Attach 1 Bioinformatics Svcs PWS 07152025.pdf

Attachment 1

PERFORMANCE WORK STATEMENT (PWS)

for

BIOINFORMATICS SERVICES

Non-Personal Services

DESCRIPTION OF SERVICES AND GENERAL INFORMATION. The Contractor shall provide bioinformatics services in accordance with (IAW) this Performance Work Statement (PWS) and the professional standards, guidelines, and regulations of the American College of Medical Genetics. These services will be provided in response to samples provided by Keesler Medical Center (KMC) as required for government beneficiaries at Keesler Air Force Base (KAFB), hereafter referred to as Defense Health Agency Genetics Reference Laboratory (DHAGRL). The DHAGRL will provide the contractor FASTQ (biological sequence data and its quality score in text-based format) files generated using Illumina’s sequencing by synthesis technology, Nextera reagents, SOPHIA DDM Enhanced Whole Exome Solution HC+CS+PGx (WES+) enrichment.

1.1. SPECIFIC PROCEDURES/SERVICES FOR WHICH THE CONTRACTOR SHALL BE

RESPONSIBLE.

All returned data shall be provided with a unique anonymized identifier. No personal identifiable information shall be provided.

1.1.1. Requirement 1: The bioinformatics contractor shall perform basic sample processing to include adapter trimming and initial quality checks on FASTQ files generated from the DHAGRL next generation sequencers, Illumina’s Miseq, NextSeq 500, NextSeq 550, NextSeq 2000, and Novaseq 6000.

1.1.1.1. The reads that pass basic quality control measures will go on to be analyzed; this includes initial alignment to a reference genome; both nuclear and mitochondrial, local realignment, identification of single nucleotide variants, small insertions/deletions (up to at least 40 base pairs), insertion of transposable elements and larger copy number variants down to the single-exon level.

Copies of the Binary Alignment Map file and variant call format files produced shall be made available to the AFMGC. For the Sophia DDM WES+ solution enrichment, haplotype phasing will be performed for every sample using bioinformatics methods.

1.1.1.2. After all variants have been identified they shall be annotated with, at a minimum:

a. Basic variant information such as gene(s)/transcript(s) predicted to be affected, transcript-appropriate Human Genome Variation Society coding DNA reference sequence, mitochondrial reference sequence, and protein reference sequence, exon/intron involvement and type of variation (i.e, missense, nonsense, splicing).

b. Population frequency data from public databases, including 1000 Genomes database, Exome Variant Server, Exome Aggregation Consortium, and Genome Aggregation Database.

c. Population frequency obtained from DHAGRL data and from other utilizers of the same bioinformatics pipeline.

d. Clinical significance reports derived from the Clinical Variation, the Catalogue of Somatic Mutations in Cancer and Online Mendelian Inheritance In Man.

DRAFT

e. Results of common in-silico prediction tools including sorting intolerant from tolerant, Polymorphism Phenotyping, Mutation Taster, and Splice Prediction Tools.

f. Evolutionary and conservation data. Physiochemical difference between two distinct amino acid residues.

g. The service provider will annotate mitochondrial variants using tools comparable to MSeqDR, MITOMAP, HmtDB, or mvTools.

1.1.1.3. A recommended final classification consistent with the American College of Medical Genetics criteria, shall be assigned to all variants. Variants of undetermined significance, likely pathogenic variants, shall be identified separately. This final classification needs to include a graphical representation of the different criteria met and used to classify the variant.

1.1.1.4. Capability to identify known pseudogenes and areas of homology for the regions covered in the panel. Final analysis shall include information on whether the potential remains that the identified variant lies within one of these areas rather than within the actual gene of interest. For the PMS2 gene, preliminary data on the likelihood of gene conversion events based on the presence or absence of stable paralogous single nucleotide variants is required.

1.1.1.5. Once the process is complete, the DHAGRL shall be provided a comprehensive quality control/assurance document that contains information on number of reads aligned, soft clipping, areas of poor coverage, statistics on mean coverage, mean read depth and reliability of the copy number calls.

1.1.1.6. Prior to analyzing individual samples, the bioinformatics contractor shall perform an initial validation protocol to determine accuracy, analytical sensitivity and analytical specificity. This validation shall meet the standards of the American College of Medical Genetics and the College of American Pathologists for clinical validation of a NextGen sequencing pipeline. The bioinformatics contractor shall work with the DHAGRL to resolve any quality issues identified during the validation process. Any changes in the pipeline shall result in repeating the validation protocol.

1.1.1.7. Turnaround time from receipt of data to return of reports shall be within 24 hours. All reports provided shall be error free.

1.1.1.8. The contractor shall provide the capability to filter data and only analyze/provide reports on genes requested by the DHAGRL. Although next-generation sequencing can provide information on many genes, it is anticipated that only information on specific panels of genes will be requested on any given sample.

1.1.2. Requirement 2: The contractor shall provide all necessary SOPHIA DDM WES+ enrichment reagents.

1.1.2.1. The DHAGRL will use the SOPHIA DDM WES+ enrichment sequencing reagents and capture target enrichment kits to conduct patient testing and generate FASTQ files using Illumina’s MiSeq, NextSeq or NovaSeq platforms.

1.1.2.2. The contractor shall process data in accordance with steps 1.1.1. to 1.1.1.8.

1.1.3. Requirement 3: The contractor shall provide all necessary mitochondrial genome sequencing reagents and capture target enrichment kits, except for the flow cells.

1.1.3.1. The DHAGRL will use the mitochondrial sequencing reagents and capture target enrichment kits to conduct patient testing and generate FASTQ files using Illumina's MiSeq, NextSeq, or NovaSeq platforms.

1.2. PROCEDURE GUIDANCE. The contractor shall perform procedures as stipulated in the company’s newest released stable version of the pipeline. Contractor variations or additions to the bioinformatics pipeline shall not be introduced without providing information to the DHAGRL Laboratory director.

1.3. FDA MANDATES/INDUSTRY STANDARD CHANGES. In the event the FDA mandates or industry standards require a change to bioinformatics processing and reporting of variants, an equitable adjustment will be negotiated between the Contractor and the Contracting Officer (CO) prior to implementation.

1.4. COMMUNICATION GUIDANCE. Contractor personnel shall maintain open and professional communication and display a positive/cooperative attitude with members of the DHAGRL staff.

Complaints validated by the Contracting Officer’s Representatives (COR) or Functional Requirements Evaluator Designees (FRED) shall be reported in writing to the contract administrator and the Contractor for action. The CO shall make final determination of the validity of customer complaint(s).

Failure of the Contractor to correct validated complaints raised by the Medical Treatment Facility (MTF) staff and the CO will be considered a failure to perform.

1.5. DOCUMENTATION GUIDANCE. Contractor personnel shall prepare all bioinformatics processing result reports to meet or exceed established standards of the DHAGRL and American College of Medical Genetics and Genomics (ACMGG). Reference paragraph 1.1.1.7. for timeliness and accuracy requirements.

1.6. CONTRACTOR PERSONNEL REQUIREMENTS.

1.6.1. Point of Contact (POC). The Contractor shall provide a POC that shall be responsible for the performance of the work. The POC shall have full authority to act for the Contractor on all matters relating to the daily operation of services. All information regarding testing will be coordinated with the Director of the DHAGRL or their designee.

1.6.2. Availability. The Contractor shall be available to provide upload/download services between 0400 hours (4:00 a.m.) and 2400 hours (12:00 a.m.) CST on Monday through Sunday. The contractor shall be available to answer questions during business hours, Monday through Friday, 0600 hours (6:00 a.m.) -1700 hours (5:00 p.m.) CST.

1.6.3. Holidays. The Contractor is required to provide routine bioinformatics testing services on all Federal holidays (or the actual day set aside for observation).

1.6.4. Continuity of Services. Failure to provide services may subject the Contractor to reimbursement of any additional cost incurred by the Government as a result of the Contractor’s failure to perform. In the event bioinformatics testing services cannot be performed, the Contractor shall promptly notify the DHAGRL Laboratory director or their designee and the CO. The Government retains the right to seek these services elsewhere should services not be provided by the Contractor.

1.6.5. English Language Requirement. All Contractor personnel providing services to KAFB shall read, understand, speak, and write English. Reports or reference laboratory testing data shall be submitted to the Government in English.

1.7. CONTRACTOR REQUIREMENTS.

1.7.1. Conflict of Interest. The Contractor shall not employ any person who is an employee of the United States Government if the employment of that person would create a conflict of interest. The Contractor shall not employ any active duty or a government civilian employee to perform under this contract unless the person seeks and receives approval IAW Department of Defense (DoD) Directive 5500.7-R, Joint Ethics Regulation (JER), 30 Aug 93 (incorporating through Change 7, 17 Nov 11).

1.8. Testing Site Board Certification. No certification required.

1.8.1. Licensure/Registration. No Licensure/registration required.

1.8.1.1. The Contractor shall ensure personnel performing testing procedures in the performance of this contract possess required credentials commensurate with testing difficulty in compliance with the Clinical Laboratory Improvement Act of 1988 (CLIA).

1.9. Performance Evaluation Meetings. The Contracting Officer (CO) will require the Contractor to meet with the CO, contract administrator, Functional Services Manager (FSM), and other Government personnel as often as deemed necessary. The Contractor may request a meeting with the CO when deemed necessary. Meetings will be documented in the contract file with written minutes signed by the Contractor and the CO, or contract administrator. Should the Contractor not concur with the minutes, such non-concurrence shall be provided in writing to the CO within ten calendar days of receipt of the minutes.

1.10. Patient Lists. The contractor shall only receive de-identified patients. No patients lists.

1.11. Release of Medical Information. The Contractor shall release medical information obtained during the course of this contract to MTF staff involved in the care and treatment of that individual patient only.

1.11.2 General cybersecurity requirements

o The Contractor shall maintain within the United States or US territories all Government data that is not physically located on DoD premises, unless the Contractor receives written notification from the Contracting Officer to use another location, in accordance with DFARS 239.7602-2(a).

Cyber Incident Reporting Requirement:

• When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall:

o Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support o Rapidly report cyber incidents to DHA Cyber Operations Center 24/7 help desk at 1866- 786-4432 o Access to additional information or equipment necessary for forensic analysis. Upon request by DHA, the Contractor shall provide DHA with access to additional information or equipment that is necessary to conduct a forensic analysis.

o Cyber incident damage assessment activities. If DHA RMED elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all the damage assessment information gathered in accordance with DFARS 239.7602-2(a).

1.12. Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA is comprised of several different sections, each to be implemented by the Department of Health and Human Services.

The medical facilities of the military services and the DOD health plans are specifically listed as covered by HIPAA. Currently, HIPAA Privacy and Security Rules, as set forth in the Code of Federal Regulations, are in effect for all MTF. The specific implementation of HIPAA Privacy for DOD MTFs is set forth in DODM 6025.18-R, and for HIPAA Security, the requirements for Air Force (AF) MTFs are DRAFT contained in DODI 8580.02 and AFI 41- 210, which also contains additional Information Assurance requirements for all AF MTFs. DODM 6025.18-R, DODI 8580.02, and AFI 41-210 are incorporated herein by reference. MTFs are responsible to ensure overall compliance with HIPAA requirements, which includes incorporation of certain requirements in contracts entered or amended after the respective implementation dates. IAW these regulations, the Contractor and its employees meet the definition of Business Associates; therefore, a Business Associate Agreement is required by law to comply with both the HIPAA Privacy and Security regulations. This clause serves as that agreement for each MTF, whereby the Contractor and its employees agree to abide by all HIPAA Privacy and Security requirements regarding health information as defined in this clause, DODM 6025-18-R, DOD 8520.02- R, and AFI 41-210. Additional HIPAA requirements will be addressed when implemented.

a. Introduction.

(1) Definitions, as used in this clause, generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DODM 6025.18-R, DOD 8520.02-R, or AFI 41- 210.

(a) HITECH Act shall mean the Health Information Technology for Economic and Clinical Health Act included in the American Recovery and Reinvestment Act of 2009.

(b) Individual has the same meaning as the term “individual” in 45 CFR 164.50 1 and

164.103 and shall include a person who qualifies as a personal representative IAW 45 CFR 164.502(g).

(c) Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

(d) Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 164.501, limited to the information created or received by the Contractor from or on behalf of the Government.

(e) Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

(f) Required by Law has the same meaning as the term “required by law” in 45 CFR 164.501 and 164.103.

(g) Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

(h) Security Incident shall have the same meaning as the term “security incident” in 45 CFR 164.304, limited to the information created or received by Contractor from or on behalf of the Covered Entity.

(i) Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160,162 and part 164, subpart C.

(2) Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 160.502, 164.103, 164.304, and 164.501.

(a) The Contractor agrees to not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(b) The Contractor agrees to use appropriate safeguards to maintain the privacy of the Protected Health Information and to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

(c) The HIPAA Security administrative, physical, and technical safeguards in 45 CFR 164.308, 164.310, and 164.312, and the requirements for policies, procedures, and documentation in 45 CFR 164.316 shall apply to the Contractor. The additional requirements of Title XIII of the HITECH Act that relate to security and that are made applicable with respect to covered entities shall also be applicable to the Contractor. The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(d) The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Contract.

(e) The Contractor agrees to report to the Government any security incident involving protected health information of which it becomes aware.

(f) The Contractor agrees to report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware.

(g) The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(h) The Contractor agrees to ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(i) The Contractor agrees to provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(j) The Contractor agrees to make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government or an Individual, and in the time and manner designated by the Government.

(k) The Contractor agrees to make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor on behalf of, the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner designated by the Government or the Secretary, for purposes of the Secretary determining the Government's compliance with the Privacy Rule.

(l) The Contractor agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information IAW45

CFR 164.528.

(m) The Contractor agrees to provide to the Government or an Individual, in time and manner designated by the Government, information collected IAW this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information IAW 45 CFR 164.528.

b. General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, IAW the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, DODM 6025.18-R, the HIPAA Security Rule, or DODI 8580.02 if done by the Government. The additional requirements of Title XIII of the HITECH Act that relate to privacy and that are made applicable with respect to covered entities shall also be applicable to the Contractor.

c. Specific Use and Disclosure Provisions.

(1) Except as otherwise limited in this agreement, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(2) Except as otherwise limited in this Agreement, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(3) Except as otherwise limited in this Agreement, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(4) Contractor may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with 45 CFR 164.502(j) (1).

d. Obligations of the Government. Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions.

(1) Upon request, the Government will provide the Contractor with the notice of privacy practices that the Government produces IAW 45 CFR 164.520, as well as any changes to such notice.

(2) The Government will provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor's permitted or required uses and disclosures.

(3) The Government will notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to IAW 45 CFR 164.522.

e. Permissible Requests by the Government. The Government will not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, DODM 6025.18R, the HIPAA Security Rule, or DODI 8580.02, if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

f. Termination.

(1) Termination. A breach by the Contractor of this clause may subject the Contractor to termination under any applicable default or termination provision of this contract.

(2) Effect of Termination.

(a) If this contract has records management requirements, the records subject to the clause should be handled IAW the records management requirements. If this contract does not have records management requirements, the records should be handled IAW paragraphs (b) and (c) below.

(b) If this contract does not have records management requirements, except as provided in paragraph c) of this section, upon termination of this Contract, for any reason, the Contractor shall return or destroy all Protected Health Information received from the Government, or created or received by the Contractor on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Contractor. The Contractor shall retain no copies of the Protected Health Information.

(c) If this contract does not have records management provisions and the Contractor determines that returning or destroying the Protected Health Information is infeasible, the Contractor shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Contractor that return or destruction of Protected Health Information is infeasible, the Contractor shall extend the

Page 10 of protections of this Contract to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Contractor maintains such Protected Health Information.

g. Miscellaneous.

(1) Regulatory References. A reference in this Clause to a section in DODM 6025.18- R, HIPAA Privacy Regulation, or DODI 8580.02, HIPAA Security Regulation, or any CFR or AFI provision means the section as currently in effect or as amended, and for which compliance is required.

(2) Survival. The respective rights and obligations of Business Associate agreements under the "Effect of Termination" provision of this Clause shall survive the termination of this Contract.

(3) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DODM 6025.18-R, the CFR HIPAA Privacy Rule, DOD 8520.02- R, the CFR HIPAA Security Rule, and AFI 41-210.

2. SERVICES SUMARY.

Performance Objective PWS Paragraph

Performance Measure

1. Report turnaround time shall be within 24 hours.

1.1.1.7. 100% compliance

2. Reports shall be error free. 1.1.1.7. 100% compliance

3. Maintain open and professional communication and display a positive/cooperative attitude.

1.4. No more than two valid

complaints per quarter validated by CO.

2.1. The Contractor shall utilize their own internal quality control processes in the performance of this contract. The quality control plan and supporting documentation shall be made available to the Government for review upon request. The Government will evaluate the Contractor’s performance by appointing CORs and/or FREDs to monitor performance to ensure services are received. The CORs/FREDs will evaluate the Contractor’s performance through inspections of call logs and reports and will receive/investigate all complaints from base personnel. The CO shall make final determination of the validity of customer complaint(s).

2.2. If any of the services do not conform to contract requirements, the Government may require the Contractor to perform the services again in conformity with contract requirements, at no increase in contract amount. When the defects in services cannot be corrected by re-performance, the Government may:

2.2.1. Require the Contractor to take necessary action to ensure that future performance conforms to contract requirements; and

2.2.2. Reduce the contract price to reflect the reduced value of the services performed. DRAFT