Att1 - Statement of Work.docx

Management and Research Support for the Genetic and Rare Diseases (GARD) Information Center and Related Programs Bridge Award

STATEMENT OF WORK (SOW)

Date: 06/08/2024 Contents

1. Background, Purpose, Objectives

1.1 Title of Project

Management and Research Support Services for the Genetic and Rare Diseases (GARD) Information Center and Related Programs.

1.2 Statement of Need and Purpose

The National Center for Advancing Translational Sciences (NCATS) Office of Rare Diseases Research (ORDR) is seeking research support services to enable the operation, maintenance, improvement and expansion of the GARD Information Center and related programs, including the Rare Disease Registries Program (RaDaR), the Toolkit for Patient-focused Therapeutics Development (Toolkit), and events management support services. The purpose of this effort is to provide evidence-based information and resources to patients and their caregivers, researchers and health professionals, and the general public on rare and genetic diseases which include: clinical characteristics of individual rare and genetic diseases, research and clinical trials, resources for enabling access to diagnosis and care, and support living with a rare disease.

1.3 Background

The National Institutes of Health (NIH) is the Nation’s leading medical research agency and the primary federal agency whose mission is to seek fundamental knowledge about the nature and behavior of living systems and the application of that knowledge to enhance health, lengthen life, and reduce illness and disability by supporting and making medical discoveries. NCATS is the only center at the NIH that focuses exclusively on all aspects of the translation of research with an innovative pipeline of treatment discoveries for all diseases. NCATS’ mission is to improve health through smarter science that results in better treatments faster for all diseases, rare or common. Within that remit, the NCATS ORDR’s mission is to advance rare disease research to benefit patients.

The ORDR’s GARD Information Center was established in 2002 and is a federally funded program that has an essential role in the dissemination of public health information to support ORDR’s aim of advancing rare diseases research to benefit patients. Currently, there are about 7,000-10,000 known rare diseases that affect people in the United States (US), yet only a few hundred (less than 5%) have a treatment and even fewer a cure. A rare disease is defined in US law (Orphan Drug Act (ODA) of 1983,[footnoteRef:1] Rare Diseases Act (RDA) of 2002[footnoteRef:2]) as a disease or condition that affects fewer than 200,000 people in the US. Most rare diseases affect far fewer patients than this, with most rare diseases affecting only a few hundred to thousand patients. Collectively, however, rare diseases are not rare at all, and in total are estimated to affect as many as 25-30 million patients in the US, making rare diseases a large public health consideration. [1: Orphan Drug Act of 1983, amended for prevalence 1984. Pub.L. 97-414] [2: Rare Diseases Act of 2002, Pub.L. 107-280]

GARD plays an important public health role in serving as a centralized clearinghouse for rare and genetic disease information that provides freely accessible health information to the public. Obtaining accurate, comprehensive, timely, and objective information on a rare disease is often difficult. Major public health challenges face the rare disease community, particularly in obtaining a diagnosis, a lack of approved therapies even if a diagnosis is made, and significant barriers to conducting clinical research in rare diseases due to factors such as difficulties in identifying patients, small populations with the individual diseases, and limited numbers of disease experts and researchers, among others.

GARD also supports ORDR’s interest in the development and dissemination of best practices in research and translational science to support patient groups, researchers, clinicians, and other rare disease constituencies in advancing their research agendas. These are organized in GARD’s related initiatives, Toolkit, RaDaR, and through support of scientific meetings and conferences.

In order to continue to provide and to improve upon information support services to the rare diseases community, NCATS ORDR is seeking research support services to: 1) operate and manage the GARD Contact Center in providing individual inquiry services; 2) operate, maintain, improve and expand the GARD Knowledge Base which is used to support GARD and related programs; 3) provide events management services for scientific meetings and conferences; and 4) operate, maintain, improve and expand related programs, such as the Toolkit and RaDaR.

1.4 Period of Performance

July 29, 2024, through September 28, 2024.

1.5 Scope of Work

Independently, and not as an agent of the Government, the Contractor shall provide all the necessary services, qualified personnel, supervision, equipment, facilities, transportation, tools, materials, and other items and non-personal services necessary to perform the following services, not otherwise provided by the Government to perform the Statement of Work (SOW) herein.

The rapid pace of scientific discovery and heterogeneity in rare diseases necessitates scalable approaches for managing scientific knowledge. One critical component for GARD’s ongoing success is the continuous monitoring, tracking, and expert curation of research findings that have been collected into a knowledge base that is kept updated by automated integration of information from other NCATS and public database. Making use of this knowledge base, with information collected on over 7,000 rare diseases, requires access to diverse skill sets and expertise, and the ability to function in multidisciplinary teams that may involve NCATS extramural program staff, intramural researchers, and IT support staff. GARD operations staff utilize information from this knowledge base in responding to public inquiries for its contact center and in managing consumer health content for its Website through a Customer Relationship Management (CRM) platform and a Content Management System (CMS), respectively.

The Contractor shall operate the GARD Contact Center by providing and managing a bilingual (English and Spanish) omni-channel contact center and knowledge management system for use in operating, managing, developing, and implementing of its related program websites (GARD, Toolkit, RaDaR), and through other tasks in support of the following scope of work:

1. Project Management, Coordination, and Planning Support

2. Contact Center Inquiry and Management Services

3. Knowledge Management Services

4. Events Management and Support Services

5. Other Supporting Services The Contractor shall use multiple datasets and enterprise systems to operate and manage its tasks. For information technology (IT) related areas, the NCATS Information Technology Resource Branch (ITRB) is responsible for the enterprise system(s), databases, applications, system architecture, server and the security infrastructure provided and/or hosted by NCATS, while the contractor will be expected to be knowledgeable about and support these tasks and/or responsibilities in collaboration with ITRB as specified in the SOW.

The IT enterprise systems currently in use include:

1. Knowledge Management System

2. Customer Relationship Management (CRM) platform

3. Content Management System (CMS) platform

4. Cloud business platforms for file sharing and communications

The Contractor shall use NCATS materials and Government-selected sources of information, including pre-approved non-NCATS resources (text books, research publications, websites, databases, and more), in responding to inquiries and communications on behalf of ORDR, and in developing and maintaining related websites and online resources. This shall include:

Toll-Free Telephone Numbers:

0. 1-888-205-2311 (GARD Contact Center)

0. 1-888-205-3223 (TTY)

Additional Access Channels:

0. NCATS Enterprise Systems, such as the Customer Relationship Management (CRM) platform

0. E-mail

0. U.S. Postal Mail

0. NCATS Enterprise Social Media Accounts, Facebook, Twitter, Instagram

0. Voicemail boxes for use during operational closures (see hours of operation)

Websites (URLs may be subject to change):

1. GARD - https://rarediseases.info.nih.gov/

2. Toolkit - https://toolkit.ncats.nih.gov/

3. RaDaR - https://registries.ncats.nih.gov/

Access channels and/or program services may be refocused based upon the availability of new technologies, Federal Agency Partnerships, or evolving needs of NCATS and its stakeholders. This may include implementing chat bots, offering text message responses, video calling, mobile apps, and/or the provision of additional language/translation services.

Hours of operation:

0. Telephone Service: 12:00 p.m. to 6:00 p.m. Eastern Time, Monday through Friday, except on federal government holidays

0. Automated multilingual voicemail support during overnight hours, weekends, and government holidays, or when all lines are busy. During overnight hours, weekends, and holidays, GARD staff shall post a recorded message in English and Spanish that the center is closed.

0. Hours of operation will be aligned with user needs and are subject to change and may include emergency operations depending upon the needs of the Government.

Federal Government Holidays: The following government holidays are normally observed by government personnel per the Office of Personnel Management (OPM): New Year’s Day; Birthday of Martin Luther King, Jr.; Washington’s Birthday/President’s Day; Memorial Day; Independence Day; Labor Day; Columbus Day; Veterans Day; Thanksgiving Day; Christmas Day; and any other day designated by federal statute, executive order, and/or presidential proclamation.

Target Audiences:

1. Patients affected by a rare disease and their caregivers.

2. Healthcare providers and researchers whose work involves a rare disease.

3. Members or Staff of the United States Congress and the media as well as other sensitive requests shall be referred immediately to ORDR staff for appropriate disposal and tracking.

2. Specific Task Areas

2.1 Task Area 1 – Program Management, Coordination, and Planning Support The Contractor shall provide project management support for the overall administration of the GARD Information Center and related programs. The Contractor’s project management support staff shall work in coordination with designated federal staff; and be responsible for performing all the non-inherently governmental activities associated with administration of this contract. The Contractor shall coordinate and liaise with government stakeholders and designated federal staff such as the Contracting Officer (CO), designated NCATS ORDR staff, NCATS managers/points of contact (POCs), administrative officers, etc. as needed to successfully perform all Task Areas.

The Contractor shall effectively and efficiently manage cost, schedule, and performance under this contract across all aspects of performance and in a manner that yields performance efficiencies under this SOW.

The Contractor shall develop, implement, document, and maintain a detailed project planning and management approach with regular reporting and coordination with NCATS/ORDR staff. This shall include the following activities:

· Perform project management and liaison responsibilities that include gathering initial project requirements; providing ongoing technical and administrative support, such as staff scheduling, budget, travel approvals, ad hoc reporting, and communicating and reporting on timelines, milestones, and completion and/or changes thereof.

· Assist government stakeholders in defining their need and having clearly defined management processes, organizational roles and responsibilities, interfaces between Contractor personnel and key federal personnel to manage the successful execution of this contract.

· Facilitate and track progress and performance of all activities under this contract.

· Develop and maintain standard templates, processes, and workflows; all elements of which shall be consistent with industry best practices and contract requirements.

· Document all management processes as well as recommending and implementing technologies/systems to ensure and support their execution.

· Develop procedures to continuously monitor, evaluate, and respond with process improvements that address the efficient operation of the GARD Information Center and its services as well as products.

· Identify any challenges and deficiencies in operational management of the Contact Center and Knowledge Base, and develop, implement, and provide improvements.

· Participate in regular calibration sessions with ORDR staff to ensure that research support services are aligning procedures to create consistent ant accurate data as research projects evolve.

The Contractor shall employ appropriate measures and safeguards required by the Contractor’s project management staff to accomplish its responsibilities. Upon request, the Contractor shall perform project evaluation and benchmarking to ensure that activities are on track, within budget, and above all, meet requirements. This shall include the following:

· Demonstrate and institute program enhancements and use of innovative technology solutions that serve to refine operations, increase efficiency, and reduce costs.

· Monitor, routinely report on, and make recommendations around industry trends, including emerging standards, tools, and new technologies, to keep current on the most effective technologies that serve to optimize efficiency and effectiveness of operating a contact center and knowledge base.

· Analyze user data and potential target audiences to assess effective communication channels.

Training: The Contractor is responsible for the development, implementation, and evaluation of training for all staff operating and managing both GARD’s Contact Center and the Knowledge Base used for its related programs. The Contractor shall conduct supplemental trainings for staff when necessary to address subsequent changes to ORDR programs and/or priorities. Supplemental trainings will be coordinated with ORDR staff.

The Contractor shall:

1. Manage training of all Information Specialists to enhance knowledge and build skills;

2. Implement skills-based training as needs are identified in the Contact Center and Knowledge Base;

3. Ensure that the training program reflects the needs of the users and the Government; and

4. Incorporate Contact Center and Knowledge Base policies and procedures into its training plan.

The following deliverables are required for this task area and are detailed further in Section 5.1:

· Contract Management Plan

· Monthly Activity and Financial Status Reports

· Training Plan

2.2 Task Area 2 – Contact Center Inquiry and Management Services The Contractor shall provide a tailored, user-centric service that will offer accurate, up-to-date, and reliable information on rare diseases that is easy to understand and accessible for a diverse range of users. Inquiries from users may be highly complex and sensitive in nature and Information Specialists are expected to provide personalized responses to a range of questions, tiered by complexity, that address:

Tier 1 - General questions that do not require specialized training or expertise on genetics, such as:

· Navigating access and utilization of health care systems

· Support and resources for living with a rare disease

· Finding research studies and clinical trials

Tier 2 - Specific questions that may require specialized training and/or expertise understanding, such as:

· Information on a rare disease (i.e., epidemiology, symptoms, diagnosis, treatment, etc.)

· Finding specialists and medical centers that are experts in a specific rare disease

· Role of patient organization and activities, such as registries, in advancing research

The Contractor shall:

1. Provide telephone, email, social media, and postal mail inquiry responses, in English and Spanish, based on the Procedure Manual, as detailed as a deliverable in Section 5.1 found further below;

1. Respond within 5 business days of receiving an inquiry;

1. Utilize the NCATS enterprise Customer Relationship Management (CRM) platform to electronically record, track, and respond to inquiry cases in addition to other systems designated by NCATS;

1. Manage rare disease research data, website content, inquiry talking points, and standard response language in the knowledge base through the CRM and CMS platforms;

1. Provide information in a professional manner, and ensure that users’ questions are answered accurately and completely in accordance with approved NCATS materials;

1. Manage the collection and generation of high-quality research data and patient-friendly content;

1. Develop and implement procedures for handling, escalating, and prioritizing inquiries received by the Contact Center as appropriate based on complexity of information, subject matter, or caller behavior in close consultation with ORDR staff;

1. Consult with ORDR staff and/or medical consultants in complex cases or cases of a sensitive nature and obtain guidance on calls that are highly technical or otherwise fall outside the expected expertise of Information Specialists;

1. Participate in promotional activities, by providing images, audio, etc. that depict Contact Center and other related activities.

Workforce Management: The Contractor is responsible for hiring and training staff for all contract requirements including coverage for all access channels and scheduling staff to meet service demands while meeting quality assurance standards.

The Contractor shall:

1. Forecast volume of customer contacts over all channels, and use the forecasts to create schedules that will efficiently meet users’ access throughout the day, and will be adjusted based on volume;

2. Monitor the call management system and other systems that indicate the real-time flow of inquiries on each access channel to meet real-time service needs, updating the workforce management system as necessary;

3. Monitor contact volume data to anticipate and adjust staffing needs and guarantee consistent, efficient operation of the Contact Center; and

4. Anticipate media events that may increase volume and provide scalability options to meet increased demand.

Confidentiality and Data Security: To maintain the confidentiality of Contact Center users, the Contractor shall adhere to data security requirements of the contract and destroy all Personally Identifiable Information (PII) on a schedule provided by ORDR staff. Procedures shall be clearly in place to ensure the confidentiality of those who request information or are the subject of an inquiry and to comply with the requirements of the Privacy Act.

2.3 Task Area 3 – Knowledge Management Services

GARD currently utilizes an enterprise knowledge management system to operate and manage the functions of the Contact Center by utilizing the Customer Relationship Management (CRM) platform, the websites through a Content Management System, and access to data that has been extracted, harmonized, and stored for use in the GARD Knowledge Base. The Contractor shall be responsible for the management of knowledge used in these systems, in close collaboration with NCATS/ITRB developers, and will actively maintain, add to, harmonize, and leverage information as needed to perform and optimize day-to-day operating tasks.

The Contractor shall provide services, which include the following:

· Utilize and maintain best practices in data curation, annotation, research evaluation, and knowledge base management.

· Support the curation and annotation of data to the GARD Knowledge Base.

· Develop, prepare, and maintain website content that will include text, images, links to resources, and/or other multimedia formats that comply with applicable Section 508 accessibility standards.

· Track, interpret, and analyze website traffic analytics and support the collection of user experience feedback and research to support continuous process improvements in all GARD and related programs.

· Provide promotional materials (digital or print brochures and fliers, images, infographics, etc.) that can aid in the dissemination of information about or from GARD and related programs.

· Maintain access to professional translators able to produce, translate and/or adapt existing health information into other languages, such as Spanish.

· Assist in making GARD content available for dissemination or syndication on other websites and/or databases.

· Provide supporting services to enable GARD to utilize data available within other NCATS and NIH knowledge bases, such as NCATS‘ Pharos and Inxight, and clinicaltrials.gov and National Library of Medicine to augment the content of GARD or link to unique content available in these systems.

The Contractor shall provide a Knowledge Base Management Plan as detailed in Section 5.1.

Data Collection and Analysis: The Contactor shall utilize data-driven approaches and use of data collected shall be integrated into planning and delivery of services.

The Contractor shall:

1. Collect and report data on status of milestones and tasks, and analysis on trends as part of the Monthly Operations Report as described in Section 5.1,

2. Collect and report data in support of contact center activities such as number of open cases by origin (web, phone, email, etc.) by day, and by month; number of closed cases by rejection status and case age; responses by primary language; responses by domestic vs international; responses by user category and user sub category; cases by disease and inquiry codes; average case by month; average pending time by month; closed cases by month; and additional data points as requested pending availability within the CRM. This data will be reported in the monthly operations report as described in section 5.1,

3. Ensure the accuracy, reliability, and completeness of data through established quality assurance processes, and staff shall be trained in the proper data collection process for specific NCATS projects.

Ownership of Data/Materials: The Contractor shall not release, publish, share, or use data and other information collected under this contract with other Government agencies, organizations, companies, or individuals without the express written authorization of the Government.

2.4 Task Area 4 – Events Management and Support Services

NCATS/ORDR requires support services for scientific or otherwise rare diseases-related workshops, meetings, and conferences of experts at the National Institutes of Health, the Washington metropolitan area, and outside of the Washington metro area including internationally.

The Contractor shall coordinate virtual or in-person meetings on NCATS-identified topic areas, plan and coordinate speakers, set up pre-meeting planning conference calls for these meetings, and support logistical arrangements for events.

All meetings shall comply with Federal law, regulation, and guidelines regarding location, refreshments, travel, etc. ORDR staff will be responsible for securing necessary agency approvals for any events prior to assigning tasks to the Contractor for coordination, including payment of honorariums.

It is anticipated that there will be a minimum of three and maximum of five meetings/conferences annually. Meetings will include the following:

· Rare Disease Day at NIH

· Annual event, open to the public.

· Attendance in 2020 was estimated at >750 in-person and >1000 online attendees.

· Rare Diseases Clinical Research Network/Coalition for Patient Advocacy Groups (RDCRN/CPAG)

· Annual closed event.

· Attendance in 2020 was estimated at 80-100 attendees.

The Contractor shall provide exhibit services, which include the following:

· Make all arrangements for reserving space and paying exhibit and other fees necessary for furniture and equipment rental.

· Assist in organizing and management of event planning activities through use of commercially available applications and systems.

· Staffing to support registration, event coordination, project management, technical support, transporting exhibits and materials to and from meetings, and maintaining, storing and shipping of exhibits and materials.

2.5 Task Area 5 – Other Supporting Services

The Contractor shall provide design, development, illustration, typography, layout, production, printing and other services as coordinated with ORDR staff, which include the following:

· Support creation and maintenance of new website-based or application-based tools that are developed from ORDR and NCATS programs/initiatives.

· Access to existing and/or support for the design and production of new visual graphics or audio/video resources to enable broader multimedia access in GARD and related programs.

· Design, production, and maintenance of promotional materials for GARD and related programs in both print (annually estimated at 200 brochures, 1500 information cards, stickers, etc.) and digital formats (infographics, social media posts, etc.).

· Distribution of information, messages, and materials may occur through in-person events (3-5 per a year), web applications, websites, social media, or other digital means to individuals, organizations, or trade publications.

2.6 Task Area 6 – Transition Planning

All materials and data (most current versions) created and collected during performance and owned by the Government shall be turned over in a timely manner.

The Contractor shall:

1. Submit a final transition-in plan as described as a deliverable in Section 5.1;

2. Submit a final transition-out plan as described as a deliverable in Section 5.1;

3. Participate in meetings and/or telephone conversations required by the Government in which procedures and activities are discussed and delineated;

4. Provide NCATS at any point during and at the conclusion of the contract access to or copies of data and materials created, captured or stored required to support the services of this contract;

5. Deliver in accordance with the transition plan: all materials, data, documentation, and software used and developed to support contract activities; and,

6. Prepare all the items noted in this section for mailing or shipping to the successor Contractor(s) and/or the Government. All items must be packed in new boxes of uniform size, clearly labeled with contents and a unique number along with an inventory showing contents of each box and placed on a loading dock for pickup by the new Contractor or designated agent in accordance with the delivery schedule. Transfer of electronic files shall be coordinated with the Government.

The Contractor shall develop and submit a Continuity of Operations/Disaster Recovery Plan (COOP/DR) as a deliverable as described in Section 5.1.

3. Key Personnel The following table defines the labor categories and the projected annual number of hours required for all tasks outlined in the Statement of Work.

Key personnel for this statement of work shall include to:

2-5 years experience in a contact center or genetic counseling, or related with direct patient care support

Functions as a Senior level Information Specialist or Bilingual Information Specialist and a Senior Manager.

Functions as a Tier 2 Information Specialist.

1 year of related experience such as medical writing or information analysis, or related with direct patient care support

Functions as an Tier 1 Information Specialist.

Senior writer and editor with experience in health information programs. Experienced in developing and coordinating quality control (QC) and quality assurance (QA) procedures required to write and edit state-of-the-science health information materials.

Functions as a content management specialist and/or curator.

Senior Analyst/Manager I

Provides technical, meeting planning, and outreach support for the NCATS Office of Rare Diseases Research, and the Food and Drug Administration (FDA).

Positions marked with an asterisk (*) have been defined as key personnel.

4. Government Responsibilities The Government shall:

4.1 Provide the Contractor with government computer(s) and Personal Identification Verification (PIV) cards to access the NIH encryption system after successfully completing the required security screening.

4.2 Review monthly and annual reports as well as planning document and provide changes, if needed, and approval within ten (10) days.

4.3 Provide physical space, parking access, and assigned building access to accommodate the Contractor personnel in case they must visit government site(s).

5. Deliverables and Reporting

5.1 Reporting

Monthly Activity and Financial Status Reports: The Contractor shall provide Monthly Activity and Financial Status Reports that will detail the progress of current milestones, cost, schedule, quality assurance, and project management of performance under this SOW. The reports shall include progress updates on contract deliverables, outstanding administrative or technical issues, and cost projections. Reports shall notify the Government of anticipated gaps in services and their impact on the management of expected or forecast inquiry volume. While the activity and financial status reports are due monthly, the Contractor shall immediately notify the Government of any issues or problems as anticipated or as they occur (including technical, cost, or schedule issues).

Roster of Employees Requiring Suitability Investigations: The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO within fourteen (14) calendar days after the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within seven (7) calendar days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx.

Contractor Non-Disclosure Agreement (NDA): Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Privacy Threshold Analysis (PTA)/ Privacy Impact Assessment (PIA): The Contractor shall assist the NIH Office of the Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed. The NIH PIA guide is located at: https://oma.od.nih.gov/forms/Privacy%20Documents/Documents/NIH%20PIA%20Guide.pdf

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv SOP or designee with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the NIH Office of the SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

NIH Security Awareness, Privacy, and Records Training: All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/NIH Contractor Information Security Awareness, Privacy, and Records Management training course at:

http://irtsectraining.nih.gov/ before performing any work under this contract. Thereafter, the employees shall complete NIH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum. Read further guidance about the NIH Role-based Training: https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html.

The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Incident Response: The Contractor shall report any incidents subject to 6. HHS Security and Privacy Language for Information and IT Procurements, paragraph D. INCIDENT RESPONSE, within 24 hours of the occurrence.

Sanitization of Government Files and Information: As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation in accordance with the NIH Media Sanitization and Disposal Policy to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

Notification of Employee Departure: The Contractor shall notify the COR within 15 days before an employee stops working under this contract.

Employee Separation Checklist: The Contractor (and/or any subcontractor) shall perform and document the actions identified in the NIH Contractor Employee Separation Checklist: https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Emp-sep-checklist.pdf when an employee terminates work under this contract within 2 days of the employee's exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

6. HHS Security and Privacy Language for Information and IT Procurements

1. Baseline Security Requirements

1. Applicability- The requirements herein apply whether the entire task order or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

1. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

1. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor)will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

0. Safeguarding Information and Information Systems- In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

1. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

1. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less , bring the situation to the attention of the other party.

1. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

1. Comply with the Privacy Act requirements.

0. Information Security Categorization- In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Contractor Non-Disclosure Agreement and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information systems are the following:

Confidentiality: [X] Low [ ] Moderate [ ] High

The above risk levels apply to the following information types:

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[ ] No PII [X] Yes PII

Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, "PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother's maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be:

[X] Low [ ] Moderate [ ] High

1. Controlled Unclassified Information (CUI)- CUI is defined as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

1. Marked appropriately;

1. Disclosed to authorized personnel on a Need-To-Know basis;

1. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

1. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

1. Protection of Sensitive Information- For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

1. Confidentiality and Nondisclosure of Information- Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

1. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

1. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

1. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Each employee, including subcontractors, having access to non-public Department information under…