

C.5.1.30 Conduct Record Audits

Within six (6) months of award and on a weekly basis throughout the Contract’s period of performance, the Contractor will work with states to monitor the timeliness of record submissions and monitor for failing or missing records. If discrepancies are noted between STTDC and national records, the Contractor work with the STTDC and vendors to re-submit any failed or missing records.

C.5.1.31 Develop and Submit NEMSIS Case Definitions for Diseases, Syndromes, and Conditions performance, the Contractor shall develop, test, and maintain reliable and valid NEMSIS Version 3.x case definitions for diseases, syndromes, and conditions as directed by the NHTSA COR. Examples of case definitions that should be prioritized for development, update, and validation include: opioid overdose, trauma center need, stroke, STEMI, cardiac arrest, motor vehicle traffic crash, pedestrian traffic crash, motorcycle traffic crash, bicycle traffic crash, and scooter crash, behavioral health, influenza-like illness, micro-mobility, patient death, seizure and, sepsis.

After development and testing, the Contractor shall develop resources that describe the case definitions and the methodology that was used to verify the validity and reliability, case-specific Public Release Research Datasets for individual States and Territories, a toolkit with standard SAS code that States and territories can apply to State EMS data repositories to produce case-specific datasets, and other resources as directed by the

COR.

C.5.1.32 Develop Processes for Export of State-level NEMSIS Data into other Public Health Data Registries performance, the Contractor shall develop and maintain a system to effectively and reliably export NEMSIS data from existing State EMS data repositories directly into the Cardiac Arrest Registry for Enhanced Survival (CARES), National Emergency Response

Information System (NERIS), Fatality Analysis Reporting System (FARS) and other registries identified by the NHTSA COR. Contractor staff shall work with representatives of CARES, NERIS, FARS, and other registries as directed by the NHTSA COR.

C.5.1.33 ePCR Vendor Input on National Standard performance, the Contractor will facilitate mechanisms allowing ePCR Vendors to have a voice in the establishment and continual improvement of the national standard. The Contractor will hold quarterly meetings where vendors can speak not only to the TAC but to each other about lessons learned. These quarterly meetings must provide an atmosphere allowing EMS software vendors to see each other as teammates rather than competitors. The Contractor must maintain an environment that is careful to avoid conversations that veer into intellectual property or commercial application of an ePCR product.

C.5.1.34 Disaster Recovery, High Availability and Retention Plan

Within six (6) months award and throughout the contract period of performance, the Contractor must present a comprehensive disaster recovery and high availability plan that includes strategies for data backup, multi-region deployment, and specific disaster recovery planning. The proposal should detail the mechanisms in place to ensure business continuity and data integrity in the event of an outage or disaster.

C.5.1.35 Vendor Experience with Migration and Modernization the Contractor must elaborate on the vendor's experience and methodology for migrating existing applications and data to the Cloud, alongside strategies for modernizing applications to fully utilize cloud capabilities. This encompasses a comprehensive approach to application and data migration, as well as the adoption of contemporary Cloud technologies such as containerization and serverless computing. Vendors are expected to showcase their understanding of the intricacies, challenges, and best practices involved in cloud migration and application modernization processes.

C.5.1.36 Customer Support and Service Level Agreements the Contractor is required to specify the level of customer support provided and the specifics of Service Level Agreements (SLAs) related to service availability and performance. The proposal should outline the vendor's commitment to customer service and support, including response times, escalation procedures, and access to technical expertise.

C.5.1.37 Compliance Testing Process the Contractor shall maintain an objective, unbiased process designed to test vendor EMS software for NEMSIS compliance and post on the project website a current listing of compliant software. The Contractor shall also provide a method for local, states, Federal, territorial, tribal, and private EMS agencies to verify EMS software compliance. The Contractor shall include a brief description of the NEMSIS software compliance testing procedure in the project work plan. The Contractor shall evaluate the software compliance testing process during the first year and shall report evaluation results and proposed changes to NHTSA, by end of first year, so they can be incorporated in second year testing.

The Contractor must maintain a standardized process for testing 30+ new and revised software applications for adherence to the current NEMSIS standard annually. Each year the Contractor will devise a new set of test cases that are randomly applied to test software for proper application of the demographic and event XML schemas, implementation of all national, state, and optional standard elements, use of error messaging and application of national and state Schematron rules, application of defined lists and adherence to interoperability standards. A process must be available to address compliance questions and test case review during the process, via a helpdesk or through direct communications with the NEMSIS TAC. Currently compliance testing, on average, takes software applications 30-60 days to complete the process. The general process for software compliance testing should include:

Standard Protocol/Process – An ePCR software application…