ATTACH A - PWS (BOD).pdf

Title: Board of Directors Support IDIQ RFP No. 75R60224R00009 Attachment A – Performance Work Statement (PWS)

HRSA Organ Procurement and Transplantation Network Modernization Initiative

The Health Resources and Services Administration (HRSA) oversees the Organ Procurement and Transplantation Network (OPTN). The OPTN was established by Congress nearly four decades ago and consists of a comprehensive network of transplant professionals and community members charged with increasing organ donation and operating and overseeing a fair and accountable system for allocating and transplanting organs in the United States.

Throughout the Biden-Harris Administration, HRSA has worked to strengthen the OPTN to better meet the urgent needs of the more than 100,000 people on the organ transplant waitlist and their families. In March 2023, HRSA launched the HRSA OPTN Modernization Initiative to strengthen OPTN accountability and performance by focusing on improving the organ procurement and transplant network’s governance, technology, and operations.

HRSA’s OPTN Modernization Initiative Across the nearly 40-year history of the OPTN, all functions of the OPTN have been managed by a single vendor and not competed separately based on technical expertise in areas like IT or operations.

In 2023, Congress adopted HRSA’s proposal to update the decades-old statute, including allowing HRSA to make multiple different contract awards to benefit from best-in-class vendors in different areas to improve performance and innovation. Congress also adopted HRSA’s proposal to require the OPTN Board of Directors to be independent from other OPTN contractors to strengthen OPTN accountability and oversight. The new law eliminated the arbitrary appropriation cap to support this work. A key element of HRSA’s efforts to implement these important changes is the President’s Fiscal Year 2024 Budget proposal to more than double investment in organ procurement and transplantation with a $36 million increase over Fiscal Year 2023 for a total of $67 million.

As part of HRSA’s OPTN Modernization Initiative, HRSA has conducted extensive market research, assessed responses to a HRSA request for information seeking public input on reforms, hosted two industry days with over 300 participants each, and engaged in more than 800 conversations with community members. For the first time in the history of the program, HRSA is issuing a solicitation to support an independent OPTN Board of Directors and releasing multi-vendor solicitations for the OPTN informed by this market research and centered on improving outcomes for patients.

First Ever Multi-Vendor OPTN Solicitations These multi-vendor solicitations mark the first time OPTN support and services have been competitively bid by function. This is just phase 1 of the HRSA multi-vendor acquisition strategy.

Later this year, HRSA intends to begin issuing solicitations for OPTN Next Gen contracts to develop an agile, modern organ matching technology solution that is based on human-centered design, highly reliable, secure, and user-friendly, and informed by HRSA’s on-going engagement with stakeholders and leading government technologists.

Phase 1: New OPTN Solicitations

OPTN Board of Directors Support Contractor: HRSA is releasing an Indefinite-Delivery- Indefinite-Quantity (IDIQ) solicitation to provide supports and services for an independent OPTN Board of Directors. Services in this solicitation include:

• Establishing a transitional nominating committee and seeking public input to develop a slate of candidates for a Board of Directors special election.

• Conducting a special election to establish a new independent OPTN Board of Directors.

• Reviewing and providing recommendations for modernizing OPTN by-laws and conflict of interest policy.

• Reviewing Board composition and structure and making recommendations for reforms to improve functionality and system outcomes.

• Supporting the new Board of Directors in executing its oversight and management responsibilities for OPTN organ matching policy and operations, OPTN membership standards, OPTN budget and financing, and other functions.

• Providing support to the Board for strategic planning, training, and performance evaluation.

• Collaborating with other OPTN contractors across the HRSA Modernization Initiative.

The OPTN Board Support Contractor will not be eligible for other HRSA OPTN contracts.

HRSA intends to award base contract/s under the Board Support IDIQ to a non-profit organization/s and issue task orders for services included in the performance work statement. The number and scope of task orders issued is contingent on final Fiscal Year 2024 appropriations.

OPTN Operations Transition Contractors: HRSA is releasing an IDIQ solicitation for multiple vendors to provide support for OPTN operations. Awards will support operations during the transition to and inform the development of a modernized OPTN, including implementing innovations and actionable reforms. The OPTN Next Gen contracts will build on this foundational work. Services in this solicitation include:

• Reviewing and mapping legacy OPTN operations approaches and identifying actionable reforms to improve patient outcomes, system functionality, and system accountability.

• Developing and implementing processes and metrics for monitoring and measuring OPTN member performance and compliance across all OPTN membership types and phases of the organ donation, procurement, waitlist, matching, transportation, and transplantation processes – with a focus on improving patient and donor/donor family experience.

• Supporting HRSA Modernization Initiative contractors in the development phase of new modular IT functionalities and the transition to a modernized OPTN IT system that leverages industry-leading standards.

• Updating and improving IT infrastructure now as a new modernized OPTN IT platform is built and deployed.

• Conducting reviews of current OPTN processes to identify and implement process improvements and change management strategies to improve system fairness, transparency and accountability.

• Providing strategic and administrative services – including improving transparency and increasing public input -- to support OPTN functions such as membership and professional standards, policy development, finance and auditing, network operations, and data.

• Analyzing and implementing approved recommendations to improve transplant program waitlist processes and acceptance criteria.

• Collaborating with other OPTN contractors across the HRSA Modernization Initiative.

HRSA intends to award base contracts under the IDIQ to multiple vendors and issue task orders for services included in the performance work statement. The number and scope of task orders issued is contingent on final Fiscal Year 2024 appropriations. No member of the OPTN Board of Directors may serve as an officer or employee of any OPTN contractor.

I. PURPOSE

II. SCOPE

III. BACKGROUND

IV. PERIOD AND PLACE OF PERFORMANCE

V. TASK AREAS

Task Area 1: Services to Support Board of Directors Independence and the Board Nominating Committee Task Area 2: Review of OPTN Board Structure and Composition Task Area 3: Strategic Planning and Board Development Task Area 4: Services to Support Board of Director Management Including Membership and Staffing Task Area 5: Administrative Services Task Area 6: General Requirements

6.1 OPTN Branding and Reporting

6.1.1. Branding

6.1.2. Reporting

6.2 Coordination Among All Entities Supporting the OPTN

6.3 Transition Activities

6.4 Use of Plain Language Guidelines and Other Government Laws and Regulations for all Products

6.5 Records Management Requirements (Reserved)6.5.1. Records and Information Regulations Guidelines

6.5.2. Records and Information Management

6.5.3. Records Management Training

6.6 Security and Privacy Requirements

6.7 Section 508 Requirements

Performance Work Statement (PWS) Title: Organ Procurement and Transplantation Network (OPTN)

Board of Directors Support IDIQ Date: 1/26/2024

I. PURPOSE

This Indefinite-Delivery-Indefinite-Quantity (IDIQ) contract vehicle supports the Health Resources and Services Administration’s (HRSA) Organ Procurement and Transplantation Network (OPTN) Modernization Initiative. The OPTN is a comprehensive network of transplant professionals and community members charged with increasing organ donation and operating and overseeing a fair and accountable system for allocating and transplanting organs. The contractor will provide strategic and administrative support services to support HRSA and the OPTN Board of Directors in providing effective governance and oversight of the OPTN. The OPTN Board of Directors Support contractor will be independent from other awards made to support the OPTN. Contractor services to be provided include Board of Directors’ staffing, services that facilitate the Board member nomination and election processes, services to support Board governance and oversight functions, review and updating of Board processes and procedures, facilitation and support of Board review and updating of the OPTN Bylaws, and administrative services for operations of the Board. Specific deliverables will be articulated at the task order level. The OPTN Board Support contractor will work closely with HRSA, the OPTN Board of Directors, and other HRSA contractors (OPTN operations contractors and the Scientific Registry of Transplant Recipients contractor) to effectively advance the mission of the

OPTN.

II. SCOPE

The IDIQ contractor/s shall provide all services, qualified personnel, materials, equipment, and facilities needed to enable the OPTN Board of Directors to carry out the full scope of its responsibilities, including its statutory and regulatory responsibilities.

III. BACKGROUND

HRSA, an agency of the U.S. Department of Health and Human Services (HHS), oversees the OPTN, as authorized by the National Organ Transplant Act of 1984 (42 U.S.C. § 273 et seq.) and recently amended by Public Law 118-14. (Also see 42 CFR part 121). In March 2023, HRSA launched the HRSA Organ Procurement and Transplantation Network Modernization Initiative to strengthen accountability and performance in the organ donation and transplantation system by focusing on critical areas such as improved technology, governance, and operations. In 2023, Congress updated the nearly 40-year-old National Organ Transplant Act of 1984, including increasing contractor competition to enhance performance and innovation. The OPTN Board of Directors is charged with the lifesaving responsibility of overseeing the nation’s organ procurement and allocation policies and processes. Board of Directors’ functions include organ procurement and allocation policymaking, OPTN membership standards and monitoring, OPTN governance, quality improvement and patient safety, and oversight of OPTN operations.

https://www.hrsa.gov/optn-modernization

This IDIQ is the first of multiple planned contract vehicles under the revised statute. The Board Support contractor shall be a non-profit organization capable of supporting an independent OPTN Board of Directors to ensure mission-driven governance, strong oversight of conflicts of interest policy, and a highly effective, representative board. The Board of Directors of the OPTN shall not be officers or executives of any OPTN contractors. Other HRSA contractors supporting OPTN operations may include non-profit and for-profit organizations. The single organization awarded the OPTN Board Support Contract will not be eligible for other OPTN contracts. HRSA will issue task orders for specific services under this Board Support IDIQ.

About the Organ Procurement and Transplantation Network Board of Directors The governing statute for the OPTN directs that the OPTN have a board of directors that includes representatives of “organ procurement organizations …, transplant centers, voluntary health associations, and the general public.” 42 U.S.C. § 274(b)(1)(B)(i). It further requires that the board of directors establish an executive committee and other committees, whose chairpersons are selected to ensure continuity of leadership for the board. § 274(b)(1)(B)(ii). Further, enacted in 2023, the Securing the U.S. Organ Procurement and Transplantation Network Act amended 42 U.S.C. § 274 (the National Organ Transplant Act) to require that awards made by HRSA to support the OPTN board of directors be distinct from other awards made to support the operation of the OPTN. The OPTN is also subject to regulatory oversight through the OPTN final rule at 42 C.F.R. part 121. 42 CFR § 121.3(a)(1) includes compositional requirements for the OPTN Board of Directors.

The OPTN Board of Directors is a group of volunteers that oversee and govern OPTN operations and budget, OPTN policy development informed by public input, OPTN member quality and standards, and data collection and submission requirements. The Executive Committee, chaired by the OPTN President, continues the work of the Board of Directors between meetings of the entire board, including taking action on emergency issues as necessary.

Board of Directors’ responsibilities include:

• Developing, reviewing, approving, and enforcing policies for organ allocation, procurement, and transplantation;

• Establishing committees as necessary to perform functions of the OPTN and to provide input and support for the Board of Directors’ policy development responsibilities;

• Overseeing OPTN system operational functions, including finance, electronic organ matching, data collection, and OPTN committee nominations;

• Supporting, establishing, and enforcing OPTN membership criteria and transplant and organ procurement organization program requirements; and

• Conducting reviews and evaluations of OPTN members and taking actions consistent with the OPTN Final Rule and OPTN Bylaws for OPTN member non-compliance.

Operating committees support the work of the Board of Directors by carrying out critical oversight activities and functions necessary for the effective operations of the OPTN, serving in an advisory capacity to the Board of Directors.

IV. PERIOD AND PLACE OF PERFORMANCE

See section F.1 and F.2 of the contract.

V. TASK AREAS

Task Area 1: Services to Support Board of Directors Independence and the Board Nominating Committee

1. Provide a plan to HRSA for the OPTN to hold a special election to establish a new independent

OPTN Board of Directors. The plan shall include seating a transitional nominating committee and mechanisms for soliciting public input on committee membership and Board nominations.

The committee shall consist of members of the OPTN community and be vetted for conflicts of interest. Support a special election for a new OPTN Board of Directors and support seamless transition to the new independent OPTN Board of Directors not more than 6 months from the task order award.

2. Provide recommendations and work with the newly elected Board to update existing OPTN bylaws and procedures addressing OPTN Board of Directors nominations and elections process and OPTN committee nomination and selection processes for transparency, fairness, and effectiveness in recruiting and seating Directors and committee members that reflect the multiple communities the organ transplant community serves. Support the implementation of the recommendations once approved.

3. Support communications with the public and community on the updated bylaws and procedures for OPTN nominations, Board elections, and committee member selection process.

4. Provide the services necessary for the OPTN Nominating Committee to conduct annual Board of Directors and OPTN committee composition reviews, needs assessments, and recruitment plans in accordance with applicable federal laws, OPTN policies, and contract requirements.

5. Provide the services necessary for the Nominating Committee to manage and execute the annual nomination and elections process for the Board of Directors and nominations and selection process for OPTN committees.

Task Area 2: Review of OPTN Board Structure and Composition

1. Review current OPTN Board of Directors structure and composition requirements within

NOTA, the OPTN final rule, and OPTN bylaws, and review and analyze stakeholder feedback, public input, and industry best practices to produce a report for HRSA on the most effective governance structure for the OPTN Board of Directors. Support the implementation of the recommendations once approved.

2. Review and in consultation with HRSA, work with the Board to update Board of Directors whistleblower and member code of conduct policies and procedures and conflict of interest policy, including a process for regular review of potential conflicts, to reflect best in class standards for avoiding conflicts affecting Board decision-making. Support the implementation of the recommendations once approved.

3. Develop process to support communications and community/public input on Board of Directors decision-making and recommendations. Support the implementation of the recommendations once approved.

4. Support HRSA in developing materials to update the OPTN Final Rule as necessary.

Task Area 3: Strategic Planning and Board Development

1. Strategic planning: Support the OPTN Board of Directors to develop a strategic plan that outlines the OPTN’s goals and objectives for the next 3-5 years, including a SWOT analysis, a review of the OPTN’s charter and vision statements, and a detailed action and performance management plan for achieving the Board’s goals and objectives.

2. Board orientation: Develop an orientation program for new board members that focuses on the OPTN statutory and regulatory requirements and mission, as well as the roles, responsibilities, code of conduct, and conflicts of interest policy for board members. Support the implementation of the orientation program once approved.

3. Board training: Develop a training program for board members that includes topics such as governance, financial management, and strategic planning as well as applicable federal laws, regulations, OPTN policy and bylaws, and contract requirements. Support the implementation of the training program once approved.

4. Board assessment: Conduct regular assessments of the board’s performance including OPTN member feedback to identify areas for improvement and ensure that the board is meeting its goals and objectives.

5. Board communication: Develop a communication plan for the board that includes regular meetings, reports, and other forms of communication to keep board members informed and engaged. Support the implementation of the communications plan once approved.

Task Area 4: Services to Support Board of Director Management Including Membership and Staffing

1. Develop and implement a plan, to be approved by HRSA, to continuously monitor and address potential or actual Board member conflicts of interest, including ensuring Board members have signed annual attestations/disclosures, notifying HRSA of potential or actual conflicts, retaining all records related to conflicts, and managing mitigation processes.

2. Review all Board members’ conflict disclosures for completeness and accuracy and report to HRSA on the results of this task. All new policies and procedures shall apply to all Board members once approved.

3. Obtain, provide, and manage indemnification insurance, including Directors & Officers (D&O) Insurance, for Board members.

4. Support the Board of Directors, in consultation with HRSA, in hiring an OPTN Executive Director, including recruitment and selection. The process must be objective, ensure no conflicts of interest and otherwise meet the OPTN Executive Director requirements in the OPTN Final Rule. Develop a plan for managing the OPTN Executive Director, including setting Board performance expectations and goals for the position, facilitating, and conducting annual Board performance evaluations.

5. Compensate OPTN Executive Director and any associated staff supporting the Executive Director using contract funds.

6. Facilitate internal and external reviews and evaluations of recommendations to OPTN policy updates and process improvements, including validating and stress-testing recommendations or alternative approaches through stakeholder engagement.

7. Develop and implement a process to regularly solicit public feedback on OPTN priorities and projects and incorporate feedback in annual planning.

8. Provide all services necessary to support Board of Director operations and implement approved policies and procedures.

9. Provide the services necessary for the Board of Directors to complete reviews of all proposed policies, policy changes, or policy variances for compliance with applicable federal laws, OPTN policies, and contract requirements. This includes services to coordinate Board of Directors review with OPTN Operating Committees and HRSA.

10. Provide all services, including expertise, necessary for the Board of Directors to review and monitor revenue, registration fees, expenditures, and financial records. This includes services to compile financial reports of OPTN expenditures by contractors and coordinating with OPTN operations contractor(s), for example those providing services to the Finance Committee, as necessary. Provide independent financial analysis and audits of OPTN finances and activities.

11. Ensure Board of Directors access to specialized operations and management knowledge, subject matter experts, and topical skillsets allowing the Board of Directors to understand, evaluate, implement, and fully perform their governance, operational, and management oversight and functional responsibilities. This includes providing research and analytic services to facilitate Board management and oversight of the areas of finance and budget development, legal requirements, information technology, and other technical expertise. [Note: Support for OPTN committee research and analytic services will be provided in OPTN operational contracts.]

Task Area 5: Administrative Services

1. Coordinate across the OPTN, HRSA, HRSA contractors, and other entities supporting the

OPTN, to ensure two-way communication, discussion, information sharing, and timely Board of Directors and HRSA access to all relevant information needed to oversee the OPTN and OPTN decision-making by the OPTN Board of Directors. This includes coordinating information transfer related to all operational activities of the OPTN functions being supported by entities under other OPTN contracts.

2. Provide program and project management services necessary to ensure that the Board of Directors is able to effectively track, monitor, and implement effective oversight of all activities in progress across the OPTN. This includes tracking progress, cost, schedule, quality assurance, and management considerations for OPTN activities.

3. Provide logistics, planning, and other services for virtual, in-person, and hybrid meetings and events, including reasonable accommodations as needed. Platforms for hosting virtual meetings and virtual components of hybrid meetings will be provided by other OPTN entities.

Responsibilities include facilitating effective discussions, drafting related documents and agendas, coordinating records management and archiving with other entities supporting the OPTN, and other documentation requirements.

4. Coordinate with other OPTN entities responsible for records management and retention to ensure retention, dissemination, and archiving of OPTN Board of Directors records, including documentation related to Board of Directors decisions and actions, briefing papers, reports, meeting summaries, communications, templates, and key operating documents.

5. Facilitate web posting and regularly updating OPTN Board communications, actions, pending items, agendas, and other materials.

Task Area 6: General Requirements

6.1 OPTN Branding and Reporting

6.1.1. Branding

All contractors shall brand all OPTN products produced under contracts associated with this IDIQ as OPTN products. OPTN contractor products shall be approved by a process established by the Board and/or HRSA. OPTN products can only contain OPTN branding.

Contractors shall not brand any OPTN product as a product of the entity supporting the OPTN or as joint OPTN products. Additionally, no contractor shall brand any product not produced or approved to support the OPTN as an OPTN product.

6.1.2. Reporting

At the direction of HRSA, contribute to the development of internal and external reports as necessary for the Board or HRSA to meet statutory and regulatory requirements, including information such as data and analyses on organ donation and transplantation, OPTN policies and policy development, OPTN system activities, and longitudinal analyses that describe trends over time in organ donation and transplantation.

6.2 Coordination Among All Entities Supporting the OPTN

This subtask encompasses work and requirements to cooperate and collaborate with all entities supporting the OPTN while delivering the services necessary for the OPTN to meet its obligations.

1. All entities contracted to support the OPTN, including the Board Support Contractor, shall meet on a regular basis to be determined by HRSA to report on the status of deliverables and action items and shared metrics, conduct strategic planning, collaborate on innovative reforms, identify and address risks, and implement the HRSA OPTN Modernization Initiative.

2. All entities contracted to support the OPTN, including the Board Support Contractor, shall enter into data use agreements for OPTN data with other entities contracted to support the OPTN, as necessary and at the direction of HRSA.

• Implement all appropriate privacy and security protections for OPTN-related materials, as outlined in the attachments and future task orders.

• Share all data and information necessary to enable OPTN and all entities supporting the OPTN to successfully perform. This includes assisting with access to OPTN data, process and procedure documentation, and other data necessary to complete OPTN activities. NOTE: Any potential restrictions on the part of contractors to sharing data and necessary information must be identified at the time of task order award.

3. All entities contracted to support the OPTN, including the Board Support Contractor, shall regularly meet with the OPTN Board of Directors and all appropriate Board of Directors Committees on a basis to be determined by the Board and provide requested OPTN-related materials and updates as part of the Board’s oversight activities.

4. All entities contracted to support the OPTN, including the Board Support Contractor, shall report to HRSA all data, information, and other requested OPTN-related materials to support HRSA’s oversight and congressional, statutory, regulatory, financial and other reporting requirements and oversight function.

5. All entities contracted to support the OPTN, including the Board Support Contractor, shall continually monitor, manage, and adjust processes, procedures, and functionality to integrate work with other entities supporting the OPTN.

6. All entities contracted to support the OPTN, including the Board Support Contractor, shall continually monitor, identify, and mitigate risks and proactively inform HRSA of any issues that prevent performance or successful implementation of efforts.

7. All entities contracted to support the OPTN, including the Board Support Contractor, shall conduct and participate in retrospectives to work collaboratively with other entities supporting the OPTN to identify issues and achievements, develop recommendations for improvement, and report on outcomes.

6.3 Transition Activities

This subtask encompasses services required to enable the transition of any contract activities from incumbent contractors to other entities, including HRSA, the OPTN, HRSA contractors, and other entities supporting the OPTN. This includes both transition-in at the start of performance and transition-out at the end of performance.

1. Develop a transition plan for HRSA review and approval outlining the details of any transition (including applicable implementation roadmaps, risk management, privacy, back-up protocols, document transfer and processes) and implement approved plans to ensure successful transition.

2. Coordinate and implement the transition of any existing OPTN function or activity (including but not limited to processes, protocols, data collection or analyses, templates, systems) in such a way that ensures users have a seamless experience. This may include collaboration, coordinating, and training for multiple entities supporting the OPTN.

6.4 Use of Plain Language Guidelines and Other Government Laws and Regulations for all Products The Contractor shall:

1. Follow the federal Plain Language Guidelines when developing products. The Plain Language Act of 2010 requires federal agencies to create communications that are clear and understandable to the public.

2. Ensure that all materials adhere to the Government Printing and Binding Regulations, including the prohibition on commercial advertising, “No Government publication or other Government printed matter, prepared or produced with either appropriated or nonappropriated funds or identified with an activity of the Government, shall contain any advertisement inserted by or for any private individual, firm, or corporation; or contain material which implies in any manner that the Government endorses or favors any specific commercial product, commodity, or service.” -- (Title III--General Provisions, 13. Advertisements, Commercial.)

3. Ensure that all materials do not contain any non-federal logos outside of the OPTN (since contractor logos are a form of institutional advertising); that materials do not contain contact information for non-federal organizations outside of the OPTN or OPTN affiliated individuals.

4. Ensure that all materials adhere to the prohibition against referring to lobbying in materials produced with appropriated funds.

6.5 Records Management Requirements (Reserved)6.5.1. Records and Information Regulations Guidelines

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

6.5.2. Records and Information Management

The Contractor shall manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate record keeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

6.5.3. Records Management Training

The contractor (and/or subcontractor) shall ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report

6.6 Security and Privacy Requirements

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with OMB, NIST, HHS, HRSA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the COR, CO, and to HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) or 301-443-3333.

c. Privacy Act. Comply with the Privacy Act requirements.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-

53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual."

Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

2. Contract Initiation and Expiration

a. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

b. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within 14 days before an employee stops working under this contract.

mailto:hrsacsirt@hrsa.gov

c. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or HRSA policies.

Deliverables

Policy Section Deliverable Title/Description Due Date

Incident Response

Incident Report (as incidents or breaches occur)

As soon as possible and without reasonable delay and no later than 1 hour of discovery

6.7 Section 508 Requirements

The contractor shall ensure all products and services delivered under this contract are compliant with Section 508 in accordance with the Health and Human Services Acquisition Regulation (HHSAR). These Section 508 Standards were issued by the United States Access Board (https://www.access-board.gov/) and published in the Federal Register, on January 18, 2017, as the final rule (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule). The final rule updates the Section 508 Standards along with accessibility guidelines for telecommunication products and equipment covered by section 255 of the Communications Act.

The Section 508 Standards applicable to this contract are:

Section 508 Standards and Guidelines (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines)

• Web Content Accessibility Guidelines (WCAG) 2.0 o Success Criteria, Level A and AA

• Chapter 3: Functional Performance Criteria (FPC)

• Chapter 4: Hardware (If Applicable)

• Chapter 5: Software

• Chapter 6: Support Documentation and Services

Section 508 requires that all external public facing content and non-public facing official agency communications be accessible. Regardless of format, all digital content or communications materials produced as deliverables under this contract must conform to applicable Section 508 standards to allow federal employees and members of the public https://www.access-board.gov/ https://www.access-board.gov/ https://www.access-board.gov/ https://sharepoint.hrsa.gov/oo/oit/dcppm/Pages/final%20rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines with disabilities to access information that is comparable to information provided to persons without disabilities.

The contractor shall complete and submit the applicable HHS Section 508 Accessibility Compliance Checklist per Section 508 deliverable. The checklist will serve as an artifact declaration of the Section 508 deliverable's compliance. Remediation of any Section 508 deliverables that do not comply with the applicable requirements as set forth below shall be the contractor's responsibility.

HHS guidance and checklists regarding accessibility of documents can be found at https://www.hhs.gov/web/section-508/accessibility-checklists/index.html.

The HHS Section 508 Product Assessment Template (PAT) that is referenced above in 352.239-73 Electronic Information and Technology Accessibility Notice, Paragraph (c), has been replaced with the Voluntary Product Accessibility Template Version (VPAT) 2.1 or later, and is considered to meet HHS PAT requirement. The new form can be downloaded from https://www.itic.org/policy/accessibility/vpat.

NOTE: ICT vs. EIT Procurement documentation from HHS or other agencies may contain references to "EIT" (Electronic and Information Technology) and "ICT" (Information and Communications Technology). HHS considers these terms to be interchangeable, and "EIT" should always be interpreted to be "ICT" in any HHS procurement.

https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.itic.org/policy/accessibility/vpat