75F40120C00061 CB_FE.pdf

09/03/2020 09/04/2020

75F40120C00061 Polyethylene Glycol Safety in Children Study

Part 1

SECTION B - SUPPLIES OR SERVICES AND PRICE/COSTS

B.1 SOLICITIATON DESCRIPTION

The Contractor shall furnish all necessary facilities, materials, and personnel, and shall perform all non-personal services and program support necessary in a requirement titled, “Polyethylene Glycol Safety in Children Study.”

B.2. CONTRACT TYPE

In accordance with FAR 52.216-11 Cost Contract - No Fee., the government awards a Cost - No Fee Contract award. The structure of the contract shall be base plus option year period.

B.3 PRICING

The pricing chart below outlines the procedure and labor categories that are anticipated throughout the life of the contract. The Contractor shall provide services in accordance with the Statement of Work with fully loaded, fixed hourly rates.

Pricing Table

Below is the pricing table for this project:

Line Item Description Total Cost Amount* 1 Performance of Tasks 1-5 of Section C.4 of the

Statement of Work $325,893.00

2 Option to perform additional Tasks on Metadata Collection (C.4, #3) and Clinical Data Tabulation (Section C.4, #4)

$325,807.00

TOTAL ESTIMATED COST $651,700.00

*each line item is considered a non-severable effort and is subject to the cost ceiling listed for the specific line item, subject to FAR 52.232-20 Limitation of Cost. Funds from one-line item do not carry forward with the exercise of the Option.

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 Background

Polyethylene glycol (PEG) 3350 is an osmotic agent that retains water within the stool and produces an osmotic diarrhea. PEG 3350 is an active ingredient found in approved prescription products and nonprescription products. Some of the prescription products are indicated for bowel cleansing prior to colonoscopy and in some cases preparation for barium enemas in adults 18 years of age and older.

NuLytely and the drug products approved under abbreviated new drug applications (ANDAs) that reference it are currently the only prescription PEG 3350 bowel preparation products that are approved for use in pediatric patients (children 6 months of age and older).

There are also nonprescription (often referred to as over-the-counter or OTC) products indicated for the relief of occasional constipation in consumers who are 17 years of age and older. The labeling does not provide for use by children 16 years of age or younger. Instead, it directs that a medical professional be consulted.

At this time, there are no FDA-approved products (prescription or nonprescription) indicated for use in pediatric1 patients for the relief of occasional constipation.2

FDA has funded research aimed at studying the potential exposure (and extent of absorption) of the pediatric population to smaller molecules that may be found in PEG 3350, such as ethylene glycol and diethylene glycol, and that may be absorbed by children taking this product chronically for the treatment of constipation. The Children’s Hospital of Philadelphia (CHOP) was awarded Grant 1R01FD005312 and initiated Part A Pilot Study in its protocol “Polyethylene Glycol Safety in Children” (PGSC, eIRB Number IRB-14-011454), which will determine if PEG 3350 metabolites can be detected in blood components and urine collected from children who use PEG 3350 chronically (at least a month). During CHOP’s execution of the grant, challenges were encountered related to the development of novel analytical techniques to accurately, precisely, and reliably measure PEG 3350 metabolites in pediatric plasma. This grant expired September 30, 2019.

FDA scientists within the Office of Pharmaceutical Quality (OPQ) / Division of Product Quality Research (DPQR) have worked on analytical development and bioanalytical method validation for the following PGSC study primary analytes and their metabolites: ethylene glycol, diethylene glycol, triethylene glycol, glycolic acid, glyoxylic acid, diglycolic acid, hydroxyethoxyacetic acid, and oxalic acid. FDA scientists are working to improve the efficiency of assay development and to provide increased sensitivity and selectively to detect the primary analytes and their metabolites. While the analytical challenges have been mostly addressed, there is still analysis from the Part A Pilot Study to complete as well as collecting the necessary samples and associated data for the Part B Main Study.

C.2 OBJECTIVES

The objectives of this study are as follows:

To determine the presence of metabolites in blood components and urine collected from participants and to identify the peak interval between PEG 3350 ingestion and metabolite detection To measure PEG 3350 metabolites in blood components and urine collected from participants

C.3 SCOPE OF WORK

The purpose of the contract is to complete work initiated in the PGSC study under grant number 1R01FD005312-01 utilizing the improved assay methods developed by FDA scientists to understand if PEG 3350 metabolites can be identified in blood components and urine of children

1 The term “pediatric patients” as used in this Statement of Work includes children from birth to 16 years of age.

See 21 CFR 201.57(c)(9)(iv).

2 The Constipation Guidelines Committee of the North American Society for Pediatric Gastroenterology, Hepatology, and Nutrition (NASPGHAN) published a Clinical Practice Guideline in 2006 and 2014 on the management of pediatric constipation, which includes PEG 3350 as one of the recommended medications.

However, FDA did not have a role in establishing this recommendation, and no PEG 3350 products are approved for these recommended uses.

who take PEG 3350 chronically (at least a month). At the conclusion of the analysis, the final objective is to jointly draft a manuscript of the findings

C.4 ASSIGNMENTS

Tasks may require the contractor to perform the following assignments and require all deliverables to be submitted electronically, as approved by the FDA Contracting Officer Representative (COR).

1. SUBJECT ENROLLMENT/WITHDRAWAL

The Contractor shall utilize the protocol reviewed and approved by the designated Institutional Review Board (IRB) to take the necessary actions to identify the correct representative population and process their enrollment in the PGSC study.

The Contractor shall obtain consent, assent and HIPAA authorization from the appropriate family members and in consultation with those family members determine a feasible day and time for the specimen collection.

The Contractor shall provide an adult family member compensation in the amount of $30.00 for their child’s participation. If a subject turns 18 years of age during participation, the subject shall be paid directly.

The Contractor shall allow subjects to withdraw from the study at any time without prejudice to their care and shall destroy all Protected Health Information (PHI) that links data and samples provided by the participant to the subject.

The Contractor shall document and report any serious, related adverse events to the designated IRB, including events that occur after a subject completes or withdraws from the study.

The Contractor shall document and report any adverse events that are not serious but that are notable and could involve risks to subjects to the designated IRB.

The Contractor shall document and report any unanticipated problems related to the research involving risks to subjects or others during the study to the designated IRB.

2. BIOSPECIMEN COLLECTION AND DELIVERY

The Contractor shall collect blood, urine and in some cases stool samples from the subjects whom have completed all the appropriate paperwork required by law and FDA processes.

The Contractor shall collect blood and urine samples from 75 subjects who have used PEG 3350 daily for at least a month and from 75 subjects who have not taken PEG-3350.

The Contractor shall attempt, wherever possible, to provide samples from subjects who have used PEG 3350 daily (at least 17 grams/day) for at least a month from the following groups with corresponding inclusion and exclusion criteria:

o Group 1: Children who do not have bowel or nervous system disease, or neuropsychiatric symptoms.

Inclusion criteria:

a. Children less than 17 years old who have been taking PEG 3350 for at least one month.

b. Dose of PEG 3350 greater than or equal to 0.4 grams/kg/day currently recommended by the NASPGHAN and ESPGHAN guidelines (2).

Preferences will be given to children taking at least 17 grams/day.

c. Normal Physical and neurological development for age.

d. Weight and height percentiles 5% and 95% for age.

Exclusion criteria:

Children with underlying bowel problems that might be expected to increase bowel permeability (are included in group 2). In this group we will specifically exclude children with:

a. Diarrhea within the past month while noting that PEG 3350 may cause loose stool and this is often the intended therapeutic effect. Therefore, we will exclude children with presumed infectious diarrhea since this may alter gut permeability but will include children whose loose stool is attributed to PEG 3350. If loose or watery stool began after initiation of PEG 3350 or after an increase in PEG 3350 dose within prior 3 days, children may be enrolled for GROUP 1.

b. Children whose stool had a recognized diarrhea causing pathogen within the past 4 months will be excluded since the time required to repair epithelial lining is not clear. Enteric pathogens that would prevent enrollment include Salmonella, Shigella, Campylobacter, Yersinia, E.

Coli (enterotoxigenic, enteropathogenic, enteraggregative, enterohemorrhagic), Clostridum difficile, Rotavirus, Norovirus, Astrovirus, and other known or suspected diarrhea causing organisms.

c. H. pylori infection since this causes a stomach inflammation.

d. HIV infection since this may alter bowel permeability and predispose to other types of infection

e. Symptoms neurologic disease or dysfunction (since they will be enrolled in Group 3).

o Group 2: Children with problems that might increase intestinal epithelial permeability.

Inclusion criteria:

a. Children who have been taking at least 17 grams of PEG 3350 for at least one month.

b. Any of the following problems associated with increased bowel permeability:

i. Weight 5% for age. Malnutrition is associated with increased intestinal permeability.

ii. Children who had a pathogen (see Group 1 Exclusion Criteria for list of pathogens) isolated from their stool within the past month.

iii. Children with celiac disease who are untreated or began treatment within the past 3 months.

iv. Children with inflammatory bowel disease

v. Children with Hirschsprung disease. This intestinal motility disorder predisposes to bowel injury called enterocolitis.

vi. Children with intestinal motility disorders other than

Hirschsprung disease.

Exclusion criteria: Children with neurologic or neuropsychiatric symptoms.

These children will be enrolled in Group 3.

o Group 3: Children with underlying neurologic disease or with neuropsychiatric disorders or symptoms.

Inclusion criteria:

a. Children less than 17 years old who have been taking at least 17 grams of

PEG 3350 for at least one month.

b. Any of the following problems with the nervous system:

i. Diagnosed with a disease that affects nervous system function before starting PEG 3350.

ii. Diagnosed with a disease that affects nervous system function after starting PEG 3350.

iii. Abnormal nervous system function without a specific diagnosis.

iv. Episodic nervous system dysfunction. This might include seizure disorder, metabolic disease, or mitochondrial disease.

v. Cerebral palsy, neuronal migration defects, traumatic brain injury, hypoxic ischemic encephalopathy, seizure disorder, tics, migraine, clinical depression, anxiety disorder, obsessive-compulsive disorder, post-surgical brain injury, autism spectrum disorder as well as genetic defects that affect the nervous system (Cornelia de Lange, Rett Syndrome, Pelizaeus-Merzbacher disease, etc.).

c. Any weight and height (i.e., no exclusions based on growth percentiles).

d. Abnormalities in any organ including the bowel are acceptable.

The Contractor shall attempt, wherever possible, to meet the below Government-desired subject enrollment targets who have taken at least 17 grams of PEG-3350 daily from each of the previously identified groups.

o 15 children aged 0-6 years old.

o 6 children aged 7-12 years old.

o 4 children aged 13-17 years old.

The Contractor shall collect stool samples from 20 subjects who have used PEG 3350 daily (at least 17 grams/day where possible) for at least a month and from 20 subjects who have not taken PEG-3350. A special effort will be made to obtain these samples from children whose parents attribute an adverse outcome to PEG 3350.

The Contractor shall collect a one teaspoon sample of the PEG 3350 medicine the children ingest as part of their daily dosage.

The Contractor shall deliver coded blood samples to be processed as plasma in labelled blood vacuum container pre-coated with Na2-EDTA. These samples will be frozen and stored at -20 ºC and shipped over dry ice to the FDA laboratory.

The Contractor shall deliver coded urine samples collected in standard specimen cups, frozen and stored at -20 ºC and shipped over dry ice to the FDA laboratory.

FDA laboratory will not receive any subject identifying information; key will never be released to the FDA.

The Contractor shall deliver medication samples in a contractor-determined appropriate container on ice to the FDA laboratory.

The Contractor shall store all coded blood and urine samples in their facility until the appropriate time of delivery when they will be delivered to the FDA laboratory.

3. METADATA COLLECTION

The Contractor shall administer questionnaires and a neurobehavioral assessment for the subjects whom have completed all the appropriate paperwork required by law and FDA processes.

The Contractor shall administer questionnaires to the subject’s families to elicit neurological or psychiatric symptoms that parents might attribute to PEG 3350 use.

o The Contractor shall provide families with children > 1.5 years old with an age appropriate Child Behavior Checklist (CBCL) from the Achenbach System of Empirically Based Assessment.

o The Contractor shall provide families with children < 1.5 years old with a Bayley-III Social-Emotional Scale (BSID-III) assessment to measure neurobehavioral skills and test for Sensory Processing and Social Emotional functioning.

The Contractor shall interview each subject and review their medical records to identify additional relevant medical history information.

The Contractor shall collect the following information from each subject: name, height, weight, date of birth, problem list diagnoses, and prescribing department specialty.

The Contractor shall enter the necessary data in the NIH-supported Research Electronic Data Capture (REDCap) database.

The Contractor shall ensure that time-stamped backup files are made from the REDCap database daily using automated backup routines.

The Contractor shall ensure that all data and records generated during this study will be kept confidential in accordance with Institutional policies and Health Insurance Portability and Accountability Act of 1996 (HIPAA) on subject privacy. The Contractor shall not use the data and records generated from this study for any purpose other than conducting the study. To maintain subject confidentiality, PHI will only be available to research team members who have completed appropriate training (HIPAA).

4. CLINICAL DATA TABULATION

The Contractor shall assist in analyzing and integrating clinical data with information about PEG 3350 metabolite levels (for the ongoing analysis from the referenced grant and the analysis from the newly collected Samples), generating figures and supporting the FDA in writing a manuscript describing the study’s results.

The Contractor shall provide collaborative support to the FDA upon request to assist in data tabulation activities.

5. STUDY PROJECT MANAGEMENT

The Contractor shall be proactive in informing the designated government Project Managers and Contracting Officer Representatives of any issues, problems and recommendations that should be addressed for the overall effective accomplishment of the order goals.

The Contractor shall provide recommendations for actions that need to be taken by FDA staff, or other contractors, shall be clearly defined and communicated to the responsible party and the FDA, and have identified dates for completion.

C.5 ANTICIPATED LABOR/KEY PERSONNEL

The following Labor Categories and individuals listed are considered Key Personnel and are subject to the Key Personnel Clause, HHSAR 352.237-75 Key Personnel (Dec 2015):

Principal Investigator: Dr. Robert Heuckeroth Research Study Coordinator: Ms. Amanda Lemke

SECTION D - PACKAGING AND MARKING

All deliverables required under this contract shall be packaged, marked and shipped/submitted in accordance with the Government specifications below. At a minimum, all deliverables shall be marked with the contract number and contractor name.

SECTION E - INSPECTION AND ACCEPTANCE

The FDA COR will inspect and make acceptance decisions for all materials, documents, and services provided under this contract. For the purpose of this Section, the FDA COR is the authorized representative of the Contracting Officer.

SECTION F - DELIVERIES OR PERFORMANCE

F.1 ANTICIPATED DELIVERABLES

Deliverables

F.2 PERIOD OF PERFORMANCE

The contract period of performance is to begin at the time of award. The exact date will be established when the contract award is made. The period of performance will last one year from the date of award, plus an option year.

The initial 12-month period of performance will cover all tasks (1 through 5) in Section C.4.. The Government reserves the right to exercise an option for an additional 12-month period of performance to complete activities on Metadata Collection in Section C.4, #3 and Clinical Data Tabulation in Section C.4 #4 given the complexity of those tasks.

F.3 PLACE OF PERFORMANCE

Deliverables Estimated Quantity/ Frequency

Delivery Date Delivery Location

4.2 Deliverable 1

Blood/Plasma Samples 150/Once Upon completion of the sample collection from the requisite population groups.

Food and Drug Administration 10903 New Hampshire Ave Bldg 62 Loading Dock or Bldg 64 Room 1030 Silver Spring, MD 20993

4.2 Deliverable 2

Urine Samples 150/Once Upon completion of the sample collection from the requisite population groups.

Food and Drug Administration 10903 New Hampshire Ave Bldg 62 Loading Dock or Bldg 64 Room 1030 Silver Spring, MD 20993

4.3 Deliverable 1

Stool Samples 40/Once Upon completion of the sample collection from the requisite population groups.

Food and Drug Administration 10903 New Hampshire Ave Bldg 62 Loading Dock or Bldg 64 Room 1030 Silver Spring, MD 20993

The Contractor shall perform all Tasks at its own place of business: Children’s Hospital of Philadelphia – Research Institute, 3401 Civic Center Blvd., Philadelphia, PA 19104. Visits to FDA in connection with this project shall be coordinated with Point of Contact (POC), see below.

POC and Contracting Officer’s Representative (COR):

Contact: Carole Miller Phone: 240-402-0237 E-mail: Carole.Miller@fda.hhs.gov The US Food and Drug Administration White Oak Campus 10903 New Hampshire Avenue Silver Spring, MD 20993

Inspection and Acceptance Criteria

The Government will review all deliverables in accordance with the requirements identified in the statement of work or any directives issued by the COR.

Government Furnished Equipment (GFE)/Government Furnished Information (GFI)

The Government will provide the Contractor with sample data that is generated by the collected samples after completing analysis at FDA laboratories.

Staffing

The Contractor shall be responsible for providing personnel that are adequately trained and have the management, technical and subject matter expertise required to accomplish the activities and prepare the deliverables identified in this Statement of Work.

Access to Non-Public Information

All persons authorized by FDA to work under this contract shall be required to sign Form FDA 3398 – Contractor’s Commitment to Protect Non-Public Information Agreement. If a person who has signed this agreement resigns, is dismissed, or is otherwise no longer working on this contract, the Contractor shall notify the COR and Contracting Officer within ten (10) days. Any new person assigned to this contract shall sign the agreement and shall submit it to the Contracting Officer and COR prior to commencement of any work under this contract. No person working under this Contract shall be provided or possess non-public information in any form unless written approval has been granted by the Contracting Officer. The disclosure of any confidential information in violation of the agreement may be subject to civil or criminal sanctions.

IT Architecture and Technical Standards:

Architecture Standards Must conform to FDA’s architecture and technical standards and follow the ICT-21 three-tier architecture standards (presentation, application, and data).

Technical Standards Any software required on FDA client computers, or in FDA data centers, shall not conflict with FDA technical standards. FDA’s Master Approved Technology List (MAT) contains a list of approved and not approved technologies, including applications (software), infrastructure and peripherals (hardware), and scientific software and devices.

Software that is required as part of the solution design that is not already approved for use within FDA shall be evaluated by the FDA IT Investment Management (ITIM) governance process.

EPLC Compliance All work completed during this project shall be subject to compliance with FDA’s EPLC process as appropriate.

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 CONTRACTING OFFICERS REPRESENTATIVE (COR)

The following COR will represent the Government for the purpose of this contract: Carole Miller

The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements;

(2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

G.2 CONTRACTING OFFICER (CO)

The Contracting Officer is the only person with authority to act as agent of the Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in a task order;

(2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor any costs incurred during the performance of this contract; or (5) otherwise change any terms and conditions of this contract.

The contact information for the Contracting Officer is:

Richard Robinson 4041 Powder Mill Road Beltsville, MD 20704 Email: Richard.Robinson@fda.hhs.gov Tel: (301) 796-6508

Contract Administration

The contact information for the Contract Specialist is:

Robert Maydwell 4041 Powder Mill Road Beltsville, MD 20704 Email: Robert.Maydwell@fda.hhs.gov Tel: (301) 348-1814

Representatives The COR will perform acceptance of services to be provided.

Carole Miller is the authorized representative of the Contracting Officer.

The COR is responsible for the following as required by this order: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the

Contracting Officer changes in requirements; (2) interpreting the Statement of Work and any other technical performance requirements; (3) performing technical evaluations and acceptances; and (4) assisting in the resolution of technical problems encountered during performance.

The Contracting Officer is the only person with authority to act as an agent of the Government under this order. Only the Contracting Officer has authority to: direct or negotiate any changes in the order, including modifying or extending the period of performance, changing the delivery schedule, authorizing reimbursement to the Contractor for any costs incurred during the performance of this order, or otherwise change any terms and conditions of this order.

SECTION H. – SPECIAL CONTRACT REQUIREMENTS

H.1 CONTRACTOR PERFORMANCE EVALUATION(S)

In accordance with Federal Acquisition Regulation (FAR) 42.15, FDA will complete annual and final contractor performance evaluations. Annual evaluations will be prepared to coincide with the anniversary date of the contract. Additional interim performance evaluations may be prepared at Contracting Officer discretion, as necessary. Final performance evaluations will be completed upon contract expiration.

FDA will utilize the Contractor Performance Assessment Reporting System (CPARS) in order to execute annual and final contractor performance evaluations. CPARS is a secure Internet website located at http://www.cpars.csd.disa.mil/cparsmain.htm. FDA will register the contractor in CPARS upon receipt of the name and email address of two (2) individuals who will be responsible for serving as the Contractor’s primary and alternate CPARS contacts. Once FDA registers the contractor in CPARS, the Contractor will receive an automated CPARS email message which contains User IDs and instructions for creating a password.

Once a performance evaluation is issued, the Contractor’s primary and alternate CPARS contact will receive an email instructing them to logon to CPARS in order to review the performance evaluation. The Contractor has 14 days from the date of performance evaluation issuance in which to review the evaluation. If the Contractor is in agreement with the performance evaluation outcome, the evaluation becomes final. Should the Contractor be in disagreement with the performance evaluation outcome, rebuttal comments must be submitted via the CPARS within 14 days from date the evaluation was issued by FDA. Any disagreement between the Contracting Officer and the Contractor will be referred to a contracting official one level above the Contracting Officer, whose decision will be final.

Copies of each performance evaluation and contractor responses, if any, will be retained as part of the official contract file and will be used to support future award decisions. Evaluations will also be stored for a 3-year period in the Past Performance Information Retrieval System (PPIRS) at www.ppirs.gov.

Contractors may obtain CPARS training material and register for on-line training at http://www.cpars.gov/allapps/cpcbtdlf.htm. There is no fee for registration or use of the CPARS.

H.2 CONFLICT OF INTEREST

As a regulatory agency charged with protection of public health, the Food and Drug Administration (FDA) must maintain public confidence in the integrity of its decisions. The FDA has policies and procedures that safeguard against actual and apparent conflict of interest on the part of its employees. In contracting for review and evaluation of scientific data and information submitted to the agency, it is critical that the FDA be assured that there is no actual or apparent conflict of interest on the part of the individual contractor. Offers performing work under this contract must assure the protection of information and data they receive under this contract from unauthorized use or disclosure and must avoid actions that would cause a reasonable person to question the impartiality of the contractor.

(a)Purpose. The purpose of this clause is to ensure that the contractor and its subcontractors:

(1) Are not biased because of their financial, contractual, organizational, or other interests which relate to the work under this contract, and

(2) Do not obtain any unfair competitive advantage over other parties by virtue of their performance of this contract.

(b)Scope. The restrictions described herein shall apply to performance or participation by the contractor, its parents, affiliates, divisions and subsidiaries, and successors in interest (hereinafter collectively referred to as “contractor”) in the activities covered by this clause as a prime contractor, subcontractor, co-sponsor, joint venturer, consultant, or in any similar capacity. For the purpose of this clause, affiliation occurs when a business concern is controlled by or has the power to control another or when a third party has the power to control both.

(c)Warrant and Disclosure. The warrant and disclosure requirements of this paragraph apply with full force to both the contractor and all subcontractors. The contractor warrants that, to the best of the contractor's knowledge and belief, there are no relevant facts or circumstances which would give rise to an organizational conflict of interest, as defined in FAR Subpart 9.5, and that the contractor has disclosed all relevant information regarding any actual or potential conflict. The contractor agrees it shall make an immediate and full disclosure, in writing, to the Contracting Officer of any potential or actual organizational conflict of interest or the existence of any facts that may cause a reasonably prudent person to question the contractor's impartiality because of the appearance or existence of bias or an unfair competitive advantage. Such disclosure shall include a description of the actions the contractor has taken or proposes to take in order to avoid, neutralize, or mitigate any resulting conflict of interest.

(d)Remedies. The Contracting Officer may terminate this contract for convenience, in whole or in part, if the Contracting Officer deems such termination necessary to avoid, neutralize or mitigate an actual or apparent organizational conflict of interest. If the contractor fails to disclose facts pertaining to the existence of a potential or actual organizational conflict of interest or misrepresents relevant information to the Contracting Officer, the Government may terminate the contract for default, suspend or debar the contractor from Government contracting, or pursue such other remedies as may be permitted by law or this contract.

(e)Subcontracts. The contractor shall include a clause substantially similar to this clause, including paragraphs (f) and (g), in any subcontract or consultant agreement at any tier expected to exceed the simplified acquisition threshold. The terms “contract,” “contractor,” and “Contracting Officer” shall be appropriately modified to preserve the Government's rights.

(f)Prime Contractor Responsibilities. The contractor shall obtain from its subcontractors or consultants the disclosure required in FAR Part 9.507-1 and shall determine in writing whether the interests disclosed present an actual, or significant potential for, an organizational conflict of interest. The contractor shall identify and avoid, neutralize, or mitigate any subcontractor organizational conflict prior to award of the contract to the satisfaction of the Contracting Officer. If the subcontractor's organizational conflict cannot be avoided, neutralized, or mitigated, the contractor must obtain the written approval of the Contracting Officer prior to entering into the subcontract. If the contractor becomes aware of a subcontractor's potential or actual organizational conflict of interest after contract award, the contractor agrees that the Contractor may be required to eliminate the subcontractor from its team, at the contractor's own risk.

(g)Waiver. The parties recognize that this clause has potential effects which will survive the performance of this contract and that it is impossible to foresee each circumstance to which it might be applied in the future. Accordingly, the contractor may at any time seek a waiver from the Head of the Contracting Activity by submitting such waiver request to the Contracting Officer, including a full written description of the requested waiver and the reasons in support thereof.

H.3 DISSEMINATION, PUBLICATION AND DISTRIBUTION OF INFORMATION

Data and information either provided to the Contractor, or to any subcontractor or generated by activities under this contract or derived from research or studies supported by this contract, shall be used only for the purposes of the contract. It shall not be duplicated, used or disclosed for any purpose other than the fulfillment of the requirements set forth in this contract. This restriction does not limit the Contractor’s right to use data or information obtained from a non-restrictive source. Any questions concerning “privileged information” shall be referred to the Contracting Officer.

Some data or information may require special consideration with regard to the timing of its disclosure so that preliminary findings which could create erroneous conclusions are not stimulated. Also, some data or information, which relate to policy matters under consideration by the Government, may also require special consideration with regard to the timing of its disclosure so that the open and vigorous debate, within the Government, of possible policy options is not damaged.

Any questions about use or release of the data or information or handling of material under the contract shall be referred to the COR who must render a written determination to the Contracting Officer. The COR’s determination will reflect the results of internal coordination with appropriate program and legal officials. After receipt of the COR’s written determination, the Contracting Officer will make a final decision authorizing the release of information.

Written advance notice of at least forty-five (45) days shall be provided to the COR of the Contractor’s desire to release findings of studies or research or data or information described above. If the Contractor disagrees with the COR’s determination and if the disagreement cannot be settled by the Contractor and the CO in a mutually satisfactory manner, then the issue will be settled pursuant to the “Disputes” clause.

Any presentation of any report, statistical or analytical material based on information obtained from this contract shall be subject to review by the COR before dissemination, publication, or distribution.

Presentation includes, but is not limited to, papers, articles, professional publications, speeches, testimony or interviews with public, print or broadcast media. This does not apply to information that would be available under the Federal Freedom of Information Act.

The COR’s review shall cover accuracy, content, manner of presentation of the information, and the protection of the privacy of individuals. If the review finds that the Privacy Act is or may be violated, the release/use of the presentation shall be denied until the offending material is removed or until the Contracting Officer makes a formal determination, in writing, that the privacy of individuals is not being violated.

If the review shows that the accuracy, content, or manner of presentation is not correct or is inappropriate in the light of the purpose of the project, the COR shall immediately inform the Contractor, in writing, of the nature of the problem. If the Contractor disagrees, the COR may insist that the presentation contain, in a manner of equal importance, materials which show the government's problem with the presentation.

The Contractor agrees to acknowledge support by FDA whenever reports of projects funding, in whole or in part, by this contract are published in any medium. The Contractor shall include in any publication resulting from work under this contract, an acknowledgement substantially, as follows:

“The analyses upon which this publication is based were performed under Contract Number [ ], entitled, “[ ],” sponsored by the Food and Drug Administration, Department of Health and Human Services.”

H.4 PROCUREMENTS REQUIRING INFORMATION SECURITY AND/OR PHYSICAL

ACCESS SECURITY

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA

Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [ x ] Moderate [ ] High Integrity: [ ] Low [ x ] Moderate [ ] High Availability: [ ] Low [ x ] Moderate [ ] High Overall Risk Level: [ ] Low [x ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[X ] No PII [ ] Yes PII

Complete this section using the information obtained from the Security and Privacy Checklist in Appendix A, parts A and B.

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ x ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re- using, and disposing of the information.” 81 Fed.

Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

7) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

8) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

See Appendix D for baseline deliverables.

9) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. All devices (i.e.: desktops, laptops, mobile devices, etc.) that store, transmit, or process non-public FDA information should utilize FDA-provided or FDA information security authorized devices that meet HHS and FDA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use are compliant with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS Personal Identification Verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys (PIV card) shall be provided to the COR upon request and at the conclusion of the contract. Upon completion of contract, contractor ensures that COR is able to access and read any encrypted data.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the FDA non-disclosure agreement (3398 Form), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable FDA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete FDA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS and FDA training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS and FDA policy and

FDA Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Standard Operating Procedures (SOP).

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS and FDA policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior (ROB) before accessing HHS and FDA…