75P00124Q00051.pdf

SEE ADDENDUMIS CHECKED

CODE 18a. PAYMENT WILL BE MADE BY

CODE

FACILITYCODE

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

OFFEROR

OAMS

See Schedule

OS-ONC-SWITZER BLDG CODE 16. ADMINISTERED BYCODE

X

X

541720

SIZE STANDARD:

% FOR:SET ASIDE:UNRESTRICTED OROAMS

REQUEST FOR

PROPOSAL

(RFP)

INVITATION

FOR BID (IFB)

10. THIS ACQUISITION ISCODE

REQUEST FOR

QUOTE (RFQ)

14. METHOD OF SOLICITATION

13b. RATING

NORTH AMERICAN INDUSTRY

CLASSIFICATION STANDARD

(NAICS):

SMALL BUSINESS

05/30/2024 1600 ET

05/21/2024

CHRISTOPHER POULOS

(No collect calls)

INFORMATION CALL:

FOR SOLICITATION 8. OFFER DUE DATE/LOCAL TIMEb. TELEPHONE NUMBER a. NAME

4. ORDER NUMBER3. AWARD/ 6. SOLICITATION

75P00124Q00051

5. SOLICITATION NUMBER

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS 1. REQUISITION NUMBER PAGE OF

1 76 OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

TELEPHONE NO.

17a. CONTRACTOR/

See Schedule

15. DELIVER TO

Rockville MD 20857 15E 10D 5600 Fishers Lane Office of Acquisition Management Services

9. ISSUED BY

7.

2. CONTRACT NO.

EFFECTIVE DATE

$28

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW

ISSUE DATE

DELIVERY FOR FREE ON BOARD

(FOB) DESTINATION UNLESS

BLOCK IS MARKED

11.

SEE SCHEDULEX

12. DISCOUNT TERMS THIS CONTRACT IS A RATED

ORDER UNDER THE DEFENSE

PRIORITIES AND ALLOCATIONS

SYSTEM - DPAS (15 CFR 700)

13a.

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

(SDVOSB)

HUBZONE SMALL

BUSINESS

8(A)

OS/ASA/OAMS

WOMEN-OWNED SMALL

BUSINESS (WOSB)

ECONOMICALLY DISADVANTAGED

WOMEN-OWNED SMALL

BUSINESS (EDWOSB)

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

ADMINISTERED BY:

OS/ASA/OAMS

Office of Acquisition Management Services 5600 Fishers Lane 15E 10D Rockville MD 20857 USA

DELIVER TO:

OS-ONC-Switzer Bldg Department of Health and Human Serv Office of the National Coordinator Continued ...

(Use Reverse and/or Attach Additional Sheets as Necessary)

HEREIN, IS ACCEPTED AS TO ITEMS:

DATED

CHRISTOPHER W. POULOS

. YOUR OFFER ON SOLICITATION (BLOCK 5),

INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE SET FORTH

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DELIVER

ARE

ARE

31c. DATE SIGNED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (Type or print)

ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY ADDITIONAL

SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

27a. SOLICITATION INCORPORATES BY REFERENCE (FEDERAL ACQUISITION REGULATION) FAR 52.212-1, 52.212-4. FAR 52.212-3

AND 52.212-5 ARE ATTACHED. ADDENDA

26. TOTAL AWARD AMOUNT (For Government Use Only)

OFFER

STANDARD FORM 1449 (REV. 11/2021)

Prescribed by GSA - FAR (48 CFR) 53.212

ARE NOT ATTACHED.

ARE NOT ATTACHED.

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

30b. NAME AND TITLE OF SIGNER (Type or print)

30a. SIGNATURE OF OFFEROR/CONTRACTOR

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

25. ACCOUNTING AND APPROPRIATION DATA

29. AWARD OF CONTRACT: REFERENCE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32c. DATE 32b. SIGNATURE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED:

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

40. PAID BY39. S/R VOUCHER NUMBER38. S/R ACCOUNT NUMBER

37. CHECK NUMBER

FINALPARTIAL

36. PAYMENT

FINALPARTIAL

35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER33. SHIP NUMBER

COMPLETE

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

42d. TOTAL CONTAINERS42c. DATE REC'D (YY/MM/DD)

42b. RECEIVED AT (Location)

42a. RECEIVED BY (Print)

41c. DATE41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

STANDARD FORM 1449 (REV. 11/2021) BACK

24.

AMOUNT

23.

UNIT PRICE

22.

UNIT

21.

QUANTITY

20.

SCHEDULE OF SUPPLIES/SERVICES

19.

ITEM NO.

330 C Street SW Rm 1200

Washington DC 20201 US

Delivery: 07/01/2024

Period of Performance: 07/01/2024 to 06/30/2026

1 Base

National Survey of Digital Health Companies

Additional information included in Continuation

Pages

32f. TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT REPRESENTATIVE

76 2 of

75P00124Q00051 National Survey of Digital Health Companies

SECTION A - Solicitation/Contract Form

Solicitation to establish a Contract to perform the work described in Section C, entitled, “Statement of Work.”

SECTION B - Supplies or Services and Prices/Costs

B.1 BRIEF DESCRIPTION OF SERVICES

This contract will provide ONC with policy-relevant information on digital health companies’ use of various API technologies, experiences with EHR integration, and related challenges faced by these companies.

B.2 TYPE OF CONTRACT

The contract type awarded is a firm fixed price contract.

B.3 NONSEVERABLE SERVICES

The services specified in each contract line item (CLIN) have been determined to be nonseverable services - a specific undertaking or entire job with a defined end product of value to the Government.

B.4 CONSIDERATION AND PAYMENT (Fixed Price – Separate Nonseverable Services Components)

In consideration of satisfactory performance of the work as described throughout this contract, the Contractor shall be paid a fixed price for each CLIN (if exercised). If the options are exercised subsequent year funding will be obligated by modification to the contract. The base period and option periods are priced as follows:

CLIN 1 – Services Component 1:

This is a line item for nonseverable services. The end product of value is specified in Section C.

Fixed Price: ______________

SECTION C - Description/Specifications/Statement of Work

National Survey of Digital Health Companies

C.1 PROGRAM DESCRIPTION AND BACKGROUND

C.1 .1 BACKGROUND

The 21st Century Cures Act (Cures Act) was enacted in 2016 with the aim of improving the exchange of electronic health access, including exchange that allowed both patients and providers greater access to health information for decision-making. This legislation emphasized the importance of patient access to their health information and stressed the usefulness of APIs in enabling this access. The subsequent ONC Cures Final Rule (2020) further set the stage for adoption of APIs by underscoring the use of standardized APIs to allow for streamlined exchange, specifying the FHIR (Fast Healthcare Interoperability Resources) standard as the gold standard for healthcare APIs. The Final Rule also instituted criteria for certifying Health IT to these API standards.

Numerous digital health companies develop apps and other health IT tools that allow for human interaction with APIs to exchange healthcare information – this includes both providers and patients. Previous studies of digital health companies’ adoption of and experiences with APIs have found that a large portion of companies are using standards-based APIs to interoperate with EHRs and highlight opportunities to collect policy suggestions from these same companies.

However, it is important to continue tracking the use of these technologies and related experiences over time. Examining the early and ongoing impacts of the implementation of the health IT provisions of the Cures Act is critical to informing ONC’s policy efforts. Digital health companies’ product development processes are directly impacted by ONC policy related to APIs, and these companies are uniquely poised to provide insight into challenges with using these APIs and aspects of standards that require improvement.

C1.1 Past Surveys of Digital Health Companies

ONC conducted a survey of digital health companies assessing implementation of and experiences with healthcare APIs in 2022; findings from this survey work are published in the Journal of the American Medical Informatics Association. Prior to this work, the California Health Care Foundation (CHCF) had conducted surveys of digital health companies in 2016, which highlighted barriers to integrations with EHRs experienced by the companies surveyed, and in 2018, focusing in on companies’ API implementations. The survey fielded in 2022 was developed and received responses from 141 digital health companies nationwide, a greater number of respondents than previous similar surveys.

C1.2 Current Measurement Approach

ONC fielded a survey of digital health companies to assess digital health companies’ use of and experiences with adopting APIs to integrate with EHRs for the first time from June – November 2022. ONC finds it essential to continue supporting this effort to survey digital health companies to track adoption of novel exchange technologies, identify barriers to companies’ integrations with EHRs, and highlight opportunities for federal health IT policy. Furthermore, ONC anticipates including many of the same items from the survey fielded in 2022 in this subsequent survey of digital health companies to allow for longitudinal tracking of the implementation of https://academic.oup.com/jamia/advance-article/doi/10.1093/jamia/ocae006/7590608 https://www.slideshare.net/health2dev/health-20-emr-api-report https://www.slideshare.net/health2dev/helath-20-emr-api-report-2018

Cures Act health IT provisions.

C.1.2 PURPOSE

The purpose of this contract is to develop a national survey of digital health companies.

C.1.3 STATEMENT OF WORK

This survey will help ONC to better understand:

• Companies’ adoption of various types of API technologies for EHR integration

• Use of the FHIR standard

• Status of integrations with EHRs, as well as the EHR vendors with which companies have integrated their products

• Critical factors that affect companies’ abilities to work successfully with EHR APIs

• Barriers experienced by companies to integrate products with EHRs using APIs

• Underlying characteristics of digital health companies

• Perceived benefit of federal health IT policy

• Desired improvements to API standards and relevant federal health IT policy

Gaining insights into each of these domains is essential in supporting efforts to enable interoperability and exchange.

To achieve the purpose stated above, the Contractor shall perform but is not limited to the following:

C.1.3.1 Task 1 – Administrative Requirements

Kickoff Meeting The contractor shall schedule a kickoff meeting no later than 5 business days after being awarded the contract. The contractor shall prepare a meeting agenda to be sent to the Contracting Officer’s Representative (COR) no later than 1 business day before the meeting and prepare a meeting summary to be sent to the COR no later than 3 business days after the meeting. The contractor shall attend the kickoff meeting, which may include discussion topics such as the purpose of the contract, deliverables, and the Project Work Plan.

Deliverable 1: Kickoff meeting, agenda, and summary Status Update Meetings The contractor shall meet on a bi-weekly basis with the ONC COR and SMEs; prepare a meeting agenda to be sent to the COR no later than 1 business day before each meeting; and prepare a meeting summary to be sent to the COR no later than 3 business days after each meeting. The contractor shall also provide bi-weekly verbal report during status update meetings summarizing progress of the data collection, such as response rate, number of respondents, and success of follow-up efforts.

All meetings shall be virtual unless otherwise specified and agreed upon by the contractor and the COR.

Deliverable 2: Status update, meeting agenda, summary, and verbal report

Project Work Plan

The contractor shall maintain regular communications and meetings with the COR and develop a Project Work Plan and monitor progress on an ongoing basis. The contractor shall submit a draft Project Work Plan no later than 10 business days after being awarded the contract. The COR will provide feedback on the draft Project Work Plan within one week after receiving it. The contractor shall provide a final Project Work Plan within two weeks after receiving the COR’s feedback.

The Project Work Plan shall include a detailed timeline for accomplishing the requirements of Task 2 that includes, but is not limited to:

• Detailed breakdown of the steps required to successfully complete Task 2

• Milestones and sub-milestones to measure progress that can be demonstrated to and verified by the COR;

• Timeline of steps, milestones, and sub-milestones, with responsible individuals/entities;

• List of critical dependencies on which the contractor expects to be reliant on the government, including the dates by which those issues should be resolved.

Deliverable 3: Project work plan

Monthly Progress Report

The contractor shall document the efforts performed and status of each task in a detailed Progress Report due on or before the 15th of each month. Reporting requirements will be outlined at the kickoff meeting.

The Progress Report shall include, at a minimum:

• Project status, including objectives met, work completed, and notable achievements as specified in the Project Work Plan/SOW;

• Work outstanding, including plans and milestones for the next month, as specified in the Project Work Plan;

• Overall status of deliverables/milestones;

• Current and anticipated issues/risks/obstacles impeding progress and recommended solution/mitigation strategies;

• Resource planning/status;

• Estimate of the tools and/or resources needed in the coming month to accomplish the

Project Work Plan’s objectives;

• Any dependencies related to the government’s upcoming responsibilities;

• Topics or issues identified by the COR.

Deliverable 4: Monthly progress report

C.1.3.2 Task 2 – Survey Development, Fielding, and Reporting

Survey Methodology Selection and Plan

The contractor shall determine appropriate survey methodology to obtain national survey results and submit a plan summarizing the proposed approach. The contractor shall develop a Survey

Methodology Plan that includes but is not limited to: the sampling frame, determining the most appropriate respondent, determining the sample size and potential response rate, and appropriate data collection methods. The contractor shall submit the Survey Methodology Plan within 1 month of award to COR for review and approval.

The sampling frame shall consist of all digital health companies nationwide that develop solutions that enable human interaction with an API. For example, such companies may include those that develop provider-facing apps that access clinical data or patient-facing apps that access clinical or non-clinical data. The contractor shall compile a complete list of intended respondents and their contact information; the respondent identified at each company shall be knowledgeable of the topics posed in the survey. The contractor shall determine the appropriate methods to achieving a high response rate (50% or above), which will be critical to the success of the survey.

Deliverable 5: Survey methodology plan

Survey Content Update and Development

The contractor shall update and revise survey content and develop new survey items. The contractor shall review and update survey content to align with ONC priorities. Additionally, the contractor shall analyze past response rate at the item level. Based upon these activities, the contractor shall make recommendations regarding which items to include to ensure trending on key measures and which items to drop that did not work well in the prior survey. Discussions with the COR shall be conducted to assess whether there are other key health information exchange technologies or challenges that would be relevant to include in the survey (besides the topics identified in this SOW).

The COR shall review the contractor’s recommendations and provide feedback to the Contractor.

Based on the collective feedback, the contractor shall develop an initial draft of the survey.

Deliverable 6: Draft Survey

Cognitive Testing and Pilot Survey

The contractor shall cognitively test new or revised survey items, pilot test the survey with potential respondents, and refine the survey. Once a full draft of the survey is developed, the contractor shall cognitively test any new survey items with potential respondents. In addition, the testing shall consist of obtaining input from potential respondents on the wording of the survey items to make sure they are understandable and appropriate. The results of the cognitive testing must be used to further revise or determine whether the item(s) should be included in the survey.

Once this process is complete, the entire survey must be pilot tested with potential respondents (digital health company CTOs). The contractor shall estimate survey completion time (for the OMB burden estimate). Finally, the pilot testing should also solicit input on the proposed data collection methods to ensure that they will obtain a high response rate. The contractor shall prepare a brief report summarizing the results of the pilot testing and recommendations to modify the survey and methodology based on the pilot testing. The contractor shall modify the survey based upon the results of the cognitive and pilot testing, creating the final version of the survey.

Deliverable 7: Summary report Deliverable 8: Create final version of survey, incorporating results of cognitive and pilot testing.

Office of Management and Budget (OMB) Package

The contractor, working closely with the COR, shall develop a full OMB package for submission. The contractor shall make revisions based on OMB comments to obtain OMB approval for conducting the survey.

Deliverable 9: Draft OMB package Deliverable 10: Final OMB Package

Field the Survey

The contractor shall field the survey using the ONC approved methodology. The data collection and fielding period will be long enough to ensure adequate time for the respondent to answer the survey and will include follow-up with non-respondents to achieve at least a 50% response rate.

Data Delivery

The contractor shall provide data in a secure manner and in a format that can be imported into a standard statistical software package such as STATA or Statistical Analysis System (SAS). The contractor shall clean the data ensuring the data is properly formatted enabling analysis.

The contractor shall create two separate files: 1) a file for the COR that includes identifying information for respondents but excludes any information that has been designated to be specifically confidential (e.g., financial information) and 2) a de-identified file that can be shared publicly. The de-identified file will remove responses to any questions (e.g., any geographic information) that could identify a particular respondent. This file shall be shared with the COR to be made available on ONC’s public website.

The data shall be sent in a secure manner to the COR (i.e., encrypted). The contractor shall provide the COR with proper documentation, including a codebook, so that the COR may easily analyze and interpret the data provided.

Deliverable 11: Provide survey data and documentation to the COR as described above.

Data Analysis and Reporting

The contractor shall analyze and report on survey results. The contractor shall conduct descriptive analyses to compare respondents to non-respondents, examine item non-response, and provide national estimates on the survey items. The contractor shall also stratify descriptive results by digital health company characteristics. The results of these analyses shall be shared in a presentation to the COR.

The analyses and presentation may summarize and describe key results, such as:

• Proportion of digital health companies using standards-based versus proprietary APIs to integrate with EHRs and assess trends over time (using data from the survey fielded in 2022).

• Proportion of companies whose products integrate with a variety of EHR vendors and garner a better understanding of the number of EHRs with which companies interoperate.

• Identify the most important factors that allow companies to work successfully with EHR APIs (e.g. technical performance, breadth of data elements) and major barriers to API integrations.

• Summarize digital health company characteristics.

Deliverable 12: Presentation of Survey Results

C.4 INFORMATION SECURITY AND/OR PHYSICAL ACCESS SECURITY

REQUIREMENTS

Important Note to Contractor: In the event of a discrepancy between the following language and included HHSAR clauses, the HHSAR clauses take precedence.

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/[OpDiv] policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/[OpDiv] and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [X ] Low [ ] Moderate [ ] High Integrity: [X ] Low [ ] Moderate [ ] High Availability: [X ] Low [ ] Moderate [ ] High Overall Impact Level: [X ] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS policies. Unauthorized disclosure of information will be subject to the HHS sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6) available at https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR [OpDiv-provided delivery date].

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

vi. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the OpDiv non-disclosure agreement. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition..

http://csrc.nist.gov/publications/

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/OpDiv Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual OpDiv Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send HHS approved notifications to affected individuals.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT), COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US- CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the

Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/OpDiv and privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

5. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

6. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Note to the Requiring Activity Representative: For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

7. Roster

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within [OpDiv Specific timeline] of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within [OpDiv Specific timeline] of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology or [insert OpDiv-specific requirement] and in accordance with the HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

https://www.dhs.gov/homeland-security-presidential-directive-12

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation [enter OpDiv-specific requirements] to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified in the Contractor Employee Separation Checklist when an employee terminates work under this contract within at the time of the employee's exit from the contract. All documentation must be available to the CO and/or COR upon request

9. Records Management and Retention

a. The Contractor (and/or any subcontractor) must maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS Policy for Records Management policies and must not dispose of any records unless authorized by HHS.

b. In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, he/she must document and report the incident in accordance with HHS policies.

10. High Value Asset (HVA)

If a system is identified as HVA, the contractor must comply with the HHS Policy for the High Value Asset (HVA) Program and the DHS HVA Control Overlay in addition to the above requirements.

C.5 PROCUREMENTS INVOLVING GOVERNMENT INFORMATION PROCESSED ON

GOCO OR COCO SYSTEMS

Important Note to Contractor: In the event of a discrepancy between the following language and included HHSAR clauses, the HHSAR clauses take precedence.

1. Security Requirements for GOCO and COCO Resources

a. Federal Policies. The Contractor (and/or any subcontractor) must comply with applicable federal laws and HHS policies that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P); Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, latest revision, Security and Privacy Controls for Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies.

b. Assessment and Authorization (A&A). A valid authority to operate (ATO) certifies that the Contractor's information system meets the contract's requirements to protect the agency data. If the system under this contract does not have a valid ATO, the Contractor (and/or any subcontractor) must work with the agency and supply the deliverables required to complete the ATO within the specified timeline(s). The Contractor must conduct the A&A requirements in accordance with HHS IS2P/ [Insert OpDiv policy if any], NIST SP 800-37, Guide for Applying the Risk Management Framework to Information Systems: A Security Life Cycle Approach (latest revision), NIST SP 800-53B, Control Baselines for Information Systems and Organizations, and the NIST SP 800-53A (latest revision).

ONC acceptance of the ATO does not alleviate the Contractor's responsibility to ensure the system security and privacy controls are implemented and operating effectively.

i. A&A Package Deliverables - The Contractor (and/or any subcontractor) must provide an A&A package to the CO and/or COR. The following A&A deliverables are required to complete the A&A package:

System Security Plan (SSP) - The SSP must comply with the NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, the Federal Information Processing Standard (FIPS) 200, Recommended Security Controls for Information Systems, and NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline requirements, and other applicable NIST guidance as well as HHS policies and other guidance. The SSP must be consistent with and detail the approach to IT security contained in the Contractor's bid or proposal that resulted in the award of this contract. The SSP must provide an overview of the system environment and security requirements to protect the information system as well as describe all applicable security controls in place or planned for meeting those requirements. It should provide a structured process for planning adequate, cost-effective security protection for a system. The Contractor must review and update the SSP at least annually thereafter and if requested, provide a copy of the updated SSP.

Security Assessment Plan/Report (SAP/SAR) - The security assessment must be conducted by ONC assessor and be consistent with NIST SP 800-53A, NIST SP 800-30, and HHS and OpDiv policies. The assessor will document the assessment results in the

SAR.

Thereafter, the Contractor, in coordination with HHS must assist in the assessment of the security controls and update the SAR at least annually. A copy of the updated SAR should be provided if requested.

Independent Assessment - The Contractor (and/or subcontractor) must have an independent third-party validate the security and privacy controls in place for the system(s) commensurate with the risk levels per NIST SP 800-53B. The independent third party must review and analyze the Security Authorization package, and report on technical, operational, and management level deficiencies as outlined in NIST SP 800-53. The Contractor must address all "high" deficiencies before submitting the package to the Government for acceptance and document all remaining deficiencies in a system Plan of Actions and Milestones

(POA&M).

POA&M - All critical-risk weaknesses must be mitigated within 15 days, high-risk weaknesses must be mitigated within 30 days, medium weaknesses must be mitigated within 90 days, and low weaknesses must be mitigated within 180 days,from the date the weaknesses are formally identified and documented. HHS will determine the risk rating of vulnerabilities.