Attach A - PWS (OPA) - 6.13.22 - Amend0001.pdf

Attachment A – PWS – 6.13.22

OPA

OPA - Page 1 of 41

Attachment A

Performance Work Statement

Office of Patient Advocacy (OPA)

June 13, 2022

OPA - Page 2 of 41

CONTENTS

I. BACKGROUND

II. GENERAL DESCRIPTION

III. PERIOD OF PERFORMANCE

IV. TASKS

Task 1 – Fulfill Contract Administration Requirements

Task 2 – Provide Patient Advocacy and Case Management

Task 3 – Provide Support to and in Collaboration with HRSA

Task 4 – Submit Routine Reports

Task 5 – Perform Contingent Tasks

V. HHS Policy for Information Technology Procurements - Security and Privacy Language 11

VI. SCHEDULE OF DELIVERABLES

VII. PAYMENT SCHEDULE

Appendix A - Use Plain Language Guidelines and Other Government Laws and Regulations for all Products

Appendix B - QASP

OPA - Page 3 of 41

Performance Work Statement (PWS) June 13, 2022

Office of Patient Advocacy (OPA)

I. BACKGROUND

In 1987, the National Bone Marrow Donor Registry (NBMDR) was initiated through a congressionally-directed grant from the United States (U.S.) Department of the Navy and formally established in 1990 as a responsibility of the U.S. Department of Health and Human Services (HHS). The National Institutes of Health (NIH), National Heart, Lung, and Blood Institute initially provided oversight; but, the Health Resources and Services Administration (HRSA) has provided oversight since 1994. The activities of the NBMDR included increasing the number of transplants for recipients suitably matched to biologically unrelated donors of cord blood and adult volunteer donors of bone marrow. Activities also included ensuring healthcare professionals and patients were able to search electronically for cells from bone marrow donors and cord blood units (CBUs) through a single point of access. Additional activities involved providing patient advocacy and case management support from diagnosis through survivorship, and collecting stem cell transplant outcomes data in a standardized, electronic format.

In 2005, the Stem Cell Therapeutic and Research Act (Public Law (P.L.) 109-129)1 amended the Public Health Service Act (Act) to require the HHS Secretary (Secretary), acting through HRSA, to rewrite provisions that required the Secretary to establish and maintain the C.W. Bill Young Cell Transplantation Program (CWBYCTP), the successor to the NBMDR. The goal of the CWBYCTP is to increase the number of transplants for recipients suitably matched to biologically unrelated donors of bone marrow and cord blood. The Act also requires the Secretary to enter into contracts with qualified cord blood banks to assist in the collection and maintenance of at least 150,000 new, high quality CBUs, which are to be available for transplantation through the CWBYCTP.

The Office of Patient Advocacy (OPA), one of the federally legislated functions within the CWBYCTP, is authorized by section 379 of the Public Health Service Act [42 U.S.C. § 274k(h)], as amended. The Act stipulates that the Secretary, through the HRSA CWBYCTP, shall by contract establish and maintain an office of patient advocacy, which shall be staffed with a director and individuals with expertise in cord blood and bone marrow therapy covered under the CWBYCTP.

1 As amended by P.L. 111-264, and reauthorized by P.L. 114-104 and P.L. 114-15 (‘‘Timely ReAuthorization of Necessary Stem-cell Programs Lends Access to Needed Therapies Act of 2021’’ or the ‘‘TRANSPLANT Act of 2021’’).

OPA - Page 4 of 41

The OPA shall also serve as an advocate for the patient; provide individualized case management services to the patient (or family members, physicians, or other individuals acting on behalf of the patient); assist the patient in efficiently utilizing the system to search for a bone marrow donor or cord blood unit; and assist with information regarding third party payor matters. The OPA shall ensure that data are made available to patients and shall conduct surveys to determine the extent of satisfaction with the OPA and to identify ways to improve it.

II. GENERAL DESCRIPTION

The HRSA, Health Systems Bureau, Division of Transplantation, CWBYCTP requires that the OPA Contractor establish and maintain a system for patient advocacy, which shall serve patients (or family members, physicians, or other individuals acting on the patient’s behalf), searching for a bone marrow donor or cord blood unit (CBU) through the CWBYCTP. The OPA Contractor shall be headed by a director and staffed by individuals with expertise in bone marrow and cord blood therapy, physician with experience in cord blood transplantation, covered under the CWBYCTP. The OPA Contractor shall serve as an advocate for the patient by directly providing to the patient (or family members, physicians, or other individuals acting on behalf of the patient) individualized services with respect to efficiently utilizing the system to conduct an ongoing search for a bone marrow donor or cord blood unit and assist with information regarding treatment options and third party payor matters.

The OPA Contractor shall monitor the system to determine whether the search needs of the patient involved are being met. The Contractor shall ensure that, in serving as an advocate for a patient, the OPA provides individualized case management services directly to the patient (or family members, physicians, or other individuals acting on the patient’s behalf), including individualized case assessment and functions related to the search process. Also, the OPA Contractor shall, on behalf of patients who have completed the search for a bone marrow donor or CBU, provide information and education on the pre-transplant, transplant and post-transplant processes (diagnosis through survivorship).

The OPA includes a scope of work that encompasses:

1. patient advocacy and case management specific to bone marrow stem cell transplantation (using marrow and peripheral blood stem cells from volunteer adult donors) and cord blood unit transplantation;

2. histocompatibility/search expertise and guidance for patients and physicians;

3. public and professional education, including the maintenance of the CWBYCTP website; and

4. hematopoietic stem cell transplantation (HSCT) information made available to patients, families, health care professionals, and to the public.

OPA - Page 5 of 41

In the performance of this contract, the OPA Contractor shall furnish all the necessary services, qualified personnel, materials, equipment, and facilities as needed to perform its tasks as listed below in the Performance Work Statement.

The Government shall monitor the Contractor’s performance under this contract in accordance with the Contractor’s proposed and accepted Quality Assurance Surveillance Plan (QASP) (Attachment B).

III. PERIOD OF PERFORMANCE

The period of performance shall be a base period of twelve months and four (4) twelve-month option periods. The option periods under this contract may be exercised in accordance with Federal Acquisition Regulation (FAR) clause 52.217- 9 Option to Extend the Term of the Contract (MAR 2000). The period of performance under this contract shall commence with the effective date of the contract. The work will be performed off site, primarily at the location of the Contractor’s site.

IV. TASKS

Task 1 – Fulfill Contract Administration Requirements

1.1 Attend Initial/Kick-off Meeting – The Contractor shall meet with the COR and other Government staff to review the requirements, QASP (Attachment B), and deliverable schedule for the contract. The Contractor shall meet with HRSA either in person in Rockville, Maryland or via video conference/teleconference.

The COR shall provide the meeting agenda and meeting access information prior to the meeting, and the Contractor shall submit the meeting minutes after the kick-off meeting.

1.2 Attend Quarterly COR Meetings – The Contractor shall attend quarterly meetings, via remote conference, with the COR to discuss milestones, discuss progress and challenges related to the OPA contract, and provide recommendations on improvements to the OPA structure and processes to increase efficiency and effectiveness of the OPA functions. The Contractor shall schedule the meetings (this includes sending the meeting invitations) provide the meeting agenda prior to each meeting, and submit the meeting minutes after each quarterly COR meeting.

1.3 Attend Special COR Meetings – The Contractor shall convene via remote conference, no more than 12 times per year, for special or emergency situations that arise. The Contractor or HRSA may request the Special COR meeting. The Contractor shall schedule the meetings (this includes sending the meeting invitations) and, after each special COR meeting, submit the meeting minutes. If the Contractor is the requester of the meeting, the Contractor shall provide the meeting agenda prior to each meeting.

OPA - Page 6 of 41

1.4 Establish Policy and Technical Direction of the OPA – The Contractor shall develop a process plan to establish and review policy and technical direction of the OPA. The Contractor shall include key stakeholders in the structure used to establish the policy and technical direction and provide a copy of the Contractor’s conflict of interest (COI) policy and a blank copy of any document(s) required to assess COI of the stakeholders. The Contractor shall also provide written certification that its COI policy is in place and being followed.

The contractor shall provide certification of data security measures in place to maintain adequate data protection, consistent with industry standards, applicable National Institute of Standards and Technology standards and technology best practices, to protect data from unauthorized disclosure or acquisition by an unauthorized party and other relevant frameworks such as General Data Protection Regulation.

The Contractor shall also establish and provide information to the public on procedures under which the HHS Secretary shall receive and consider comments, from interested persons, relating to the manner in which the OPA is carrying out the duties of the CWBYCTP.

The Contractor shall consult with the COR regarding both the proposed changes to and assessments of key policies in an effort to ensure that such key policies do not conflict with other policies established for other components of the CWBYCTP and, in the case of National Cord Blood Inventory (NCBI) cord blood units (CBUs), with HRSA requirements for such CBUs.

The Contractor shall submit to the COR for approval, prior to their adoption and implementation, proposed changes to program standards; polices and standard operating procedures regarding unrelated donor/patient confidential information;

policy regarding conflict of interest; policy regarding quality improvement (data entry) (the “key policies”). At the direction of the COR, the Contractor shall also provide an opportunity for public comment by posting proposed changes on the CWBYCTP website (https://bloodstemcell.hrsa.gov). Updates on this task shall be provided in the progress report. (Task 4.1)

1.5 Records and Information Regulation – In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C.

552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

https://bloodstemcell.hrsa.gov/

OPA - Page 7 of 41

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

1.6 Records Management Training – The contractor (and/or subcontractor) shall ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2021recordsmanagement/01_index.

html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

1.7 System Of Records Notice – Managing the records includes, maintaining records to retain functionality and integrity throughout the records’ full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

For the records identified in the System of Records Notice (SORN) the Contractor shall follow the NARA-approved retention period. If there is no NARA- approved disposition schedule, the Contractor shall retain the records permanently during the duration of the contract, until Contracting Officer Representative (COR) notifies the contractor that NARA has approved an HRSA Records Schedule and HRSA provides approval for disposal of records.

Task 2 – Provide Patient Advocacy and Case Management

2.1 Establish and Maintain an Office for Patient Advocacy – The Contractor shall establish and maintain an Office of Patient Advocacy (OPA) that shall be headed by a highly qualified director and staffed by individuals with expertise in bone marrow and cord blood therapy covered under the CWBYCTP. Qualified staff shall include a physician with cord blood transplantation experience. In an OPA report, the Contractor shall provide details regarding the process it undertook to find and secure a director to head the OPA and individuals with expertise in bone marrow and cord blood therapy covered under the CWBYCTP to staff it.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhumancapital.learning.hhs.gov%2Fcourses%2F2021recordsmanagement%2F01_index.html&data=05%7C01%7CNShawir%40hrsa.gov%7C8dc54780f1664f9e26f508da43cb53a3%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C637896837800496732%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sU9pjlvFS3gh3R1etiy3HehuVMvf%2BNB5Sy2vaN2Wyj0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhumancapital.learning.hhs.gov%2Fcourses%2F2021recordsmanagement%2F01_index.html&data=05%7C01%7CNShawir%40hrsa.gov%7C8dc54780f1664f9e26f508da43cb53a3%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C637896837800496732%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=sU9pjlvFS3gh3R1etiy3HehuVMvf%2BNB5Sy2vaN2Wyj0%3D&reserved=0

OPA - Page 8 of 41

The OPA report shall also describe how OPA intends to serve as an advocate for the patient by directly providing to the patient (or family members, physicians, or other individuals acting on behalf of the patient) individualized patient advocacy and case management services (including search information for marrow, haploidentical, and cord blood transplant options, or other types of therapeutic options). Updates on this task shall be provided in the progress report. (Task 4.1)

2.2 Provide Patient Advocacy, Case Management, and Education Support – The Contractor shall develop a plan for patient advocacy, case management, and education efforts. The Contractor shall provide patient advocacy services that are separate from any Contractor mechanisms for donor advocacy, and which shall serve patients for whom the CWBYCTP is conducting, or has been requested to conduct, a search for a bone marrow donor or cord blood unit (CBU). In the case of such a patient, the Contractor shall serve as an advocate for the patient by directly providing to the patient (or family members, physicians, or other individuals acting on behalf of the patient) individualized patient advocacy and case management services. These services shall be in respect to efficiently utilizing the patient advocacy system under the bone marrow and cord blood functions, in order to conduct an ongoing search for a bone marrow donor or CBU; assist with information regarding third party payor matters; provide individualized case assessment; and provide case management services that include the functions related to the progress in the search process.

The Contractor shall, on behalf of patients who have completed a bone marrow donor or cord blood unit search, provide information and education on the process of receiving a transplant, including the post-transplant process. The Contractor shall increase the awareness of referring physicians, transplant physicians, primary care physicians, and obstetricians regarding the utility of bone marrow, peripheral blood and cord blood for unrelated blood stem cell transplants and the need for early patient referral and for a larger, more diverse registry of volunteer adult donors and inventory of CBUs. The Contractor shall develop a plan to conduct educational activities with respect to increasing the number of CBUs and bone marrow donors. The Contractor shall develop a process to receive feedback from its patients (or others acting on their behalf) to determine the extent to which the OPA is meeting the needs of the patients (or others acting on their behalf) and to identify ways in which the Contractor can be improved to best meet the needs of patients. The Contractor shall ensure the patients (or others acting on their behalf) can provide such feedback anonymously. Updates on this task shall be provided in the progress report.

(Task 4.1)

2.3 Monitor the Search Process – The Contractor shall develop a plan and

OPA - Page 9 of 41 update written policies and procedures for monitoring the search process to determine the extent to which the needs of the patients are being met and periodically provide to the patient (or individual acting on the patient’s behalf) information regarding bone marrow donors or cord blood units that are suitably matched to the patient, and other information regarding the progress being made in the search. The Contractor shall also provide patients with information about the progress of their searches, including ensuring that patients (or others acting on behalf of patients) are notified if their search has been interrupted or discontinued. The Contractor shall also identify how many patients initiated a search, how many moved from initiation of a search to a formalized search, and how many discontinued their search. The Contractor shall also identify and resolve problems in the search, to the extent practicable. Updates on this task shall be provided in the progress report. (Task 4.1)

2.4 Develop Plan for Dissemination of Information – The Contractor shall develop a plan for disseminating information (e.g., brochures, educational and informational resources, transplant costs, data, etc.) to patients, transplant centers, researchers, the general public, cord blood banks, and the CWBYCTP contractor(s). The Contractor shall develop a plan for annually updating the CWBYCTP website. Updates on this task shall be provided in the progress report. (Task 4.1)

2.5 Share Transplant Center-Specific Survival Data – The Contractor shall make the transplant center-specific survival data available on multiple webpages of CWBYCTP’s website and through OPA’s public website. The transplant center-specific survival data should be no more than one link away from the CWBYCTP homepage. Updates on this task shall be provided in the progress report. (Task 4.1)

Task 3 – Provide Support to and in Collaboration with HRSA

3.1 Provide Analytic Support to HRSA – The Contractor shall provide analytic support to HRSA, or other Federal agencies, specific to carrying activities necessary for the CWBYCTP. This shall include support to other CWBYCTP contracts, the Advisory Council, the provision of information used in preparation of the Annual Report to the Congress, and the preparation and submission of Office of Management and Budget (OMB) Clearance Packages and Federal Register Notices (FRNs). For the OMB package, specifically, the Contractor shall prepare and submit draft 60-day and 30-day FRNs, and a draft information collection request clearance package, in accordance with OMB's clearance process under the Paperwork Reduction Act. The Contractor shall make necessary changes to these documents, as requested by the COR, and respond in writing within 10 days of request (or as otherwise specified).

This support must include working with the Stem Cell Therapeutic Outcomes

OPA - Page 10 of 41

Database (SCTOD) to submit a report on actions taken to engage with stakeholders, findings, and proposed next steps to improve patient late-effects that may help with professional education within the field. Support also includes working with SCTOD to ensure appropriate review, understanding, and impact of late-effects on patients who have undergone blood stem cell transplantation. Additionally, support includes providing patient (or others acting on their behalf) feedback regarding the donor search and reservation processes to assist in improving advocacy and case management services provided by CWBYCTP contracts.

The COR shall notify the Contractor on specific analytic needs. Once approved by the COR, the Contractor shall conduct the analysis and submit a written report and a presentation to the COR for approval.

The Contractor shall respond to the COR within 48 hours for urgent requests, revisions, or for questions; and within 48 hours if: (1) the data are not collected and/or verified; (2) release of the data violates the Privacy Act or applicable laws; (3) the use of the data is not sufficiently valuable to warrant a large scale expenditure of time and effort; or (4) the data and information are otherwise exempted from disclosure under the Freedom of Information Act (FOIA), when applicable. Updates on this task shall be provided in the progress report. (Task 4.1)

Task 4 – Submit Routine Reports

4.1 Submit Quarterly Progress Reports – The Contractor shall submit progress reports to the COR. The quarterly progress report includes implementation status updates, progress and challenges, and recommendations for improvement for the following deliverables:

1. Task 1.4 – Establish Policy and Technical Direction of the OPA

2. Task 2.1 – Establish and Maintain an Office for Patient Advocacy

3. Task 2.2 – Provide Patient Advocacy, Case Management, and

Education Support

4. Task 2.3 – Monitor the Search Process

5. Task 2.4 – Develop Plan for Dissemination of Information

6. Task 2.5 – Share Transplant Center-Specific Survival Data

7. Task 3.1 – Provide Analytic Support to HRSA

Task 5 – Perform Contingent Tasks

5.1 Submit Transition Plan – The Contractor shall submit a draft written transition plan that includes the transition completion timeline for receiving materials from the predecessor Contractor (if applicable) and for notifying affected parties of the

OPA - Page 11 of 41 transition, or for transitioning materials to the successor Contractor (if applicable).

If transitioning from a predecessor Contractor, the transition plan shall address scheduling of a meeting with the predecessor Contractor to discuss the receipt and transfer of data and documentation and continuity of services during the transition period. The transition plan shall also address the description and receipt of contract materials from the predecessor Contractor.

If transitioning to a successor Contractor, the transition plan the Contractor shall provide to the Government includes:

1. A list of the materials developed and procured using contract funds;

2. A copy of all data files for the OPA within possession or control of the

Contractor, including documentation of all file layouts and copies of any software;

3. A copy of the forms and instructions used to collect data for the OPA, and a copy of documentation for OMB approval of data collection;

4. A copy of the operations manual for the OPA; and

5. A copy of OPA policies, standards, procedures, and membership criteria.

During this period, the Contractor shall cooperate with the successor Contractor(s) to maintain parallel systems, continue backup of data, and compare results of searches.

V. HHS Policy for Information Technology Procurements - Security and Privacy

Language

A. Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by

OPA - Page 12 of 41 the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/HRSA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/HRSA and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, HRSA Senior Official for Privacy (SOP), or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [ ] Low [ X ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ X ] Low [ ] Moderate [ ] High Overall Impact Level: [ X ] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

OPA - Page 13 of 41 information collected and/or managed on behalf of HHS/HRSA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/HRSA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/HRSA security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

Note to the Requiring Activity Representative: This information may be included after award in the event it is not yet available at the time of acquisition. Section d must be included in all contracts regardless of whether or not personally identifiable information (PII) is involved.

i. Per the Office of Management and Budget (OMB) Circular A- 130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the

OPA - Page 14 of 41 public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and

Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800- 171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

OPA - Page 15 of 41

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and HRSA policies.

Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet

Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The contractor (and/or any subcontractor) must notify the

OPA - Page 16 of 41 government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.)

that store and process government information and ensure devices meet HHS and HRSA-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including

PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be http://csrc.nist.gov/publications/

OPA - Page 17 of 41 provided to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the HRSA non-disclosure agreement. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract and have access to HRSA’s network must complete the applicable HHS/HRSA Cybersecurity Awareness Training training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees must complete HHS/HRSA Cybersecurity Awareness Training at least annually, during the life of this contract.

All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete Role-Based Training for IT Admin annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior (included in the HHS/HRSA Cybersecurity Awareness Training), and any applicable system-level rules of behavior.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HHS/HRSA Cybersecurity Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a

OPA - Page 18 of 41 separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send HRSA approved notifications to affected individuals following specific instructions from the HHS Privacy Incident Response Team (PIRT).

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) or 301-443- 3333, COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-mailto:hrsacsirt@hrsa.gov mailto:hrsacsirt@hrsa.gov

OPA - Page 19 of 41

CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS and HRSA privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

5. Position Sensitivity Designations All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

Note to the Requiring Activity Representative: The Requiring Activity Representative, in conjunction with Personnel Security, must use the OPM Position Sensitivity Designation automated tool (https://www.opm.gov/investigations/) to determine the sensitivity designation for background investigations. After making those determinations, include all applicable position sensitivity designations.

6. Homeland Security Presidential Directive (HSPD)-12 The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors;

OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

https://www.opm.gov/investigations/

OPA - Page 20 of 41

Note to the Requiring Activity Representative: For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

7. Roster The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation, including HRSA Disposition Plan to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within 14 days before an employee stops working under this contract.

https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

OPA - Page 21 of 41

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR.

Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or HRSA policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified in the HRSA Clearance Form for Separating Employees and Contractors (Form-419) when an employee terminates work under this contract within 14 days of the employee's exit from the contract. All documentation must be available to the CO and/or COR upon request.

9. Records Management and Retention

a. The Contractor (and/or any subcontractor) must maintain all information…