Task Order 1_Revised__Amendment 0006.pdf

IDIQ – Task Order #1

C.4 - TASK AREAS

Task Area 1 - Mission and Policy Subject Matter Experts: The Contractor shall provide mission support services for policy analysis and provide recommendations and advice regarding the development and implementation of OCR’s mission. The Contractor shall provide regulatory impact analysis (RIA) to support OCR through the decision-making process for promulgating new and existing regulations. The senior level categories described in this area assume a deep level of expertise which generally accompanies years of experience as a senior level employee (equivalent to a GS 15 or higher if federal) within an organization.

Task Area 2 – Investigation: The Contractor will provide subject matter experts in compliance investigations to carry out investigations of complaints and compliance reviews concerning Health and Human Services divisions, State and local governments, and private entities.

The Contractor will support regional and headquarter staff by independently reviewing and assessing information security data from HIPAA covered entities and business associates to assess the effectiveness of their security programs and safeguarding of protected health information

C.4.1 – Senior Advisor Labor Categories

C.4.1.B – Senior Advisor (Disability)

1. Provides subject matter expert advice on mission support issues of policy, impact of administrative rules, compliance, and enforcement mechanisms for OCR’s disability portfolio, including Section 504 of the Rehabilitation Act, the Americans with Disabilities Act, or the Olmstead/community integration initiative. As directed by the COR, carries out activities in support of OCR’s mission, program goals, and strategic objectives

2. Provides expert consultation in the form of research, briefings, and written documents on OCR’s disability portfolio for the OCR Director and Deputy Directors.

3. Provides recommendations on OCR’s disability portfolio applying OCR’s mission activities, program goals, and strategic objectives affecting OCR to the OCR Director and Deputy Directors.

4. Provides recommendations regarding improving the quality and efficiencies of

OCR’s Olmstead/community integration initiative or other disability nondiscrimination projects, activities, and mission. Coordinates with OCR leaders to evaluate program efficiencies, identify areas of overlap, and provides and implements recommendations for improvements and/or consolidation of workstreams.

5. Conducts outreach activities on OCR’s disability portfolio such as outreach to stakeholders, media relations and special initiatives to maximize the impact of OCR’s mission activities, program goals and strategic objectives.

Education: Minimum educational experience is a law degree (J.D.) from a law school accredited by the American Bar Association (ABA) or a Master’s degree from an accredited university, plus four years of specialized experience addressing disability discrimination and related matters. For example, state Medicaid programs and waivers that support home and community-based services, experience with working as an expert consultant or expert witness in an Olmstead matter, or experience in the federal rulemaking process. Must have expert understanding of disability discrimination or the service needs of a person with disabilities.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to at least four years specialized experience equivalent to the GS-15 level in the Federal Government.

C.4.1.C – Senior Advisor (HIPAA)

1. Provides subject matter expert advice on mission support issues of policy, impact of administrative rules, compliance, and enforcement mechanisms related to OCR’s HIPAA Privacy and Security Rules and Cyber Security initiative. As directed, carries out activities in support of OCR’s mission, program goals, and strategic objectives.

2. Provides expert consultation in the form of research, briefings, and written documents on OCR’s HIPAA Privacy and Security Rules and Cyber Security for regulatory impact analysis (RIA) to the OCR Director and Deputy Directors.

3. Provides recommendations related to OCR’s HIPAA Privacy and Security Rules and Cyber Security initiative applying OCR’s mission activities, program goals, and strategic objectives affecting OCR to the OCR Director and Deputy Directors.

4. Provides recommendations regarding improving the quality and efficiencies of

OCR’s HIPAA and Cyber Security projects, activities, and mission. Coordinates with OCR leaders to evaluate program efficiencies, identify areas of overlap, and provides recommendations for improvements and/or consolidation of workstreams.

5. Conducts outreach activities on OCR’s HIPAA and Cyber Security initiatives such as outreach to stakeholders, media relations and special initiatives to maximize the impact of OCR’s mission activities, program goals and strategic objectives.

Education: Minimum educational experience is a master’s degree from an accredited university with the focus on Cybersecurity, Computer Science, Information Sciences, or other comparable fields of study, plus four years of specialized experience with Cyber Security equivalent to the GS-15 level in the Federal Government. Preference will be given to candidates with relevant industry certifications from CISSP, CISM, CIPP/CIPT/CIPT.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to four years specialized experience equivalent to the GS-15 level in the Federal

C.4.1.D – Senior Advisor (Language Access)

1. Lead efforts to establish language access compliance policies and processes, including procurement, software and web development, content development and publication, and oversight of HHS websites and other digital properties.

2. Review and provide feedback and guidance on Operating and Staff Divisions’ proposed language access policies, procedures, and activities.

3. Centralize language access resources and promoting language access directives across the Department; improving awareness by staff of the Department’s telephonic language service, translation services, and other language services and contracts that may be used by all HHS Operating and Staff Divisions; working with public-facing components to provide assistance in making programs more language accessible; and ensuring appropriate Department-wide consistency in the language access policy.

4. Collaborate with HHS Operating and Staff Divisions in developing and overseeing the creation of:

• a centralized unit for HHS Operating and Staff Divisions to obtain interpreters or translations, including an inventory of internal resources such as existing translation and interpretation contracts.

• an intra-agency working group on language access, with representatives from HHS Operating and Staff Divisions that most commonly interact with the public, to ensure a consistent approach to providing language assistance.

• an internal repository of commonly translated documents.

• a department-wide translation glossary of common legal terms in at least the top 15 languages spoken by LEP individuals.

• standard language assistance notices, flyers, and posters for use by HHS

Operating and Staff Divisions.

• template web pages or web standards to help HHS Operating and Staff

Divisions post translated content for LEP communities.

• guidance on identifying documents for translation and targeting languages for translation.

• translations of the Department’s most common publicly accessed webpages into Spanish, and will consider translation into additional common languages of LEP individuals in the United States, in the relevant geographic region, or in the relevant subject matter audience; and

• guidance and technical assistance for HHS Operating and Staff Divisions, as appropriate, on their ongoing language access needs.

5. Establish partnerships with other language access coordinators throughout the federal government to assist in meeting language access goals and objectives.

6. Coordinate outreach regarding language access services and develop and deliver language access training to ensure staff receive appropriate role-based training.

7. Coordinate and facilitate meetings of the HHS Language Access Steering

Committee (LASC); oversee deliverables from the LASC; field questions from LASC subcommittees; and support implementation and updating efforts regarding the HHS Language Access Plan and the language access plans of HHS Operating and Staff Divisions.

8. Provide guidance to technology providers, acquisition teams, communications and training groups, civil rights and language access officials, human resources staff, legal staff, and other Federal language access services contacts.

Education: Minimum educational experience is a bachelor’s degree from an accredited university with the focus on international relations, plus at least four years of relevant, specialized experience equivalent to the GS-15 level in the Federal Government. Certifications in translations and interpretations preferable.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to four years specialized experience equivalent to the GS-15 level in the Federal

C.4.1.E - Executive Consultant/Program Manager

1. Serves as the Point of Contact with the contracting entity when issues or projects require the designation of a team lead for work areas as referenced elsewhere in this SOW.

2. Provides consultation regarding policy development, administrative rule making, compliance and enforcement activities, inter- and intra-agency coordination, outreach to stakeholders, media relations and special initiatives that provide creative and effective ways to maximize impact in these areas.

3. Supports the OCR Director in garnering support for OCR’s mission activities, program goals, and strategic objectives.

4. Advises senior policy officials within OCR and throughout HHS on mission activities and policies. Coordinates with OCR leaders to identify areas of overlap and ensure integration of the office’s mission in day-to-day operations.

5. As needed and directed by the COR, conducts outreach actives described in section C.4.4.A.

6. As needed and directed by the COR, manages other contractor staff when designated and conducts mission support activities as described in labor categories C.4.1.A – C.4.6.F

Education: Minimum educational experience is a law degree (J.D.) from a law school accredited by the American Bar Association (ABA) or a Bachelor’s degree from an accredited university, plus four years of specialized experience in a field which equips the applicant with the knowledge, skills, and abilities necessary to do the work of the position.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to four years specialized experience equivalent to the GS-15 or SES level in the Federal

C.4.2 – Program Area support Labor Categories

C.4.2.B - Management Analyst III (Disability)

1. Provides project management and develops and implements processes to improve OCR’s disability portfolio, including under Section 504 of the Rehabilitation Act, the ADA, or the Olmstead/community integration initiative, compliance and enforcement authorities regarding case investigations, conduct of compliance reviews, and case resolution and enforcement strategies concerning Health and Human Services divisions, State and local governments, and private entities, or related policy goals.

2. Provides mission support, policy, and regulatory analysis on OCR’s disability portfolio to the OCR Director and Deputy Directors on issues of policy, impact of administrative rules, compliance, and enforcement mechanisms.

3. Provides input for OCR’s disability portfolio on the implementation of policies and procedures under OCR’s compliance and enforcement authorities.

4. Provides high-quality research and analysis for OCR’s disability portfolio by processing and investigating cases, conducting compliance reviews in support of OCR’s nationwide goals.

5. Supports OCR officials’ intra- and inter-agency efforts regarding OCR’s disability portfolio to develop, coordinate and implement mission activities.

6. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities, complainants, covered entities and business associates, advocacy groups, and other stakeholders as required.

7. Provides outreach activities on OCR’s disability portfolio such as outreach to stakeholders, media relations and special initiatives to maximize the impact of OCR’s mission activities, program goals and strategic objectives.

Education: Minimum educational experience is a law degree (J.D.) from a law school accredited by the American Bar Association (ABA) or a Master’s degree from an accredited university, plus at least three years of specialized experience with addressing disability discrimination and related matters. For example, state Medicaid programs and waivers that support home and community-based services, experience with working as an expert consultant or expert witness in an Olmstead matter, or experience in the federal rulemaking process. Must have expert understanding of disability discrimination or the service needs of a person with disabilities.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to at least four years of specialized experience equivalent to the GS-13/14 level in the Federal Government.

C.4.2.E - Management Analyst I

1. Provide mission support and policy analysis services to the COR in developing case-related guidance for front-line OCR investigators and makes recommendations regarding regional operations to ensure consistency in compliance activities and application of policies and administration.

2. Conducts and analyses HHS program-related research.

3. Provides general administrative and analytical support to the divisions and/or regions.

4. Develops a system for tracking the goals and accomplishments of the divisions and/or regions.

5. Develops spreadsheets, analyzes information, and provides reports. The spreadsheets should track complaints, information about covered entities and relevant stakeholders, and information needed to meet reporting requirements for

OCR.

6. Interfaces with appropriate staff within OCR to get needed information and arrange meetings.

7. Provides logistical support for division and/or regional activities.

Education: Minimum educational experience is an associate degree from an accredited university, plus one year of specialized experience in a field which equips the applicant with the knowledge, skills, and abilities necessary to do the work of the position.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to four years of specialized experience equivalent to the GS-9/11 level in the Federal

C.4.3 – Investigatory Labor Categories

C.4.3.A – HIPAA Subject Matter Experts/Technical Analyst

1. Reviews security and privacy complaints, data breach notification and cybersecurity incident reports, and other correspondence and evidence to determine whether the complaint, self-report or breach notification report indicates non-compliance with the HIPAA Security Rule. Reviews data provided by the healthcare organizations across the nation to assess the overall impact of security and privacy incidents.

2. Provides subject matter expertise with evaluating and determining the technical sufficiency of submissions from HIPAA covered entities and business associates in response to data and documentation requests (i.e. Assessing reports related to security baselines, penetration tests, vulnerability assessments, and digital forensics).

3. Document processes, standard operating procedures and system requirements;

develops reports summarizing the analysis along with formulating recommendations for OCR to consider for future action.

4. Develops written reports with technical security analyses, summaries, and recommendations for action, reports on root causes of problems, efficiency, and support needs.

5. Provides expertise in the development and evaluation of health information privacy policies and technologies, specifically regarding protected health information; de-identified / re-identified health information; limited data sets.

6. Provides subject matter expert analysis, evaluation, and recommendations based on national security standards (NIST), industry best practices (ISO) and implementation specifications of the HIPAA Security Rule.

7. Provides expert guidance in designing, implementing, and managing information security, data protection, and risk management programs, including policies, procedures, and controls for protected health information based on HIPAA requirements.

8. Provides advisory expertise in the areas of risk analyses, vulnerability assessments, incident response, security architecture, physical security, business continuity and disaster recovery, enterprise mobility, threat intelligence and analysis, security awareness and online safety, and resolution of highly.

Education: Minimum educational experience is bachelor’s degree from an accredited university with the focus on Cybersecurity, Computer Science, Information Sciences, or other comparable fields of study, plus two years of specialized experience with Cyber Security equivalent to the GS-13/14 level in the Federal Government.

Preference will be given to candidates with relevant industry certifications from

CISSP, CISM, CIPP/CIPT/CIPT.

Combination of Education and Experience: A combination of education and experience may be used to qualify for this position. Experience must be equivalent to four years of specialized experience equivalent to the GS-13/14 level in the Federal

C.4.6 – Post-award Orientation

If determined to be necessary by the Contracting Officer, and in accordance with FAR 42.5, the Contracting Officer will coordinate the post-award orientation between the Government and Contractor within thirty (30) days of award. The Contractor shall attend the post-award meeting which may be held virtually or in-person at the Government’s discretion not to place an undue burden on the Contractor.

C.4.7 Project Deliverables

C.4.7.A

1. The contractor shall provide the COR with electronic files of all developed material. Reports and other materials should be prepared using Word, Excel or Access. Project Plans shall be delivered in Microsoft Project. Graphics materials should be delivered using Adobe projects. If other software programs will be used, COR approval must be obtained. All data files, original artwork, disks, and other media materials produced as a result of this contract shall be delivered to the COR. Electronic versions should also be provided to the COR.

The contractor shall obtain COR approval before delivering products using cloud solutions.

2. Media materials prepared for the OCR website should be formatted so that they can be downloadable, and 508 compliant. Electronic files shall meet HHS specification for reproduction by a printer. The contractor shall work with the COR to resolve any problems with files prior to the acceptance of final deliverables by the COR. All media materials produced under this contract must be submitted first to the COR and shall not be released without COR approval.

3. Meetings or conference calls with the COR shall be held as needed to discuss specific information or needs and project progress and provide information.

Meetings shall be held telephonically and/or at HHS headquarters in Washington, D.C.

SECURITY AND POSITION SENSITIVITY

To perform the work specified herein, contractor personnel will require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems. The Government anticipates the position sensitivity under this effort to be Public Trust Level 5.

REPORT(S)/DELIVERABLES AND DELIVERY SCHEDULE

Item No.

Deliverable Deliverable Recipient

Objective Due

1 Post-Award Meeting

CO and

COR

Provide processes and expectations with the Contracting Officer and contract awardee

TBD

2 Weekly Status Reports

COR Report documenting tasks & issues weekly. Include general summarized activities for all contractors and amount of time applied for each division with OCR

Weekly, every Friday by 3:00 pm (EDST) until the contract is completed

3 Bi-Weekly Funds Status Report

CO and

COR

Provide bi-weekly status of funds report to CO and COR. Reports should include a burn rate showing how funds are spent.

Bi-weekly, every Friday by 3:00 pm (EDST) until the contract is completed

4 Monthly Summary

COR Report documenting labor and funds remaining and provides overview of case activity for the month

Last day of every month, by Friday by 3:00 pm (EDST) until the contract is completed

5 Editorial Review

COR Expert review of outreach content products

TBD

6 Technical facilitation

COR Accreditation of final products for outreach

TBD

7 Administrative and Mission support

COR Provide administrative and analytical support for OCR’s mission activities

TBD

8 Regulatory Impact Analysis

COR Provide consultation regarding cost analysis of notices of proposed rulemaking, administrative rule making and drafts regulatory comments reviews

TBD

9 Investigations and compliance review

COR Participates in investigations of complaints and compliance reviews undertaken by the office’s divisions

TBD

10 Production of video modules and webinars, podcasts, and other products

COR All aspects of video production and direction, including recommendations with respect to topics, participants, and agenda items

TBD

11 Writing and editing support

COR Development and execution of various outreach, educational and training products

TBD

12 Document Management

COR Provides support to OCR to improve document management program including scanning support and paper disposal

TBD

13 Final Report COR Prepare, edit and provide a final report to the COR including a summary of activities performed during each POP. Report will summarize weekly and monthly activities and provide a final accounting of the contract. A draft report will be provided for comments before issuance of the final report.

No later than ten (10) days following OCR’s receipt of all deliverables