75D30126Q78929 Solicitation Dated 7.28.2026.pdf

75D30126R78929

Subject: Daily-Updated, Longitudinal, Patient-Level Electronic Health Record Data

Solicitation Number: 75D30126R78929

ISSUANCE DATE: 28 July 2026

QUESTIONS DUE DATE/TIME: NLT 3:00PM ET August 13, 2026

Response DUE Date/time: NLT 3:00PM ET August 13, 2026

Section A – Description

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in FAR RFO Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a separate written solicitation will not be issued.

Solicitation number 75D30126R78929 is issued as a Request for Proposal (RFP) for Daily- Updated, Longitudinal, Patient-Level Electronic Health Record Data.

This acquisition is conducted in accordance with FAR RFO Subpart 12.2. Pursuant to FAR RFO 12.201-2, because the estimated value of this acquisition exceeds $9 million, the procedures of FAR RFO Subpart 12.2 are used in conjunction with the procedures of FAR Part 15.

This solicitation incorporates provisions and clauses by reference. The full text of the referenced provisions and clauses may be accessed electronically at www.acquisition.gov.

The associated North American Industry Classification System (NAICS) code is 518210 – Data Processing, Hosting, and Related Services, with a size standard of $40 Million. The Product Service Code (PSC) is B506 – Special Studies/Analysis (Other than Scientific).

The Government intends to award a single Firm-Fixed-Price contract to the responsible Offeror whose proposal satisfies the Government's minimum requirements and represents the best value to the Government.

NOTICE OF INTENT TO AWARD A SOLE SOURCE CONTRACT

In accordance with FAR RFO 6.103-1, the Centers for Disease Control and Prevention (CDC) intends to award a contract on a sole-source basis to Truveta, Inc.

Based on the Government's market research, Request for Information responses, and the Justification for Other Than Full and Open Competition (JOFOC), the Government has determined that Truveta, Inc. is the only known responsible source currently capable of satisfying the Government's minimum requirements described in the Statement of Work.

The Government will consider all timely capability statements and proposals received from http://www.acquisition.gov/ responsible sources to determine whether another source can satisfy the Government's minimum requirements. Offerors other than Truveta, Inc. should clearly demonstrate in their capability statement and proposal how they satisfy each of the Government's minimum requirements identified in the Statement of Work.

If the Government determines that another responsible source can satisfy the Government's minimum requirements, the Government reserves the right to modify its acquisition strategy and conduct a competitive acquisition if determined to be in the Government's best interest.

RESPONSE INSTRUCTIONS

Interested parties wishing to demonstrate their capability to satisfy the Government's minimum requirements shall submit a capability statement no later than August 6, 2026, at 3:00 p.m.

Eastern Time.

Offerors wishing to submit a proposal shall submit proposals no later than August 13, 2026, at 3:00 p.m. Eastern Time.

Capability statements and proposals shall be submitted electronically to the Contracting Officer at the email address identified below.

The Government will evaluate all timely capability statements and proposals received in accordance with this solicitation. A determination that no other responsible source can satisfy the Government's minimum requirements, and the resulting decision not to compete this acquisition, is solely within the discretion of the Government.

POINT OF CONTACT

All questions concerning this solicitation and all capability statements and proposals shall be submitted in writing to:

Latoya Michel Contracting Officer Email: zrb5@cdc.gov

Telephone inquiries will not be accepted.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

CLINs 0001 and 0002 will be funded at time of award.

ITEM SUPPLIES / SERVICES QTY/UNIT UNIT

PRICE

EXTENDED

PRICE

0001 Data Subscription & Platform Access

Task 1: Includes 150 user licenses for continuous platform access, daily updates, monthly official data deliverables, metadata, and usage reports IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2026 - 08/31/2027

12 Months $ TBD $ TBD

0002 Training and Technical Support

Task 2: 120 hours of training and technical support.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2026 - 08/31/2027

1 Lot $ TBD $ TBD

0003 OPTION: Additional Platform Cloud Usage

Task 3: Purchase of additional cloud compute and storage units, available in up to five (5) blocks of 50,000 units each up to 250,000 total units. Billed monthly based on actual consumption IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2026 - 08/31/2027

5 Each $ TBD [Price per block of 50,000 units]

NOT TO

EXCEED

[5 x Unit Price]

0004 OPTION: Linked Closed Claim Data

Task 4: Linked claims data delivered initially within 1 month, monthly updates thereafter, IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2026 - 08/31/2027

1 Lot $ TBD $ TBD

0005 OPTION: Clinical Concept Codes

Task 5: Delivery of natural language processing (NLP) derived clinical concept codes within 3 months of option exercise, IAW the SOW.

Firm Fixed Price Line Item.

Delivery Date: To be delivered on or before – 08/31/2027

1 Lot $ TBD $ TBD

Option Period 1

1001 Data Subscription & Platform Access

Task 1: Includes 150 user licenses for continuous platform access, daily updates, monthly official data deliverables, metadata, and usage reports IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2027 - 08/31/2028

12 Months $ TBD $ TBD

1002 Training and Technical Support

Task 2: 120 hours of training and technical support.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2027 - 08/31/2028

1 Lot $ TBD $ TBD

1003 OPTION: Additional Platform Cloud Usage

Task 3: Purchase of additional cloud compute and storage units, available in up to five (5) blocks of 50,000 units each. Billed monthly based on actual consumption IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2027 - 08/31/2028

5 Each $ TBD [Price per block of 50,000 units]

NOT TO

EXCEED

[5 x Unit Price]

1004 OPTION: Linked Closed Claim Data

Task 4: Linked claims data delivered initially within 1 month, monthly updates thereafter, IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2027 - 08/31/2028

1 Lot $ TBD $ TBD

1005 OPTION: Clinical Concept Codes

Task 5: Delivery of NLP-derived clinical concept codes within 3 months of option exercise, IAW the SOW.

Firm Fixed Price Line Item.

Delivery Date: To be delivered on or before – 08/31/2028

1 Lot $ TBD $ TBD

Option Period 2

2001 Data Subscription & Platform Access

Task 1: Includes 150 user licenses for continuous platform access, daily updates, monthly official data deliverables, metadata, and usage reports IAW the SOW.

Fixed Price Line Item.

Period of Performance: 09/01/2028 - 08/31/2029

12 Months $ TBD $ TBD

2002 Training and Technical Support

Task 2: 120 hours of training and technical support.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2028 - 08/31/2029

2003 OPTION: Additional Platform Cloud Usage

Task 3: Purchase of additional cloud compute and storage units, available in up to five (5) blocks of 50,000 units each. Billed monthly based on actual consumption IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2028 - 08/31/2029

5 Each $ TBD [Price per block of 50,000 units]

NOT TO

EXCEED

[5 x Unit Price]

2004 OPTION: Linked Closed Claim Data

Task 4: Linked claims data delivered initially within 1 month, monthly updates thereafter, IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2028 - 08/31/2029

1 Lot $ TBD $ TBD

2005 OPTION: Clinical Concept Codes

Task 5: Delivery of NLP-derived clinical concept codes within 3 months of option exercise, IAW the SOW.

Firm Fixed Price Line Item.

Delivery Date: To be delivered on or before – 08/31/2029

1 Lot $ TBD $ TBD

Option Period 3

3001 Data Subscription & Platform Access

Task 1: Includes 150 user licenses for continuous platform access, daily updates, monthly official data deliverables, metadata, and usage reports IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2029 - 08/31/2030

12 Months $ TBD $ TBD

3002 Training and Technical Support

Task 2: 120 hours of training and technical support.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2029 - 08/31/2030

1 Lot $ TBD $ TBD

3003 OPTION: Additional Platform Cloud Usage

Task 3: Purchase of additional cloud compute and storage units, available in up to five (5) blocks of 50,000 units each. Billed monthly based on actual consumption IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2029 - 08/31/2030

5 Each $ TBD [Price per block of 50,000 units]

NOT TO

EXCEED

[5 x Unit Price]

3004 OPTION: Linked Closed Claim Data

Task 4: Linked claims data delivered initially within 1 month, monthly updates thereafter, IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/01/2029 - 08/31/2030

1 Lot $ TBD $ TBD

3005 OPTION: Clinical Concept Codes

Task 5: Delivery of NLP-derived clinical concept codes within 3 months of option exercise, IAW the SOW.

Firm Fixed Price Line Item.

Delivery Date: To be delivered on or before – 08/31/2030

B1. Total Contract Value Including (Base and All Options):

The total value for this Task Order, inclusive of the Base Period and all Option Periods, is set forth below. This section will be finalized and incorporated at the time of award based on the successful offeror's price proposal.

Summary of Pricing

Base Period (Funded) $ - Base Period (Unfunded) $ - Option Period 1 $ - Option Period 2 $ - Option Period 3 $ - Total: $ -

B.2 Option CLINs 1001-1005, 2001-2005 and 3001-3005 are Optional Priced Line Items, as described in FAR 52.217-5. Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s).

Section C - Description/Specification/Work Statement

Statement of Work

Title: Daily-updated, Longitudinal, Patient-level Electronic Health Record Data

SECTION 1 – BACKGROUND

The U.S. Centers for Disease Control and Prevention (CDC), Office of Public Health Data, Surveillance, and Technology (OPHDST) leads efforts to modernize public health data, surveillance, and informatics capabilities to ensure timely, accurate, and actionable information for public health decision-making. The CDC routinely uses electronic healthcare data to meet its public health mission. Healthcare data are used to inform situational awareness, predictive modeling, and strategic, tactical, and policy decision making;

to help track the spread and intensity of outbreaks and identify areas that are highly impacted by disease;

to understand spectrum of illness, disease burden, risk factors for severe disease, and outcomes; and to understand the impact public health threats on healthcare systems and communities.

Electronic health records (EHRs) are a critically important healthcare data source for the CDC because they provide timely, longitudinal, patient-level clinical information at local, state and national scale that is not routinely available through traditional surveillance systems. EHR data include rich clinical details such as granular diagnoses and procedures, lab tests and results, prescriptions, vital measurements, https://www.acquisition.gov/far/part-17#FAR_17_206 clinical notes, outcomes, and demographic characteristics that may not be available in other data sources such as administrative claims data. Unlike administrative claims data, EHR data are not contingent on the insurance status of the patient and can be available on a near–real-time basis. Near-real-time EHR data enable the CDC to monitor disease occurrence burden, health care utilization, outcomes, and disparities across diverse populations and geographies, supporting both routine public health surveillance and emergency response. Additionally, the longitudinal structure of EHR data allows the CDC to assess risk factors, treatment effectiveness and safety, and short- and long-term outcomes and to conduct robust epidemiologic analyses. Routine, ongoing access to high-quality, analysis-ready, EHR data substantially enhances the CDC’s ability to detect and respond to public health threats, understand disease epidemiology, and generate actionable, evidence-based insights that inform public health policy and practice.

The CDC Data Hub within OPHDST is a full-service enterprise resource connecting CDC staff and other authorized individuals with high-value healthcare data and technical and analytic support to generate actionable insights and inform public health action. CDC Data Hub helps ensure data security, governance, stewardship, and quality assurance; manages data onboarding and access permissions; and provides training, technical assistance, and data analysis and scientific support, including within CDC’s cloud-based data platforms. CDC Data Hub will manage the data and related resources obtained through this contract and serve as the primary liaison between the vendor and CDC staff using the data.

SECTION 2 – PURPOSE

The purpose of this contract is for CDC to obtain enterprise license and access to daily-updated, longitudinal, patient-level electronic health record (EHR) data that are analysis ready and immediately accessible to CDC staff via an integrated data and analytics platform. Specifically, CDC seeks to obtain access to patient-level EHR data that are very timely, daily-updated, and population-scale and capture detailed clinical information on the health and healthcare events of the U.S. population at local, state, and national levels. The data and platform shall meet the detailed requirements and functionality described in the SOW.

CDC requires immediate and ongoing access to very timely, daily-updated, population-scale EHR data to enable near–real-time monitoring of disease occurrence, health care utilization, and patient outcomes across population subgroups and geographies. These data are needed to support CDC’s routine public health surveillance, response to public health emergencies, and epidemiologic investigations and complex public health analyses at national, regional, state, and local levels.

SECTION 3 – SCOPE OF WORK

The Contractor shall provide up to 150 authorized CDC users (including federal employees, fellows, and authorized federal contractors) with access to daily-updated, longitudinal, patient-level Electronic Health Record (EHR) data, inclusive of all patient records from January 1, 2018 through current. The data must be very timely and population-scale, containing records for one-third of U.S. population since 2018 and 10% of U.S. population each year since 2021. The EHR data shall contain key demographic variables and a rich set of structured, coded clinical variables, including laboratory tests, vitals, medical and family history, prescriptions, diagnoses, procedures, and therapeutic outcomes, required for addressing public health questions. The data shall also include social determinants of health, deterministic mother–infant linkages, linked mortality data, and structured representations of clinical note extracts. The data shall be standardized, analysis ready, and immediately accessible via a secure, integrated data access and analytics platform, without CDC first having to build, normalize, host, or engineer the underlying data asset.

The Contractor’s platform shall be readily accessible to all authorized CDC users and scalable to support up to 150 CDC users with data access and analysis. Users shall have the ability to query, view, analyze, and export/download custom data subsets as needed to support Government research. The platform shall support advanced analytics with multiple programming languages and export of aggregate and line-level data tables and analytic results directly to CDC-owned platforms and environments. The Contractor shall provide CDC with up to 600,000 units of cloud storage and compute per 12-month period of performance.

The Contractor’s data shall include unique patient- and encounter-level identifiers within, and ideally across, health systems to enable patient-level longitudinal analyses. The data shall be record-level anonymized. CDC seeks to obtain the minimum data necessary to accomplish CDC’s public health mission. CDC does not seek and will not accept Personally Identifiable Information (PII) that directly identifies individuals, such as patient name, address, social security number or other identifying number or code, date and place of birth, telephone number, email address, or biometric records such as fingerprints. If PII is found within the data delivered to CDC, CDC will alert Contractor and users immediately and then request Contractor to scrub the data within their environment to eliminate the PII.

CDC will destroy any data containing PII.

While the primary master database will remain hosted on the Contractor's secure platform, the Contractor shall formally submit Monthly Data Usage reports to the COR as an official deliverable.

The Contractor’s data platform shall:

1. Provide up to 150 authorized CDC users with immediate access to required data and analytics capabilities, including up to 600,000 units of cloud compute and storage per 12-month period of performance.

2. Enable full and complete data access and analytics in one integrated environment that supports the use of supports use of SQL, Python, and the R statistical programming languages.

3. Provide the Government the ability to export and retain aggregate and line-level data tables, metadata, and associated documentation generated under this contract.

Requirements of the Contractor-provided data:

1. Standardized and analysis ready

2. Daily update of the entire data model (including all patient healthcare transactions from all data sources)

3. Very timely with a short lag (2-3 days) between data generation (patient transaction documented in the EHR) and data being available for analysis in the data platform.

4. Contain record-level data for all patients since January 1, 2018, with >120 million total unique patients (>33% of U.S. population) since 2018 and >35 million unique patients (>10% of the U.S.

population) per year since 2021

5. Contain a rich set of structured, coded clinical variables available in the EHR, such as laboratory tests, vitals, prescriptions, diagnoses, procedures, and therapeutic outcomes.

6. Contain key demographic variables, such as patient age, race, and ethnicity, at a granular level needed for public health analyses.

7. Contain geographic indicators based on patient place of residence at state, 3-digit ZIP code, and 5-digit ZIP code granularity.

8. Enable patient-level longitudinal analyses, including the analysis of mother-child pairs.

9. Be able to be linked at the patient-level to additional data sources, including closed medical and pharmacy claims, pharmacy dispensing, and social and economic indicators.

Training and Technical Support:

The Contractor shall also provide training and professional technical services relating to the data provided pursuant to this contract. Specifically, training shall encompass custom data access tools and/or analytical platforms to ensure CDC staff can effectively utilize the system.

SECTION 4 – TASKS TO BE PERFORMED

Task 1: Daily-updated electronic health record data access via secure analytic platform

The Contractor shall provide CDC with enterprise license for ongoing access to daily-updated, longitudinal, patient-level EHR data that are analysis ready and immediately accessible via a secure, integrated data access and analytics platform. The data and the platform shall meet the criteria in Section 3 – Scope of Work. The data shall include demographic data, structured clinical data, and structured representations of clinical note extracts from electronic health records, plus linked mortality and social determinants of health variables and mother-child linkages. All routine and ongoing enhancements to the Contractor’s underlying data and platform shall be included at no additional cost.

The Contractor shall make all data available to CDC users via the Contractor’s secure platform. The Contractor shall also provide the Government with official data deliverables in the form of aggregate and line-level data extracts exported or downloaded from the Contractor’s platform and delivered to CDC-owned or Government-approved platforms in accordance with CDC data receipt and storage requirements. Data extracts will be project-specific and determined by CDC authorized users, as needed, to fulfill their analytic study objectives. Contract deliverables include, but are not limited to, aggregate and line-level data extracts, reports, metadata, data dictionaries, documentation, and other deliverables required under this contract.

During each period of performance, the Contractor shall provide

A. Full access to the licensed data and platform for up to 150 CDC authorized users.

B. Up to 600,000 units of cloud storage and compute.

C. Metadata and data dictionaries, to be updated when changes to the data model occur.

D. Exports of aggregate and line-level data extracts from the Contractor’s platform as needed by

CDC authorized users to fulfill their analytic study objectives. Exports shall be in a format approved by the Government and delivered to Government-owned platforms and environments.

E. Monthly Data Usage Reports to include number and names of CDC users who accessed the platform, current monthly and cumulative cloud usage - overall and by user and project, other platform metrics including down time, if applicable.

F. Monthly Data Deliverable Reports to include a list of official data deliverables (i.e., aggregate and line-level data extracts exported or downloaded from the Contractor’s platform and delivered to CDC-owned or Government-approved platforms)

Task 2: Training/Technical Support

The Contractor shall provide CDC with 120 hours of technical support, office hours, consultation and training on the data and platform per 12-month contract period, to include the base year and each exercised option year. Training shall be presented live and shall be provided remotely (via video- or tele-conference). Training content shall be jointly determined by the Contractor and CDC at least 4-6 weeks in advance of the training date. Examples of training content include best practices for variables in the relational datasets, insight to understand inconsistencies in similar variables across datasets, and scenarios when one variable is preferable over another. As part of the training, the vendor shall provide user guides with multiple practical examples specifically for any custom software or language. The contractor shall provide technical support, including but not limited to assistance with use of the vendor platform interface; custom vendor software/language and notebooks/cloud and guidance on specific studies or projects, including cohort extraction, use of the vendor Common Data Model, and other technical tasks as requested by CDC users.

Optional Task 3: Additional Platform Cloud Usage

The Contractor shall provide authorized CDC authorized users with additional units of cloud compute and temporary analytical storage services within the Contractor’s platform on an as-needed basis to support active analyses and complex, high-volume data queries. This optional task will ensure CDC authorized users have sufficient cloud resources available on the Contractor’s platform to conduct priority public health analyses throughout the 12-month period of performance for the base period and each exercised option year.

This optional task may be exercised during the base period and/or any subsequent option period(s). For each 12-month performance period in which this option is exercised, the Government may purchase in units of 50,000 cloud compute/storage units up to a maximum of 250,000 additional cloud compute/storage units. Pricing for these units shall be established by the Contractor’s proposed unit rate and will be incrementally funded via the applicable Not-To-Exceed (NTE) Contract Line Item Number (CLIN) based on actual Government usage.

Optional Task 4: Linked Closed Claims Data

The Contractor shall provide CDC with license to third-party closed claims data that are linked to the daily-updated, longitudinal, electronic health record data and accessible to CDC authorized users via the integrated data access and analytics platform licensed in Task 1. The closed claims data shall be available for analysis in conjunction with the EHR data. As needed, data elements or variables from the linked closed claims data shall be available for export in aggregate or line-level data tables from the Contractor’s platform, as described in Task 1.

The closed claims data shall be inclusive of commercial, Medicare, and Medicaid medical and pharmacy claims; include enrollment data; be updated monthly; and be available for a minimum of 40% of patients in the Contractor’s data ecosystem. The closed claims data shall be of sufficient quality and utility to support high-quality health economics and outcomes research as well as providing complete view of patient healthcare utilization, outcomes, and costs across care settings, including settings outside of the Contractor’s data ecosystem.

Optional Task 5: Clinical Concept Codes from Unstructured Notes

The Contractor shall develop structured clinical concept codes that are extracted from unstructured clinical notes within patient medical records. Available note types shall include progress notes, nursing evaluations, procedure and operative reports, referral notes, discharge summaries, and imaging reports.

The Contractor shall collaborate closely with CDC SMEs to define specialized clinical concepts to be extracted using the Contractor’s natural language processing (NLP) model. As appropriate, the Contractor shall apply or adapt CDC-provided NLP codes and models.

The resulting structured clinical concept code(s) shall be linkable to the structured EHR data delivered in Task 1 via unique patient- and encounter-level identifiers. The clinical concept code(s) shall become fully integrated into and made available to CDC via the Contractor’s data and platform delivered in Task 1 such that the developed concept codes are updated daily and immediately available for analysis.

The clinical concept codes shall remain available to CDC for the duration of this contract including throughout any option periods. The Contractor shall also provide CDC with documentation of the methodology and NLP model used for code development; the documentation shall be sufficiently detailed to meet CDC standards for inclusion in official Government reports or peer-reviewed journal publications.

If exercised, the Contractor shall deliver the resulting structured clinical concept code(s) and documentation within three (3) months.

This optional task may be exercised during the base period and/or any subsequent option period(s). For each 12-month performance period in which this option is exercised, the Government may purchase in units of one (1) clinical concept code up to a maximum of four (4) clinical concept codes. Pricing for these units shall be incrementally funded via the applicable Not-To-Exceed (NTE) Contract Line Item Number (CLIN) based on actual Government usage.

SECTION 4 – DELIVERABLES/REPORTING SCHEDULE

Task Deliverable Quantity/Format Due Date Deliver To 1 Enterprise license to required data and platform with 600,000 cloud units

1 license and 600,000 cloud units / Electronically

Within 5 days of contract award.

COR and TM

1 Provisioning of up to 150 CDC authorized users on the platform

Electronically (Account setup/credentials)

Beginning within 5 days of contract award; continue as requested by

CDC.

COR and TM

1 Metadata and data dictionaries

Once and as needed / Electronically in agreed upon format

Within 10 days of contract award; as needed thereafter

COR and TM

1 Monthly Data Usage reports

Twelve (12) / Electronically in agreed upon format

Monthly;

beginning 30 days after contract award.

COR and TM

1 Monthly Data Deliverable reports

Twelve (12) / Electronically in agreed upon format

Monthly;

beginning 30 days after contract award

COR and TM

1 Exports of aggregate and line-level data extracts from the platform

As needed / Electronically to CDC-owned and government-approved platform

Beginning within 5 days of contract award; continue as needed by

CDC.

COR and

TM; CDC

authorized users

2 Training/Technical Support

120 hours / Live, remote sessions of technical support, office hours, consultation and training

To begin within 10 days of contract award;

specific times to be determined.

COR and TM

3 Optional: Access to Additional Platform Cloud Usage units

Up to 250,000 units purchased in increments of 50,000 units / Electronically via the Contractor’s platform

Within 2 days of exercising the optional task

COR and

TM; CDC

authorized users

4 Optional: Linked Closed Claim Data

Ongoing / Electronically via the Contractor’s platform

Within 1 month of exercising the optional task

COR and

TM; CDC

authorized users

5 Optional: Clinical Concept Codes

Up to four (4) codes purchased in increments one (1) code / Electronically via the Contractor’s platform.

Documentation delivered Electronically in agreed upon format

Within 3 months of exercising the optional task.

COR and

TM; CDC

authorized users

SECTION 5 – QUALITY ASSURANCE PLAN

Performance Objective

Performance Standard

Acceptable Quality Level

(AQL)

Surveillance Method

Incentive/Disincentive

Task 1: Data & Platform Access

1a. Platform Accessibility: The contractor's data and analytics platform must be available to up to 150 CDC users.

The platform must maintain a documented uptime of 95% or greater each month, excluding scheduled maintenance.

COR and TM will monitor platform accessibility.

Review of CDC user complaints.

Favorable or unfavorable performance evaluation in CPARS.- Performance is considered in determining whether to exercise the option period.

1b. Data Timeliness: EHR data available on the platform must be updated daily with a minimal lag of 2-3 days between a patient transaction and its availability for analysis.

95% of records available on the platform must meet the 2-3 day lag requirement each month. The monthly official data deliverable must be provided by the due date.

COR and TM will conduct periodic checks on data lag.- Monitor delivery dates of the official data extracts.

Favorable or unfavorable performance evaluation in CPARS.- Invoice payments are contingent upon receipt and acceptance of deliverables.

1c. Data Completeness & Quality: The licensed data must be complete, standardized, analysis-ready, and contain all required variables as defined in the SOW and data dictionary, including >120 million unique patients since 2018.

95% of required data fields must be present and conform to the data dictionary standards. No more than a 5% deviation in the total unique patient count.

COR and TM will review and accept each monthly data deliverable.- Automated data quality checks and validation against the data dictionary.

Favorable or unfavorable performance evaluation in CPARS.

Task 2:

Training & Technical Support

The contractor shall provide 120 hours of high-quality technical support, training, and consultation per contract period.

Not more than two

(2) documented and validated user complaints regarding the quality or timeliness of support within any 30-day period.

COR and TM will track support hours used.- Document and investigate any CDC user complaints.

Favorable or unfavorable performance evaluation in CPARS.- Invoice payments are executed after COR review.

Optional Tasks 3-5:

Optional Deliverables

All optional tasks, if exercised, must be executed and delivered in full accordance with the requirements defined in the

SOW.

100% compliance with the deliverable timeline and content requirements specified for each exercised optional task (e.g., claims data linked to >40% of patients;

clinical concept codes delivered within 3 months).

COR and Technical Monitor will review and formally accept each optional deliverable against the

SOW

requirements.

Favorable or unfavorable performance evaluation in CPARS.

SUBSECTION A – PERFORMANCE MATRIX

The COR will be responsible for the oversight of the QASP. The Technical Monitor will provide day-to-day assistance with the performance of specific tasks and will provide input to the COR of the Contractor’s performance in the tasks for which they monitor.

Desired Outcome

Required Service

SLA

Performance

Standards (Completeness, Reliability, Timeliness)

Acceptable Quality Levels

(AQLs)

Monitoring Method

Incentives/ Disincentives

(Task 1) Access to timely, complete, and high-quality data via a reliable platform.

Provide continuous access to the data platform and deliver data extracts as needed.

Platform has ≥95% uptime.

Data has 2-3 day lag from transaction.

Data extracts are complete and accurate.

≥95% platform uptime. 95% of records meet timeliness standard.

95% data completeness per data dictionary.

COR/TM

review of uptime logs and user feedback.

Periodic validation of data timeliness.

Review and acceptance of monthly data deliverables.

Favorable/Unfavorable CPARS Evaluation.

Payment is tied to acceptance of deliverables.

(Task 2) CDC staff are effectively trained and supported.

Provide 120 hours of technical support, training, and consultation.

High-quality, timely support that meets user needs.

Fewer than two (2) validated user complaints per 30-day period.

COR/TM

tracking of support hours.

Review of CDC user feedback and

Favorable/Unfavorable CPARS Evaluation.

Invoice payments are executed after COR review.

any formal complaints.

(Optional Tasks 3-5) Optional requirements are delivered successfully.

Execute and deliver optional tasks if exercised per SOW.

Deliverables meet all requirements for content and timeliness defined in the

SOW.

100% compliance with the specific requirements and delivery timelines for each exercised optional task.

COR and Technical Monitor will conduct a formal review and acceptance of each optional deliverable.

Favorable/Unfavorable CPARS Evaluation.

SECTION 6 – ADDITIONAL REQUIREMENTS

Information Security and Privacy

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission.

In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less after it is determined that a threat or hazard exists, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality (Low, Moderate, High)

Integrity

High)

Availability

High)

Security Objectives Impact Level:

(NIST SP 800-60)

Moderate Moderate Moderate

Security Objectives Impact Level: (If System/Information Owner need to downgraded / upgraded risk)

Overall Impact Level (Low, Moderate, High)

Moderate Moderate Moderate

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: N/A [ ] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed.

Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by HHS or collected by the Contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor.

Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC

Office of Chief Information Security Officer (OCISO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training (RBT) within 60 days of assuming their new responsibilities. Thereafter, they shall complete RBT at least annually in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

All HHS employees and Contractors with SSR who have not completed the required training within the mandated timeframes shall have their user accounts disabled until they have met their RBT requirement.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Security Awareness Training. If the training is provided by the Contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act

(FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an “other than” authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or…