75D301-25-Q-78553 - Retinal Image Svcs.pdf

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Federal Acquisition Requirements (FAR) Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; quotes are being requested, and a written solicitation will not be issued.

The solicitation number is 75D301-25-Q-78553 and is issued as a Request for Quote (RFQ) using FAR Part 12 in conjunction with FAR 13.5. The RFQ and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2025-01 (11/12/2024). The NAICS code is 621512 with a size standard of $19M in annual revenue.

The Centers for Disease Control and Prevention (CDC) intends to award an indefinite-delivery, indefinite-quantity (IDIQ) with a firm fixed pricing arrangement for the following requirement with a one-year base period; three, one-year, optional periods; and a fourth optional six-month close-out period. Please either fill in the dollar amounts for each contract line item number (CLIN) below, or replicate in your Price Quote (MS Word or separate Excel spreadsheet).

Section A. Line Items/Ordering

Base Period – 12 Months

ITEM SUPPLIES / SERVICES QUANTITY /

UNIT

UNIT

PRICE

EXTENDED

PRICE

0001 Develop Grading and Quality Control Protocol in accordance with (IAW) the Statement of Work (SOW) Firm Fixed Price / Non-Severable Services Period of Performance: 1/1/2025 – 12/31/2025

MIN: 0 Each MAX: 1 Each

0002 Retinal Image screening (per person) IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2025 – 12/31/2025

MIN: 0 Each MAX: 2,200 Each

0003 Review of Ophthalmology Procedure Manual per SOW Firm Fixed Price / Non-Severable Services Period of Performance: 1/1/2025 – 12/31/2025

MIN: 0 Each MAX: 1 Each

0004 Project Management IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2025 – 12/31/2025

MIN: 0 Job MAX: 1 Job

0005 Macula centered and widefield fundus photography grading (per person) IAW the SOW Firm Fixed Price / Severable Services

MIN: 0 Each MAX: 2,200 Each

Period of Performance: 1/1/2025 – 12/31/2025

0006 Macula centered and widefield optical coherence tomography (OCT) grading (per person) IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2025 – 12/31/2025

Total for Base Period ____________

Option Period One – 12 Months

ITEM SUPPLIES / SERVICES QUANTITY /

UNIT

UNIT

PRICE

EXTENDED

PRICE

1001 Retinal Image screening (per person) IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2026 – 12/31/2026

MIN: 0 Each MAX: 2,200 Each

1002 Project Management IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2026 – 12/31/2026

MIN: 0 Job MAX: 1 Job

1003 Macula centered and widefield fundus photography grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2026 – 12/31/2026

MIN: 0 Each MAX: 2,200 Each

1004 Macula centered and widefield optical coherence tomography (OCT) grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2026 – 12/31/2026

Total for Opt. Pd. One ____________

Option Period Two – 12 Months

UNIT

UNIT

PRICE

EXTENDED

PRICE

2001 Retinal Image screening (per person) IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2027 – 12/31/2027

MIN: 0 Each MAX: 2,200 Each

2002 Project Management IAW the SOW Firm Fixed Price / Severable Services

MIN: 0 Job MAX: 1 Job

Period of Performance: 1/1/2027 – 12/31/2027

2003 Macula centered and widefield fundus photography grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2027 – 12/31/2027

MIN: 0 Each MAX: 2,200 Each

2004 Macula centered and widefield optical coherence tomography (OCT) grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2027 – 12/31/2027

Total for Opt. Pd. Two ____________

Option Period Three – 12 Months

UNIT

UNIT

PRICE

EXTENDED

PRICE

3001 Retinal Image screening (per person) IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2028 – 12/31/2028

MIN: 0 Each MAX: 2,200 Each

3002 Project Management IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2028 – 12/31/2028

MIN: 0 Job MAX: 1 Job

3003 Macula centered and widefield fundus photography grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2028 – 12/31/2028

MIN: 0 Each MAX: 2,200 Each

3004 Macula centered and widefield optical coherence tomography (OCT) grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2028 – 12/31/2028

Total for Opt. Pd. Three ____________

Option Period Four [Close-out] – 6 Months

UNIT

UNIT

PRICE

EXTENDED

PRICE

4001 Retinal Image screening (per person) IAW the SOW

MAX: 220 Each

Firm Fixed Price / Severable Services Period of Performance: 1/1/2029 – 6/30/2029

4002 Project Management IAW the SOW Firm Fixed Price / Severable Services Period of Performance: 1/1/2029 – 6/30/2029

MIN: 0 Job MAX: 1 Job

4003 Macula centered and widefield fundus photography grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/2029 – 6/30/2029

MIN: 0 Each MAX: 220 Each

4004 Macula centered and widefield optical coherence tomography (OCT) grading (per person) Firm Fixed Price / Severable Services Period of Performance: 1/1/1/2029 – 6/30/2029

MAX: 220 Each

Total for Opt. Pd. Four ____________

Total max. price for base and all option periods _____________

Type of Contract/Ordering Indefinite-delivery indefinite-quantity (IDIQ) contract for commercial services. Fixed-priced individual task orders will be issued.

The Contracting Officer (CO) is the only individual authorized to issue task orders under the contract. The Contractor shall not commence work until a task order or other written notification for a specific assignment is issued by the CO. The government is not obligated to reimburse the Contractor for any costs that it incurs before issuance of a task order or other written notification by the Contracting Officer.

Minimum Guarantee This IDIQ contract guarantees that task order(s) amounting to a minimum of $10,000 will be issued during the first 12 months of the contract period of performance. In the event the Contractor receives obligations of less than this minimum during the first 12 months, the Government will fund the difference between the actual obligation and the guaranteed minimum.

Once a task order is issued for $10,000.00 or more in the first 12 months of the period of performance, the Government has satisfied its minimum guarantee.

Maximum Contract Value The aggregate maximum value of all combined awards made under this IDIQ contract is estimated to not exceed $TBD. If the government's requirements for services set forth in the solicitation do not result in orders in the amounts described as “maximum," the event shall not constitute the basis for an equitable price adjustment under this contract.

Quote Submittal Instructions/Evaluation - Please see Section D on pp. 52 - 57.

Section B. Statement of Work (SOW)

Grading of Retinal Images by a Reading Center for the National Health and Nutrition Examination Survey

SECTION 1 – BACKGROUND

The National Health and Nutrition Examination Survey (NHANES), administered by the National Center for Health Statistics (NCHS), collects information on the health of the civilian, noninstitutionalized U.S. population. The NHANES survey includes interviews in respondents’ homes and laboratory assessments, physical examinations, and private interviews in mobile examination centers (MECs). The MECs are owned by the federal government and staffed by a data collection contractor under a separate contractual agreement. The NHANES results produce data that is representative of the diversity of the US population and provides the ability to link measured vision and eye health data with hundreds of variables on demographics, nutrition, physical activity, physical functioning, other health conditions, and mental health.

NCHS is undergoing a re-design of NHANES in 2025. The survey includes a household interview and health examination of approximately 5,000 sample persons of all ages per year. The 2025-2026 NHANES vision and ophthalmology exam aims to collect data to assess the burden of visual impairment, and the major eye conditions through a comprehensive set of vision exams (i.e., visual acuity, and objective auto-refraction), ophthalmic imaging tests, and participant-reported outcomes. Retinal images were last obtained in the 2007-2008 NHANES.

Trained technicians will obtain non-mydriatic fundus photography and optical coherence tomography (OCT) images. The reading center Contractor’s trained graders shall evaluate the fundus photo and OCT images for retinal features (abnormalities), and grading of eye conditions by using standardized grading protocols. The proposed grading shall build upon what was done in the 2005-2008 NHANES, and the resulting variables produced while considering current imaging and grading methods and technology. Images and data shall be accessed on a laptop via a secure electronic environment. The laptop and secure enclave will be provided by the NHANES data collection contractor [Research Triangle Institute (RTI)].

Data collection for the 2025-2028 survey will begin in January 2025 and conclude in December 2028. Images from approximately 2,200 individuals aged 45 and over, and 18-44, who report having diabetes are expected to be obtained per year. This contract shall cover the identification of retinal features (abnormalities) and grading of digital images of the retina collected during the 2025 to 2028 data collection period.

SECTION 2 – PURPOSE/OBJECTIVE

The purpose of this IDIQ with firm fixed price orders is to conduct standardized gradings of digital retinal images obtained in 2025 through 2028. The IDIQ will contain a base period, three one-year option periods, and one six month close out period. At the MEC, trained technicians will scan both eyes using the Topcon Maestro2 camera. The scans will capture fundus photograph and optical coherence tomography (OCT) images, including wide field, that include the macula https://www.cdc.gov/nchs/data/nhanes/nhanes_05_06/NHANES_ophthamology_digital_grading_protocol.pdf https://wwwn.cdc.gov/Nchs/Nhanes/2007-2008/OPXRET_E.htm and optic nerve. The technicians are employees of the NCHS data collection contractor who will assist with technician training for the ophthalmology component, and monitoring of technician performance in the field. The data collection contractor shall provide access to electronic files containing digital retina images within a secure environment to the Contractor for evaluation. The Contractor’s graders shall manually evaluate fundus photographs and OCT images for retinal features (abnormalities) and grading of eye conditions including diabetic retinopathy, age-related macular degeneration, diabetic macular edema, myopic degeneration, glaucoma, and other retinal conditions listed in Attachment 1. The retinal images are considered sensitive personally identifiable participant information (PII) and are required to remain within an approved NHANES security accreditation boundary at all times. The government, via the current NHANES data collection contractor (RTI), will provide a secure enclave within the accreditation boundary which shall not have Internet access. The Contractor shall access the retinal images, grade the images, and provide results through a secure channel on the laptop(s) provided by the data collection contractor within an agreed upon time frame. Standardized grading procedures shall be followed by the graders.

SECTION 3 – SCOPE OF WORK

This contract shall provide evaluation of retinal images and quality control review for the NHANES Ophthalmology component. The reading center Contractor shall perform the following tasks –

1. All work completed under this contract shall be performed within the United States.

2. All information processing shall occur on hosts/devices that comply with approved baseline configurations as this project and its IT component are part of the NHANES Security Authorization boundary. As needed, the Contract shall work with the Contracting Officer’s Representative (COR), the NHANES Business and Security Stewards, and the NHANES data collection contractor to ensure this occurs.

3. Develop a document to describe in detail the protocol, procedures, and quality control measures for manual grading of fundus photos and OCT images, including checks for inter- and intra-variability in grading of images. The protocol shall build upon what was done in the 2005-2008 NHANES, and the resulting variables produced, while considering current imaging and grading methods and technology.

The document shall be delivered to NCHS during the base period.

4. Access and grade high-resolution fundus photographs and OCT images in a secure enclave within the approved NHANES accreditation boundary. The images shall be in a mutually agreeable format to both the government and the reading center contractor. The data files of graded results shall be posted in the same environment.

The images shall be available for grading at minimum, on a weekly basis. Image files shall include a participant identification, and exclude personal information such as participant age and sex. The images inherently have sensitive Personally Identifiable Information (PII) and Personal Health Information (PHI).

5. Review 100% of fundus photos and OCT images for gradability.

6. All images shall be evaluated by experienced graders. Should the grading protocol https://www.cdc.gov/nchs/data/nhanes/nhanes_05_06/NHANES_ophthamology_digital_grading_protocol.pdf include more than one grader to evaluate the images and there is disagreement between the graders, an adjudicator shall make a final decision.

7. Keep a log or spreadsheet of retinal images received. Update the retinal image log to include specified analytic results (to be included in a Report of Findings sent by the Government to survey participants), detailed image quality information, and quality assurance/quality control measures performed.

8. The government, via the data collection contractor will provide a secure enclave within the approved NHANES accreditation boundary. The Contractor is required to work with the data collection contractor on the following –

a. Obtain credentials for multi-factor authentication to access the secure enclave environment.

b. Obtain laptops from the NHANES data collection contractor that meet the

CDC/NCHS requirements for accessing the secure enclave environment.

c. Install any special software required to analyze the images. Any licensing and other costs for the software shall be borne by the reading center Contractor. Note that the software has to be self-contained as it shall not be able to access the Internet from within the secure enclave.

d. Work within the secure enclave to perform the image analyses.

e. Provide the results via the RTI-hosted information resources that are part of the

NHANES security accreditation boundary, or some other solution approved by NCHS security officials (e.g., ISSO) within 20 days of accessing the images. The secure enclave where the reading center shall post data will be provided by the NHANES data collection contractor.

The Contractor is not allowed to copy the images to any location. The NHANES retinal image files and related data shall remain in the provided secure enclave within the accreditation boundary at all times.

NHANES 2025-2026 is the first two-year cycle for grading digital images for participants 45 years and older, and 18-44, with self-reported diabetes. Depending on available funds, 2027-2028 is the second two-year cycle for grading digital images for participants 45 years and older, and 18-44, with self-reported diabetes.

The following table summarizes the number of digital images to be obtained and graded.

Analysis Estimated Number of Participants Per Year

01/01/2025-12/31/2025 2200

01/01/2026-12/31/2026 2200

01/01/2027-12/31/2027 2200

01/01/2028-12/31/2028 2200

01/01/2029-06/30/2029 220

Note: Images per eye include fundus photos and OCT images, including widefield, that include the macula and optic nerve; will allow retakes if image is of poor quality.

SECTION 4 – TASKS TO BE PERFORMED (SPECIFIC REQUIREMENTS FOR

GRADING OF RETINAL IMAGES)

Task 1 (Base Period) Technical Services. To grade the retinal and OCT images, the Contractor shall:

1. Review protocols developed by NCHS and the data collection contractor for the acquisition of fundus photography and OCT images from NHANES examinees in the MEC. Recommendations for changes shall be made to the NCHS Project Officer in writing within six-weeks after contract award in accordance with the instructions in Section 8.

2. Grading Protocol. Prepare a grading protocol that includes detailed information on the criteria that shall be used to grade fundus photographs and OCT images and which builds upon what was done in 2005-2008 NHANES and the resulting variables produced while considering current imaging and grading methods and technology.

Describe in the grading protocol that data quality shall be maximized, and data loss minimized by adhering to quality control procedures. At minimum, the grading protocol shall include the following:

a. Criteria to determine whether images are gradable.

b. Criteria used to determine retinal features (abnormalities); and to determine the grading of eye conditions.

c. Adjudication procedures to determine the presence of pathology when more than one grader disagrees, if applicable.

d. Quality control procedures, including checks for inter and intra-variability in grading of images.

3. Create a data dictionary of variables including retinal features (abnormalities), and eye conditions associated with the graded images.

Task 2 (all periods): Access electronic files with fundus photos and OCT images in the secure enclave within the NHANES accreditation boundary, as described in Sections 2 and 3. Images may be made available to the Contractor on a rolling basis, one to three times per week. Using https://www.cdc.gov/nchs/data/nhanes/nhanes_05_06/NHANES_ophthamology_digital_grading_protocol.pdf the criteria outlined in the grading protocol, grade the fundus photos and OCT images of all survey participants using current grading technology and equipment.

Task 3 (all periods): Post the grading results including retinal features (abnormalities) and eye conditions in the provided secure enclave of the accreditation boundary within 20 days following receipt of the images. Grading results shall be provided in a format mutually agreeable to the reading center contractor and NCHS, such as Excel.

1. Indicate retinal features (abnormalities) and grade of eye conditions.

2. Indicate if the image was ungradable.

Task 4 (all periods): The Contractor shall submit a quarterly status report, in electronic format, to the COR no later than 15 days from the end of each quarter. At a minimum the report shall include the following information from the preceding three months:

• The status of all scans and quality control measures.

• A description of any major problems encountered and what was done to overcome them. Problems that appear to be recurrent in nature shall be noted.

• The number of scans accepted, reanalyzed, or rejected based on the expert review.

• A summary of the performance of the NHANES health technicians who administered the scans in the MECs and recommendations for performance improvement, as well as any other suggestions for improving scan acquisition in the MECs.

• A summary of the results of QC analyses and recommendations for corrective action.

Appropriate tables, plots and graphs to be included in the report will be developed in collaboration with the COR.

Task 5 (all periods): The Contractor shall keep up with emerging grading technology and software, and medical updates related to eye pathology.

The Contractor shall not update, or change, the technology or software used to grade images without prior approval from NCHS.

SECTION 5 – GOVERNMENT FURNISHED PROPERTY

Fundus photos and OCT images obtained for NHANES shall be accessed and graded via the RTI-hosted NHANES accreditation boundary. All required staffing, permits, and licenses necessary to perform the contract are the responsibility of the reading center Contractor. The Contractor shall use laptops furnished by the data collection contractor (RTI) to access and grade images, and to post the results.

SECTION 6 – PLACE and PERIOD OF PERFORMANCE The retinal images shall be graded at the Contractor’s facility, or an approved location within the U.S., on a computer provided by the data collection contractor (RTI). The graders are not allowed to access the images from outside of the U.S. or non-approved locations such as hotel lobbies, cafes, restaurants, public places, etc. as detailed in the designated agent agreement (DAA).

Confidential NCHS data shall always be secured from unauthorized access. When not in use, the computer shall be shut down and its power-on password enabled. The computer room shall be secure during business hours and locked after close of business. No images, data, or other files related to the study shall be saved externally.

Anticipated Period of performance is January 1, 2025 to June 30, 2029 Base Period: January 1, 2025 to December 31, 2025 Option Period One: January 1, 2026 to December 31, 2026 Option Period Two: January 1, 2027 to December 31, 2027 Option Period Three: January 1, 2028 to December 31, 2028 Close-out Period: January 1, 2029 to June 30, 2029

SECTION 7 – TRAVEL

No Travel will be required under the contract.

SECTION 8 – DELIVERABLES/REPORTING SCHEDULE

Task(s)/Deliverable Quantity/Format Due Date Delivery / Surveillance

1.2. The contractor shall

submit a grading protocol for evaluation of retinal images.

Procedures manual in Word format

No later than 2 months after contract award

Review of procedures manual by the COR

1.3. Data Dictionary

of Variables

Word Within 30-days of contract award

Review by COR

2 & 3. The contractor shall review the gradability of retinal images and provide in a report via the secure enclave.

Every image shall be assessed for gradability/gradability variable in Excel

Within 20 days of receipt of image.

The contractor shall provide a report with the grading results.

Review by the COR and data collection contractor

4. The contractor shall submit quarterly status reports via the secure enclave.

Word No later than 15 days after the quarterly reporting period

Review of report by the COR

SECTION 9 – MINIMUM CONTRACTOR QUALIFICATIONS

All required staffing, services, permits, and licenses necessary to perform the contract shall be provided by the reading center contractor. The Contractor shall use laptops provided by the data collection contractor (i.e., RTI who will handle all IT operations and security compliance) to access and grade images, and to post the results to the data collection contractor. All information processing shall occur within the RTI-hosted accreditation boundary via compliant hosts/devices issued by RTI. No information processing is permitted to occur on unapproved devices in accordance with the DAA for this project (e.g., taking screen shots of information, or printing/transposing of information is not permitted). See the DAA for further details.

The Contractor shall be able to receive and analyze minimum images for 45 survey participants per week, and report results within 20 days of date of receipt.

The Contractor shall have experience grading fundus photos and OCT images for a broad range of retinal features (abnormalities) and eye conditions including those listed in Attachment 1. Fundus photography and OCT images shall be evaluated by trained, certified, and experienced staff.

Personnel without an advanced degree in ophthalmology shall work under the supervision of at least one Ophthalmologist.

The reading center shall demonstrate the use of current technology and software to grade NHANES fundus photography and OCT images.

The Contractor shall be aware that the retinal images, as inherently sensitive PII and Personal Health Information (PHI), shall remain within an approved NHANES security accreditation boundary at all times.

The government, via the current NHANES data collection contractor (RTI), will provide a secure enclave within the approved accreditation boundary which shall not have internet access. This shall require the reading center contractor to work with NHANES data collection contractor on the following –

a. Obtain credentials for multi-factor authentication to access the secure enclave environment.

b. Obtain laptops from the NHANES data collection contractor that meet CDC/NCHS requirements to access the secure enclave.

c. Install any special software required to analyze the retinal images. Any licensing and other costs for the software shall be borne by the reading center Contractor. Note that the software must be self-contained as it shall not be able to access the Internet from within the secure enclave.

d. Work within the secure enclave to perform analyses of the images.

e. Provide the results via RTI-hosted information resources that are part of the NHANES accreditation boundary, or some other solution approved by NCHS security officials (e.g., ISSO). The secure enclave where the Contractor shall post data will be provided by the NHANES data collection contractor.

SECTION 10 – ADDITIONAL REQUIREMENTS

Information Security and Privacy

1.1 Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the NCHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart

2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

1.2 Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

1.3 Information Security Categorization.

In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-122, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ X ] Moderate [ ] High

Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ ] Low [ X ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [ X ] Yes PII

PII Confidentiality Impact Level has been determined to be: [ ] Low [X] Moderate [ ] High

1.4 Personally Identifiable Information (PII).

Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

1.5 Controlled Unclassified Information (CUI).

CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.”

81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

d. returned to NHCS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

1.6 Protection of Sensitive Information.

For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-3 validated solution.

1.7 Confidentiality and Nondisclosure of Information.

Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

1.8 Internet Protocol Version 6 (IPv6)

All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

1.9 Government Websites

All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended. As per CDC Policy, CDC-IR-2008-01, the use of non-CDC.GOV domain names is prohibited.

1.10 Section 508 Compliance

The Section 508 accessibility standards applicable to this contract are as follows.

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

The vendor shall comply with all requirements of HHSAR 352.239-79, Information and Communication Technology Accessibility.

1.11 Contract Documentation

The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

1.12 Standard for Encryption

The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, PHI),

c. proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-3 validated encryption solution.

d. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

e. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

f. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Officer (OCIO).

1.13 Training

1.13.1 Mandatory Training for All Contractor Staff

All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC/NCHS Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC specific Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract.

All provided training shall be compliant with HHS training policies.

1.13.2 Role-based Training

All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. All HHS employees and Contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

1.13.3 Training Records

The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

1.14 Rules of Behavior

a. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the Contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

1.15 Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states:

Definition of an Incident: An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for another use rather than the authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

a. The Contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

b. All Contractors and subcontractors shall properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies, including CDC-specific policies, and comply with HHS-specific policies for protecting PII. To this end, all Contractors and subcontractors shall protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

c. All Contractors and subcontractors shall participate in regular training on how to identify and report a breach.

d. All Contractors and subcontractors shall report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC and incident management policy, and United States Computer Emergency Readiness Team (US-CERT) notification guidelines. To this end, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise

(IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC Computer Incident Response Team (CSIRT) within 24 hours via email at csirt@cdc.gov or telephone at 866-655-2245, whether the response is positive or negative.

e. All Contractors and subcontractors shall be able to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector.

f. All Contractors and subcontractors shall allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with HHS/CDC Policy and the HHS/CDC Breach Response Plan and to assist with responding to a breach.

g. Cloud service providers shall use guidance provided in the FedRAMP Incident Communications Procedures when deciding when to report directly to US-CERT first or notify CDC first.

h. Identify roles and responsibilities, in accordance with HHS/CDC Breach Response Policy and the HHS/CDC Breach Response Plan. To this end, the Contractor shall NOT notify affected individuals unless and until so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, all notifications must be pre-approved by the appropriate CDC officials, consistent with HHS/CDC Breach Response Plan, and the Contractor shall then send CDC- approved notifications to affected individuals; and, Acknowledge that CDC will not interpret report of a breach, by itself, as conclusive evidence that the Contractor or its subcontractor failed to provide adequate safeguards for PII.

1.16 Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). As such, the following position sensitivity designations apply unless otherwise adjusted by the COR with a risk-based decision accepted by the NCHS Information Systems Security Officer and the Contract Officer.

Sensitive / High Risk Positions – Level 6 or Higher is required for all Contractor (and/or any subcontractor) employees with elevated privileges (e.g. logical/physical systems access privileges that exceed ordinary/routine access or use), such as:

• system administrators;

• database administrators;

• system developers;

• staff with duties that involve physical/logical control and/or protection of information technology systems that process high, moderate, or low US Government information; or similar as determined by the COR, ISSO, and CO.

Sensitive / Moderate Risk Positions – Public Trust Level 5 or Higher is required for all Contractor (and/or any subcontractor) employees who, as part of their duties, are exposed to or handle sensitive US Government information (e.g. PII, Procurement Information, information subject to NDA, Controlled Unclassified Information (CUI)…) in any format (e.g. Audio, Electronic, Printed…) An HSPD-12/PIV card is required for all Contractor (and/or any subcontractor) employees who require unescorted, regular physical access to CDC facilities, and/or require access to the CDC enterprise network / PIV-enabled IT systems to carry out their job duties.

A favorable National Agency Check is the minimum investigation required for this contract for all Contractor (and/or any subcontractor) employees whose positions are not considered Sensitive / High Risk, Sensitive / Moderate Risk or require HSPD-12/PIV cards.

1.17 Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2. For additional information, see HSPD-12 policy at:

https://www.dhs.gov/homeland-security-presidential-directive-12)

1.18 Roster

The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within the 7 days of Specified timeline of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 7 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

Section C. Clauses/Provisions [Addendum to FAR 52.212-4 Contract Terms and Conditions—Commercial Products and Commercial Services (Nov 2023)]

FAR 52.252-2 Clauses Incorporated by Reference (Feb 1998) This contract incorporates one or more clauses by reference [see below list], with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The full text of a clause may be accessed electronically at the following URLs

– https://www.acquisition.gov/browse/index/far, http://www.hhs.gov/policies/hhsar/subpart301- 1.html

(End of Clause) https://www.acquisition.gov/browse/index/far http://www.hhs.gov/policies/hhsar/subpart301-1.html http://www.hhs.gov/policies/hhsar/subpart301-1.html

CLAUSE TITLE AND DATE

52.203-3 Gratuities (Apr 1984) 52.203-12 Limitation on Payments to Influence Certain Federal Transactions (Jun 2020)

52.204-13 System for Award Management Maintenance (Oct 2018) 52.204-18 Commercial and Government Entity Code Maintenance (Aug 2020) 52.212-4 52.224-1 52.224-2

Contract Terms and Conditions- Commercial Items (Nov 2023) Privacy Act Notification (Apr 1984) Privacy Act (Apr 1984)

52.227-14 52.232-39 52.242-15 52.245-1 52.246-4 352.222-70

352.270-4 b

Rights in Data-General (May 2014) Unenforceability of Unauthorized Obligations (Jun 2013) Stop-Work Order (Aug 1989) Government Property (Sep 2021) Inspection of Services--Fixed-Price (Aug 1996) Contractor Cooperation in Equal Employment Opportunity Investigations (Dec 2015) Protection of Human Subjects (Dec 2015)

Clauses Incorporated in Full Text

FAR 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders- Commercial Products and Commercial Services (Nov 2024)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial products and commercial services:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (Jan 2017) (section 743 of Division E,…