75P00123R00048 Amendment 01.pdf

(x)

75P00123R00048 x x

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted ; or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGEMENT TO BE

RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR

OFFER. If by virtue of this amendment you desire to change an offer already submitted , such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

x

Bethesda MD 20814

OAMS

8th Floor 7700 Wisconsin Avenue Office of Acquisition Management Services

OS/ASA/OAMS

07/31/20230001

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS. IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

12. ACCOUNTING AND APPROPRIATION DATA (If required) is not extended.is extended, Items 8 and 15, and returning

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended , by one of the following methods: (a) By completing

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

FACILITY CODE CODE

10B. DATED (SEE ITEM 13)

10A. MODIFICATION OF CONTRACT/ORDER NO.

9B. DATED (SEE ITEM 11)

9A. AMENDMENT OF SOLICITATION NO.

CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

7. ADMINISTERED BY (If other than Item 6)CODE 6. ISSUED BY

PAGE OF PAGES

4. REQUISITION/PURCHASE REQ. NO.3. EFFECTIVE DATE2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO. (If applicable)

1. CONTRACT ID CODE

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

07/31/2023

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority) appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

E. IMPORTANT: Contractor is not is required to sign this document and return __________________ copies to the issuing office.

ORDER NO. IN ITEM 10A.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

The purpose of this amendment is to provide responses to questions and revise the solicitation.

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)15A. NAME AND TITLE OF SIGNER (Type or print)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA 15B. CONTRACTOR/OFFEROR 16C. DATE SIGNED

(Signature of person authorized to sign) (Signature of Contracting Officer)

STANDARD FORM 30 (REV. 11/2016)

Prescribed by GSA FAR (48 CFR) 53.243

Previous edition unusable

Except as provided herein, all terms and conditions of the document referenced in Item 9 A or 10A, as heretofore changed, remains unchanged and in full force and effect .

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

This IDIQ is to provide the Office of Civil Rights (OCR) support in executive and consultative services, strategic planning, program management, administrative services and all related advisory activities required by the OCR Director.

B.2 TYPE OF CONTRACT

The contract type awarded is Indefinite Delivery Indefinite Quantity (IDIQ).

B.3 TYPE OF ORDERS (IDIQ)

Task or delivery orders issued under this IDIQ contract shall be: firm fixed price, time & material, and labor hour orders.

B.4 MINIMUM AND MAXIMUM QUANTITIES (IDIQ)

During the contract period, the Government shall place orders totaling a minimum of ___$10,000.00____. This reflects the contract minimum for the entire period of performance, including any options. The contract maximum for the entire period of performance, including any options, shall be for the placement of orders totaling a maximum of _$25,000,000.00_.

B.5 CONTRACT LINE-ITEM PRICING (IDIQ)

The price for each task order will be based on the negotiated unit prices listed below and estimated level of effort, or firm fixed price amount, to be determined at the time of task order award.

The Contractor will be reimbursed in accordance with pricing section of each task order for satisfactory performance of the work.

Time and Material/Labor Hour Orders The Contractor shall not exceed the maximum, fully loaded hourly rates (inclusive of wages, indirect costs such as fringe, overhead, general and administrative expenses, any other indirect costs for labor, and profit) for each category listed below.

Base Ordering Period: Estimated 9/15/2023 - 9/14/2024

SOW

Section Labor Category Ceiling Rate

Estimated Hours

Estimated Extended

C.2 Project Manager 637

C.4.1.A Senior Advisor 240 C.4.1.B Senior Analyst 240

C.4.1.C Statistician/Economist 4,080

C.4.2.A Management Analyst, Program III 13,050

C.4.2.B Management Analyst, Program II 2,040

C.4.2.C Management Analyst, Program I 4,080

C.4.2.D HIPAA Subject Matter Experts/Technical Analyst

3,350

C.4.3.A Senior Analyst, Outreach Function 240

C.4.3.B Management Analyst, Outreach Function 240

C.4.3.C Management Analyst, Outreach 240

C.4.4.A Administrative Assistant II 2,040

C.4.4.B Administrative Assistant I 2,020

Evaluated Base Period

Optional Ordering Period 1: Estimated 9/15/2024 - 9/14/2025

Section Labor Category

Ceiling Rate

Estimated Hours

Estimated Extended

C.2 Project Manager 637

C.4.1.A Senior Advisor 240

C.4.1.B Senior Analyst 240

C.4.1.C Statistician/Economist 4,080

C.4.2.A Management Analyst, Program III 13,050

C.4.2.B Management Analyst, Program II 2,040

C.4.2.C Management Analyst, Program I 4,080

C.4.2.D HIPAA Subject Matter Experts/Technical Analyst

3,350

C.4.3.A Senior Analyst, Outreach Function 240

C.4.3.B Management Analyst, Outreach Function 240

C.4.3.C Management Analyst, Outreach 240

C.4.4.A Administrative Assistant II 2,040

Evaluated Option Period 1

Optional Ordering Period 2: Estimated 9/15/2025 - 9/14/2026

Section Labor Category

Ceiling Rate

Estimated Hours

Estimated Extended

C.2 Project Manager 637

C.4.1.A Senior Advisor 240

C.4.1.B Senior Analyst 240

C.4.1.C Statistician/Economist 4,080

C.4.2.A Management Analyst, Program III 13,050

C.4.2.B Management Analyst, Program II 2,040

C.4.2.C Management Analyst, Program I 4,080

C.4.2.D HIPAA Subject Matter Experts/Technical Analyst

3,350

C.4.3.A Senior Analyst, Outreach Function 240

C.4.3.B Management Analyst, Outreach Function 240

C.4.3.C Management Analyst, Outreach 240

C.4.4.A Administrative Assistant II 2,040

Evaluated Option Period 2

Optional Ordering Period 3: Estimated 9/15/2026 - 9/14/2027

Section Labor Category

Ceiling Rate

Estimated Hours

Estimated Extended

C.2 Project Manager 637

C.4.1.A Senior Advisor 240

C.4.1.B Senior Analyst 240

C.4.1.C Statistician/Economist 4,080

C.4.2.A Management Analyst, Program III 13,050

C.4.2.B Management Analyst, Program II 2,040

C.4.2.C Management Analyst, Program I 4,080

C.4.2.D HIPAA Subject Matter Experts/Technical Analyst

3,350

C.4.3.A Senior Analyst, Outreach Function 240

C.4.3.B Management Analyst, Outreach Function 240

C.4.3.C Management Analyst, Outreach 240

C.4.4.A Administrative Assistant II 2,040

Evaluated Option Period 3

Optional Ordering Period 4: Estimated 9/15/2027 - 9/14/2028

Section Labor Category

Ceiling Rate

Estimated Hours

Estimated Extended

C.2 Project Manager 637

C.4.1.A Senior Advisor 240

C.4.1.B Senior Analyst 240

C.4.1.C Statistician/Economist 4,080

C.4.2.A Management Analyst, Program III 13,050

C.4.2.B Management Analyst, Program II 2,040

C.4.2.C Management Analyst, Program I 4,080

C.4.2.D HIPAA Subject Matter Experts/Technical Analyst

3,350

C.4.3.A Senior Analyst, Outreach Function 240

C.4.3.B Management Analyst, Outreach Function 240

C.4.3.C Management Analyst, Outreach 240

C.4.4.A Administrative Assistant II 2,040

C.4.4.B Administrative Assistant I 2,020 Evaluated Option Period 4 Total Evaluated Price (All Years)

In the event that 52.217-8 is exercised, the ceiling rates during the extension period shall be the ceiling rates for the last optional ordering period exercised prior to the exercise of clause 52.217- 8.

Firm Fixed Price Orders Firm Fixed Price orders shall comply with the labor rate maximums for each category listed above. A payment schedule for Firm Fixed Price orders will be negotiated for individual task orders.

SECTION C - Description/Specifications/Statement of Work

Executive Services & Consulting

C.1 PROGRAM DESCRIPTION AND BACKGROUND

Background

The Office for Civil Rights (OCR), a staff division at the HHS Office of the Secretary, ensures that individuals receiving services from HHS-funded programs are not subject to unlawful discrimination, that civil rights laws promote health equity in HHS funded and administered by HHS to the extent possible, that regulated entities comply with applicable privacy and security requirements promulgated under HIPAA and HITECH, and individuals can exercise their rights to access their health information and can trust in the privacy and security of their health information. By rooting out insidious discrimination and removing unlawful barriers to HHS-funded services, OCR carries out the HHS mission of improving the health and well-being of all Americans and providing essential human services. By promoting health equity and protecting the right of individuals to access their health information while protecting the privacy and security of this information, OCR helps empower people’s health care decision-making and helps ensure the integrity of the health care system, both of which promote better health outcomes for the Nation.

OCR protects these rights by:

Teaching health, social service workers, and other stakeholders about civil rights laws, health information privacy, and patient safety confidentiality laws.

Educating communities about civil rights and health information privacy rights.

Investigating civil rights, health information privacy, and patient safety confidentiality complaints to identify discrimination or violations of the law and taking action to correct problems up to and including enforcement actions, compliance actions, and imposing civil monetary penalties.

Drafting regulations within the scope of applicable authorities.

Program Goals and Objectives

The Contractor will support the Office for Civil Rights (OCR) in obtaining highly skilled executive consultants and management/administrative analysts. These highly trained and highly skilled consultants and analysts are integral to the success and performance of OCR and further OCR’s mission as described above thru various mission support activities.

C.2 SCOPE OF IDIQ

This contract is to provide OCR support in consultative services, strategic planning, program management, administrative services and all related advisory activities required by OCR as set forth in each task order.

The contractor shall oversee its personnel in performance of task orders issued under this contract. The Government anticipates that no more than 2% of hours under task orders issued against this contract will be committed to project management. The minimum qualifications for the Project Manager are: [To be updated prior to award based on the offeror’s proposed Key Personnel; however, in no event shall it be less than 5 years of experience in successfully managing projects of similar scope and complexity.]

C.4 TASK AREAS

C.4.A – Task Area 1 - Mission and Policy Support: The Contractor shall provide mission support, policy analysis and provide recommendation through consultation and advice to the OCR Director and provide recommendations regarding the development and implementation of OCR’s mission. The Contractor will provide regulatory impact analysis (RIA) to support OCR through the decision-making process for promulgating new and existing regulations.

C.4.B – Task Area 2 – Investigation Support: The Contractor will assist headquarters with mission support activities involving investigations of complaints and compliance reviews concerning Health and Human Services divisions, State and local governments, and private entities by making recommendations to the Director or other Federal designee about findings and disposition.

The Contractor will support regional and headquarter staff by independently reviewing and assessing information security data relating to the security programs and safeguarding of protected health information of HIPAA covered entities and business associates.

C.4.C – Task Area 3 – Outreach Support: The Contractor will provide expert advice regarding the quality of OCR’s outreach activities and media relations. They will provide mission support to intra- and inter-agency work groups in the development of Departmental policies, legislative and regulatory proposals, and special OCR initiatives that the OCR Director has determined should be implemented.

C.4.D – Task Area 4 – Administrative Support: The Contractor will provide general administrative and analytical support to headquarters and regional staff with minimal oversight.

They will assist staff with mission support activities related to investigations of complaints and compliance reviews within OCR’s divisions, including regional staff.

C.4.1 –Senior Advisor Labor Categories C.4.1.A - Senior Advisor

1. Provides mission support, policy and regulatory impact analysis (RIA) to the OCR Director and Division Directors on issues of policy, impact of administrative rules, compliance, and enforcement mechanisms.

2. Supports OCR with applying OCR’s mission activities, program goals, and strategic objectives affecting OCR.

3. Provides recommendations regarding the quality of OCR’s missions and activities.

Coordinates with OCR leaders to identify areas of overlap provide recommendations for improvements and/or unifying.

4. Provides outreach activities, such as outreach to stakeholders, media relations and special initiatives to maximize the impact, in support of OCR’s mission activities, program goals and strategic objectives.

Minimum educational experience is a law degree (J.D.) from a law school accredited by the American Bar Association (ABA) or a Master’s degree from an accredited university or specialized experience equivalent to the GS-15 level in the Federal Government.

C.4.1.B - Senior Analyst

1. Provides mission support, policy, and regulatory impact analysis (RIA) to the OCR Director and Division Directors on issues of policy, impact of administrative rules, compliance, and enforcement mechanisms.

2. Assists in investigations of complaints and compliance reviews undertaken by OCR and makes recommendations to the Deputy Directors and/or Regional Managers about findings and disposition.

3. Provides recommendations and guidance regarding the quality of OCR’s mission activities and develops mechanisms for OCR’s continuous improvements initiatives through the use of effective performance metrics, surveys, and other performance management tools.

4. Provides consultation and recommendations regarding mission guidance, technical assistance, and other policy documents, including regulations.

5. Provides mission support, policy and regulatory impact analysis (RIA) to the OCR Director and Division Directors.

6. Provides outreach activities, such as outreach to stakeholders, media relations and special initiatives, in support of OCR’s mission activities, program goals and strategic objectives.

specialized experience equivalent to the GS-15 level in the Federal Government.

C.4.1.C - Statistician/Economist

1. Performs multiple, varying, and complex assignments under the limited direction of the COR. Acts as a contributing specialist on large work activities or individually perform single or small work activities.

2. Applies experience and advanced technical knowledge of economic theory and statistical techniques to perform regulatory impact analyses, economic analyses, and benefit-cost analyses of proposed and final regulations or other cross-cutting policy initiatives to support OCR policies, goals and priorities.

3. Provides subject matter expertise to ensure that regulatory impact analyses meet legal and analytical requirements as established under the Administrative Procedure Act, the Regulatory Flexibility Act, the Paperwork Reduction Act, the Unfunded Mandates Reform Act, Executive Order 12866 Regulatory Planning and Review, and OMB Circular A-4.

4. Develops plans, methods, and other data and statistics to support regulatory impact analyses of rulemaking to advance the mission of OCR; develops improvements in economic methods, techniques, and models to improve regulatory and economic analyses of OCR policies.

5. Contributes to the preparation of management/technical reports and communicates the overall results of a project or work activity to the COR.

6. Communicates highly technical quantitative concepts and procedures focused on programs and policies, broadly defined (i.e., as above) through written materials and in face-to-face briefings for senior policy officials and non-technical audiences.

7. May serve as the subject matter expert on key economic on interdisciplinary rulemaking workgroups and committees.

8. In accordance with the Paperwork Reduction Act, coordinate outreach and develop surveys to gather data and information on potential impacts.

9. Resolves all but unique technical problems without the intervention of management or a more experienced technical specialist.

10. Identifies and develops and recommends techniques to address problem situations;

participates in developing process improvements, procedures, and templates for regulatory analyses.

11. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities and stakeholders as required.

Minimum educational experience is a Bachelor’s degree from an accredited university or specialized experience in economic analysis and regulatory impact analysis equivalent to the GS- 14 level in the Federal Government.

C.4.2 – Program Area Support Labor Categories

C.4.2.A - Management Analyst III, Program Specialist

1. Provides consultation and makes recommendations under OCR’s compliance and enforcement authorities regarding case investigations, conduct of compliance reviews, and case resolution and enforcement strategies concerning Health and Human Services divisions, State and local governments, and private entities.

2. Provides mission support, policy and regulatory impact analysis (RIA) to the OCR

3. Provides policy and regulatory impact analysis on the implementation of policies and procedures under OCR’s compliance and enforcement authorities.

4. Provides high- quality research and analysis by processing and investigating cases, conducting compliance reviews in support of OCR’s nationwide goals.

5. Supports OCR officials’ intra- and inter-agency efforts to develop, coordinate and implement OCR mission activities pertaining enforcement.

6. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities, complainants, covered entities and business associates, advocacy groups, and other stakeholders as required.

7. Provides outreach activities, such as outreach to stakeholders, media relations and special specialized experience equivalent to the GS-15 level in the Federal Government.

C.4.2.B - Management Analyst II, Program

1. Provide mission support and policy analysis services to OCR Regional Managers in developing case-related guidance for front-line OCR investigators and makes recommendations regarding regional operations to ensure consistency in compliance activities and application of policies.

2. Makes recommendations to the OCR Regional Managers about the findings and disposition of cases and compliance reviews.

3. Provides mission support, policy, and regulatory impact analysis (RIA) to the OCR

4. Provides research and recommendations regarding implementation of policies and procedures under OCR’s compliance and enforcement authorities to the OCR Regional Manager.

5. Conducts and analyses HHS program-related research.

6. Assists with analyzing clearances implicating the office’s mission and makes recommendations to the COR for processing.

7. Provides outreach activities, such as outreach to stakeholders, media relations and special

American Bar Association (ABA) or a Bachelor’s degree from an accredited university or specialized experience equivalent to the GS-13/14 level in the Federal Government.

C.4.2.C - Management Analyst I, Program

1. Provide mission support and policy analysis services to COR in developing case-related guidance for front-line OCR investigators and makes recommendations regarding regional operations to ensure consistency in compliance activities and application of policies and administration.

2. Conducts and analyses HHS program-related research.

3. Provides general administrative and analytical support to the Divisions.

4. Develops a system for tracking the goals and accomplishments of the Division.

5. Develops spreadsheets, analyzes information, and provides reports. The spreadsheets could track complaints, information about covered entities and relevant stakeholders, and information needed to meet reporting requirements for OCR.

6. Interfaces with appropriate staff within OCR to get needed information and arrange meetings.

7. Provides logistical support for Division activities.

Minimum educational experience is a one-year law school completed from a law school accredited by the American Bar Association (ABA) or a Bachelor’s degree from an accredited university or specialized experience equivalent to the GS-12 level in the Federal Government.

C.4.2.D – HIPAA Subject Matter Experts/Technical Analyst

1. Reviews security and privacy complaints, data breach notification and cybersecurity incident reports, and other correspondence and evidence to determine whether the complaint, self-report or breach notification report indicates non-compliance with the HIPAA Security Rule. Reviews data provided by the healthcare organizations across the nation to assess the overall impact of security and privacy incidents.

2. Provides subject matter expertise with evaluating and determining the technical sufficiency of submissions from HIPAA covered entities and business associates in response to data and documentation requests (i.e. Assessing reports related to security baselines, penetration tests, vulnerability assessments, and digital forensics).

3. Document processes, standard operating procedures and system requirements; develops reports summarizing the analysis along with formulating recommendations for OCR to consider for future action.

4. Develops written reports with technical security analyses, summaries, and recommendations for action, reports on root causes of problems, efficiency, and support needs.

5. Provides expertise in the development and evaluation of health information privacy policies and technologies, specifically regarding protected health information; de-identified / re-identified health information; limited data sets.

6. Provides subject matter expert analysis, evaluation, and recommendations based on national security standards (NIST), industry best practices (ISO) and implementation specifications of the HIPAA Security Rule.

7. Provides expert guidance in designing, implementing, and managing information security, data protection, and risk management programs, including policies, procedures, and controls for protected health information based on HIPAA requirements.

8. Provides advisory expertise in the areas of risk analyses, vulnerability assessments, incident response, security architecture, physical security, business continuity and disaster recovery, enterprise mobility, threat intelligence and analysis, security awareness and online safety, and resolution of highly.

Minimum educational experience is a Bachelor’s degree from an accredited university with the focus on Cybersecurity, Computer Science, Information Sciences or other comparable fields of study. Preference will be given to candidates with relevant industry certifications from CISSP, CISM, CIPP/CIPT/CIPT.

C.4.3 – Outreach support Labor Categories

C.4.3.A - Senior Analyst, Outreach Function

1. Provides recommendations regarding the quality of OCR’s outreach activities and develops mechanisms for OCR’s continuous improvement initiatives through the use of effective performance metrics, surveys, and other performance management tools.

2. Participates in outreach to stakeholders, provides media relations and performs special initiatives that provide creative and effective ways to maximize impact of OCR’s mission.

3. Provides recommendations to the OCR Director and Division Directors regarding outreach and media relations activities.

4. Assists in outreach events and initiatives undertaken by OCR’s divisions concerning Health and Human Services divisions, State and local governments, and private entities.

Makes recommendations to OCR Director and Division Directors.

5. Provides recommendations regarding the quality of OCR’s outreach activities and develops mechanisms for OCR’s continuous improvement initiatives through the use of effective performance metrics, surveys, and other performance management tools.

6. Advises senior officials within OCR on outreach activities.

7. Provides mission support, policy and regulatory impact analysis (RIA) to the OCR

8. Provides outreach activities, such as outreach to stakeholders, media relations and special specialized experience equivalent to the GS-15 level in the Federal Government

C.4.3.B - Management Analyst, Outreach Function

1. Provides consultation and recommendation regarding public awareness campaigns, education programs, and training curricula on mission activities under HHS programs for a multitude of audiences, including, but not limited to, health care entities, faith-based organizations, advocacy organizations, schools, colleges, and universities, and HHS grant recipients.

2. Assists in the development of and provides recommendations regarding effective liaison strategies in mission activities under OCR’s compliance and enforcement authorities with

HHS Operating Divisions, national advocacy, beneficiary, and provider groups, and to other Federal departments and agencies.

3. Assist in implementing OCR’s nationwide goals in outreach and provides advice to regional offices in developing and executing mission outreach programs.

4. Supports OCR officials with inter-governmental mission activities.

5. Assists in the development of press packages for roll outs, provides consultation regarding public relations matters and drafts speeches and articles for the OCR Director and Division Directors.

6. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities, the media, complainants, covered entities and business associates, advocacy groups, and other stakeholders as required.

7. Conducts presentations, trainings and provides information to audiences including members of the press and media utilizing materials approved by the Director of OCR or his/her designee.

American Bar Association (ABA) or a Bachelor’s degree from an accredited university or specialized experience equivalent to the GS-13/14 level in the Federal Government

C.4.3.C - Management Analyst, Outreach

1. Makes recommendations to the OCR Director and/or Division Directors about public awareness campaigns, education programs, and training curricula that support OCR’s mission.

2. Provides mission support, policy and regulatory impact analysis (RIA) to the OCR

3. Conducts and prepares materials for internal and external outreach, education, and training activities supportive of OCR’s mission.

4. Reviews outreach, education and training materials implicating the office’s mission and makes recommendations.

Minimum educational experience is a one-year law school completed from a law school accredited by the American Bar Association (ABA) or a Bachelor’s degree from an accredited university or specialized experience equivalent to the GS-12 level in the Federal Government.

C.4.4 – Administrative Support

C.4.4.A - Administrative Assistant II

1. Provides general administrative and analytical support.

2. Provides scheduling and calendar management services to specific executives as directed by the COR.

3. Conducts routine office functions with minimal direction.

4. Provides support to OCR with the day-to-day functions of the regional and/or headquarters offices.

5. Develops and/or maintains spreadsheets, reports, and other documents with minimal oversight.

6. Conducts routine office functions with minimal direction and has experience with a variety of computer applications, including Microsoft Word and Excel.

7. Excellent organizational, written, and oral communication skills are required.

8. Ability to produce, track and manage multiple deliverables with overlapping deadlines in a high-performing environment.

9. Experience working effectively within a team and independently in a busy environment.

10. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities, the media, complainants, covered entities and business associates, advocacy groups, and other stakeholders as allowed.

11. Provides logistical support as needed for the COR including assisting with preparing ordering lists for supplies and materials, managing property and equipment, preparing items for mail services, and other inherently general administrative functions.

Minimum educational experience is Bachelor’s degree from an accredited college/university or experience equivalent to the GS-11 level or higher in the Federal Government

C.4.4.B - Administrative Assistant I

1. Provides general administrative and analytical support.

2. Conducts routine office functions as directed.

3. Provides assistance to the OCR with the day-to-day functions of the regional and/or headquarters offices.

4. Maintains existing spreadsheets, reports, and other documents with minimal oversight.

5. Conducts routine office functions with minimal direction and has experience with a variety of computer applications, including Microsoft Outlook, Word and Excel.

6. Excellent organizational, written, and oral communication skills are required.

7. Ability to produce, track and manage multiple deliverables with overlapping deadlines in a high-performing environment.

8. Experience working effectively within a team and independently in a busy environment.

9. Provides logistical support as needed for the OCR including assisting with preparing ordering lists for supplies and materials, managing property and equipment, preparing items for mail services, and other inherently general administrative functions.

Minimum educational experience is an Associate’s degree from an accredited college/university or experience equivalent to the GS-9 level or higher in the Federal Government.

C.4.5 – Post-award Orientation If determined to be necessary by the Contracting Officer, and in accordance with FAR 42.5, the Contracting Officer will coordinate the post-award orientation between the Government and Contractor within thirty (30) days of award. The Contractor shall attend the post-award meeting which may be held virtually or in-person at the Government’s discretion not to place an undue burden on the Contractor.

C.5 SECURITY AND POSITION SENSITIVITY

To perform the work specified herein, contractor personnel will require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems. The Government anticipates the position sensitivity under this effort to be tier 2 Moderate Risk Public Trust.

INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY REQUIREMENTS

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/OS/OCR policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/OS/OCR and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [ ] Low [X ] Moderate [ ] High Integrity: [ ] Low [X ] Moderate [ ] High Availability: [ ] Low [X ] Moderate [ ] High Overall Impact Level: [ ] Low [X ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/OS/OCR regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/OS/OCR Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/OS/OCR security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OS/OCR privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within a time acceptable to the COR and Contractor and after completion of the PTA and in accordance with

HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and OCR policies. Unauthorized disclosure of information will be subject to the HHS/OS/OCR sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents provided by HHS/OS/OCR COR to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR. The delivery date will be within ten (10) days of the compliance confirmation.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/OpDiv Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete OCR Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual OpDiv Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/OCR IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send OCR approved notifications to affected individuals within the timeframe specified by the

COR.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT), COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US- CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv.…