Attach A - PWS (SCTOD) - 6.13.22 - Amend0001.pdf

SCTOD

Attach A – PWS (SCTOD) – 6.13.22

SCTOD - Page 1 of 44

Attachment A

Performance Work Statement

Stem Cell Therapeutic Outcomes Database (SCTOD)

June 13, 2022

SCTOD - Page 2 of 44

I. BACKGROUND

II. GENERAL DESCRIPTION

III. PERIOD OF PERFORMANCE

IV. TASKS

Task 1 – Fulfill Contract Administration Requirements

Task 2 – Collect Stem Cell Therapeutic Outcome Data

Task 3 – Disseminate Data

Task 4 – Provide Analytic Support to and in Collaboration with HRSA

Task 5 – Report on Study Activities

Task 6 – Submit Routine Reports

Task 7 – Use Plain Language Guidelines and Other Government Laws and Regulations for all Products

Task 8 – Perform Contingent Tasks

Task 9 – HHS Policy for Information Technology Procurements - Security and Privacy Language

V. SCHEDULE OF DELIVERABLES

VI. PAYMENT SCHEDULE

SCTOD - Page 3 of 44

Performance Work Statement (PWS) June 13, 2022

Stem Cell Therapeutic Outcomes Database (SCTOD)

I. BACKGROUND

In 1987, the National Bone Marrow Donor Registry (NBMDR) was initiated through a congressionally-directed grant from the United States (U.S.) Department of the Navy and formally established in 1990 as a responsibility of the U.S. Department of Health and Human Services (HHS). The National Institutes of Health (NIH), National Heart, Lung, and Blood Institute initially provided oversight; but, the Health Resources and Services Administration (HRSA) has provided oversight since 1994. The activities of the NBMDR included increasing the number of transplants for recipients suitably matched to biologically unrelated donors of cord blood and adult volunteer donors of bone marrow. Activities also included ensuring health-care professionals and patients were able to search electronically for cells from bone marrow donors and cord blood units (CBUs) through a single point of access. Additional activities involved providing patient advocacy and case management support from diagnosis through survivorship, and collecting stem cell transplant outcomes data in a standardized, electronic format.

In 2005, the Stem Cell Therapeutic and Research Act (Public Law (P.L.) 109-129)1 amended the Public Health Service Act (Act) to require the HHS Secretary (Secretary), acting through HRSA, to rewrite provisions that required the Secretary to establish and maintain the C.W. Bill Young Cell Transplantation Program (CWBYCTP), the successor to the NBMDR. The goal of the CWBYCTP is to increase the number of transplants for recipients suitably matched to biologically unrelated donors of bone marrow and cord blood. The Act also requires the Secretary to enter into contracts with qualified cord blood banks to assist in the collection and maintenance of at least 150,000 new, high quality CBUs, which are to be available for transplantation through the CWBYCTP.

The Stem Cell Therapeutic Outcomes Database (SCTOD), one of the federally legislated functions within the CWBYCTP, is authorized by section 379A of the Public Health Service Act [42 United States Code 274l], as amended. The Act stipulates that the Secretary, through the HRSA CWBYCTP, shall by contract establish and maintain a scientific database of information relating to patients who have been recipients of a stem cell therapeutics product (including bone marrow, cord blood, or other such product) from a donor. The Act also stipulates that the Secretary shall require the entity awarded a contract under this section to submit to the Secretary an annual report concerning patient outcomes with respect to each transplant center.

1 As amended by P.L. 111-264, and reauthorized by P.L. 114-104 and P.L. 114-15 (‘‘Timely ReAuthorization of Necessary Stem-cell Programs Lends Access to Needed Therapies Act of 2021’’ or the ‘‘TRANSPLANT Act of 2021’’).

SCTOD - Page 4 of 44

II. GENERAL DESCRIPTION

The CWBYCTP, which is located within the HRSA, Health Systems Bureau, Division of Transplantation, requires that the SCTOD Contractor establish and maintain a scientific database of information relating to patients who have been recipients of a stem cell therapeutics product (including bone marrow or cord blood) from a donor. The SCTOD Contractor shall collect, maintain, analyze, and report patients’ outcomes data, for all allogeneic (related and unrelated) hematopoietic stem cell (HSC) transplants and other therapeutic uses of blood stem cells, in a standardized electronic format. The patients’ outcomes data shall include the information necessary to conduct an ongoing evaluation of the scientific and clinical status of transplantation involving recipients of a stem cell therapeutic product from a donor; and make HSC transplant outcomes data available to patients, families, health care professionals, and to the public. In addition, the Contractor shall make relevant scientific information (not containing individually identifiable information) available to the public in the form of summaries and data sets to encourage medical research and to provide information to transplant programs, physicians, patients, and CWBYCTP contractors.

HRSA requires that the SCTOD Contractor shall provide statistical and other analytic support to the CWBYCTP, including in the preparation of recurring and special reports to Congress and the Advisory Council on Blood Stem Cell Transplantation (Advisory Council). Additionally, the Contractor shall prepare and submit an annual report on patient outcomes at each transplant center.

In the performance of this contract, the SCTOD Contractor shall furnish all the necessary services, qualified personnel, materials, equipment, and facilities needed to perform its tasks as listed below in the Performance Work Statement.

The Government shall monitor the Contractor’s performance under this contract in accordance with the accepted Quality Assurance Surveillance Plan (QASP) (Attachment B).

III. PERIOD OF PERFORMANCE

The period of performance shall be a base period of twelve months and four (4) twelve-month option periods. The option periods under this contract may be exercised in accordance with Federal Acquisition Regulation (FAR) clause 52.217-9 Option to Extend the Term of the Contract (MAR 2000). The period of performance under this contract shall commence with the effective date of the contract. The Contractor shall perform the work primarily at its site, rather than at the Government’s site.

SCTOD - Page 5 of 44

IV. TASKS

Task 1 – Fulfill Contract Administration Requirements

1.1 Attend Initial/Kick-off Meeting – The Contractor shall meet with the COR and other Government staff to review the requirements, QASP (Attachment B), and deliverable schedule for the contract. The Contractor shall meet with HRSA either in person in Rockville, Maryland or via video conference/teleconference. The COR shall provide the meeting agenda and meeting access information prior to the meeting, and the Contractor shall submit the meeting minutes after the kick-off meeting.

1.2 Attend Quarterly COR Meetings – The Contractor shall attend quarterly meetings, via remote conference, with the COR to discuss milestones, discuss progress and challenges related to the SCTOD contract, and provide recommendations on improvements to the SCTOD structure and processes to increase efficiency and effectiveness of the SCTOD functions. The Contractor shall schedule the meetings (this includes sending the meeting invitations) provide the meeting agenda prior to each meeting, and submit the meeting minutes after each quarterly COR meeting.

1.3 Attend Special COR Meetings – The Contractor shall convene via remote conference, no more than 12 times per year, for special or emergency situations that arise. The Contractor or HRSA may request the Special COR meeting. The Contractor shall schedule the meetings (this includes sending the meeting invitations) and, after each special COR meeting, submit the meeting minutes. If the Contractor is the requester of the meeting, the Contractor shall provide the meeting agenda prior to each meeting.

1.4 Establish Policy and Technical Direction of the SCTOD – The Contractor shall develop a process plan to establish and review policy (including cord blood data policy and procedures) and technical direction of the SCTOD. The Contractor shall include key stakeholders in the structure used to establish the policy and technical direction of the SCTOD and provide a copy of the Contractor’s conflict of interest (COI) policy and a blank copy of any documentation of the process

(es) required to assess COI of the stakeholders. The Contractor shall also provide written certification that its COI policy is in place and being followed.

When establishing cord blood data policy, the Contractor shall include all key stakeholders in the CWBYCTP and National Cord Blood Inventory (NCBI) Program.

The Contractor shall consult with the COR regarding both the proposed changes to and assessments of policies in an effort to ensure that such policies do not conflict with other policies established for other components of the CWBYCTP and, in the case of NCBI cord blood units (CBUs), with HRSA requirements for such CBUs.

SCTOD - Page 6 of 44

At the direction of the COR, the Contractor shall also provide an opportunity for public comment by posting proposed changes on the CWBYCTP website (https://bloodstemcell.hrsa.gov). The Contractor shall submit proposed changes to policies and standards to the COR, for approval, prior to their adoption and implementation. Updates on this task shall be provided in the progress report.

(Task 6.1)

1.5 Records and Information Regulation – In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C.

552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

1.6 Records Management Training – The contractor (and/or subcontractor) shall ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2021recordsmanagement/01_inde x.html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

1.7 System Of Records Notice – Managing the records includes, maintaining records to retain functionality and integrity throughout the records’ full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

For the records identified in the System of Records Notice (SORN) the Contractor shall follow the NARA-approved retention period. If there is no NARA- approved disposition schedule, the Contractor shall retain the records permanently during the duration of the contract, until Contracting Officer Representative (COR) notifies the contractor that NARA has approved an HRSA Records Schedule and HRSA provides approval for disposal of records.

https://bloodstemcell.hrsa.gov/ https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhumancapital.learning.hhs.gov%2Fcourses%2F2021recordsmanagement%2F01_index.html&data=05%7C01%7CNShawir%40hrsa.gov%7C8dc54780f1664f9e26f508da43cb53a3%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C637896837800496732%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sU9pjlvFS3gh3R1etiy3HehuVMvf%2BNB5Sy2vaN2Wyj0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhumancapital.learning.hhs.gov%2Fcourses%2F2021recordsmanagement%2F01_index.html&data=05%7C01%7CNShawir%40hrsa.gov%7C8dc54780f1664f9e26f508da43cb53a3%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C637896837800496732%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sU9pjlvFS3gh3R1etiy3HehuVMvf%2BNB5Sy2vaN2Wyj0%3D&reserved=0

SCTOD - Page 7 of 44

Task 2 – Collect Stem Cell Therapeutic Outcome Data

2.1 Collect and Maintain Outcomes Data – The Contractor shall collect data, using a standardized electronic system, on the outcomes of all recipients of allogeneic (related and unrelated) transplants for hematopoietic reconstitution (including multiple unit cord blood transplants), regardless of the source of funding for the transplant or the collection, processing, storage, or procurement of the stem cell product. The standardized electronic system shall be operational within 6 months after the effective date of the contract.

The data collection plan shall include Common Data Elements (CDEs) that detail transplant-related variables and stem cell source(s) that shall be incorporated into the systems for data collection, dissemination, and analysis.

CDEs shall include data elements that are sufficient to evaluate pre-transplant patient characteristics, overall survival, disease free survival, relapse, and morbidity.

The Contractor shall work with existing stem cell database organizations, transplant centers, the suppliers of stem cell products, and other transplant and research registries to collect and maintain the necessary data. The Contractor shall take into consideration the needs of transplant centers, cord blood banks, and other parties responsible for reporting data when developing the system and procedures for data submission to ensure that the scope of data collection and the procedures for submitting data are not overly burdensome. Updates on this task shall be provided in the progress report.

(Task 6.1)

2.2 Evaluate Data Collection Process and Assess Gaps in Data – The Contractor shall evaluate the data collection process and assess and address any factors, including gaps in data, that impact the Contractor’s ability to collect outcomes data. The Contractor shall also propose recommendations regarding any aspect of the data collection process. The evaluation plan should pay special attention to those transplants (both related and unrelated allogeneic) facilitated by the CWBYCTP, including those transplants taking place outside the U.S., but using a U.S. product. This evaluation plan shall encompass a thorough examination of the processes involved in reporting data, the composition of the data set, reliance on the SPA-CC to assure data submission, the auditing of the data, and other factors that contribute to the Contractor’s ability to obtain data on all transplants.

2.3 Develop a Data Validation and Verification Plan – The Contractor shall develop a data validation and verification plan to ensure completeness, timeliness, and accuracy of information in the SCTOD and provide a process for correcting discrepancies or inaccuracies. The Contractor shall establish and implement mechanisms to:

(a) encourage maximum participation of transplant centers and cord blood banks;

SCTOD - Page 8 of 44

(b) ensure participating transplant centers and cord blood banks consistently comply with any data validation and verification policies or guidance; (c) ensure that data collected from transplant centers, cord blood banks, and all other contributors of data have been verified and are accurate and complete; and (d) maintain attention to every stage of the process of delivery or production to ensure that information in the SCTOD is accurate, timely, and complete. In fulfilling the requirements of this task, the Contractor shall perform on-site audits of data submitted by transplant centers. If a sampling of the data for audit purposes is proposed, the Contractor shall ensure that an adequate sampling is conducted to reasonably verify the accuracy and quality of the entire data set.

The Contractor shall implement the data validation and verification plan after approval by the COR.

2.4 Implement Process to Maintain Historical Data Sets and Programming

Codes – The Contractor shall implement a process to maintain historical data sets and programming codes to retain for future references. The Contractor shall ensure these stored archives can be easily located and retrieved.

Task 3 – Disseminate Data

3.1 Disseminate Data to the Public and CWBYCTP-participating Organizations –

The Contractor shall develop a process plan to establish and review data release policy and to disseminate data to the public and to organizations participating in the CWBYCTP. Specifically, the Contractor shall establish policies that govern the release (at no charge to the public and that is Section 508 compliant) and use of data, prevent unnecessarily limiting access to data, and have reasonable time limits for the retention of data that are actively being used for publications developed by the contractor.

The Contractor shall make relevant scientific information (not containing individually identifiable information) available to the public in the form of data sets, reports and summaries (developed by the contractor) to encourage medical research and to provide information to transplant programs, physicians, patients, cord blood banks, donor registries, and CWBYCTP contractors. The Contractor shall also describe the process for disseminating organization-specific data and data sets to the organizations participating in the CWBYCTP. This process shall include a standardized electronic system that allows organizations participating in the CWBYCTP to receive or readily obtain data (e.g., graft source quality) regarding their activities for their own records, as well as the ability to simultaneously transmit or copy the data to parties to which they routinely submit outcomes data.

The Contractor shall collaborate with HRSA and CWBYCTP contractors to maintain a search mechanism on the CWBYCTP website for users to be able to retrieve transplant outcomes information. The search mechanism should be adaptable and compatible to the data set provided by CWBYCTP contractors.

Patients are the primary audiences for the CWBYCTP website and the search

SCTOD - Page 9 of 44 mechanism shall be user friendly. The Contractor shall develop products suitable for posting on the CWBYCTP website as well public distribution. For these products, the contractor shall submit draft copies to the COR, and the COR will obtain review from HRSA’s Office of Communications. The Contractor shall revise these products based on feedback from the COR, and then submit final copies to the COR. Appropriate timelines will be included in the Schedule of Deliverables for these products at time of contract award.

The Contractor shall make available a list of its peer-reviewed articles, as well as its datasets and summaries, on the CWBYCTP website or one click away from the CWBYCTP website. In addition, the contractor will provide instructions on its public website for making data requests and the cost of fulfilling data requests.

3.2 Create Standard Analysis Files (SAFs) – The Contractor shall create standard analysis files (SAFs) that includes analyzable SCTOD data set with calculated analytical variables. The SAFs shall be in the form of patient-level data sets that shall allow HRSA to perform analyses to provide information to HRSA, transplant programs, physicians, patients, CWBYCTP contractors, donor registries, and cord blood banks. The Contractor shall also provide electronic data dictionary and data operation manual. The SAFs shall not contain individually identifiable information.

Task 4 – Provide Analytic Support to and in Collaboration with HRSA

4.1 Provide Analytic Support to HRSA – The Contractor shall provide analytic support to HRSA, or other Federal agencies, specific to carrying activities necessary for the CWBYCTP. This shall include support to CWBYCTP contractors, the Advisory Council, the provision of information used in preparation of the Annual Report to the Congress, and the preparation and submission of Office of Management and Budget (OMB) clearance packages and Federal Register Notices (FRNs). For the OMB package, specifically, the Contractor shall prepare and submit draft 60-day and 30-day FRNs, and a draft information collection request clearance package, in accordance with OMB's clearance process under the Paperwork Reduction Act. The Contractor shall make necessary changes to these documents, as requested by the COR, and respond in writing within one week to questions about and to make any required revisions to the OMB package.

The support must include working with the Single Point of Access- Coordinating Centers (SPA-CC) contractor to establish and maintain one or more research repositories containing donor-recipient paired samples to be used in the ongoing examination of tissue matching factors affecting transplant outcomes and facilitate research to determine the degree of HLA match required for successful transplants.

The support shall include analyzing feedback received from cord blood banks and transplant centers; analyzing the ideal size and composition of the NCBI, the public inventory of CBUs, and the Program’s adult donor registry; and evaluating the

SCTOD - Page 10 of 44 optimal selection, harvesting and processing of an unrelated donor graft.

The Contractor shall also support making transplant center-specific survival data readily available to patients and health care providers, developing website content and supporting maintenance of the CWBYCTP website (following the procedures detailed by the CWBYCTP, evaluating access to care and conducting analytical activities, participating in the process to establish policy and technical review involving the CWBYCTP website, and presenting at forums and assisting with reports related to patient education and professional education activities. The Contractor shall develop content and products suitable for posting on the CWBYCTP website. For these contents and products, the Contractor shall submit draft copies to the COR, and the COR will obtain review from HRSA’s Office of Communications.

The Contractor shall revise these products based on feedback from the COR, and then submit final copies to the COR. Appropriate timelines will be included in the Schedule of Deliverables for these products at time of contract award.

The Contractor shall support the CWBYCTP’s efforts to update the Schedule of Records Notice.

The COR shall notify the Contractor on specific analytic needs. Once approved by the COR, the Contractor shall conduct the analysis and submit a written report and a presentation to the COR for approval.

The Contractor shall respond to the COR within 48 hours for urgent requests, revisions, or for questions; and within 48 hours if: (1) the data are not collected and/or verified; (2) release of the data violates the Privacy Act or applicable laws;

(3) the use of the data is not sufficiently valuable to warrant a large scale expenditure of time and effort; or (4) the data and information are otherwise exempted from disclosure under the Freedom of Information Act (FOIA), when applicable. Updates on this task shall be provided in the progress report. (Task 6.1)

Task 5 – Report on Study Activities

5.1 Report on Study Priorities in the Field of Stem Cell Transplantation and

Cellular Therapy – The Contractor shall report on the current study priorities proposed in the field of stem cell transplantation and cellular therapy. The Contractor shall establish study priorities with professionals possessing expertise in transplant outcomes studies and histocompatibility, as well as with the SPA- CC, the Advisory Council and relevant Federal agencies. The Contractor shall have a mechanism for prioritizing studies and analyses identified by the COR as being especially important to the CWBYCTP (this may include studies recommended by the Advisory Council). (Task 6.1)

5.2 Report on the Current State of Quality of Life for Transplant Recipients and Analysis to Improve Late Effects – The Contractor shall submit a report on the

1) current findings from studies related to quality of life for those individuals receiving transplants, including a comparison to their quality of life pre-transplant, SCTOD - Page 11 of 44 and 2) findings from studies performed by the Contractor, related to the late effects of patients who have received an allogeneic transplantation, to advance the field of stem cell transplantation and cellular therapy. The Contractor shall evaluate the quality of life and late effects of allogeneic transplantation and conduct related analysis, on patient late-effects, that advances the field of stem cell transplantation and cellular therapy. The Contractor shall work with stakeholders, including transplant centers, CWBYCTP contractors, and Federal agencies (e.g., HRSA, National Institutes of Health (NIH), the U.S. Department of Navy) to inform its late effects research studies, as appropriate.

5.3 Compare Treatment Options and Outcomes – The Contractor shall compare selected treatment options and outcomes for those patients who receive blood stem cell transplants and those patients undergoing alternate treatments, including no clinical intervention. The analysis includes comparing alternative donor and graft sources for patients without a human leukocyte antigen-identical sibling donor, evaluating optimal patient selection and treatment strategies for unrelated donor transplantation and cord blood transplantation, and additional analysis related to comparing treatment options and outcomes that advances the field of stem cell transplantation and cellular therapy.

The Contractor shall submit a plan that compares selected treatment options. Upon approval by the COR, the Contractor shall implement the plan and report on the results.

Task 6 – Submit Routine Reports

6.1 Submit Monthly Progress Reports – The Contractor shall submit progress reports that include, at minimum, notifications of upcoming stakeholder meetings, outcomes of those meetings, support provided to CWBYCTP contractors, and status updates on at least the following tasks:

1. Task 1.4: Establish Policy and Technical Direction of the SCTOD

2. Task 2.1: Collect and Maintain Outcomes Data

3. Task 4.1: Provide Analytic Support to and in Collaboration with HRSA

6.2 Provide a Quarterly SCTOD Function Report – The Contractor shall establish and implement quantifiable measures for monitoring SCTOD functions and provide a quarterly SCTOD function report.

6.3 Submit Annual Statistical Report on SCTOD Transplant Activities – The

Contractor shall submit an annual statistical report on SCTOD transplant activity.

The Contractor shall submit the proposed outline for the report, draft report and final report to the COR for review and approval prior to making the report available to the public.

SCTOD - Page 12 of 44

6.4 Develop and Disseminate Transplant Center Survival Rates Reports – The Contractor shall develop an annual report to include survival rates at each transplant center in the United States. The Contractor shall propose the content and format and shall work with CWBYCTP contractors to include content, including the approach used, that shall be of a value to the transplant centers.

Upon approval, the Contractor shall make the results of the analysis available to the public from the CWBYCTP website, provide national center-level summary report to the COR, and disseminate transplant center specific report to the transplant centers at no charge.

6.5 Provide Cord Blood Bank Reports – The Contractor shall provide, at no charge, domestic cord blood banks (including NCBI cord blood banks): 1) reports relevant to product quality and safety within seven (7) days of an adverse event;

and 2) monthly reports on the characteristics of their products upon receipt and thaw at the transplant centers, adverse events associated with the infusion of products, engraftment, cellular therapy, and overall patient survival. The Contractor shall include additional variables in the report based on feedback from the cord blood banks.

The cord blood bank reports shall provide information to identify procedures involving multiple cord blood units and to identify the prevailing unit to engraft if the latter data are available to the Contractor. The Contractor shall make information relevant to possible adverse infusion or product events available to CWBYCTP contractors and supplying cord blood bank within 48 hours or as consistent with reporting timelines established by the Food and Drug Administration and applicable accrediting organizations. Updates on this task shall be provided in the progress report.

Task 7 – Use Plain Language Guidelines and Other Government Laws and Regulations for all Products

7.1 Comply with Plain Language Guidelines – The Contractor shall:

1. Follow the federal Plain Language Guidelines when developing products. The Plain Language Act of 2010 requires federal agencies to create communications that are clear and understandable to the public.

2. Produce content that follows federal plain language guidelines. All text content must aim for a Flesch-Kinkaid Reading Ease score of at least 60.

HRSA’s Office of Communications’ liaisons use Readable to review, update, and score content. Contractor shall work with the COR and program communications liaisons and use Readable to review, score and enhance the content.

3. Use PlainLanguage.gov’s Checklist for Plain Language and HHS’s Plain Writing Checklist as guidelines.

7.2 Comply with Other Government Laws and Regulations – The Contractor shall:

https://plainlanguage.gov/guidelines/ https://readable.com/blog/the-flesch-reading-ease-and-flesch-kincaid-grade-level/ https://readable.com/ https://www.plainlanguage.gov/resources/checklists/checklist/ https://www.hhs.gov/web/building-and-managing-websites/managing-websites/plain-writing-checklist/index.html https://www.hhs.gov/web/building-and-managing-websites/managing-websites/plain-writing-checklist/index.html

SCTOD - Page 13 of 44

1. Ensure that all materials adhere to federal copyright laws including the citation of sources in endnotes or footnotes; obtaining written permission to reproduce, reprint, or adapt existing materials used in the creation of materials under this contract; and including credits for images, which include photographs, pictures, illustrations, tables, charts, figures, and graphs.

2. Ensure that all materials adhere to the Government Printing and Binding Regulations, including the prohibition on commercial advertising which says, “No Government publication or other Government printed matter, prepared or produced with either appropriated or nonappropriated funds or identified with an activity of the Government, shall contain any advertisement inserted by or for any private individual, firm, or corporation; or contain material which implies in any manner that the Government endorses or favors any specific commercial product, commodity, or service.” -- (Title III--General Provisions,

13. Advertisements, Commercial.)

3. Ensure that all materials do not contain any non-federal logos (since logos are a form of institutional advertising); that materials do not contain contact information for non-federal organizations, except the website address for informational purposes; and that all materials do not contain any contact information for individuals.

4. Ensure that all materials do not contain the name of the contractor or subcontractors since this is also a form of advertising.

5. Ensure that all materials adhere to the prohibition against referring to lobbying in materials produced with appropriated funds. The prohibition against lobbying also includes grassroots lobbying, which is advocating for a change in legislation at the federal, state, or community level.

Task 8 – Perform Contingent Tasks

8.1 Submit Transition Plan – The Contractor shall submit a draft written transition plan that includes the transition completion timeline for receiving materials from the predecessor Contractor (if applicable) and for notifying affected parties of the transition, or for transitioning materials to the successor Contractor (if applicable). If transitioning from a predecessor Contractor, the transition plan shall address scheduling of a meeting with the predecessor Contractor to discuss the receipt and transfer of data and documentation and continuity of services during the transition period. The transition plan shall also address the description and receipt of contract materials from the predecessor Contractor.

If transitioning to a successor Contractor, the transition plan the Contractor shall provide to the Government:

1. A list of the materials developed and procured using contract funds;

2. A copy of all data files for the SCTOD within possession or control of the Contractor, including documentation of all file layouts and copies of any software;

3. A copy of the forms and instructions used to collect data for the SCTOD, and a copy of documentation for OMB approval of data

SCTOD - Page 14 of 44 collection;

4. A copy of the operations manual for the SCTOD; and

5. A copy of SCTOD policies, standards, procedures, and membership criteria.

During this period, the Contractor shall cooperate with the successor Contractor(s) to maintain parallel systems, continue backup of data, and compare results of searches.

Task 9 – HHS Policy for Information Technology Procurements - Security and Privacy Language

A. Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/HRSA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

SCTOD - Page 15 of 44

Availability, which means ensuring timely and reliable access to and use of information.

Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/HRSA and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, HRSA Senior Official for Privacy (SOP), or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [ ] Low [ X ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Impact Level: [ X ] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/HRSA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/HRSA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/HRSA security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

SCTOD - Page 16 of 44

NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

Note to the Requiring Activity Representative: This information may be included after award in the event it is not yet available at the time of acquisition. Section d must be included in all contracts regardless of whether or not personally identifiable information (PII) is involved.

i. Per the Office of Management and Budget (OMB) Circular A- 130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or

SCTOD - Page 17 of 44 increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and

Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800- 171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be

SCTOD - Page 18 of 44 notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and HRSA policies.

Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet

Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with

SCTOD - Page 19 of 44 encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.)

that store and process government information and ensure devices meet HHS and HRSA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including

PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the HRSA non-disclosure agreement. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract and have access to HRSA’s network must complete the applicable HHS/HRSA Cybersecurity Awareness Training training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees must complete HHS/HRSA Cybersecurity Awareness Training at least annually, during the life of this contract.

All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete Role-Based Training for IT Admin annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this http://csrc.nist.gov/publications/

SCTOD - Page 20 of 44 contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior (included in the HHS/HRSA Cybersecurity Awareness Training), and any applicable system-level rules of behavior.

b. All Contractor employees performing on the contract…