75D301-23-R-72696 Qs As 8.9.23.pdf

CDC/CFA Demographic Social Comorbidities Table (DSCT)

Solicitation No. 75D301-23-R-72696

Questions and Answers (Qs&As)

Q1. Who are the end users for the DSCTs? CDC, other federal agencies, state and local health departments, general public? Section 3 – Scope of work pg. 6

A. Potentially all entities listed could be end users.

Q2. Can CDC provide the link to the influenza risk factors document? Section 4, Task 2, Bullet 1 pg. 7

A. https://www.nejm.org/doi/full/10.1056/nejmra1000449

Q3. Will the publicly accessible tool be available on the CDC website or the contractor’s website? If on the contractor’s website, will this require an authority-to-operate (ATO) given that the tool will house only aggregate counts (no PHI or PII)? Section 4, Task 4, Bullet 3 pg. 9

A. CDC website: An ATO will not be required. Depending on data and format the standard

WCMS will be used to format and prepare data for display.

Would CDC like both a user-interface and an application programming interface (API) to access this tool?

A.Yes

Q4. Should the contractor budget for a virtual or in-person kick-off meeting?

A. Virtual

Q5. Is task 5 about producing a new DSCT tool for a different condition than COVID-19/ influenza or about updating the COVID-19 or influenza tool with new data? Section 7, Deliverables table, Task 5 pg. 10

A.It is for a different condition than COVID-19/influenza

Q6. Does the CDC want the contractor to use the same years of data (2018-2023) for the base period and all option years? Or update the data as additional years become available? Section

8 – Minimum vendor qualifications pg. 14

A. Ideally, additional years as they become available, but we would consider proposals to use only the same data

Q7. Is an ATO required for the data processing environments? Section 9, Security

Assessment and Authorization pg. 22

A. Based on the nature of this work CDC does not anticipate the need for an ATO. As described an IT system is not being built and or delivered. In the unlikely event that an ATO is needed CDC will make accommodations for any delays on CDC’s part in the ATO process.

Q8. The proposal is due August 24. Should the period of performance October 1, 2023 through

September 30, 2028?

A. The estimated POP is September 29, 2023 – September 28, 2028

Q9. This section refers to budget spreadsheets not counting toward the page limitation of the technical proposal. However there is no mention of budget spreadsheets in the business proposal instructions (section L.4 on pg. 77). Are offerors required to submit their budget in spreadsheet format, and if so, can the government please provide instructions on what should be included in the spreadsheets?

A. See Amendment 1. Page 77 has been revised to include spreadsheet.

Q10. Please confirm this means that it is acceptable for illustrations and tables to contain font sizes less than 12pt/other than Times New Roman, as long as they are easily readable.

A. Yes

Q11. The instructions (L.5) state the offerors shall include the information for the last 3 completed contracts and all current contracts. The evaluation criteria (M.7) mention relevant contracts.

A. The last 3 relevant contracts completed and/or in process during the past three years.

Can CDC confirm what offerors should submit to satisfy Section L.5? The last 3 contracts completed or the last 3 relevant contracts completed? To satisfy the requirement for 3 completed contracts, can offerors provide a project description for a current project that is ongoing and has been underway for over a year? For contracts currently in process, all contracts currently in process or only relevant current contracts?

A. The last 3 relevant contracts completed and/or in process during the past three years.

Q12. Given the technical proposal page limit of 20 pages, can the CWBS and PMP be placed in the appendix?

A. No

Also, this sentence is in the technical approach section, but there’s also a separate management approach section – where should this information be provided?

A. In the Technical Approach

Q12. How do linkages to state immunization registries relate to the SOW? Can the CDC elaborate on why this is a requirement? If required, at what level of data is this linkage intended?

Section M, M.3, 1. Technical approach pg. 81

A. This is an error. See Amendment 1.

Q13. What is the expected level of effort for this project? Section M, M.3, 2. Staffing plan

pg. 81

A.This depends on the complexity, number of datasets and sophistication of the analytic approach.

Q14. Are the three projects requested in the Similar Experience section the same 3 projects used for the past performance questionnaire (sections L.5, p.79; M, M.7 - Past Performance, p. 83)?

Can offerors provide a project description for a current project that is ongoing and has been underway for over a year?

Q15. Can a CPARS be submitted for a project in lieu of a questionnaire?

Q16. The past performance questionnaire language references another opportunity. Is this the correct past performance questionnaire? Past performance questionnaire attachment pg 1

A. This is an error. See Amendment 1.

Q17. The contractor is to make two DSCTs. When the contractor “re-produces the DSCT is the primary DSCT to be taken offline or kept accessible? Page 3 of 83 PWS Section 3- Scope of work “2. Re-produce DSCT one time during contract period to include an alternative set of characteristics…”

A.No, the primary DSCT is not to be taken offline when the second DSCT is produced. The two requested DSCTs for the first performance period are separate products.

Q18. Will the CDC provide a listing inclusive of applicable URL’s, organizational points of contact, and other relevant information to access datasets deemed critical to this project? Page 7 of 83 PWS Section 4 – Tasks to be Performed “1. The Contractor shall propose a means of making estimates using a combination of data sources including the contractors’ own data in addition to other data sets that are publicly available”

A.No

Q19. Will the CDC share insurance type information to produce population estimates? Page 7 of 83 PWS Section 4 Tasks to be Performed “10. The Contractor shall document population estimates stratified by insurance type, i.e., Private, Medicare, Medicaid and Uninsured”

Q20. There appears to be a link missing in the document when referencing risk factors relevant to the 2009 influenza pandemic. Can CDC send the appropriate URL as referenced? Page 7 of 83 PWS Section 4 Tasks to be Performed Task 2 number 1 “..As a default, this DSCT will replicate the procedure in Task 1 but for the list risk factors relevant to the 2009 pandemic influenza, which are listed here…”

A. A. https://www.nejm.org/doi/full/10.1056/nejmra1000449

Q21. Will contractor staff be required to obtain special access and security clearances to access

CDC based systems? This could include but not be limited to obtaining Personal Identity

Verification (PIV) cards and undergoing background checks. Page 8 of 83 PWS Section 4

Tasks to be Performed Task 3: number 5 “All custom developed code shall be provided to CDC and hosted on a CDC-recognized source code repository, to include data preparation, data transformation, and analytic code”

A.No

Q22. Should contractors assume all data related to this project are stored on a CDC based system and all costs related to storage will not be contractors’ responsibility? Page 8 of 83 PWS

Section 4 Tasks to be Performed Task 3: number 5 “All custom developed code shall be provided to CDC and hosted on a CDC-recognized source code repository, to include data preparation, data transformation, and analytic code”

A. Task 3 number 5 refers to any custom coding the offeror develops to create data tables. There is not expectation of delivery of data used in analysis, just coding developed specifically for this

PWS.

Q23. Please identify the secure portal being referenced in this context Page 9 of 83 PWS

Section 4 Tasks to be Performed Task 4: item 5a “All the data transfer and document storage related to all queries shall be carried using the secure portal”

A. As stated in the previous sentence it is the offerors responsibility to create and utilize a secure data transfer capability. CDC does have a secure mechanism available through CDC Secure

Access Management System (SAMS). If it is determined by both CDC and the offeror to be easier in post award this mechanism can be set-up but offeror will be expected to complete aprropriate identity proofing to use system.

Q24. Is the CDC open to hosting this solution on a FedRAMP compliant cloud provider that meets all the security needs of the project? Page 28 of 83 B. Protection of Information in a

Cloud Environment Number 3 “The Contractor shall ensure that the facilities that house the network infrastructure are physically and logically secure in accordance with FedRAMP requirements and HHS policies”

A. As the data being used by the contractor does not belong to CDC and was not collected on behalf of CDC and there is no IT system being developed or delivered to CDC this requirment does not apply to the work discussed in the outline tasks to be complete.

Q25. Can the CDC provide to contractors the timeline proscribed in the CDC SA&A SOP?

Page 34 of 83 PWS. Row 13 in Schedule of Deliverables

A.The timeline will be discussed after the contract is awarded.

Q26. Can CDC provide guidance on how we should budget the base year since it starts August 1, 2023 and proposals are due August 24, 2023? Page 39 of 83 Section F – Deliveries Or

Performance “Base Period: August 1, 2023 to July 31, 2024” and page 77 of 83 item (d) “The proposal must receive by August 24, 2023 at 2:00 PM EST”

A. The estimated start date is September 29, 2023

Q27. The CLIN Structure in Section B states the unit of measure for each CLIN is “1 Job”. Are

Offerors to assume that “1 Job” is equal to one contract year completing the tasks outlined in

Section C, Section 4 – Tasks to be Performed? OR Will CDC clarify how the tasks described in

Section C convert to a “Job” as referenced in Section B?

A. Yes, the Offeror can assume that “1 job” is equal to one contract year completing the tasks.

All tasks in Section C, Section 4 are to be completed each contract year, with the exception of

Optional Task 5.

Q28. The period of performance in the RFP starts on 8/1/23. Since the RFP response is due on

8/24/23, would CDC please update the anticipated period of performance for each year of the contract?

Q29. The RFP states, “The technical proposal shall be limited to no more than 20 pages of text.

Appendices shall be limited to no more than 10 pages of text. Cover pages, tables of contents, appendices, resumes, or the budget spreadsheets are not counted in the number of pages limitation.”. Would CDC please clarify if appendices are limited to 10 pages, or do not count in page limits?

A. Appendices are limited to no more than 10 pages.

Q30. Would CDC consider extending the proposal submission deadline to Wednesday, August

30th so that we can factor into our response CDC’s answers to questions submitted?

“(b) Offerors shall submit the past performance information as part of their business, technical or as a separate proposal. The offeror should include the last 3 contracts completed during the past three years and all contracts currently in process for both the offeror and all proposed major subcontractors.”

For the “last three contracts” requirement, can offerors simply provide three contracts that are either active or completed during the past three years that demonstrate our ability to fulfill the

RFP requirements?

For the “All contracts currently in process” requirement, would CDC accept a list that includes only relevant active contracts?

A. CDC is only looking for the relevant contracts from the past three years.

For the “all contracts currently in process” requirement, did CDC intend to require submission of all information items 1 through 11 for all of those active contracts? Or is that information required only for three recent relevant contracts from the past three years?

A. Only relevant contracts from the past three years.

Q31. Will CDC please define “major subcontractor”?

A. See Amendment 1.

Q32. Are contractors required to provide past performance as a third volume to their RFP response?

Q33. The RFP notes 8/01/2023 as the start date for the contract. Can CDC please clarify the anticipated start date since proposals are due 8/24/2023?

Q34. Can CDC please provide the link to the 2009 pandemic influenza risk factors referenced under Task 2? Section 4: Task 2, #1 pg. 7

. A. https://www.nejm.org/doi/full/10.1056/nejmra1000449

Q35. For budgeting purposes, can CDC please specify the number of protocols, reports, presentations, and manuscripts the contractor will be involved in preparing? Section 4:

Task 4, #2 pg. 8

A. Approximately: 1-2 protocols, 1 report, 1 manuscript, 1 presentation for each DSCT (thus

2 x these numbers for the main contract comprising 2 DSCTs, and 1x these numbers for each optional DSCT)

Q36. For staffing and budgeting purposes, can CDC clarify if the contractor will be expected to:

1) fully draft all protocols, reports, presentations, manuscripts and submit to CDC personnel for review, OR 2) review and provide inputs for protocols, reports, presentations, manuscripts that

CDC personnel will draft? Section 4: Task 4, #2 pg. 8

A.Assume #1, for budget purposes

Q37. Can CDC clarify whether the “publicly accessible website” referenced in Task 4 will be hosted by CDC or should the contractor establish and host this website throughout the life of the contract? Section 4: Task 4, #3 pg. 9

A. CDC

Q38. For budgeting purposes, can CDC estimate the number of ad hoc data calls to expect during each contract year? Section 4: Task 4, #4 pg. 9

A. Approximately 2 per DSCT

Q39. Can CDC please clarify what tool is referenced as "the prioritization tool" under Section 5, Reference Materials? Section 5, Reference Materials pg. 9

A. “Prioritization tool” is an alternate name for the DSCT

Q40. The Deliverables/Reporting Schedule references monthly progress reports in 3 sections.

Can CDC please clarify the differences among the monthly reports listed under: Deliverable 4.5

"Secure Portal" with a due date of "2 months after award," "Status Reports" with a due date of

"Monthly through contract period," and “Consultation with CFA on design of DSCT” with a due date of “Once monthly in months 5, 6, & 7; Progress reports due on the last Friday of every month?” Section 7, Deliverables/ Reporting Schedule pg. 10

A.Each of these items is a separate deliverable. The “Secure Portal” deliverable refers to the creation of secure data transfer capabilities, to be completed within 2 months of award (see page

9). Associated reports are specifically pertaining to progress on this capability. The “Status

Reports” are monthly reports that the Offeror shall produce for CDC on the overall progress of contract. The reports for “Consultation with CFA on design of DSCT” are reports specific to production of DSCT.

Q41. If an “authority to operate (ATO)” is required, as stated on p. 22, will CDC consider revising the due dates for deliverables since the ATO process can take many months during which time the contractor would not be able to share preliminary table files with CDC? Section

7, Deliverables/ Reporting Schedule, and

Section 9, Additional Requirements/ Information Security and Privacy pg. 10 pg. 22

A. Yes, the deliverable table can be revised after contract award, based on the circumstances.

Q42. For budgeting purposes, can CDC estimate the number of hours required for the annual

“HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training”? Section 9, Additional Requirements/ Training pg. 18

A. Training can be completed in about an hour or less.

Q43. Can CDC clarify whether or not contractor staff will need to complete “role-based training”? If they do, can CDC estimate the number of hours required for this training? Section

9, Additional Requirements/ Training pg. 18

A. Training can be completed in about an hour or less, if needed.

Q44. Will the offeror be using CDC’s REDCAP product? If not, does Vanderbilt’s REDCAP environment meet CDC’s security requirements? Section 9.A.2, SA&A pg. 22

A. Offeror will not be collecting new data or designing a study. The intent is that offeror will be using existing data from a data provider who has access to large amounts of EHR data as described in Section I and Section 8: “Vendor must have at a minimum, access to electronic medical records, including inpatient and outpatient data on a minimum of 3 million persons.

Preference will go to proposals with shorter data lags, larger overall sample size, longer duration of coverage for covered persons, and better coverage of vulnerable populations. Preference will also be given to proposals that contain a higher proportion of health care encounters of covered persons and to those that can link individual records to state immunization Registries"

Q45. Should the offeror include the costs of an independent 3rd party security controls assessor or penetration test in their budget or will the agency perform these activities? Section 9, Annual Assessment: pg. 24

A. If the offeror feels that this is work required in order to complete the requirements, the offeror should include these costs in their proposal.

Q46. Can the required HHS Section 508 Product Assessment Template be included as an appendix to the Business Proposal? Section 508 compliance pg. 35

A. Yes. The intent of this requirement is to assure offeror is aware of all 508 requirements for deliverables and that all deliverables will be 508 compliant.

Q47. The Evaluation Criteria refer to the “Data Analysis Environment,” however this is not described in Section 3, Scope of Work, or Section 4, Tasks To Be Performed. Can CDC describe the requirements of this Data Analysis Environment? Can CDC also clarify if this environment will be a CDC-hosted and maintained environment, or whether the contractor should host and maintain this environment throughout the period of performance of the contract? Section M, Evaluation Factors For Award pg. 81

A. Language for “Data Analysis Environment” is incorrect; please see Amendment 1.

Q48. The Past Performance Questionnaire references the ”Safety and Healthcare Epidemiology

Prevention Research Development (SHEPheRD) Program” under the Contractor Name section.

Can CDC confirm this is an error since this RFP was not released under SHEPheRD?

Attachment 1 – Past Performance Questionnaire pg. 1

A.This is an error. See Amendment 1.

Q49. Does CFA prefer a specific querying tool (e.g., Excel, Tableau, or Oracle-based querying tool)? Task 1: Demographic, Social, and Comorbidities Table (DSCT) for Influenza or Condition of CFA’s Choice (item 11.a) pg. 7

A.CFA does not have a preference for a specific querying tool, but we prefer one that is flexible, fast, and can provide output in standard formats.

Q50. It appears that the hyperlink to the risk factors for the 2009 pandemic influenza may be broken. Please provide. Task 2: Demographic, Social, and Comorbidities Table (DSCT) for

Influenza or Condition of CFA’s Choice pg. 7

A. https://www.nejm.org/doi/full/10.1056/nejmra1000449

Q51. Does CFA anticipate this contract in need of the common data model given that certain data sources for particular population segments may not be available in CDM forms? Can you clarify the reason for requiring CDM ETL data transfer? Task 3: Operations and Management

pg. 8

A. This statement was incorrectly included in this statement of work. Disregard. See amendment

1.

Q52. Our understanding is that CFA would like to create a COVID DSCT, an influenza DSCT in the base year, and 4 other DSCTs for 4 additional conditions in the option years. Does the CFA expect the DSCTs created in previous years to be updated in subsequent years, if so, at what frequency? Optional Task 5 pg. 9

A. No update is expected.

Q53. Please confirm that FedRAMP security requirements only applies to those cloud based solutions and not applicable if the Offeror's proposed solution is a Contractor-Owned, Contractor-Operated (COCO) internal on-premise solution. A. HHS FedRAMP Privacy and

Security Requirement pg. 27

A.That is correct. FedRAMP only applies to cloud based solutions being provided to CDC as part of this contract. under the current scope this does not apply.

Q54. Please confirm that federal ATO is not required since the Offeror is only using deidentified data to produce aggregated results, using a Contractor-Owned, Contractor-Operated (COCO) internal on-premise solutions.

A. No ATO will be required. This is standard lauguage required for all IT and data contracts. If the scope of contract continues to not have an IT system as deliverable this does not apply.

Q55. What is the anticipated start date for the period of performance?

Q56. Who are the Key Personnel required for this contract, including roles/responsibilities and minimum education/experience? In addition, please verify if resumes for Key Personnel are required.

A. These are the offerors key personnel. Yes, resumes for proposed Key Personnel are required

(limited to two (2) pages per resume).

Q57. Please confirm that Times New Roman/Arial Narrow 8 point font is acceptable for tables, figures, graphics, and exhibits.

A. Yes, for tables, figures, graphics, and exhibits.

Q58. Please confirm that a list of tables, list of figures/exhibits, and the acronym list are excluded from the 20 page limit. In addition, please confirm that offerors are allowed to supply a

Cover Letter, excluded from the page count.

A. Cover pages, tables of contents, appendices, resumes, or the budget spreadsheets are not counted in the number of pages limitation.

Q59. Please confirm that offerors can provide a separate, standalone Past Performance volume inclusive of the requested information (e.g., Volume III - Past Performance), with no prescribed page limit. L.5 CDC0.L018 Past Performance Information (May 2020) pg. 74

A. Yes, but past performance should be submitted on no more than 4 pages.

Q60. Please confirm that the Government's intent is for Offerors to provide only three past performance citations, for either completed or on-going awards of similar scope/complexity, and not a comprehensive list of all current/active contract awards which would include contracts not relevant to this RFP. In order to provide the most relevant past performance, we respectfully recommend that the Government modify this language to "The Offeror should include 3 relevant contracts performed during the last 5 years"

A. Offeror only needs to provide three projects completed within the past three years ofsimilar scope, size, and complexity similar totherequirements described in the SOW.

Q61. Does the requirement for all proposed major subcontractors include "the last 3 contracts", "all contracts", or both? In order to provide the most relevant past performance, we respectfully recommend that the Government modify this language to "The Offeror should include 3 relevant contracts performed during the last 5 years" L.5 CDC0.L018 Past Performance Information

(May 2020) pg. 79

A. The three most recent and/or currentcontracts most relevant to the requirement listed in the

SOW.

Q62. What are the domains being referred to in this evaluation criteria language? M.1 Evaluation of Technical Proposals pg. 80

A. See amendment 1

Q63. Please explain if and how this requirement is applicable to the DSCT work.

A. Unable to answer this question because requirement is not specified.

Q64. Recommend that the Government modify Attachment 1 to reference the DSCT program rather than the SHEPheRD program. Attachment 1 - Past Performance Questionnaire Att 1

A.This is an error. See Amendment 1.