ATTACHMENT A - PrEP SOO.pdf

STATEMENT OF OBJECTIVES

Ending the HIV Epidemic: Pre-Exposure Prophylaxis (PrEP) Implementation and Dissemination

Revised December 19, 2019

Statement of Objectives Pre-Exposure Prophylaxis (PrEP) Implementation and Dissemination

2 | P a g e

1. PURPOSE

In line with one of the key goals of the Ending the HIV Epidemic Strategy’s Federal Action Plan, this procurement seeks to expand patient access to HIV pre-exposure prophylaxis (PrEP) 2 drugs.

The Office of the Assistant Secretary for Health (OASH), Office of Infectious Disease and HIV/AIDS Policy (OIDP) within the Department of Health and Human Services (HHS) will be issuing one or multiple contracts to provide access to PrEP for qualified eligible patients in the U.S.

to assist in ending the HIV Epidemic.

2. BACKGROUND

2.1. Overview

HIV has cost the U.S. billions of dollars annually in direct health expenditures for HIV care and treatment.

More significantly, since 1981 more than 700,000 American lives have been lost, and while new HIV diagnoses have declined significantly from their peak, progress on further reducing them has stalled with an estimated 40,000 Americans being newly diagnosed each year. In 2012, the Food and Drug Administration approved the use of PrEP for individuals at risk for HIV. Of the estimated 1 million Americans at risk for HIV and who could benefit from PrEP, only a small fraction are actually using this medication.

In the State of the Union address, in February 2019, President Donald J. Trump announced the administration’s goal to end the HIV epidemic in the United States in 10 years. The proposed Ending the HIV Epidemic: A Plan for America (https://www.hrsa.gov/ending-hiv-epidemic) will leverage new biomedical prevention and treatment options and powerful data to reduce the number of new HIV infections in the United States by 75% in five years and by 90% by 2030. This will prevent an estimated 400,000 new HIV cases over those 10 years, while protecting and preserving the health of people currently living with

HIV.

In May 2019, HHS and Gilead Sciences (henceforth Gilead) announced that the pharmaceutical company had agreed to donate PrEP medication for up to 200,000 individuals each year for up to 11 years. PrEP, which is a daily regimen of two oral antiretroviral drugs in a single pill, has proven to be highly effective in preventing HIV infection for individuals at risk, reducing the risk of acquiring HIV by up to 99 percent.

Under the HHS program, patients that do not have prescription drug coverage, have a valid on label prescription for PrEP, and test negative for HIV will be eligible to receive PrEP medication at no cost.

In November 2019, CVS Health, Walgreens, and Rite Aid donated their dispensing services to HHS. As part of these donations, patients who enroll and qualify for the Ready, Set, PrEP program (https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/prep-program) can obtain the PrEP medications at the more than 21,000 combined CVS Health, Walgreens, and Rite Aid locations throughout 50 states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands or through mail—all at no cost to patients.1 The dispensing services donated by these pharmacies include the following:

• Dispensing the donated Product to qualified eligible patients (QEPs) and submitting claims for reimbursement from Gilead pursuant to instructions provided by HHS or its agents.

• When dispensing the Product to QEPs, provide appropriate counseling to QEP relating to the PrEP regimen.

1 HHS notes that in the future, other pharmacies may also donate their dispensing services (together with CVS, Walgreens, and Rite Aid, “Donating Pharmacies”), and thus will become part of this effort.

https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/overview https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/overview https://www.hiv.gov/blog/news-release-trump-administration-secures-historic-donation-billions-dollars-hiv-prevention https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/prep-program

3 | P a g e

• Taking appropriate steps to promote QEPs adherence to the PrEP regimen. Such steps may include, but are not limited to, reminders to QEPs by text messages, phone calls, or other appropriate communications.

• Dispensing the donated product at its brick-and-mortar establishments and through mail, if requested by QEPs and at no cost to QEPs.

• Following the procedures set forth in the Gilead Donation Agreement to ensure that Product is provided only to QEPs.

When presented with a card or some other documentation (“Voucher”) issued to QEPs for purposes of the Ready, Set, PrEP and a valid “on-label” prescription for the relevant PrEP product , the pharmacy shall dispense the Product to QEPs free of charge out of its customary commercial inventory. The pharmacy will then submit a claim for reimbursement to a third-party vendor at wholesale acquisition cost (WAC) as of the date of dispense of the Product. QEPs receiving the Product may not be considered 340B eligible for that Product.

2.2. Business Goals

HHS, OASH leads development of agency-wide, public-health policy recommendations and oversees core public-health offices, including the Office of the Surgeon General and the U.S. Public Health Service Commissioned Corps, as well as 10 regional health offices across the nation and 10 presidential and secretarial advisory committees. Within OASH, the OIDP, develops, coordinates, and supports a range of infectious disease initiatives including the Ending the HIV Epidemic Initiative on behalf of the Assistant Secretary for Health.

As such, the business goals of the OASH/OIDP regarding this initiative are:

• To provide strategic leadership and management;

• Ensure transparency and accountability; and

• Encourage collaboration, coordination, and innovation among federal agencies and stakeholders to reduce the burden of infectious diseases.

3. STATEMENT OF OBJECTIVES

Although the solution for this request for proposal (RFP) is broken down into the following objectives, HHS strongly prefers an integrated approach with as many of the objectives/functions developed under one primary solution (See Section L.3 Technical Proposal, number 7, M.4. Award Criteria, M.5 Evaluation Criteria, number 3. Factor 4).

Awardee(s) will be responsible for coordinating and working with all contractors carrying out objectives as described in this Statement of Objectives (SOO), as well as pharmacies or other entities that have donated services to carry out the donation program pursuant to the Gilead Donation Agreements with HHS.

3.1. Overall Objectives

HHS requires services of one or more contractors to administer an integrated process of distributing the donated Product to Qualified Elegivle Patients (QEPs) as described in the Gilead Donation Agreement. The scope of this activity will entail several distinct, but interconnected steps. The scope of activity will include:

4 | P a g e

• Designating a Program Manager (PM) who is the Contractor’s authorized interface with the Contracting Officers Representative (COR), and Government stakeholders. The PM shall ensure the contract functions appropriately to achieve the work outlined in this SOO. In addition, the PM shall ensure work products are assigned and delivered based on agreed-upon timelines and that delivered work products are high quality. The PM should also provide the necessary centralized administration, documentation, as well implementation of services necessary to complete the work and oversee and manage all deliverables.

• Administering a solution that provides the following services for a maximum of 200,000 QEP per year:

• Determining eligibility and enroll QEP in Ready, Set, PrEP.

• Verifying lack of prescription drug coverage.

• Administering a network of donating pharmacies and mail-order pharmacies (network pharmacies) to dispense donated Product to patients.

• Administering a call-center for individuals and providers to access the program.

• Developing and administering an online portal for individuals and providers to access the program.

• Administer wholesaler logistical services to support purchase and distribution of product to appropriate pharmacies.

• Processing claims and reimburse pharmacies.

• Administering a Client Resource System in HHS Section 508 conformant format that is capable of providing statistical data on the program to authorized entities within HHS upon request.

• Administering a program in which each QEP is issued a Voucher with a BIN number (bank identification number) that the QEP can use, together with a prescription, to obtain a 30- or 60-day supply of Product, at the option of the QEPs prescribing healthcare provider.

o The contractor will issue the Voucher to the QEP after verifying the uninsured status and other eligibility requirements, as set forth in the Gilead Donation Agreement, and reconfirm each QEP’s continued eligibility at least twice per year through the verification process.

• Establish and administer an auditable process to verify that individuals seeking access to donated Product meet the requirements for QEPs under the Gilead Donation Agreement.

1 https://www.hiv.gov/federal-response/ending-the-hiv-epidemic/overview.

2 https://www.cdc.gov/hiv/risk/prep/index.html.

3 The Donation Agreement and Amended Donation Agreement (“Gilead Donation Agreement”) (Attachment J) is incorporated by reference into this RFP as well as any resultant contract.

http://www.hiv.gov/federal-response/ending-the-hiv-epidemic/overview http://www.hiv.gov/federal-response/ending-the-hiv-epidemic/overview http://www.cdc.gov/hiv/risk/prep/index.html http://www.cdc.gov/hiv/risk/prep/index.html http://www.cdc.gov/hiv/risk/prep/index.html

5 | P a g e

The contractor or contractors must perform each of these functions in accordance with the Gilead Donation Agreement. Insofar as there is any discrepancy or ambiguity between this RFP and the Gilead Donation Agreement, the latter controls.

The overall objectives for this contract are:

Objective 1: Determination of Eligibility and Enrollment Processes

Under the Gilead Donation Agreement, it is necessary that patients seeking to participate in the program go through an eligibility determination and enrollment process. Therefore, certain information must be collected from each individual seeking donated Product through this program.

A process should be established and administered to collect the following information, as set forth in the Gilead Donation Agreement:

• That the patient has been prescribed the Product for PrEP in a manner consistent with the product label.

• That the patient has received appropriate testing, has or will complete quarterly testing as required by the Product label, and has tested negative for HIV.

• The patient certifies that he or she is not covered by a health insurance plan or policy that covers outpatient prescription drugs.

• The patient has been advised that he or she may not resell or transfer the Product to any other individual or third party and will not bill any insurer or other third party for the donated Product.

• An executed authorization under the Privacy Provision of the Health Insurance Portability and Accountability Act of 1996, Social Security Act §1171 et seq.

Note that elements of this objective will depend upon performance of additional objectives–e.g., patient attestation regarding insurance status must be verified through objective 2.

Objective 2: Insurance Status Verification

Under the Gilead Donation Agreement, it is necessary that patients seeking to participate in the program be evaluated for eligibility for receipt of program benefits. In order to be designated as Qualified Eligible Patient, recipients must not have any health insurance coverage for outpatient prescription drugs, including by way of example only, any group health plan, Qualified Health Plan, Basic Health Plan, short-term limited duration plan, association health plan, or any Federal health care program, qualified retiree prescription drug plan, or State Pharmaceutical Assistance Program.

In order to complement the patient self-certification, provided as part of the enrollment process (see objective 1), an independent process must be established and administered to verify that the patient is not covered by a health insurance plan or policy that covers outpatient prescription drugs.

Objective 3: Call Center

Establish and administer a call center for information and verification of patient eligibility for the program and distribution of Vouchers for eligible patients.

6 | P a g e

• The call center shall be easily accessible by health care providers and patients and be available in English and Spanish. The system shall record and maintain pertinent information as per the enrollment form. The solution shall have the ability to query relevant databases to verify the patient’s eligibility for the program.

• The call center shall provide accommodations to users who require the use of assistive technology in order to complete system actions, such as filling in and submitting applications.

• If the patient qualifies for and is issued a Voucher, the system must retain the records for all applicants in a format suitable for third-party auditing to be performed by HHS or another entity such that patient eligibility can be verified at an individual level.

• Each patient that enters the Ready, Set, PrEP shall be uniquely identified as a participant in this program. In addition, the Vouchers must be uniquely coded.

Objective 4: Online Portal

Work with Gilead and its sub-contractors to transition the online portal, subsequently administer this portal for information, verification of patient eligibility (other than insurance verification as described in Objective 2), and distribution of Vouchers for eligible patients.

• The web-based/online portal shall be easily accessible by health care providers and patients and be available in English and Spanish. The system shall record and maintain patient information that is collected on the enrollment form. The solution shall have the ability to query relevant databases to verify the patient’s eligibility for the program, including information from any entity awarded a contract to carry out Objective 2as described in this Statement of Objectives

(SOO).

• If the patient qualifies for and is issued a Voucher, the system must retain the records for all applicants in a format suitable for third-party auditing to be performed by HHS or another entity such that patient eligibility can be verified at an individual level.

• Each patient that enters the Ready, Set, PrEP shall be uniquely identified as a participant in this program. In addition, the vouchers must be uniquely coded.

Objective 5: Wholesaler Logistical Services

Administer wholesaler logistical services to support distribution of product and reimbursement for dispensed Product to appropriate pharmacies. The distribution system must incorporate an approach involving a formalized process under which Gilead shall provide bottles of donated Product to a third-party entity (e.g., wholesaler) that will distribute the product and convert to payment through existing commercial channels. The term “existing commercial channels” shall not be construed to limit the participants in those commercial channels, so long as the participants perform functions that are not materially different than those contemplated under the terms of the Gilead Donation Agreement and the September 27, 2019 Distribution Agreement between HHS and Gilead (Section J).

Furthermore, the contractor must have the ability to support back filling the donated Product to the dispensing pharmacy instead of reimbursing for the Product.

7 | P a g e

• Provide wholesale distribution and logistical support to aligned aspects of the program, e.g., the pharmacies. This will entail wholesale distribution of the Product to persons other than the patient, and receipt of Product from the manufacturer. These services will be provided nationally, the contractor must possess applicable state-level license/registrations in good standing, or be eligible to become licensed or registered, in wholesale drug distribution in all applicable jurisdictions.

• Comply with all applicable statutes and regulations governing wholesale distribution where licensed or registered and comply with the more stringent law or regulation as determined by conflicts of law rules.

• Maintain liability insurance coverage and secured monetary funds to ensure payment in the event damages, fines, costs, and the like are assessed against the wholesale distributor.

• Provide a person to serve as the designated representative for the wholesale distributor facility who is actively involved in and aware of the actual daily operation of the wholesale distributor that engages in the distribution of drugs and, if required, the person shall be licensed or registered with the board of pharmacy or appropriate state regulatory agency.

Objective 6: Issuance of Card or Voucher to Qualified Eligible Patients and Claims Processing for Reimbursement of Network Pharmacies

Establish and administer a system to receive, process, and pay claims for reimbursement within 14 days in accordance with the Gilead Donation Agreement. The system must also support backfill of the dispensed Product in lieu of reimbursement.

• Prepare and provide HHS a monthly statement indicating drugs distributed, any back fills, product acquisition costs reimbursed by Gilead to Network Pharmacies, and vendor fees.

• Administer a program in which each Qualified Eligible Patient (QEP) is issued a Voucher with a unique identifier that the QEP can use, together with a prescription, to obtain a 30- or 60-day supply of Product, at the option of the QEPs prescribing physician. Issue a Voucher to the QEP only after eligibility had been verified.

• Voucher shall be provided in either a downloadable or mobile format or alternatively be mailed to QEPs.

Objective 7: Client Resource System

Administer a Client Resource System that is capable of providing statistical data on the program to authorized entities within the HHS upon request.

In a de-identified format, HHS may utilize the information to statistically analyze program performance, such as the number of individuals served through the program, the level of recipient adherence (duration of treatment), recipient attrition. It will also be used to assess the level of Product distribution in geographic areas identified as priority by the Ending the HIV Epidemic initiative.

For these reasons, this system shall include de-identified information regarding patient age, location of clinic, name and address of dispensing pharmacy, frequency of prescription distribution to patient, and other information as per the enrollment form.

8 | P a g e

Objective 8: Auditable Process to Verify Access to Donated Product

Establish and administer an auditable process to verify that individuals seeking access to donated Product are QEPs. The process shall involve the minimum amount of Personally Identifiable Information (PII) and Protected Health Information (PHI) required.

• For patients seeking donated Product, the system must maintain an enrollment form for each patient.

• Verify the insurance status and other eligibility of the patient.

• Reconfirm each QEPs continued eligibility at least twice per year.

• Ensure system integrity; detect and safeguard against abuse of the enrollment portal

Objective 9: Establish and Administer Network of Mail Order Pharmacies

The Mail-Order Pharmacy Network will accomplish the following tasks as it relates to dispensing donated Product.

• Dispense the donated Product to QEPs through mail order at no cost to QEPs.

• Ensure proper and auditable reimbursement from Gilead at actual acquisition cost paid by the dispensing pharmacy. Ensure proper and auditable invoicing to—and reimbursement from— HHS of other fees related to the mail-order dispense.

• Take appropriate steps to counsel and promote QEP adherence to the PrEP regimen. Such steps may include, but are not limited to, regular reminders to QEP by text messages, phone calls, or other appropriate communications.

3.2 Deliverables

The contractor shall ensure all products and services delivered under this contract are compliant with HHS Section 508 requirements in accordance with the Health and Human Services Acquisition Regulation (HHSAR). These Section 508 Standards were issued by the United States Access Board (https://www.access-board.gov/) and published in the Federal Register, on January 18, 2017, as the final rule (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule). The final rule updates the Section 508 Standards along with accessibility guidelines for telecommunication products and equipment covered by section 255 of the Communications Act.

The Section 508 Standards applicable to this contract are:

Section 508 Standards and Guidelines (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines)

• Web Content Accessibility Guidelines (WCAG) 2.0 o Success Criteria, Level A and AA

• Chapter 3: Functional Performance Criteria (FPC)

• Chapter 4: Hardware (If Applicable) https://www.access-board.gov/ https://www.access-board.gov/ https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

9 | P a g e

• Chapter 5: Software

• Chapter 6: Support Documentation and Services

Regardless of format, all digital content or communications materials produced as a deliverable under this contract must conform to applicable HHS Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. The contractor is responsible for remediating all deliverables that do not comply with the applicable requirements as identified in the HHS Section 508 checklists.

OASH/OIDP expects at a minimum the following deliverables:

MEETINGS

Contract Kickoff Meeting - Meeting with the COR via teleconference to discuss the contract requirements, tasks, and administrative arrangements within one (1) week of the Effective Date of the Contract (EDOC).

Submit minutes from the meeting to the COR via email within two (2) business days of the meeting.

Entrance Meeting - Conduct and facilitate a one to two day, in-person meeting with the COR, OIDP senior staff, representatives of partner federal agencies and their contractors to discuss the detailed, technical plans for completion of each of the project components.

Develop a draft agenda for the meeting and submit to the COR no later than two (2) business days before the meeting.

The agenda shall include:

• Detailed review of each project deliverable

• Technical Assistance (TA) considerations

• Audience and stakeholder considerations

• Tracking and evaluating progress of Contractor’s work

Incorporate COR feedback and submit a final agenda no less than one (1) business day before the meeting date.

Submit minutes from the meeting to the COR via email within two (2) business days of the meeting.

Revised schedule of deliverables–in response to the decisions during the entrance meeting, including any new tasks/deliverables and deliverable schedule within two (2) business days of the meeting.

Bi-weekly Status Meetings–to review status of tasks, requirements, milestones, deliverables, and activities accomplished during the reporting period, activities planned for the ensuing reporting period, and any potential risks to cost, schedule, or quality.

REPORTS

Weekly Status Report–submit via email or other electronic means to the COR. Reports shall include list of accomplishments.

Draft Agendas for dashboard meetings – Submit at least two (2) days, in advance to the COR and incorporate COR’s feedback into the final agenda.

10 | P a g e

Meeting notes shall be provide to the COR no later than three (3) days.

Monthly Progress Reports–submit electronically to the COR.

Progress reports shall include:

• The number of Vouchers distributed during the reporting period and the number of enrollments,

• The number of rejected applicants,

• The projected number of Vouchers to be distributed during the next reporting period and the total reimbursements issued to participating pharmacies,

• The geographical distribution of donated Product, and any potential risks to cost, schedule, or quality.

♦ Geographical distribution of donated Product by Phase I jurisdictions of the Ending the

HIV Epidemic in America

• Name of prescribing practitioner and practice location

• Dispensing pharmacy

• Race/ethnicity of applicants (approved and rejected)

• Age of applicants

This report shall not include PHI or PII.

Budget report – submit via email or other electronic means to the COR. Reports shall include data on fund burn rate, number of patients enrolled/Product dispensed, and other financial information as necessary.

PLANS

Revised Project Work Plan–submit revised project work plan to the COR 3 weeks after the Effective Date of the Contract.

The work plan shall include:

• Detail the methodology of approach, tasks, requirements, milestones, and deliverables.

• Reflects any discussions had and decisions made in the entrance meeting.

Staffing Plan–provide list of all contractor (and subcontractor) staff involved with executing the work of this contract.

Non-Disclosure Agreements (NDAs)– completed and signed by contractor and subcontractor staff.

Submit to the COR signed NDAs.

Transition-Out Plan –The contractor shall develop and implement a 120-day transition-out plan. The plan shall include methodologies and procedures for minimizing disruption of service to qualified eligible patients and major milestones at 30, 60, 90, and 120 days (for a 120 day transition). The plan must support phases to allow collaboration with the outgoing contractor. The contractor must also submit a stakeholder management plan outlining, in detail, what steps will be taken to ensure a smooth transition for current employees. The contractor(s) must also work with any future contractor(s) and donative partners and HHS to facilitate, and this must be addressed in the transition plan.

The plan shall ensure transition of all patients currently enrolled to the new contractor responsible for the next phase of the contract with minimal disruption.

The plan shall be inclusive of the transition of the documentation, operating procedures and other resources, including, devices, equipment, databases and systems. Data captured during the performance of

11 | P a g e the base and optional periods will be transferred to the government at contract conclusion; the format to deliver the data shall be decided during the performance period.

3.3 Constraints/Notes

The Government expects a team of subject matter experts to provide a detailed solution to the implementation of the overall objectives. As the offeror develops its proposed methodology, Performance Work Statement and Quality Assurance Surveillance Plan, it must be aware of the constraints and requirements listed below:

• A project management plan is required for the contract.

• Within one week of award, the Contractor shall work with the COR and technical point of contact in

OIDP to develop a process and workflow for working with the involved HHS Operating Divisions (OpDivs) to understand and discuss the details of the proposed source data, including data format, structure, sources, and other related items.

• HHS will conduct audits to ensure that the contractor has complied with the contract. The patient is not a party to the contract and therefore is not required to “comply.”

• Call Center Hours of Operation

Available between the hours of 7:00 a.m. to 8:00 p.m. (EST) (13 hours a day, 5 days a week) Monday-Friday except Federal holidays and weekends.

Incident/Ticket Management

Serve as the PrEP Customer Support Center Incident Manager (IM) for all Incidents created and has the responsibility for their lifecycle, from creation to closure. The number of interactions may increase or decrease, depending on program activities. Included in the Customer Support Center interactions received per month are contacts received via email.

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

12 | P a g e

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [ ] Low [X] Moderate [ ] High Integrity: [ ] Low [ ] Moderate [X] High Availability: [ ] Low [X] Moderate [ ] High Overall Risk Level: [ ] Low [ ] Moderate [ ] High

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [X] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

13 | P a g e specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [ ] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed.

Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

See the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

14 | P a g e

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and OS/OASH policies. Unauthorized disclosure of information will be subject to the HHS/ OS/OASH sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. Section 641 (Criminal Code: Public Money, Property or Records); and

b. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with

OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic

Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR within thirty days of contract award.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf

15 | P a g e the OpDiv non-disclosure agreement as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the OpDiv Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv

SOP or designee with completing a PIA for the system or information within 4-6 weeks or prior to system implementation after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

b. The Contractor shall assist the OpDiv SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/OpDiv Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete OS/OASH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual OpDiv Information Security Awareness

16 | P a g e

3) Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response

The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) and OASH IRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send OS/OASH approved notifications to affected individuals.

2) Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT) at 1-866-646-751, csirc@hhs.gov, COR, CO, HHS/OCIO SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

17 | P a g e

c. encrypt sensitive information in attachments to email, media, etc.

3) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information HHS/OpDiv and OS/OASH incident response policies when handling PII breaches.

4) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

E. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

F. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within one week of the effective date of this contract.

Any revisions to the roster as a result of staffing changes shall be submitted within 1 week of the change.

The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

G. Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HHS EPLC framework and methodology in accordance with the HHS Contract Closeout Guide (2012).

HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

18 | P a g e

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of…