75D30126Q79192

Subject: Comprehensive Encounter-level Inpatient and Hospital-based Outpatient Billing and Chargemaster Database for Addressing Public Health Priorities

Solicitation Number: 75D30126Q79192

ISSUANCE DATE: August 11, 2026

Response DUE Date/time: NLT 3:00PM ET August 26, 2026

Section A – Description

This is a combined synopsis/solicitation for commercial services prepared in accordance with the format in FAR RFO Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation;

proposals are being requested and a separate written solicitation will not be issued.

Solicitation number 75D30126Q79192 is issued as a Request for Quote (RFQ) for Comprehensive Encounter-level Inpatient and Hospital-based Outpatient Billing and Chargemaster Database for Addressing Public Health Priorities.

This acquisition is conducted in accordance with FAR Part 12 and FAR Part 13.5 (Simplified Procedures for Certain Commercial Items), as applicable.

This solicitation incorporates provisions and clauses by reference. The full text of the referenced provisions and clauses may be accessed electronically at www.acquisition.gov.

The associated North American Industry Classification System (NAICS) code is 518210 – Data Processing, Hosting, and Related Services, with a size standard of $40 Million. The Product Service Code (PSC) is B506 – Special Studies/Analysis (Other than Scientific).

The Government intends to award a single Firm-Fixed-Price contract to the responsible Offeror whose proposal satisfies the Government's minimum requirements and represents the best value to the Government.

NOTICE OF INTENT TO AWARD A SOLE SOURCE CONTRACT

In accordance with FAR RFO 6.103-1, the Centers for Disease Control and Prevention (CDC) intends to award a contract on a sole-source basis to Premier Healthcare Solutions, Inc.

Based on the Government's market research, Request for Information (RFI) responses, and the Justification for Other Than Full and Open Competition (JOFOC), the Government has determined that Premier Healthcare Solutions, Inc. as been determined to be the only responsible source capable of satisfying the Government's minimum requirements described in the Statement of Work.

The Government will consider all timely capability statements and proposals received from responsible sources to determine whether another source can satisfy the Government's minimum requirements. Offerors other than Premier Healthcare Solutions, Inc. should clearly demonstrate in their capability statement and proposal how they satisfy each of the Government's minimum requirements identified in the Statement of Work.

If the Government determines that another responsible source can satisfy the Government's minimum requirements, the Government reserves the right to modify its acquisition strategy and conduct a competitive acquisition if determined to be in the Government's best interest.

RESPONSE INSTRUCTIONS

Interested parties wishing to demonstrate their capability to satisfy the Government's minimum requirements shall submit a capability statement no later than August 18, 2026, at 3:00 p.m. Eastern Time.

Offerors wishing to submit a quote shall submit no later than August 26, 2026, at 3:00 p.m. Eastern Time.

Capability statements and proposals shall be submitted electronically to the Contracting Officer at the email address identified below.

The Government will evaluate all timely capability statements and proposals received in accordance with this solicitation. A determination that no other responsible source can satisfy the Government's minimum requirements, and the resulting decision not to compete this acquisition, is solely within the discretion of the Government.

POINT OF CONTACT

All questions concerning this solicitation and all capability statements and proposals shall be submitted in writing to:

Latoya Michel Contracting Officer Email: zrb5@cdc.gov

Telephone inquiries will not be accepted.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ITEM SUPPLIES / SERVICES QTY/UNIT UNIT PRICE EXTENDED

PRICE

0001 Comprehensive and Social Determinants Of Health Data (SDOH) Extracts

Task 1: The Contractor shall deliver to CDC the most up-to-date and recent Comprehensive and SDOH data extracts delivered each month in accordance (IAW) the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2026 – 09/13/2027

12 Each $ TBD $ TBD

0002 Long Term Mortality Data Table - Includes historical data between 01/01/2016 to Current

Task 2: The Contractor shall deliver to CDC the Long Term Mortality Data between 01/01/2016 to current. Data extracts shall be delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2026 – 09/13/2027

12 Each $ TBD $ TBD

0003 Training, Monthly Calls, and Technical Support

Task 3: Contractor shall provide four (4) hours of virtual, web-based training, support monthly meetings and provide technical support IAW the

SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2026 – 09/13/2027

Lot $ TBD $ TBD

Option Period 1

1001 Comprehensive and Social Determinants Of Health Data (SDOH) Extracts

Task 1: The Contractor shall deliver to CDC the most up-to-date and recent Comprehensive and SDOH data extracts delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2027 – 09/13/2028

12 Each $ TBD $ TBD

1002 OPTIONAL Long Term Mortality Data Table - Includes historical data between 01/01/2016 to Current

Task 2: The Contractor shall deliver to CDC the Long Term Mortality Data between 01/01/2016 to current. Data extracts shall be delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2027 – 09/13/2028

12 Each $ TBD $ TBD

1003 Training, Monthly Calls, and Technical Support

Task 3: Contractor shall provide four (4) hours of virtual, web-based training, support monthly meetings and provide technical support IAW the

SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2027 – 09/13/2028

12 Months $ TBD $ TBD

Option Period 2

2001 Comprehensive and Social Determinants Of Health Data (SDOH) Extracts

Task 1: The Contractor shall deliver to CDC the most up-to-date and recent Comprehensive and SDOH data extracts delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2028 – 09/13/2029

12 Each $ TBD $ TBD

2002 OPTIONAL Long Term Mortality Data Table - Includes historical data between 01/01/2016 to Current

Task 2: The Contractor shall deliver to CDC the Long Term Mortality Data between 01/01/2016 to current. Data extracts shall be delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2028 – 09/13/2029

12 Each $ TBD $ TBD

2003 Training, Monthly Calls, and Technical Support

Task 3: Contractor shall provide four (4) hours of virtual, web-based training, support monthly meetings and provide technical support IAW the

SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2028 – 09/13/2029

12 Months $ TBD $ TBD

Option Period 3

3001 Comprehensive and Social Determinants Of Health Data (SDOH) Extracts

Task 1: The Contractor shall deliver to CDC the most up-to-date and recent Comprehensive and SDOH data extracts delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2029 – 09/13/2030

12 Each $ TBD $ TBD

3002 OPTIONAL Long Term Mortality Data Table - Includes historical data between 01/01/2016 to Current

Task 2: The Contractor shall deliver to CDC the Long Term Mortality Data between 01/01/2016 to current. Data extracts shall be delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2029 – 09/13/2030

12 Each $ TBD $ TBD

3003 Training, Monthly Calls, and Technical Support

Task 3: Contractor shall provide four (4) hours of virtual, web-based training, support monthly meetings and provide technical support IAW the

SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2029 – 09/13/2030

12 Months $ TBD $ TBD

Option Period 4

4001 Comprehensive and Social Determinants Of Health Data (SDOH) Extracts

Task 1: The Contractor shall deliver to CDC the most up-to-date and recent Comprehensive and SDOH data extracts delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2030 – 09/13/2031

12 Each $ TBD $ TBD

4002 OPTIONAL Long Term Mortality Data Table - Includes historical data between 01/01/2016 to Current

Task 2: The Contractor shall deliver to CDC the Long Term Mortality Data between 01/01/2016 to current. Data extracts shall be delivered each month IAW the SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2030 – 09/13/2031

12 Each $ TBD $ TBD

4003 Training, Monthly Calls, and Technical Support

Task 3: Contractor shall provide four (4) hours of virtual, web-based training, support monthly meetings and provide technical support IAW the

SOW.

Firm Fixed Price Line Item.

Period of Performance: 09/14/2030 – 09/13/2031

12 Months $ TBD $ TBD

B1. Total Contract Value Including (Base and All Options):

The total value for this Task Order, inclusive of the Base Period and all Option Periods, is set forth below. This section will be finalized and incorporated at the time of award based on the successful offeror's price proposal.

Summary of Pricing

Base Period $ - Option Period 1 $ - Option Period 2 $ - Option Period 3 $ - Option Period 4 $ - Total: $ -

B.2 Option CLINs 1001-4003 are Optional Priced Line Items, as described in FAR 52.217-5. Except when it is determined in accordance with FAR 17.206(b) not to be in the Government’s best interests, the Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. Evaluation of options will not obligate the Government to exercise the option(s).

Section C - Description/Specification/Work Statement

Statement of Work

Title: Comprehensive Encounter-level Inpatient and Hospital-based Outpatient Billing and Chargemaster Database for Addressing Public Health Priorities

SECTION 1 – BACKGROUND

The U.S. Centers for Disease Control and Prevention (CDC), Office of Public Health Data, Surveillance, and Technology (OPHDST) leads efforts to modernize public health data, surveillance, and informatics capabilities to ensure timely, accurate, and actionable information for public health decision-making. The CDC routinely uses electronic healthcare data to meet its public health mission. Healthcare data are used to inform situational awareness, predictive modeling, and strategic, tactical, and policy decision making; to help track the spread and intensity of outbreaks and identify areas that are highly impacted by disease; to understand spectrum of illness, disease burden, risk factors for severe disease, and outcomes; and to understand the impact public health threats on healthcare systems and communities.

CDC requires access to a comprehensive, encounter-level healthcare database that combines administrative, healthcare utilization, and financial information from inpatient and hospital-based outpatient encounters with clinical laboratory results and vital measurements. Access to such an integrated healthcare database allows CDC to monitor disease and healthcare utilization trends over time and conduct longitudinal clinical, financial, and outcomes analyses related to public health priorities, including public health emergencies. The database should capture at least 25% of U.S. hospital admissions from a diverse set of hospitals with sufficient hospital-level data to generate reliable and valid national inpatient estimates. To achieve its mission, CDC requires the comprehensive database to contain general and microbiology laboratory results and vital measurements and to be linkable to social determinants of health, long-term mortality, and other potential data. For example, having detailed clinical, cost, and laboratory data within a single, integrated database is absolutely necessary for CDC to calculate burden, death, and attributable cost estimates for the several of the healthcare associated infections for the Antimicrobial Resistance (AR) Threats Report, including MRSA, VRE, CRE, carbapenem-resistant Acinetobacter, ESC-RE, and multidrug-resistance Pseudomonas. The AR Threats Report is an important CDC report providing estimates on antimicrobial resistance for the United States. Estimates for the AR Threats Report will be published by CDC at least bi-annually moving forward.

The CDC Data Hub within OPHDST is a full-service enterprise resource connecting CDC staff and other authorized individuals with high-value healthcare data and technical and analytic support to generate actionable insights and inform public health action. CDC Data Hub helps ensure data security, governance, stewardship, and quality assurance; manages data onboarding and access permissions; and provides training, technical assistance, and data analysis and scientific support, including within CDC’s cloud-based data platforms. CDC Data Hub will oversee ingestion, management, security, and access to the healthcare data licensed through this procurement and serve as the primary liaison between the vendor and CDC staff using the data.

SECTION 2 – PURPOSE/OBJECTIVE

The purpose of this contract is for CDC to continue to license, obtain, and use a large, comprehensive, U.S.-based, encounter-level inpatient and hospital-based outpatient billing and chargemaster database. The licensed Comprehensive Healthcare Database shall contain detailed encounter-level administrative, healthcare utilization, and financial information data from standard hospital discharge billing files and line-item chargemaster records, as well as general and microbiology laboratory results and vital measurements data from electronic medical records within a single, integrated database. CDC also seeks to license, obtain, and use supplemental Social Determinants of Health data and Long-term Mortality data (Optional Task) that are linkable to the Comprehensive Healthcare Database at the patient level. All data should fulfill the requirements outlined in Sections 3, 4, and 5 of this Statement of Work. In brief, the Comprehensive Healthcare Database shall be updated and delivered to CDC monthly; available historically from 2016; include majority of healthcare encounters that occurred in the most recent 2-3 months; provide ability to track individual patients longitudinally within a hospital or health system; capture detailed medications, procedures, devices, and services provided in the healthcare setting; include weights to generate national inpatient estimates; and come from a representative sample of at least 1,400 geographically diverse non-profit, non-governmental, and community and teaching hospitals and health systems from rural and urban areas that capture at least 25% of U.S. hospital admissions.

CDC requires pharmacy/medication, microbiology, general laboratory, and vital measurement data for monitoring antimicrobial resistance, sepsis, and other public health concerns. For example, to monitor trends in antimicrobial resistance, consistent hospitalization data with timing of clinical culture and associated susceptibility testing (microbiology and sensitivity data) is critical. To monitor sepsis and implement CDC’s adult sepsis event definition, CDC requires data that can identify if and when a blood culture was collected during a hospitalization (microbiology data), several general laboratory measures (e.g., creatinine, lactate, bilirubin), procedures and care level of patients (e.g., mechanical ventilation and intensive care unit status), and medications (e.g., vasopressor and antibiotic use). Measurement and risk-adjustment of important healthcare quality surveillance measures, such as hospital-onset bacteremia or non-ventilator hospital-acquired pneumonia, require detailed clinical information coupled with microbiology data to identify positive blood cultures, other laboratory results (e.g., white blood cell counts), and vital signs (e.g., temperature and oxygen saturation). Other projects to monitor health outcomes after cancer therapies also require vital signs, microbiology, and laboratory information and leverage mortality data from both inside and outside the hospital.

CDC requires information on social determinants of health (SDOH) of patients to better understand the community-level and social factors that are associated with disease occurrence, hospital admission, disease severity, and outcomes. To be most useful, SDOH variables should be based on the patients’ place of residence and provided at the lowest (or most granular) geographic level available or permissible.

It is important for CDC to have visibility on deaths that occur both inside and outside of the hospital setting. The ability to track patient-level mortality beyond the hospital encounter can provide more accurate longitudinal analyses and additional insights into outcomes for patients discharged to long-term care facilities, home health, or hospice care as well as for patients who died in other settings.

SECTION 3 – SCOPE OF WORK

The Contractor shall provide CDC with the necessary license(s) for full and complete access to and use of the Comprehensive Healthcare Database, Social Determinants of Health (SDOH) data, and Long-Term Mortality data (Optional) delivered to CDC, and shall provide training and technical support.

Requirements of the Comprehensive Healthcare Database:

1. Encounter-level administrative, healthcare utilization, and financial information for inpatient and hospital-based outpatient encounters derived from standard hospital discharge billing files and line-item chargemaster records

2. Encounter-level billing and chargemaster data from >1,400 geographically diverse non-profit, non-governmental, and community and teaching hospitals and health systems from rural and urban areas that capture at least 25% of annual U.S. hospital admissions

3. Includes unique patient identifier to track patients longitudinally over time and across inpatient and outpatient settings within the same hospital or health system

4. Contains consistently robust data from 2016 through the most recent records available;

5. Is relatively recent and includes records for the majority of healthcare encounters that occurred during the most recent

2-3 months at the time data are delivered to CDC

6. Contains the minimum data elements listed in Section 5 Task 1

7. Provides hospital/facility location at state and 3-digit ZIP code level

8. Includes weights for generating national inpatient estimates

9. Contains general laboratory and microbiology (including antibiotic susceptibility) laboratory results data, as specified in Section 5 Task 1, from >350 facilities (25% or more of total)

10. Contain vital measurements data, as specified in Section 5 Task 1, from >140 facilities (10% or more of total)

11. Contains detailed medication/drug/pharmacy data, including brand/generic drug names, strength, dosing, route of administration, day of service, quantity charged, and cost

12. Admission, discharge, and service dates shall be provided as exact dates (mm/dd/yyyy)

13. If available, patients’ residential locations at the smallest geographic scale allowable.

Requirements of the contractor-provided Social Determinants of Health data:

1. Linkable to Comprehensive Healthcare Database at the patient level using unique patient identifier

2. At a minimum, include the following measures: American Community Survey average household size, median household income, income inequality, average educational level and CDC/ATSDR Social Vulnerability Index overall and for four themes

3. SDOH variables shall be based on the patients’ place of residence (not facility location) at the lowest (or smallest) level of geography allowable (i.e., census tract, ZIP Code Tabulation Areas [ZCTAs], ZIP code, or county).

4. SDOH variables shall be provided at the highest level of resolution allowable (i.e., exact value rounded to whole number). If exact values are not allowable, the Contractor can provide the SDOH variables categorized into deciles (or ten equally sized groups) or other logical groupings for that variable.

5. SDOH variables shall align temporally to the patients’ visit (i.e., 2024 SDOH indicators linked to 2024 visits). For more recent visits in which the corresponding year of SDOH indicators are not available, the Contractor shall use the most recent year available (e.g., 2024 SDOH indicators linked to 2025 or 2026 visits).

To support a holistic government approach and response to public health priorities, CDC shall be authorized to share aggregate data products with governmental partners including HHS, other federal agencies, and state, local, tribal, and territorial governments. Additionally, CDC shall be authorized to generate state-level estimates for public dissemination (i.e., sharing outside of CDC), as long as the state-level aggregate data product is reviewed and approved by Contractor's data governance board prior to dissemination outside of CDC.

Additionally, the Contractor shall permit CDC to retain license(s) to use data delivered under this contract for a minimum of an additional 12 months after the period of performance ends. This will allow CDC to complete and disseminate (e.g., in government reports or peer-reviewed publications) important analytic projects that were initiated during the contract period.

CDC will not initiate new analytic projects after the period of performance ends.

All routine enhancements to the Contractor’s Comprehensive Healthcare Database offering shall be included and provided to CDC at no additional cost. The Contractor may provide CDC with complimentary access to additional data, tool(s), or resource(s) that are available now or become available in the future to test their capabilities and determine if they may be beneficial to CDC. Access may be granted on a complimentary basis during the evaluation period as set by the Contractor.

After the evaluation period, CDC may modify the contract to add the data, tool(s) and/or resource(s) if beneficial, cost-effective, and reasonable to the government.

SECTION 4 – TECHNICAL REQUIREMENTS

Personally identifiable information

The data delivered to CDC under this contract shall be record-level anonymized. CDC seeks to obtain the minimum data necessary to accomplish CDC’s public health mission. CDC does not seek and will not accept personally identifiable information (PII) that directly identifies individuals, such as patient name, address, social security number or other identifying number or code, date and place of birth, telephone number, email address, or biometric records such as fingerprints. Contractor shall establish robust process to ensure no direct PII is included in data delivered to CDC. If PII is found within the data delivered to CDC, CDC will alert Contractor and users immediately and then request Contractor to scrub the data within their environment to eliminate the PII. Once the PII is removed, the Contractor will send an updated replacement file. CDC will destroy data containing PII.

Technical requirements for monthly data deliveries to CDC

Data Transfer Protocol Requirements:

1. Contractor shall specify their preferred protocol for data transfer.

2. Encryption and security measures for data in transit shall be detailed.

3. Contractor shall specify whether they will push the data or if it will require CDC to pull the data. CDC prefers the contractor to deliver data to CDC’s publicly accessible cloud environment.

4. Contractor shall define the frequency and timing of data transfers.

5. See Appendix A for CDC preferred data transfer Protocol in details.

Data Transfer Security Requirements:

1. Contractor shall provide detailed protocols for the secure exchange of credentials or secrets.

2. Compliance with security standards such as OAuth or API key usage shall be clearly outlined in the intended methodologies.

3. Contractor shall transfer the data using a secure method in accordance with all applicable CDC and HHS data security and privacy regulations.

Data Content Delivery Requirements:

Contractor shall deliver the cumulative data extracts from 2016 through the most recent data available, with each data delivery following the delivery cadence outlined in the contract (i.e., monthly).

SECTION 5 – TASKS TO BE PERFORMED

C.5.1 Task One (1) – Comprehensive Healthcare Database and Social Determinants of Health (SDOH) Data License and Extracts

The Contractor shall provide CDC with necessary license(s) for full and complete access to and use of the entire Comprehensive Healthcare Database that includes facility data, patient and administrative data, visit-level diagnosis and procedure codes, itemized billing and chargemaster data, general laboratory results data, microbiology laboratory results data, and vital measurement data for inpatient and hospital-based encounters within a single, integrated database. The database shall, at a minimum, meet the requirements specified in Section 3 and include the data elements listed below. If any listed data elements are not available as specified, Contractor shall indicate such in their proposal and provide alternatives.

The Contractor shall also provide CDC with necessary license for full and complete access to and use of the Social Determinants of Health (SDOH) data. The SDOH data shall be linkable to the Comprehensive Healthcare Database at the patient level using unique patient identifier. The SDOH data shall, at a minimum, meet the requirements specified in Section 3 and include the data elements listed below. If any listed data elements are not available as specified, Contractor shall indicate such in their proposal and provide alternatives.

The Contractor shall deliver the most recent, full extracts of the Comprehensive Healthcare Database and SDOH data to CDC each month during the period of performance (12 total deliveries). The Contractor shall deliver the data extracts in accordance with technical requirements provided in Section 4. The Contractor shall provide available metadata with each data delivery to allow CDC to validate and have confidence in data quality. To the degree possible and reasonable, the Contractor shall provide metadata in a CDC-requested format. The Contractor shall provide an electronic data dictionary and contents listing with the initial data delivery and each time there is a change to the database format or contents.

Comprehensive Healthcare Database – minimum data elements

Hospital and Facility Data:

1. De-identified Provider ID;

2. Urban versus rural designation;

3. Teaching status;

4. Bed size;

5. U.S. Census region;

6. U.S. Census division;

7. U.S. State;

8. First three digits of ZIP code (zip3);

9. Monthly number of outpatient and inpatient encounters;

10. Provider and discharge month-level weights.

Patient & Administrative Data:

1. De-identified Discharge ID (use this field to link a patient’s hospital visit across data files);

2. De-identified Unique Patient ID (use this field to track a patient across multiple visits within the same hospital system, including inpatient and outpatient visits);

3. Patient Validation Indicator;

4. Discharge date (mm/dd/yyyy);

5. Admission date (mm/dd/yyyy);

6. Discharge month;

7. Provider ID (de-identified);

8. Inpatient versus Outpatient visit indicator;

9. Patient type;

10. Medicare Severity Diagnosis related groups (MS-DRG);

11. MS-DRG major diagnostic category (MDC);

12. Point of Origin;

13. Admission type;

14. Discharge status and disposition;

15. Marital Status;

16. Age at time of admission (if age is greater than 89, age is adjusted to 89);

17. Sex;

18. Race (Reported as White, Black, Asian, Other, Unknown);

19. Ethnicity (Reported as Hispanic, Non-Hispanic, Other/Unknown);

20. Admitting physician specialty;

21. Admitting physician de-identified linking identifier;

22. Attending physician specialty;

23. Attending physician de-identified linking identifier;

24. Primary payer;

25. Length of stay;

26. Total charges;

27. Total cost;

28. Total fixed cost;

29. Total variable cost;

30. Publish type of hospital encounter (indicates whether the encounter has passed all validity checks including financial reconciliation, whether or nor not total bill and costs will be assigned as final)

International Classification of Diseases, Tenth Revision (ICD-10) Diagnosis and Procedure Data:

2. ICD-10 Diagnosis related information – ICD-10-Clinical Modification (ICD-10-CM):

a. Primary ICD-10-CM diagnosis code and description;

b. All secondary ICD-10-CM diagnosis codes and descriptions reported by the hospital;

c. Admitting ICD-10-CM diagnosis code (if provided by the hospital);

d. Major category code and description;

3. ICD-10 Procedure related information – ICD-10 Procedure coding system (ICD-10 PCS):

a. Primary ICD-10 PCS procedure code and description;

b. All secondary ICD-10 PCS procedure codes and descriptions reported by the hospital;

c. Procedure date;

d. Procedure physician specialty;

e. Procedure physician de-identified linking identifier;

Current Procedural Terminology (CPT) Data:

2. All CPT4 codes and descriptions reported by the hospital.

Billing and Chargemaster Data:

2. Hospital specific charge master id and description;

3. Standard Charge Master code and description;

4. Clinical Detail code and description;

5. Date of Service (mm/dd/yyyy);

6. Standard Quantity (to be used with the Standard charge master description);

7. Clinical Detail Quantity (to be used with the Clinical detail description);

8. Billing charges;

9. Billing cost;

10. Billing fixed cost;

11. Billing variable cost;

12. Standard Department Code and description;

13. Pharmacy, Central Supply, Laboratory, Diagnostic Imaging, Surgery, etc.;

14. Pharmacy billing information, including:

a. Drug name (generic);

b. Drug strength (from Standard Charge Master Description);

c. Drug therapeutic class;

d. Route of administration (oral, parenteral, topical).

General Laboratory Results File from a subset of >350 facilities that submit data:

1. Specimen source SNOMED Code;

2. Specimen source SNOMED Description;

3. Collection Day Number;

4. Collection Time of Day;

5. Lab Test LOINC code;

6. Lab Test LOINC description;

7. Lab Test Result;

8. Result Unit;

9. Flags;

10. Result Day Number;

11. Result Time of Day;

12. Reference Interval;

13. Numeric Value;

14. Numeric Value Operator.

Microbiology Laboratory Results File from a subset of >350 facilities that submit data:

1. Specimen ID;

2. Test day and time of collection;

3. Test name;

4. Observation (test result);

5. Sensitivity data for positive test results;

6. Organism;

7. Drug tested;

8. Interpretation;

9. Minimal inhibitory concentration (MIC).

Vital Measurements Data from a subset of >140 facilities that submit data:

1. Facility Test Name;

2. Systolic Blood Pressure;

3. Pulse;

4. Temperature;

5. Diastolic Blood Pressure;

6. Oxygen Saturation Level;

7. Respiration Rate;

8. Height;

9. Weight;

10. LOINC Description;

11. LOINC;

12. Observation Day and Time;

13. Observation Result.

Social Determinants of Health Data – minimum data elements

American Community Survey data by ZCTA:

1. Value (absolute or decile) of average household size;

2. Value (absolute or decile) of Gini index of income inequality;

3. Value (absolute or decile) of median household income;

4. Value (absolute or decile) of weighted average of highest level of education achieved (less than high school, high school, associate degree, bachelor’s degree, and graduate degree)

CDC/ATSDR Social Vulnerability Index variables by County Level:

1. Percentile (absolute or decile) ranking: Theme 1, socioeconomic;

2. Percentile (absolute or decile) ranking: Theme 2, household composition;

3. Percentile (absolute or decile) ranking: Theme 3, minority status/language theme;

4. Percentile (absolute or decile) ranking: Theme 4, housing/transportation;

5. Percentile (absolute or decile) ranking for overall SVI.

C.5.2 Task Two (2) – Long-Term Mortality Data License and Monthly Extracts (OPTIONAL)

The Contractor shall provide CDC with necessary license(s) for full and complete access to and use of the Long-term Mortality data table. Long-term Mortality shall be assessed through privacy-preserving tokenized linkage to multiple third-party mortality data sources (i.e., government mortality databases, private obituary data, private claims data) to capture vast majority of deaths that occur in the United States. The Long-term Mortality data table shall contain: unique patient identifier; date of death for patients who died in-hospital or were identified as deceased through third-party mortality data sources; and an indicator of whether or not patients were able to be tokenized for linkage to the third-party mortality data. The Long-term Mortality data table shall be linkable to the Comprehensive Healthcare Database at the patient level using unique patient identifiers and contain information from 2016 through the most recent records available to the Contractor. The Long-term Mortality data table shall be delivered to CDC monthly and in the same manner as the Comprehensive Healthcare Database and SDOH data table.

Mortality Data:

1. Person Key

2. Date of Death

3. Tokenized Person – Yes, No

C.5.3 - Task Three (3) - Training, Monthly Calls, and Technical Support for Tasks 1 and 2

Contractor shall provide four (4) hours of virtual, web-based training to CDC staff. The trainings shall cover a range of introductory, intermediate, and advanced topics that will be mutually decided upon by Contractor and CDC. Trainings will be scheduled at mutually agreed upon dates and times. Contractor will coordinate with CDC to develop the training agendas, learning objectives, and content, including hands-on training as appropriate.

Contractor shall meet monthly with the CDC COR and other CDC staff (e.g., scientist, training coordinator, data manager) to discuss contractual issues, data related issues, and other topics of interest.

Contractor shall provide technical support to the CDC Data Hub technical teams (e.g., when data delivery issues arise) and to CDC scientific staff on data-related questions, when necessary.

SECTION 6 – PLACE OF PERFORMANCE AND CONTRACT SUPPORT HOURS

SUBSECTION A – PLACE OF PERFORMANCE

All work shall be conducted at the Contractor’s worksite / facility.

SUBSECTION B – CONTRACT SUPPORT HOURS

Contractor shall be available Monday through Friday between 9 AM and 5 PM (EST) except for federal holidays.

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

Contract Work

Associated Deliverable Description Required Frequency / Delivery Date

Delivery Method

TASK 1 Comprehensive Healthcare Database and Social Determinants of Health (SDOH) Data Extracts

Monthly, within five (5) business days of the data release date.

CDC cloud environment.

Notification to the Contracting Officer’s Representative

(COR)

via email.

TASK 2

(OPTIONAL)

Long-Term Mortality Data

Monthly, within five (5) business days of the data release date.

CDC cloud environment.

Notification to the Contracting Officer’s Representative

(COR)

via email.

TASK 3 Trainings/ Monthly Calls /Technical Support

Four (4) hours of virtual, web-based training

Monthly Meetings with COR and relevant CDC staff.

Technical Support, as needed.

Four (4) hours of training at mutually agreed upon dates for each period of performance.

Virtual via Microsoft Teams or similar platform.

TASKS 1, 2, 3 Monthly Report

Dates of all data deliveries, also indicate any problems with deliveries.

Monthly, by the 5th working day of each month.

Send to the Contracting Officer’s Representative

(COR)

via email.

Contractor shall ensure that data extracts described in Task 1 and Task 2 are delivered to CDC Data Hub each month within five

(5) business days of the data release date and that the CDC COR and the Data Management Lead receive an email from Contractor indicating data has been delivered.

SUBSECTION A – QUALITY ASSURANCE PERFORMANCE PLAN (QASP)

Work Requirement / Performance Standard

Acceptable Quality Level Surveillance Method

Incentive for Meeting

Performance Standard

Provision of data in format and within delivery schedule

Deliverables provided in accordance with contract requirements, at an acceptable quality with 90% compliance within each contract period.

Surveillance by Assigned CDC Contracting Officer’s Representative

(COR)

- Contractor’s performance is documented as past performance using CPARS which is considered for future awards.

- Performance is considered in determining whether to exercise the option periods.

SECTION 8 – MINIMUM CONTRACTOR QUALIFICATIONS

The Contractor shall have the following:

i. Receiving and managing encounter- and patient-level data from >1,400 geographically diverse hospitals with ability for patients to be tracked longitudinally (both retrospectively and prospectively) across visits within the inpatient and hospital-based outpatient settings, with a unique identifier within a single hospital or healthcare system.

ii. Managing a dynamic healthcare database that is extracted on a regular basis (e.g., weekly, bi-weekly, monthly), is relatively recent (i.e., most encounters incorporated into database within 2-3 months), and can be transferred to CDC every month (for Base and Option Years 1, 2, 3, and 4, if exercised) for timely analysis of public health issues and threats.

iii. Operating as a healthcare improvement organization with a large alliance that includes a geographically diverse and representative subset of U.S. hospitals and other provider organizations that submit a log of billed items, including procedures, medications, laboratory test performed, diagnostic and therapeutic services at the individual patient level, patient demographic information, visit costs and charges, discharge information including length of stay and diagnosis codes, and microbiology laboratory results.

iv. Managing healthcare data containing information on a large number of U.S. hospitals that includes information on hospital characteristics such as geographic region, three-digit ZIP code, bed size, teaching status, and urban or rural designation.

SECTION 9 – PROPOSED CONTRACT TYPE

The anticipated contract type is a Firm Fixed Priced Supply Contract.

SECTION 10 – POINT OF CONTACT INFORMATION

CDC Contracting Officers Representative (COR):

Ms. Janet Phillips

Telephone: (404) 498-2462

Email: iru5@cdc.gov

SECTION 11 – ADDITIONAL REQUIREMENTS

Information Security and Privacy A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the

Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less after it is determined that a threat or hazard exists, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality (Low, Moderate, High)

Integrity (Low, Moderate, High)

Availability (Low, Moderate, High)

Security Objectives Impact Level:

(NIST SP 800-60)

Moderate Moderate Moderate

Security Objectives Impact Level: (If System/Information Owner need to downgraded / upgraded risk)

Overall Impact Level (Low, Moderate, High)

Moderate Moderate Moderate

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: N/A [ ] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

7) Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by HHS or collected by the Contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies.

Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms, and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to CDC Office of Chief Information Security Officer (OCISO).

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

a. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the CDC SOP that a review is required based on a major change to the system (e.g., new uses of information collected, changes to the way information is shared or disclosed and for what purpose, or when new types of PII are collected that could introduce new or increased privacy risks), whichever comes first.

B. Training

1)…