A3 - NINDS Center for Clinical Trial Resources SOW - Final.pdf

May 4, 2022

ATTACHMENT No. 1 -- STATEMENT OF WORK

NINDS Center for Clinical Trial Resources

ARTICLE C.1. STATEMENT OF WORK

To address the present and anticipated future needs of the National Institute of Neurological Disorders and Stroke (NINDS), National Institutes of Health (NIH), the NINDS Division of Clinical Research (DCR) requires a contractor to provide scientific resources and services for the NINDS Center for Clinical Research Resources (hereinafter “Center”). The overall purpose of the Center is to provide scientific and technical support toward the conduct of clinical research sponsored by the NINDS.

The NINDS DCR is charged with ensuring the highest quality of each NINDS-funded clinical research project and compliance with DHHS/NIH/NINDS regulations and policies regarding human subject protection and safety monitoring. To ensure the highest quality product and most efficient use of resources, the NINDS DCR has a programmatic need for clinical research-related scientific and technical support.

In FY 2020, based on the NIH Research, Condition, and Disease Categorization (RCDC) system, NINDS invested over $750 million in 1,255 clinical research projects and ranked ninth among NIH Institutes and Centers in spending on clinical research.

Scope

To provide the NINDS with scientific and technical support toward the conduct of NINDS-sponsored clinical research.

Objectives

• Provide scientific/technical support in quality assurance and quality control in the conduct of NINDS-sponsored clinical research to ensure that the data resulting from a clinical research project are of the highest quality and are considered valid and credible within the scientific and clinical community, as well as the general public.

• Provide statistical and methodological support and analysis to the NINDS as related to the development of guidelines for NINDS programmatic staff, the resolution of methodological problems in ongoing clinical activities, and overall statistical analysis of the NINDS clinical research portfolio to aid NINDS strategic planning.

• Provide scientific/technical support, guidance and services in clinical data acquisition, archiving, and distribution activities, in accordance with current NIH data management and sharing policy, in order to store and share/provide secure access to NINDS-sponsored clinical research data with the scientific research community.

• Provide scientific/technical support and training for the ongoing development of a core set, and several disease-specific sets, of Common Data Elements (CDEs) for use in NINDS-sponsored clinical research.

Technical Performance Requirements

Independently, and not as an agent of the Government, the Contractor shall furnish the necessary services, qualified personnel, material, equipment, and facilities required to serve as a Center for Clinical Research Resources that accomplishes the work described below. The Contractor shall provide scientific resources and services necessary for a broad range of activities required to support the NINDS clinical research program effectively. This includes multiple activities requiring advanced expertise in the design, conduct, and oversight of clinical research. Although four distinct performance areas have been identified and defined (see specific requirements below), it is impossible to anticipate every need of the NINDS DCR because the future clinical research and their associated unique demands are unknown, and because of possible unanticipated NINDS and NIH policy changes. The Contractor shall provide clinical research professionals with broad enough expertise to handle such unanticipated needs.

Examples of such possible needs include: preparation of the scientific background information needed to develop new scientific initiatives involving clinical research; and dissemination and translation of results from clinical research to the clinical community (patient and physician education).

The Contractor must be able to provide services to support a variety of scientific and technical services for the conduct of NINDS-sponsored clinical research. The contract type for this requirement is cost-reimbursement, term form (level-of-effort) whereby the Government derives immediate benefit throughout the course of performance. The estimated level of effort is as follows:

Basic Requirement

Period Item Estimated Level of Effort Base Period Basic Requirement 9,655 Option Period 1 Basic Requirement 9,655 Option Period 2 Basic Requirement 9,655 Option Period 3 Basic Requirement 9,655 Option Period 4 Basic Requirement 9,655

Optional Quantities

Period Item Estimated Level of Effort

Estimated Number of Times Option Will Be Exercised*

Total (hours) Level of Effort

Base Period Small Project 100 18 1800 Base Period Large Project 500 5 2500 Option Period 1 Small Project 100 18 1800 Option Period 1 Large Project 500 5 2500 Option Period 2 Small Project 100 18 1800 Option Period 2 Large Project 500 5 2500 Option Period 3 Small Project 100 18 1800 Option Period 3 Large Project 500 5 2500 Option Period 4 Small Project 100 18 1800 Option Period 4 Large Project 500 5 2500 Grand Total (Base and All Options)

21,500

*The Government estimates the Small Project Option may be exercised up to 18 times per year and the Large Project Option may be exercised up to 5 times per year. However, the Government reserves the right to exercise the Small Project Option more than 18 times during a performance period and the Large Project Option more than 5 times during a performance period, provided the total number of times exercised does not exceed 90 and 25 respectively.

The requirement descriptions and estimated quantities below for the Basic Requirement provide general estimates for the support services required annually for the conduct of NINDS-sponsored clinical research. However, the quantities and specific activities will most likely fluctuate to meet the NINDS’ needs during each performance period. Therefore, the estimates below are provided only as a reference for estimating the level of effort and development of the cost proposal for the Basic Requirement. Actual quantities will vary depending on the specific needs of each performance period.

Additionally, the NINDS has included Option Quantities for increased level of effort to address increases in activities that may be required during a performance period. Two types of quantity options are included for each performance period: Small Project and Large Project.

The NINDS has identified four specific performance areas comprising the scope of work under the contract.

PERFORMANCE AREA #1: QUALITY ASSURANCE/QUALITY CONTROL MONITORING SUPPORT

PERFORMANCE AREA #2: STATISTICAL AND METHODOLOGICAL SUPPORT

PERFORMANCE AREA #3: CLINICAL DATA ACQUISITION AND ARCHIVING SUPPORT

PERFORMANCE AREA #4: COMMON DATA ELEMENTS SUPPORT

Specifically, the contractor, in collaboration and cooperation with the NINDS COR shall provide:

Contract Start-Up and Overall Project Management

1. The Principal Investigator (PI) shall be responsible for the oversight and management of the contract. The PI shall be responsible for overall management and strategic direction of work conducted under the contract. The Contractor shall also designate a Project Manager (PM) who will have primary responsibility for day-to-day management of this contract and all staff involved.

A Performance Area Leader shall also be designated for each of the four performance areas identified above (Quality Assurance/Quality Control Monitoring Support, Statistical and Methodological Support, Clinical Data Acquisition and Archiving Support, and Common Data Element Support). While the PM may also serve as a Performance Area leader, the PI shall not serve in any other role/capacity under the contract.

2. The designated PI, PM, and all Performance Area Leaders shall attend a start-up meeting organized by NINDS at the NINDS office location in Rockville, Maryland or a virtual meeting within 15 calendar days after the contract award.

Review and provide comments/suggestions for improvements on existing written guidelines to NINDS-sponsored Investigators on data quality assurance/quality control in clinical research as it relates to Performance Area #1 (see below) within 30 calendar days after contract award. Quality Assurance/Quality Control Guidelines and Checklist may be found on the NINDS DCR websitehttps://www.ninds.nih.gov/Current-Research/Research-Funded-NINDS/Clinical- Research/Clinical-Research-Toolkit and https://www.ninds.nih.gov/sites/default/files/study_checklist_508C.pdf .

3. Develop and deliver a draft Standard Operating Procedures (SOPs) document to be used in conducting quality assurance/quality control monitoring site visits to NINDS grantees, contractors http://www.ninds.nih.gov/Current-Research/Research-Funded-NINDS/Clinical-http://www.ninds.nih.gov/Current-Research/Research-Funded-NINDS/Clinical-http://www.ninds.nih.gov/sites/default/files/study_checklist_508C.pdf and NINDS Intramural staff within 30 calendar days after contract award. The final SOP document, to be developed in coordination with NINDS DCR staff input, will be used to assist in reviewing, assessing and providing corrective recommendations to data quality assurance and quality control procedures, and shall be delivered within 15 days after receipt of final NINDS DCR input.

4. Review and provide comments/suggestions on revising current guidelines for data archiving/sharing (https://www.ninds.nih.gov/Current-Research/Research-Funded-NINDS/Clinical- Research/Archived-Clinical-Research-Datasets ) in coordination with the NINDS CDE Program Officer. Provide written comments/suggestions on guidelines within 30 calendar days after contract award.

5. Receive, curate and archive NINDS clinical research datasets (there are currently 61 data sets in various formats including SAS, ASCII, EXCEL, CSV and PDF) that will be delivered by the NINDS to the Contractor within 6 weeks of award. Be able to distribute acquired data sets within 30 calendar days after receipt from NINDS. Information on the Archived Clinical Research Datasets can be found at the NINDS Website (https://www.ninds.nih.gov/Current-Research/Research- Funded-NINDS/Clinical-Research/Archived-Clinical-Research-Datasets).

6. Review and provide suggestions/comments on current Standard Operating Procedures for the Common Data Element (CDE) project to the NINDS COR within 60 calendar days after contract award. Information on the CDE Project process can be found on the CDE website on the “Learn” tab (https://www.commondataelements.ninds.nih.gov/ProjReview)

7. Initiate Information Systems Security clearances and complete required Information Systems Security training in order to access and perform updating and administrative functions on the NINDS Common Data Elements website.

8. Submit an Information Systems Security Plan in accordance with FISMA requirements within 30 days after contract award.

9. The Principal Investigator and Project Manager shall be available for emergency conference calls within 2 hours of notification and be available for an emergency in person meetings at the NINDS in Rockville, Maryland or via a virtual meeting within 48 hours of notification for the duration of the contract.

Performance Area #1: Monitor Quality Assurance/Quality Control in Clinical Research

Quality assurance/quality control in NINDS-funded clinical research is the responsibility of each individual study’s Principal Investigator and staff (this may be a grantee, NINDS intramural staff, or other NINDS-funded project staff). The overall objective of the quality assurance/quality control performance area is to ensure that the data resulting from a clinical research project are of highest quality, are considered valid and credible within the scientific, clinical community and general public and that it is compliant with local and federal regulations.

To assist the investigators in meeting this objective, the Contractor shall review, monitor, and recommend corrections (if needed) for quality assurance/quality control procedures in NINDS-funded clinical research. Specifically, the Contractor shall:

1. Revise/develop, in cooperation with NINDS DCR staff, guidelines specifying the procedures that the project investigator should develop and implement to assure data quality and integrity (estimated 10-12 projects/year).

http://www.ninds.nih.gov/Current-Research/Research-Funded-NINDS/Clinical-http://www.ninds.nih.gov/Current-Research/Research-http://www.commondataelements.ninds.nih.gov/ProjReview)

2. Provide technical assistance from a qualified Clinical Research Associate (CRA) or clinical research professional trained and experienced in clinical research monitoring. This person shall provide technical assistance to investigators and NINDS to facilitate the interpretation and implementation of the data quality assurance/quality control guidance according to Good Clinical Practice (GCP) Guidelines. An equally trained or higher-level staff person must be available to serve as backup if the CRA is unavailable.

3. In cooperation with NINDS DCR program staff, develop/revise written Standard Operating Procedures (SOPs) for use by the contractor for conducting site visits with NINDS grantees, contractors, and NINDS Intramural scientists to review, assess, and correct (if needed) data quality assurance/quality control procedures and to monitor, assess, and recommend actions for correction in the study; this should include PI and NINDS feedback prior to completion of the final site visit report. NINDS requires a confidentiality document to be signed by the contractor’s employees who participate in this activity. A draft template for the confidentiality document shall be delivered to the NINDS COR within 30 days after contract award; individually signed confidentiality documents shall be included with each final site visit report.

4. Conduct ongoing data quality assurance/quality control monitoring of approximately 12 intramural trials per year. Conduct approximately 4 data quality assurance/quality control monitoring visits per project per year

Performance Area #2: Statistical and Methodological Support

The Contractor shall provide support and consultation to the NINDS in the area of statistics and clinical research methodology. Specifically, assistance shall be required in the development of statistical and methodological guidelines for NINDS programmatic staff; statistical consultation will be needed for large clinical projects; expert advice will be needed to help solve methodological problems in ongoing clinical projects; and occasionally, statistical services will be required to conduct statistical analyses.

Additional activities may be needed for the support of special short-term projects to evaluate clinical research design, oversight, and conduct of clinical research identified by NINDS.

Activities will fall into two categories:

1. Methodological Support and Consultation: activities may include a special project such as a reviewing the impact of clinical research, cost effectiveness analysis, and other methodological work; additional work may include working with other agencies/organizations on mapping the NINDS CDEs to other standards, identifying new methods and tools in areas identified by external scientists/experts for the CDE project, white paper development in clinical research topics, etc.

2. Statistical Support: meta-analysis or sub analysis of NINDS funded studies, re-analyzing clinical research data, consultation and support to NINDS staff on data review of ongoing or completed studies, etc.

For each identified activity within this performance area, the contractor shall be expected to meet with NINDS staff who will provide an overview and scope of the proposed project. Specific direction will be provided as project specifications are discussed and agreed to by both the NINDS COR and PI.

Performance Area #3: Clinical Data Acquisition and Archiving

After the termination of clinical research projects, investigators must share their data and the clinical data acquisition and archiving activity is a mechanism available to NINDS- funded projects. The contractor shall provide services in the area of dataset acquisition and archiving of completed clinical research in a de-identified format. Currently NINDS has approximately 61 archived data sets that are available for researchers to use; the contractor shall archive these as well as additional data sets that are not in the current NINDS archive. Current data sets shall be delivered to the Contractor (provided as Government furnished information under this contract) for storage and dissemination within 6 weeks after contract award. In addition, the contractor shall:

1. Review the current SOPs for archiving and provide comments to NINDS on alternative processes that would present cost savings or improve processes without an increase in cost.

2. Archive the study data at the request of the NINDS; NINDS shall identify which studies are to be archived. This activity includes archiving previously de-identified raw data and study materials (protocol, data dictionary, etc.). The contractor shall archive the data in a format that will be accessible to the public. The contractor shall verify that data is properly deidentified and that all data, metadata and other documents are submitted and reflect what is listed in the Archiving Materials Form and Checklist. Together with the NINDS Archiving Liaison, the Contractor shall develop the data acquisition process; it is expected that NINDS will be the central contact for investigators.

3. Provide a list/inventory of the archived data sets to the CO, COR, and NINDS Archiving Liaison on a quarterly basis (due dates correspond to the due dates of the Quarterly and Annual Reports, See Article F.3.). This list/inventory shall include (but not be limited to) an inventory of all materials accompanying the archived data set. The list/inventory format will be reviewed and approved by NINDS. Additional reports may be requested by NINDS as needed.

4. Work with the NINDS Archiving Liaison/COR on providing the data sets and accompanying materials to investigators who have been approved by NINDS to receive data from the archive (NINDS will be responsible for the approval process). The majority of contracted work pertains to this performance area.

It is estimated that 5 new clinical trials and/or clinical research projects data sets would be archived each year. It is anticipated that approximately 50 requests for currently archived data sets would need to be processed each year.

Performance Area #4: Common Data Elements

The contractor shall provide support for the ongoing maintenance and updating of existing disease-specific and a core set of common data elements (CDEs). The Contractor shall, in collaboration with the NINDS COR, oversee the maintenance and updating of the current CDE library, and maintain and updating any new diseases added to the library during the period of the contract.

The following represents CDEs contained in the current CDE website library:

General (For all diseases) Amyotrophic Lateral Sclerosis Cerebral Palsy Chiari I Malformation Epilepsy Friedreich's ataxia Headache Huntington’s Disease https://www.ninds.nih.gov/sites/default/files/archived_clinical_datasets_and_checklist_508c.pdf https://www.ninds.nih.gov/sites/default/files/archived_clinical_datasets_and_checklist_508c.pdf

Mitochondrial Disease Multiple Sclerosis Myalgic Encephalomyelitis/Chronic Fatigue Syndrome

NEUROMUSCULAR DISEASES

Congenital Muscular Dystrophy Duchenne Muscular Dystrophy/Becker Muscular Dystrophy Facioscapulohumeral Muscular Dystrophy Myasthenia Gravis Myotonic Dystrophy Spinal Muscular Atrophy

NeuroRehab (Rehabilitation in Neurological Disorders) Parkinson's Disease Spinal Cord Injury

STROKE

Unruptured Cerebral Aneurysms and Subarachnoid Hemorrhage

TRAUMATIC BRAIN INJURY

Sport Related Concussion

The following represents the ongoing work/performance activities that will be required for the duration of the contract:

1. CDE Website – The CDE public website shall be hosted and managed by the Contractor. The contractor shall be responsible for, providing support to maintain and update the NINDS CDE website content and text, supporting documentation, and overall presentation. The current website is built on Drupal, which is an open-source web content management system written in PHP and distributed under the GNU General Public License. At the discretion of NINDS, additional changes to the website may be implemented as needed. This may include but is not limited to HHS or NIH required messages (e.g. COVID) and other content. The website may be viewed at http://www.commondataelements.ninds.nih.gov.

2. CDE Steering Committee Support– the NINDS does use, outside the coverage of this contract, a “CDE Steering Committee” to make overall recommendations as to the disease/disorders that might be included in the CDE library and possible content changes. This committee meets on an annual basis via teleconference. The Contractor shall be responsible for preparing materials in support of these meetings, facilitating and coordinating opinions of the committee, and preparing and distributing post-meeting summaries. The Contractor’s CDE Performance Area Leader shall serve as an ad hoc member to this committee and shall attend these meetings.

3. CDE Disease-Specific Oversight Committee Support: In addition to the overall CDE Steering Committee mentioned in 2. above, each disease or group of diseases (e.g., neuromuscular diseases) has an Oversight Committee (OC), consisting of the Chairs/Co-Chairs of each subgroup and if appropriate, external members. who provide guidance to the NINDS CDE Project for that specific disease. These Oversight Committees will meet at least once every year in-person or in virtual meetings. In-person meetings will be at the NINDS in Rockville, MD or at a disease-specific national meeting. The Contractor shall be responsible for preparing materials in support of these meetings, facilitating and coordinating opinions of the committee, and preparing and distributing post-meeting summaries. The Contractor’s CDE Performance Area Leader shall participate in all such meetings to address any technical CDE-specific issues. (It is anticipated this would require 1 - 2 Contractor staff for up to 2 days of travel as well as up to 18 in-person meetings per year).

4. CDE SharePoint maintenance and upload: SharePoint set up and controlled access will be http://www.commondataelements.ninds.nih.gov/ managed by NINDS. The contractor is responsible for providing the list of members that must have access, maintaining the SharePoint content up-to-date (uploads, etc.), monitor shared documents in which WG members are collaborating and keeping track of the changes.

5. Maintenance and updating of the CDEs: This includes review of feedback, literature /website searches, review of case report forms from ongoing or completed clinical studies/trials to determine if new or updated instruments are available that may need to be reviewed or revised, working with disease-specific oversight committees and working groups to update the current CDEs, update CDEs in-use, and update and maintain the CDE website and documentation. The Contractor is responsible for creating error-free CRFs and NOCs in a harmonized/standardized format. The contractor is also responsible to provide neuroscience expertise in the team to complete these tasks. The NINDS periodically evaluates the CDE project, and the Contractor may be required to provide or analyze data as part of these evaluations and to implement changes or revisions resulting from the CDE evaluations.

6. Copyright Protection Documentation Support: NINDS has a commitment to ensure that all copyrighted and trademarked instruments that are recommended and are posted on the CDE website are clearly defined as such in the Notices of Copyright (NOCs). The contractor is responsible for keeping this information updated and current. Data Dictionaries and Case Report Forms of copyrighted/trademarked instruments will not be developed or posted in the NINDS CDE website.

7. Facilitate CDE User Feedback: maintain a feedback mechanism for people to comment on the CDE Project, CDE website, review the current system for development and oversight, and provide recommendations for changes. The contractor is responsible for addressing questions related to the CDE project or forwarding this information to the NINDS Program Officer/COR as appropriate.

8. Data Standards: Collaborate as requested by the NINDS COR with other NIH ICs and data standards organizations and projects as it relates to the CDE project. Monitor and review other data standards efforts and discuss these with NINDS. This shall be included in annual CDE disease-specific reviews and in revisions or development of new CDE projects.

9. Communication: Routinely keep the NINDS COR and disease-specific NINDS staff informed of upcoming meetings, calls, and other important dates that may impact the CDE project. Update NINDS on issues related to CDE activities, meeting regularly (at least 1x month) and on an as-needed basis for the disease-specific staff on each CDE working group status.

10. 508 Compliant: Assure that the NINDS CDE website and associated documents are 508 compliant. Review the monthly score and make appropriate changes/updates. The contractor is responsible for maintaining 508 compliance.

11. Materials: Update slides, handouts, and other materials on the CDE Project that can be found on the NINDS CDE website for presentation by NINDS staff or other researchers at least once a year.

12. Federal Interagency Traumatic Brain Injury Research (FITBIR): Submission of CDE updates to the FITBIR and to the NIH CDE Repository. The contractor is responsible for complying with the CDE submission requirements of FITBIR and NLM that is includes but is not limited to query resolution and submission for endorsement.

13. CDE Web-based Training Module Development: Innovative web-based training module options are also included under this contract. The training module options cover: (1) general web-based training module on access and use of the overall NINDS CDE web-site, and (2) separate disease specific web-based training modules on use of the CDEs. The Contractor is encouraged to develop new and innovative ways of training people about the overall CDE website and disease-specific trainings. 0-1 trainings are estimated annually.

14. Publications: Publications derived from the CDE project(s) shall be written and submitted to peer-reviewed journals. The contractor will work with NINDS and CDE working groups on manuscript publications as requested by the NINDS. The Contractor is responsible for the preparation of the manuscript for publication with the feedback of NINDS and the working group members.

Authorship will be discussed with NINDS prior to the submission. All publications shall comply with the NIH Public Access Policy. It is anticipated that 1 publication will be submitted per year.

15. Compliance Reviews: The Contractor shall conduct reviews of NINDS-funded clinical trials and studies CRFs and data dictionaries, ensuring proper use of the core and non-core CDEs. The contractor is responsible for developing written instructions/guidance document(s) for the submitters and addressing any queries related to the submission. The Contractor Shall send the report to the NINDS CDE Program Officer for review and final approval. The CDE Project Officer (PO) is responsible for informing the submitter and the grant Program Officer of the approval. It is anticipated that 1 compliance review will be conducted per year. This includes query resolutions and possible meetings with the submitter.

16. New Disease-Specific CDE Development: The Contractor shall provide support of the CDE working groups, the development of Case Report Forms (CRFs), CDEs and other forms supported by a data dictionary and data elements, and the development of a new disease CDE. Work shall include literature reviews, review of CFRs from ongoing or completed clinical studies and CDEs developed by other groups, working with and coming to consensus of key stakeholders through working groups of outside experts. Once consensus is obtained, the CDE will be published and uploaded on the NINDS website. The Contractor’s performance obligation under each CDE development would be complete upon acceptance of the CDE work by the NINDS COR and posting/uploading of the information on the NINDS website. The NINDS estimates 1 New Disease-Specific CDE Development will be required each year. Full revision of an existing CDE project is also considered as a new CDE development option.

Quantity Options

The award of any option(s) will be made pursuant to the terms and conditions set forth in the Option Provisions article, in Section H of the solicitation and contract. Two types of quantity options are included in this requirement: (1) Small Project, and (2) Large Project. The NINDS may exercise Small or Large Project quantity options at any given time during the contract period and may exercise one or more options at any given time.

The purpose of the quantity options is to allow for any surges or increases in the level of effort that may potentially be required to support the NINDS Center. These hours may be used for any activities within the scope of this contract (under Performance Areas 1-4). The additional effort may be exercised by Small or Large Project. For example, the Small Project option for 100 hours may be exercised for increases in the following types of activities:

Activity Estimated Quantity under the Base Requirement (Base and all Option Periods)

Estimated Quantity under the Base Requirement and Quantity Options (Base and all Option Periods)

Publications 5 15 Extramural Compliance Reviews 5 15 Intramural Clinical Trial Monitoring

60 90

For example, the Large Project option for 500 hours may be exercised for increases in the following types of activities:

Activity Estimated Quantity under the Base Requirement (Base and all Option Periods)

Estimated Quantity under the Base Requirement and Quantity Options (Base and all Option Periods)

Web-Based Training 0-5 5 New Disease-Specific CDEs 5 8

Exercised quantity options may be used for any activities within the scope of this contract (under Performance Areas 1-4).

Government-Furnished Equipment (GFE)

The NINDS will supply two (2) laptops for work on the CDE management and intramural clinical trial monitoring activities (PA 1 and 4 above). These laptops will require badge access and security clearance for personnel identified to use the laptops. The Contractor is responsible for maintaining security training, GFE training, and any security requirements and certifications as required by NINDS throughout their use of the laptops, and the laptops will be returned to NINDS at the conclusion of the contract. THE personnel identified as using the laptops will be the only Contractor personnel allowed to use the laptops unless an official switch to a new person is requested, approved by NINDS, and they completed all necessary training. The NINDS will handle all security for the laptops themselves, and issues with the laptops must go through the NINDS IT department.

Electronic and Information Technology Accessibility (Section 508)

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, and/or used under this contract must comply with the “Electronic and Information Technology Accessibility Provisions” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR Part 1194. The Section 508 standards applicable to this contract are as follows:

All reports delivered electronically (e.g., via e-mail) must meet the requirements of Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d). Section 508 governs electronic information and requires that:

(1) Federal employees with disabilities to have access to and use information and data that is comparable to the access and use of information and data by Federal employees who are not individuals with disabilities; and

(2) Members of the public with disabilities seeking information or services from a Federal agency to have access to and use of information and data that is comparable to the access and use of information and data by members of the public who are not individuals with disabilities.

Compliance with Section 508 of the Rehabilitation Act of 1973

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

These Section 508 Standards were issued by the United States Access Board and published in the Federal Register, on January 18, 2017, as the final rule. The final rule updates the Section 508 Standards along with accessibility guidelines for telecommunication products and equipment covered by section 255 of the Communications Act.

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors1) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below.

Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

The following Section 508 provisions apply to the content or communications material identified in this SOW. See Policies and Standards at https://www.hhs.gov/web/policies-and-standards/index.html

References:

HHS Policy for Section 508 Electronic and Information Technology (E&IT) (July 2020):https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-compliance-accessibility-information-communications-technology.html HHS Section 508 Web site: http://508.hhs.gov/

HHS ASPA Web Communications Division Web site:

http://www.hhs.gov/web/policies/index.html US General Services Administration (GSA) Section 508 Web site: https://www.section508.gov/

ARTICLE C.2.- TECHNICAL REPORTING REQUIREMENTS/DELIVERABLES

The Contractor shall be required to prepare and deliver the following reports as part of their performance responsibilities under the contract as follows:

a. Quarterly Progress Reports: Quarterly progress reports shall be due January 15, April 15 and June 15 of each year of contract performance period (base period and basic requirement options). This report shall describe the progress on the project during the reporting period and shall include the following: an indication of any current problems that may impede performance and proposed corrective action; description of the work to be performed during the subsequent period; and any recommendations. A summary of costs per task area will be provided.

http://www.access-board.gov/ http://www.acquisition.gov/ http://www.section508.gov/ http://www.hhs.gov/web/policies-and-standards/index.html http://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-http://508.hhs.gov/ http://www.hhs.gov/web/policies/index.html http://www.section508.gov/

b. Annual Progress Reports: This report shall be due within 30 days of completion of each basic requirement contract performance period (annually on October 30). This report shall summarize the work completed/accomplished during the yearly period reported upon and shall include the following: an indication of any current problems that may impede performance and proposed corrective action; description of the work to be performed during the subsequent period; and any recommendations. A summary of costs per task area will be provided by the contractor.

c. Financial Status Report: This report shall be due every 2 months from the beginning of the performance period. The last report should be submitted 60 days before the end of the fiscal year and 90 days during the end of the last contract year. This report shall include the current spending broken out into all performance areas (projects within the PA, total budget, main actuals, spending per project and total actuals) and projected spending (PA and project, total budget, total accruals, variance, percentage spent and percentage time elapsed).

d. Special Project Reports for Statistical and Methodological Support: For each activity, the contractor will provide an overview and scope of the proposed project within 2 weeks of such request; this will include a statement of work, cost and time estimate, set of deliverables and a timeline for the deliverables; and will be revised accordingly until approved. Upon conclusion of each special project/assignment, the contractor shall provide a final report of the project which should include a full description of the project within 30 days from the conclusion of the project.

e. Data Audit and Site Visit Reports: Review the current guidelines for investigators on data quality assurance/control and integrity documents within 30 days of award and provide NINDS with recommended changes. Upon completion of each site visit, the contractor shall provide a Draft report to the NINDS COR, NINDS Program Manager for the associated grant (extramural monitoring only), and site PI for comment and response, within 1 week after completion of the site visit. A Final Report shall be delivered within 15 business days of receipt of comments on the Draft report from the NINDS COR.

f. Common Data Elements :

The Contractor shall be required to prepare and deliver to the NINDS, by the expiration and/or termination date of this contract, the following items as related to CDE closeout activities conducted in performance of this contract:

• All recent versions of data dictionaries, forms, manual of operations and procedures (MOPs), documentation, and all other materials available on the website, SharePoint sites or similar sites used to develop the CDEs and the CDE website.

• All additional information contained on http://www.commondataelements.ninds.nih.gov/ website and SharePoint sites related to the CDEs. This includes overview, user’s manuals, tutorial, and all other materials related to this website and SharePoint sites.

• Methodology materials for CDE development (review of NINDS studies, literature reviews, other CDE projects reviews, etc.). Additional information on the NINDS CDE Project activities is available on the website.

g. Clinical Data Acquisition and Archiving: Quarterly, a report on archiving activities shall be provided to the CO, COR and NINDS Archiving Liaison; a list of data sets distributed, and a list of datasets and metadata received from study grantees for distribution. The list of received datasets/metadata must include at a minimum, the following information: Grant title, short name, PI name, Grant number, disease area. The details and format of this report will be http://www.commondataelements.ninds.nih.gov/ determined at a meeting with the NINDS Archiving Liaison within 30 days of contract award.

Fifteen (15) days prior to expiration of the contract, the contractor will provide NINDS a summary of all clinical research projects archived, and electronic versions of all data archived including all supporting documentation.

h. Source Code and Object Code

Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract, all source code and object code developed, modified, and/or enhanced under this contract.

i. Information Security and Physical Access Reporting Requirements: The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract. Note: Each report listed below includes a reference to the appropriate subparagraph of this article.

1. Roster of Employees Requiring Suitability Investigations

The Contractor shall submit a roster, by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under the contract that will develop, have the ability to access, or host and/or maintain a Federal information system(s). The initial roster shall be submitted to the Contracting Officer's Representative (COR), with a copy to the Contracting Officer, within 14 calendar days of the effective date of the contract, and thereafter written notice of updates to the NINDS CO and COR, within 5 working days before a new employee assumes a position that requires access to HHS information systems or data; upon departure for departing personnel with such access. (See contract Article H.10.C.3, “Personnel Security Responsibilities”.)

The Contractor shall comply with all current NIH requirements for satisfying the Federal Information Security Management Act (FISMA). The Federal Information Security Management Act (FISMA) is United States legislation that defines a framework of guidelines and security standards to protect government information and operations. This risk management framework was signed into law as part of the Electronic Government Act of 2002, and later updated and amended.

Current NIH FISMA requirements include, but are not limited to, the following deliverables:

Assessment & Authorization (A&A)

FIPS 199 Security Categorization Privacy Impact Assessment (PIA) E-Authentication Risk Assessment (ERA) System Security Plan (SSP) Security Assessment Plan (SAP) Security Control Assessment (SCA) Security Assessment Report (SAR) Configuration Management Plan (CMP) Contingency Plan (CP) Contingency Plan Test (CPT) Business Impact Analysis (BIA)

Incident Response Plan (IRP) Incident Response Plan Test (IRPT) Memorandum of Understanding (MOU), when applicable Interconnection Security Agreement (ISA), when applicable Plan of Action and Milestones (POA&M) Authorization to Operate (ATO)

Continuous Monitoring (CM)

NIH Information Security Awareness & Privacy Training Monthly Vulnerability Scans Review and Update of all A&A Deliverables Listed Above Annual Assessment Policies and Procedures User Recertification Review Documents Separation of Duties Matrix Information Security Awareness and Training Records System(s) Baseline Configuration Standard Document System Configuration Settings Results of Review of Physical Access Records Penetration Test Report

The Contractor shall furthermore understand and acknowledge that NIH FISMA requirements evolve over time. The Contractor shall be responsible for obtaining the latest NIH FISMA requirements from the Contracting Officer and ISSO throughout the duration of the contract period of performance. The Contractor shall also understand and acknowledge that NIH compliant Authorizations to Operate (ATO) is required by NIH and DHHS to satisfy the FISMA law.

6. Reporting of New and Departing Employees

The Contractor shall notify the Contracting Officer's Technical Representative (COR) and Contracting Officer within five working days of staffing changes for positions that require suitability determinations as follows:

a) New Employees who have or will have access to HHS Information systems or data:

Provide the name, position title, e-mail address, and phone number of the new employee. Provide the name, position title and suitability level held by the former incumbent. If the employee is filling a new position, provide a description of the position and the Government will determine the appropriate security level.

b) Departing Employees: 1) Provide the name, position title, and security clearance level held by or pending for the individual; and 2) Perform and document the actions identified in the "Employee Separation Checklist", attached in Section J, ATTACHMENTS of this contract, when a Contractor/Subcontractor employee terminates work under this contract. All documentation shall be made available to the COR and/or Contracting Officer upon request.

(Reference subparagraph E.2.a-c. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

7. Contractor - Employee Non-Disclosure Agreement(s)

The contractor shall complete and submit a signed and witnessed "Commitment to Protect Non-Public Information - Contractor Agreement" form for each contractor and subcontractor employee who may have access to non-public Department information under this contract. This form is located at:

http://ocio.nih.gov/docs/public/Nondisclosure.pdf .

(Reference subparagraph E.3.d. of the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract.)

j. Section 508 Annual Report

The contractor shall submit an annual Section 508 report in accordance with the schedule set forth in the ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY Article in SECTION H of this contract. The Section 508 Report Template and Instructions for completing the report are available at: http://www.hhs.gov/od under "Vendor Information and Documents."

ARTICLE C.3. SPECIAL REQUIREMENTS

1. The Principal Investigator and Project Manager shall be available for emergency conference calls with 2-hour notice and be available for an emergency in-person or phone/virtual meeting at NINDS within 48 hours; this for the duration of the contract. Ongoing prescheduled meetings will require the Principal Investigator, Project Manager, and potentially other staff involved in this contract to attend meetings at NINDS. These meetings are for the purpose of reviewing progress and future plans of the contract, and to discuss data analysis and quality assurance issues.

2. The Contractor shall have in place or be able to implement procedures necessary to preserve and guard the integrity of the data and any analysis and to protect the privacy of the information provided by the NINDS or any collaborating clinical center. The Information Technology Security Plan submitted as part of the Contractor’s proposal, to be delivered 30 days after contract award, and subsequently approved by the NINDS, is hereby made a part of this contract.

3. All data sets obtained, and all other data or data applications developed, and delivered under this contract are property of the Government. The Contractor will be required to monitor data quality in designated clinical research, review data forms information to develop quality assurance guidelines, and archive data. Although the principal investigators at the clinical sites should not supply personal identifiers as data to the NINDS, it is possible that the Contractor may have access to such data while performing required site visits and monitoring data quality. All participant data is considered sensitive and confidential.

4. Non-Personal Services

As stated in the Federal Register, Volume 57, No. 190, page 45096, dated September 30, 1992, Policy Letter on Inherently Governmental Functions, no personal services shall be performed under this contract. All work requirements shall flow only from the Contracting Officer to the Contractor’s Project Manager. No Contractor employee will be directly supervised by the Government. All individual employee assignments, and daily work direction, shall be given by the applicable employee supervisor. If the Contractor believes any Government action or communication has been given that would create a personal services relationship between the Government and any http://ocio.nih.gov/docs/public/Nondisclosure.pdf http://www.hhs.gov/od

Contractor employee, the Contractor shall promptly notify the Contracting Officer of this communication or action.

The Contractor shall not perform any inherent Government function under this contract. No Contractor employee shall hold him or herself out to be a Government employee, agent, or representative. No Contractor employee shall state orally or in writing at any time that he or she is acting on behalf of the Government. In all communications with third parties in connection with this contract, Contractor employees shall identify themselves as Contractor employees and specify the name of the company for which they work.