Performance Work Statement

Base Period: 9/01/2026 – 08/31/2027

Title: Development and Implementation of FHIR Infrastructure to Support EHR Data Collection for the National Health Care Surveys

SECTION 1 – BACKGROUND AND NEED

The National Health Care Surveys Data Modernization initiative aims to improve the timeliness, volume, and quality of electronic health record (EHR) data received for health care surveys, while modernizing workflows and reducing reporting burden for health care data providers. This initiative uses a multi-pronged strategy that includes:

· Adoption of widely used health information exchange standards (e.g., CDA and FHIR)

· Collaboration with key partners, including EHR vendors and standards development organizations such as HL7

· Alignment with current Health IT policies and regulatory requirements The National Health Care Surveys currently receive production EHR data aligned with the Clinical Document Architecture (CDA) standard. However, a central goal of the modernization effort is to transition toward more contemporary standards, particularly Fast Healthcare Interoperability Resources (FHIR). FHIR is becoming the de facto standard in Health IT regulation for enabling interoperability across health care and public health systems. Continued advancement toward FHIR-based exchange is therefore essential for the National Health Care Surveys to remain current and aligned with evolving regulatory expectations.

In 2024, the Division of Health Care Statistics (DHCS), National Center for Health Statistics (NCHS) conducted a pilot with three health care sites (across two clinical sites) to evaluate the timeliness and quality of FHIR-based interoperability between EHR systems and NCHS. This pilot leveraged the Health Data Exchange Application (HDEA), the Health Care Surveys (HCS) FHIR Implementation Guide, and its associated Reference Architecture (RA). From a process perspective, the pilot assessed the feasibility of more real-time, automated data exchange approaches compared with the existing, more manual CDA-based workflows.

Although the pilot showed promise, EHR vendors were hesitant to adopt the HDEA and subscription-based model due to concerns about clinical data security, limiting our ability to fully evaluate its impact on data timeliness and volume since submissions remained largely manual. These concerns would likely persist or intensify if scaled to more providers and vendors. Additionally, while the HDEA enables near real-time, encounter-level reporting, this approach may not align with the National Health Care Surveys’ preference for periodic (e.g., weekly or monthly) submissions to support data modernization goals, suggesting that an automated batch solution such as Bulk FHIR may be better suited to DHCS’ needs.

To that end, Bulk FHIR is designed for population-level data exchange. It retrieves thousands to millions of records in a single export job at predetermined intervals (e.g., weekly) with asynchronous processing. The use of Bulk FHIR, which delivers data in large batches at periodic intervals, drastically reduces API calls and network traffic when working with large populations and enables scalable population level analytics.

From a regulatory standpoint, the ONC 21st Century Cures Act Final Rule requires health IT developers to support both the FHIR Rest API and the Bulk FHIR API by December 31, 2025. As such both options should be widely available across certified EHRs. To that end, it is essential for the National Health Care Surveys to build a robust FHIR infrastructure that aligns with evolving regulatory requirements to include both FHIR Rest API and Bulk FHIR API. Doing so will ensure readiness to test and receive FHIR test and production data, while enabling continued progress in systems modernization as regulations advance. Having this infrastructure in place is essential to advancing FHIR testing with EHR systems. It is equally important to remain adaptable, as technology and requirements evolve rapidly; we must be prepared to adjust and design systems that can be readily configured to align with an evolving regulatory and technical landscape.

Reference: The ONC 21st Century Cures Act Final Rule added a certification criterion (§ 170.315(g)(10)) that requires standardized APIs based on HL7® FHIR® Release 4 for patient and population services. Certified API technology must implement these FHIR-based APIs to meet certification requirements for EHRs and other certified health IT.

Therefore, to achieve our objectives, the National Health Care Surveys needs to procure contractor support to build out this robust, responsive, and adaptable FHIR infrastructure and advance FHIR testing in electronic health record systems located in ambulatory care and hospital settings, using (in part) the previously mentioned APIs. To complete this work, the Contractor must at a minimum be familiar with the following tools and technologies in order to work on the Healthcare Electronic Health Records (HEHR) platform:

1. Java, Python, and its corresponding server-side technologies (e.g., JDK 1.8.0, Micro Services, Spring REST, Spring JPA/Hibernate, Enterprise Messaging, Web Application Development, and Web Services Architectures).

2. SQL Server 2016, 2017, and 2019.

3. No SQL database management systems.

4. Microsoft Azure Cloud technologies include but not limited to Databricks with Azure DevOps for continuous integration and continuous delivery.

5. R, SAS 9.4 or higher versions.

6. HTML5, Angular JS 8.0; and

7. Tomcat 9.0.

Initially, the HEHR platform was hosted by CDC on premises. More recently, it successfully migrated to the Enterprise Data Analytics and Visualization (EDAV) platform utilizing Microsoft Azure Services. EDAV has an isolated Confidential Information Protection and Statistical Efficiency Act (CIPSEA, 44 U.S.C. 3561-3583) enclave for storing and processing CIPSEA-protected data. The HEHR capabilities still exist on premises in the Healthcare Electronic Health Records HEHR platform as well.

The contractor should have experience working in a CIPSEA protected environment and should not have any employees and/or subcontractors who are based outside the US to minimize administrative processes and delays with onboarding.

SECTION 2 – PURPOSE

The DHCS Data Modernization Initiative includes efforts to improve the quality and timeliness of electronic health record data for two of the National Health Care Surveys, the National Hospital Care Survey (NHCS) and the National Ambulatory Medical Care Survey (NAMCS) using FHIR. To this end, the purpose of this project is to build the necessary FHIR infrastructure at NCHS to support testing of FHIR based interoperability in hospital and ambulatory care settings. To test the infrastructure built, DHCS will select three ambulatory provider groups that are part of the National Health Care Surveys Registry and ask these groups to send test FHIR data.

SECTION 3 – SCOPE OF WORK

The contractor shall design, develop, configure, and securely deploy FHIR endpoints to support pilot testing of standards-based interoperability in ambulatory care settings. This shall include implementation of appropriate technical architecture; configuration of security controls; and compliance with applicable healthcare regulations, including CIPSEA, as required. The contractor shall provide all necessary project management, Enterprise Performance Life Cycle (EPLC) compliance, technical support, Quality Assurance (QA), and system administration to ensure functionality, validate conformance to applicable specifications, manage infrastructure, uptime, and performance.

The contractor shall provision and manage required infrastructure resources, including OCIO cloud-based hosting services (e.g., Azure or AWS) / Enterprise Data Analytics and Visualization (EDAV) to support computing, storage, networking, and security requirements. The contractor shall establish and maintain development, testing, and staging environments to support system validation prior to production deployment. The contractor shall provide all necessary documentation and staff training (if applicable) to ensure proper implementation and operational sustainability. Additionally, the contractor shall implement Extra, Transform, Load ( ETL) processes to validate, normalize, and load FHIR data into analytic databases for evaluation. The contractor may leverage existing enterprise infrastructure and resources of HEHR, EDAV, and/or Azure Cloud, where appropriate, to minimize costs as long as CIPSEA and CDC security requirements are met.

SECTION 4 – TASKS TO BE PERFORMED

BASE YEAR: 9/01/2026 – 08/31/2027

Task 1: Provide project management and CDC’s Enterprise Performance Life Cycle (EPLC) support.

A. The contractor shall ensure the “Development and Implementation of FHIR Infrastructure to Support EHR Data Collection for the National Health Care Surveys” project is developed following and applying Project Management Institute’s standards and practices of properly initiating, planning, executing, controlling and monitoring, and closing project(s).

B. The contractor shall create and be responsible for all project management artifacts, including an all-inclusive draft and final Project Management Plan (PMP), incorporating NCHS requested changes.

C. The contractor shall ensure that all project work adheres to CDC’s EPLC standards, including but not limited to, creating and managing documentation for all stage gate reviews.

D. The contractor shall provide weekly project progress updates.

E. The contractor shall develop, update, and execute draft and final project schedules in MS Project.

F. The contractor shall proactively identify, track, and resolve all project risks in real-time.

G. The contractor shall set up meeting agendas, maintain decision log, and document all meeting minutes.

H. The contractor shall be responsible for cost, schedule, and performance metrics.

I. The contractor shall schedule, lead, and facilitate both technical and non-technical meetings with internal and external customers. Create, maintain, and manage both technical and non-technical documentation.

J. The contractor shall serve as technical liaison, with multiple CDC organizations including but not limited to the Office of the Chief Information Officer (OCIO), Cybersecurity Program Office (CSPO), Office of the Chief Information Security Officer (OCISO), Systems Security and Privacy Officer (SSPO), and the Confidentiality Officer.

K. The contractor shall design, create, maintain, and update technical documentation such as business and technical specifications, manuals, change requests for OCIO and OCISO, presentations, and other artifacts/documentation supporting CDC’s EPLC, Authority to Operate (ATO), System Security Plan) (SSP), Privacy Impact Analysis (PIA), etc.

L. The contractor shall manage all artifacts in a central repository that is properly structured.

M. The contractor shall create and maintain documentation of data flow.

N. The contractor shall provide monthly written progress reports.

O. The contractor shall develop and deliver comprehensive technical and user documentation, including system architecture, API specifications, configuration guides, standard operating procedures (SOPs), and onboarding materials, and provide training to Government and stakeholder personnel on FHIR standards, endpoint operations, Bulk Data API usage, and ongoing maintenance procedures.

management plan.

(electronic copy)

call

NCHS COR

Weekly

Task 2. Establish a FHIR Endpoint (Bulk Submit Notification) and FHIR Bulk Data API (including Bulk Submit for the receiver side) including testing.

The contractor shall:

A. Design, develop, configure, secure, and deploy a standards-compliant HL7® FHIR® endpoint (FHIR R4 or later, as specified by the Government).

B. Configure the FHIR endpoint to support required resource types and RESTful operations (e.g., read, search, and, if applicable, create and update).

C. Establish, configure, and maintain separate development, testing, staging, and production environments to support secure system development lifecycle (SDLC) practices, including code promotion, user acceptance testing (UAT), performance validation, and controlled production deployment as applicable.

D. Implement applicable Implementation Guides, including U.S. Core profiles and the HCS FHIR IG V2.0 (or other versions) as directed by the Government.

E. Publish and maintain a FHIR Capability Statement (metadata) documenting supported resources, profiles, operations, and search parameters.

F. Implement and configure the FHIR Bulk Data Access API (Flat FHIR®/Bulk Data Export) in accordance with the HL7 FHIR Bulk Data Implementation Guide (or other iterations) and the Bulk Submit draft Implementation Guide (or other iterations). The Bulk Submit Implementation Guide is anticipated to be published by HL7 in November 2026 at which point an updated version will be available.

G. Support asynchronous bulk exports at the system, group, or patient level, as specified by the Government.

H. Generate bulk export files in NDJSON format and ensure secure file handling, storage, and transmission.

I. Implement secure authentication and authorization mechanisms (e.g., OAuth 2.0, SMART on FHIR, system-to-system authorization for bulk export).

J. Configure role-based access controls and enforce least-privilege access principles.

K. Ensure encryption of data in transit and at rest via FIPS-140-2 validated system.

L. Implement audit logging, monitoring, and rate limiting to support security and operational oversight.

M. Provision and manage required cloud-based hosting infrastructure (e.g., Azure, EDAV, HEHR), including development, testing, staging, and production environments.

N. Conduct functional, performance, interoperability, and security testing and remediate identified defects prior to production release.

O. Provide API documentation, onboarding guidance for external partners, and operational procedures to support maintenance and sustainability.

P. Coordinate and support technical integration with participating provider organizations, including EHR vendors and health system IT teams, to enable secure connectivity, data exchange configuration, endpoint validation, and end-to-end testing of FHIR and FHIR Bulk Data API transactions.

Q. Collaborate with diverse teams including system implementers, SMEs, developers, informatics colleagues and implementation support contractors to facilitate Testing and Validation (T&V) activities and transition to production. This involves providing back-end systems maintenance and troubleshooting to ensure successful data transmission.

R. Confirm the delivery of testing (and/or production data) to the FHIR server as part of the testing and validation effort with at least three large provider groups containing at least 500 providers in each group selected by DHCS. Provide technical assistance to the government and other contractors to ensure data delivery.

S. Provide relevant technical subject matter expertise to inform the development of the final pilot testing evaluation report highlighting key findings. This would include but not limited to sharing experiences in carrying out FHIR server maintenance activities during the pilot, the type of issues encountered with their resolution and relevant lessons learned.

T. Provide documentation that include step‑by‑step process, data sources and versions, system and environment details, quality control criteria, etc.

Task 3. Attend kick-off meeting.

A. The contractor shall attend a kick-off meeting with NCHS and submit meeting minutes within two (2) business days of the kick-off meeting. The purpose of the kick-off meeting is to discuss the technical requirements of the contract and achieve any needed clarity on tasks, deliverables, etc., to ensure the successful execution and completion of the work stated in this Task Order.

SECTION 5 - GOVERNMENT FURNISHED EQUIPMENT (GFE)

GFE will be provided in the form of a laptop and PIV card issued to each contractor.

GFE shall be managed IAW the terms of FAR 52.245-1, corresponding GFE HHS clauses incorporated in award.

Contractors shall accept and/or report provided GFE via the Shipping and Receiving document.

Serially managed items are provided to the contractor by the CDC and to be reported by the contractor.

Contractors in possession of GFE shall provide the COR an annual report of all GFE in its possession to include the item description, make, model, serial number, and last inventory date; the report should be minimally provided on an annual basis and 30 days prior to the expiration of any performance period.

Contractor will update laptops with security and software patches, BIOS updates, and other types of updates as requested by CDC.

SECTION 6 – PLACE OF PERFORMANCE

Place of Performance. Shall be performed either remotely via telework or at the NCHS facility. Occasionally, contractor staff may be requested to participate in meetings on-site at NCHS. NCHS is located at 3311 Toledo Road, Hyattsville, MD 20782

Mission Location: NCHS Facility

Place of Performance: Regardless of where work is performed, the Contractor shall ensure that work is completed effectively and that mission needs and requirements are met, without degradation of services. Also, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. The Contractor shall propose on-site rates for all work performed at an alternative work site. Incidental charges incurred while working at an alternative work site (e.g., electricity, internet) are not allocable to the contract and shall not be billed to the government.

Local travel to and around the mission location for NCHS may be required throughout the period of performance; this travel will not be reimbursed. All information processing is restricted to CDC information resources (e.g., CDC laptops, CDC enterprise network).

The following paragraph is required when the contractor performs work on-site at a government facility.

Secondary Place of Performance – Contingency Only. As determined by the Contracting Officer’s Representative (COR), contractor employees may be required to work at a secondary place of performance (e.g., home, the contractor's facility, or another approved activity within the local travel area) in cases of unforeseen conditions or contingencies (e.g., pandemic conditions, exercises, government closure due to inclement weather). Additionally, the contractor may be required to account for the physical location of their personnel should this information be requested by the COR. Non-emergency/non-essential contractors should not report to a closed government facility. Contractor shall prepare all deliverables and other contract documentation utilizing contractor resources. To the extent possible, the contractor shall use best efforts to provide the same level of support as stated in PWS. In the event the services are impacted, reduced, compromised, etc., the Contracting Officer or the contractor may request an equitable adjustment pursuant to the Changes clause of the contract.

REMOTE WORK

Remote work for contractors accessing non-public use data

At the written direction of the COR and with NCHS Confidentiality Officer prior approval, the contractor staff will be permitted to remotely work and access nonpublic use data via use of remote login with government issued laptops. Remote work with access to nonpublic use data (i.e., data that cannot be downloaded from the NCHS internet) will generally be limited to data that does not contain direct personal identifiers (such as respondent name or address, establishment name or address, social security or other identifying number, unretouched video, or audio recording). Prior to beginning remote work, it is required that all pertinent training will be completed, and that the contractor familiarize themselves with all NCHS confidentiality and data security rules and regulations. Remote work is only permitted from locations in the 50 states and Washington DC. Remote login will only be permitted with government issued laptops.

NCHS does not regularly permit contractors to access nonpublic use data that does contain direct personal identifiers while remotely working. However, if completion of the tasks is dependent upon access to nonpublic use data that contains direct personal identifiers, the need for its remote access may be reviewed by the NCHS Confidentiality Officer and may be granted. Access to these data that contain direct personal identifiers will be revoked once the need to access them for the tasks required by the contract have been completed.

Any contractor staff who receives remote access to nonpublic use data (with or without direct or indirect personal identifiers) may have this remote access terminated for violation any of the NCHS rules and regulations of its access. Consequences for violating any of the NCHS rules and regulations of its access can include required removal of the staff from the contract; suspension of system (i.e., network, shared files, CIPSEA, etc.) access; criminal prosecution, including imprisonment; and/or Civil prosecution, including imposing a fine.

SECTION 7 – DELIVERY REPORTING SCHEDULE

Task

Description Quantity of Copies

Delivery Date

Deliver To

management plan.

call

NCHS COR

Note: All materials developed – including but not limited to deliverables, programs, and documentation as part of this project – are owned by NCHS. The data collected and the data files created are covered under the Confidential Information Protection and Statistical Efficiency Act (CIPSEA, 44 U.S.C. 3561-3583).

SECTION 8 – PERFORMANCE-BASED MATRIX / QUALITY ASSURANCE SURVEILLANCE PLAN

(Standard).

The Contractor shall attend a "Kick-off" meeting with NCHS in Hyattsville, MD

The Contractor shall submit a monthly status report.

Convene onsite/teleconference calls weekly and provide meeting minutes including action items from these calls.

Timeliness

Accuracy and Timeliness

Accuracy, Timeliness, Efficiency, and Customer Satisfaction Within 14 calendar days following award

Monthly status report submitted NLT 15th of each month and approved by COR.

Weekly calls. Minutes submitted to the Project Director & COR via e-mail within 2 working days of each call.

Surveillance system will be primarily customer observations.

See QASP for details.

Surveillance system will be primarily customer observations.

Favorable or Unfavorable Performance Evaluation

Favorable or Unfavorable Performance Evaluation

Favorable or Unfavorable Performance Evaluation

Quality Assurance Surveillance Plan

1. PURPOSE

a. This Quality Assurance Surveillance Plan (QASP) provides a systematic method to evaluate the services the contractor is required to furnish. The surveillance/evaluation methods identified in this QASP will assure the Government of satisfactory contractor performance. The QASP is the management tool for documenting contractor performance evaluation and reporting of contractor performance.

b. The QASP is intended to be a “living document.” It shall be revised or modified as circumstances warrant throughout the Delivery Order performance.

c. The contractor, not the Government, is responsible for management and quality control actions to meet the terms of the Delivery Order. The role of the Government is quality assurance to ensure Delivery Order standards are achieved.

2. SURVEILLANCE

To ensure performance is being met, the government will monitor and measure the contractor’s performance based on the performance requirements. Selecting the most appropriate surveillance method for the effort involved is important. CDC has taken into consideration task criticality, Delivery Order period of performance, performance requirements and standards, availability of performance monitors, surveillance value in relation to task cost/criticality, and available resources. Careful selection of appropriate surveillance methods will enable the government to determine most appropriate surveillance method for each task order requirement.

Surveillance methods may include:

100 Percent Inspection: This is usually only the most appropriate method for infrequent tasks or tasks with stringent performance requirements, e.g., where safety or health is a concern. With this method, performance is inspected/ evaluated at each occurrence. One hundred percent inspection is not appropriate in most cases.

Random Sampling: This is usually the most appropriate method for recurring tasks. With random sampling, services are sampled to determine if the level of performance is acceptable. Random sampling works best when the number of instances of the services being performed is very large and a statistically valid sample can be obtained. Computer programs may be used to assist in establishing sampling procedures.

Periodic Inspection: This method, sometimes called "planned sampling," consists of the evaluation of tasks selected on other than a 100 percent or random basis. It may be appropriate for tasks that occur infrequently, and where 100 percent inspection is neither required nor practicable. A predetermined plan for inspecting part of the work is established using subjective judgment and analysis of agency resources to decide what work to inspect and how frequently to inspect it.

CDC reserves the right to choose the inspection methods utilized without notice to the Contractor. The methods to be used will be mostly random samplings of reports and feedback from customer satisfaction surveys. Rating levels of the surveys will be used as one measure of Contractor performance and will be determined and agreed upon by CDC.

3. PROCEDURES

The Contracting Officer Representative (COR) and designated representatives will continuously measure, monitor, and evaluate the quality of the services described herein by using quality control techniques that include inspections and customer surveys. The Contractor will be given semi-annual performance reports by the COR indicating the quality levels of all required services stated below:

Government satisfaction with services related to high impact public health activities through conducting research, policy assessments, studies, demonstration projects, consultation and technical assistance and related support activities.

Timely submission of monthly progress reports detailing current status of the Delivery Order. The report shall be narrative in form and shall include a summary of progress toward completion of each Delivery Order task and any problems encountered to date, including the Contractor’s assessment of the specific impact of such problems on scheduled date of completion of milestones. The monthly progress reports shall be provided to the individual Delivery Order Contracting Officer’s Representative and the Contracting Officer. Reports shall be submitted in a professional, edited format (i.e., with proper spelling and grammar).

The Contractor shall be held accountable for full performance of all services. CDC’s Contractor Performance Evaluation inspections and reports will be the basis for determining deficiency rates and nonconforming services. The Contractor shall be notified of unsatisfactory performance or non-preformed work.

The Contractor shall meet with the COR on a biweekly basis. The main objective of the meetings is to resolve any operational, technical, or managerial issues involving any/all tasks being performed under the contract.

SECTION 9 – SPECIAL CONSIDERATIONS

All contract staff must work an 8-hour day between the time period of 7:00am-6:30pm.

All proposed staff must be able to work independently and in a team environment according to business needs dictated by federal business owner.

508 COMPLIANCE

Section 508 and Accessibility Requirements Part A – Provision

Reference HHSAR 352.239-73[8] Electronic Information and [Communication] Technology Accessibility Notice.

[(Deviation)]

[(a) Any offeror responding to this solicitation must comply with established HHS Information and Communication Technology (ICT) accessibility standards. Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html.

(b) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-79 Information and Communication Technology Accessibility. In order to facilitate the Government's determination whether proposed ICT supplies, products, platforms, information, and documentation meet applicable Section 508 accessibility standards, offerors must submit an appropriate HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an Accessibility Conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), in accordance with the completion instructions. The purpose of the checklists and conformance reports are to assist HHS acquisition and program officials in determining whether proposed ICT supplies, products, platforms, information, and documentation conform to applicable Section 508 accessibility standards. Checklists and ACRs evaluate—in detail—whether the ICT conforms to specific Section 508 accessibility standards and identifies remediation efforts needed to address conformance issues.

(c) If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies, products, platforms, information, documentation, or services support delivered do not conform to the described accessibility standards, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(d) In order to facilitate the Government's determination whether proposed ICT supplies meet applicable Section 508 accessibility standards, offerors must submit an Accessibility Conformance Report, in accordance with its completion instructions and tailored to the requirements in the solicitation. The purpose of the Report is to assist HHS acquisition and program officials in determining whether proposed ICT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to selfevaluate their supplies and document, in detail, whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues.

Instructions for preparing the Template are available at https://www.section508.gov/.

(e) Additionally, offerors must provide enough information to assist the Government in determining that the ICT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(f) Respondents to this solicitation must identify any inability to conform to Section 508 requirements. If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(g) Items delivered as electronic content must be accessible to HHS acceptance criteria.

Checklist for various formats are available at http://508.hhs.gov/. Materials, other than items incidental to contract management, that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Contracting Officer's Representative.

(End of provision)]

Part B - Clause

352.239-74[9] Electronic, Information, and Communication Technology Accessibility.

[(Deviation)]

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all information and communication technology (ICT) supplies, products, platforms, information, documentation, and services, or support developed, acquired, maintained or delivered under this contract or order must comply with the Revised 508 Standards, which are located at 36 C.F.R. 1194.1 and Appendices A, B, and C, and are available at https://www.access-board.gov/ict/. Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html.

(b) Additional Section 508 accessibility standards applicable to this contract or order are identified as follows:

205 WCAG 2.0 Level A & AA Success Criteria 302 Functional Performance Criteria 502 Inoperability with Assistive Technology 503 Applications 504 Authoring Tools 602 Support Documentation 603 Support Services

If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract or order, which adds new ICT supplies or services or revises the type of, or specifications for, supplies, products, platforms, information, documentation, or services support, the Contracting Officer shall require that the Contractor submit a completed HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an Accessibility Conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), and any other additional information necessary to assist the Government in determining that the ICT supplies or services conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(d) If this is an Indefinite-Delivery type contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include ICT supplies, products, platforms, information, documentation, or services support will define the specifications and accessibility standards for the order. In those cases, the Contractor shall be required to provide a completed HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an ACR (based on the VPAT see https://www.itic.org/policy/accessibility/vpat), and any other additional information necessary to assist the Government in determining that the ICT supplies, products, platforms, information, documentation, or services support conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) The contractor shall identify to the Contracting Officer any perceived exception or exemption to Section 508 requirements for review by the agency Section 508 Program.

SECURITY AND PRIVACY REQUIREMENTS

1. Baseline Security Requirements:

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the CDC mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/CDC policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of CDC/NCHS and information systems that store, process, and/or transmit CDC information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the System Security and Privacy Officer (previously referred to as ISSO), CISO, CDC CPO, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

· Confidentiality: [ ] Low [X] Moderate [ ] High

· Integrity: [ ] Low [X] Moderate [ ] High

· Availability: [X] Low [ ] Moderate [ ] High

· Overall Impact Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of CDC/NCHS regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the CDC/NCHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or CDC/NCHS security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable CDC Component privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, CDC uses a privacy analysis process to assess the risks associated with CDC's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how CDC collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

· If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 30 days of project kickoff and after completion of the PTA and in accordance with CDC policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

· The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and,

iv. Returned to HHS/CDC control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by CDC or collected by the Contractor on behalf of CDC must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any CDC records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS/CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115- 232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The Contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to always assume HTTPS to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult HHS/CDC Policy for Internet and Email Security for additional information.