ATTACH A - PWS (BOD).pdf

OPTN BOD Support IDIQ

RFP No. 75R60224R00009

Attachment A – OPTN BOD PWS

pg. 1

HRSA Organ Procurement and Transplantation Network

Modernization Initiative

The Health Resources and Services Administration (HRSA) oversees the Organ Procurement and

Transplantation Network (OPTN). The OPTN was established by Congress nearly four decades ago and consists of a comprehensive network of transplant professionals and community members charged with increasing organ donation and operating and overseeing a fair and accountable system for allocating and transplanting organs in the United States.

Throughout the Biden-Harris Administration, HRSA has worked to strengthen the OPTN to better meet the urgent needs of the more than 100,000 people on the organ transplant waitlist and their families. In March

2023, HRSA launched the HRSA OPTN Modernization Initiative to strengthen OPTN accountability and performance by focusing on improving the organ procurement and transplant network’s governance, technology, and operations.

HRSA’s OPTN Modernization Initiative

Across the nearly 40-year history of the OPTN, all functions of the OPTN have been managed by a single vendor and not competed separately based on technical expertise in areas like IT or operations. In 2023, Congress adopted HRSA’s proposal to update the decades-old statute, including allowing HRSA to make multiple different contract awards to benefit from best-in-class vendors in different areas to improve performance and innovation. Congress also adopted HRSA’s proposal to require the OPTN Board of

Directors to be independent from other OPTN contractors to strengthen OPTN accountability and oversight. The new law eliminated the arbitrary appropriation cap to support this work. A key element of

HRSA’s efforts to implement these important changes is the President’s Fiscal Year 2024 Budget proposal to more than double investment in organ procurement and transplantation with a $36 million increase over

Fiscal Year 2023 for a total of $67 million.

As part of HRSA’s OPTN Modernization Initiative, HRSA has conducted extensive market research, assessed responses to a HRSA request for information seeking public input on reforms, hosted two industry days with over 300 participants each, and engaged in more than 800 conversations with community members. For the first time in the history of the program, HRSA is issuing a solicitation to support an independent OPTN Board of Directors and releasing multi-vendor solicitations for the OPTN informed by this market research and centered on improving outcomes for patients.

First Ever Multi-Vendor OPTN Solicitations

These multi-vendor solicitations mark the first time OPTN support and services have been competitively bid by function. This is just phase 1 of the HRSA multi-vendor acquisition strategy. Later this year, HRSA intends to begin issuing solicitations for OPTN Next Gen contracts to develop an agile, modern organ matching technology solution that is based on human-centered design, highly reliable, secure, and user-friendly, and informed by HRSA’s on-going engagement with stakeholders and leading government technologists.

OPTN BOD Support IDIQ

Attachment A – OPTN BOD PWS

pg. 2

Phase 1: New OPTN Solicitations

OPTN Board of Directors Support Contractor [not included in the scope of this solicitation]:

HRSA is releasing a single-award Indefinite-Delivery-Indefinite-Quantity (IDIQ) solicitation to provide support and services for an independent OPTN Board of Directors. Services in this solicitation include:

• Establishing a transitional nominating committee and seeking public input to develop a slate of candidates for an independent OPTN Board of Directors.

• Conducting a special election/appointment to establish an independent OPTN Board of

Directors.

• Reviewing and providing recommendations for modernizing OPTN bylaws and conflict of interest policy.

• Reviewing Board composition and structure and making recommendations for reforms to improve functionality and system outcomes.

• Supporting the Board of Directors in executing its management and functional responsibilities for OPTN organ matching policy and operations, OPTN membership standards, OPTN budget and financing, and other functions.

• Providing support to the Board for strategic planning, training, and performance evaluation.

• Collaborating with other OPTN contractors across the HRSA Modernization Initiative.

The OPTN Board Support Contractor will not be eligible for other HRSA OPTN contracts.

HRSA intends to award the Board Support IDIQ to a non-profit organizations and issue task orders for services included in the performance work statement. The number and scope of task orders issued is contingent on final Fiscal Year 2024 appropriations.

OPTN Operations Transition Contractors: HRSA is releasing an IDIQ solicitation for multiple vendors to provide support for OPTN operations. Awards will support operations during the transition to and inform the development of a modernized OPTN, including implementing innovations and actionable reforms. The planned NextGen IT contracts, which will be released later this year, will build on this foundational work. Services in this solicitation include:

• Reviewing and mapping legacy OPTN operations approaches and identifying actionable reforms to improve patient outcomes, system functionality, and system accountability.

• Developing and implementing processes and metrics for monitoring and measuring OPTN member performance and compliance across all OPTN membership types and phases of the organ donation, procurement, waitlist, matching, transportation, and transplantation processes – with a focus on improving patient and donor/donor family experience.

• Updating the IT infrastructure to interface with the NextGen IT that will occur in a future IDIQ.

• Conducting reviews of current OPTN processes to identify and implement process improvements and change management strategies to improve system fairness, transparency and accountability.

Title: Board of Directors Support IDIQ

Attachment A – Performance Work Statement (PWS)

• Providing strategic and administrative services – including improving transparency and increasing public input -- to support OPTN functions such as membership and professional standards, policy development, finance and auditing, network operations, and data.

• Analyzing and implementing approved recommendations to improve transplant program waitlist processes and acceptance criteria.

• Collaborating with other OPTN contractors across the HRSA Modernization Initiative.

Under the OPTN Operations Transition solicitation, HRSA intends to award a multiple IDIQ contract to vendors and issue task orders for services included in the Performance Work Statement (PWS). The number and scope of task orders issued is contingent upon annual fiscal appropriations. It is intended that the terms of these awards will prohibit any member of the OPTN Board of Directors from serving as an officer or employee of any OPTN contractor.

I. PURPOSE

II. SCOPE

III. BACKGROUND

IV. PERIOD AND PLACE OF PERFORMANCE

V. TASK AREAS

Task Area 1: Services to Support Board of Directors Independence and the Board Nominating

Committee Task Area 2: Review of OPTN Board Structure and Composition Task Area 3: Strategic Planning and Board Development Task Area 4: Services to Support Board of Director Management Including Membership and

Staffing Task Area 5: Administrative Services Task Area 6: General Requirements

6.1 OPTN Branding and Reporting

6.1.1. Branding

6.1.2. Reporting

6.2 Coordination Among All Entities Supporting the OPTN

6.3 Transition Activities

6.4 Use of Plain Language Guidelines and Other Government Laws and Regulations for all

Products

6.5 Records Management Requirements (Reserved)

6.5.1. Records and Information Regulations Guidelines

6.5.2. Records and Information Management

6.5.3. Records Management Training

6.6 Security and Privacy Requirements

6.7 Section 508 Requirements

Performance Work Statement (PWS)

Title: Organ Procurement and Transplantation Network (OPTN)

Board of Directors Support IDIQ

Date: 05/01/2024

I. PURPOSE

This Indefinite-Delivery-Indefinite-Quantity (IDIQ) contract vehicle supports the Health Resources and Services Administration’s (HRSA) Organ Procurement and Transplantation Network (OPTN)

Modernization Initiative. The OPTN is a comprehensive network of transplant professionals and community members charged with increasing organ donation and operating and overseeing a fair and accountable system for allocating and transplanting organs. The contractor will provide strategic and administrative support services to support HRSA and the OPTN Board of Directors in providing effective governance and oversight of the OPTN. The OPTN Board of Directors Support contractor will be independent from other awards made to support the OPTN. Contractor services to be provided include Board of Directors’ staffing, services that facilitate the Board member nomination and election processes, services to support Board governance and oversight functions, review and updating of

Board processes and procedures, facilitation and support of Board review and updating of the OPTN

Bylaws, and administrative services for operations of the Board. Specific deliverables will be articulated at the task order level. The OPTN Board Support contractor will work closely with HRSA, the OPTN Board of Directors, and other HRSA contractors (OPTN operations contractors and the

Scientific Registry of Transplant Recipients contractor) to effectively advance the mission of the

OPTN.

II. SCOPE

The IDIQ contractor/s shall provide all services, qualified personnel, materials, equipment, and facilities needed to enable the OPTN Board of Directors to carry out the full scope of its responsibilities, including its statutory and regulatory responsibilities.

III. BACKGROUND

HRSA, an agency of the U.S. Department of Health and Human Services (HHS), oversees the OPTN, as authorized by the National Organ Transplant Act of 1984 (42 U.S.C. § 273 et seq.) and recently amended by Public Law 118-14. (Also see 42 CFR part 121). In March 2023, HRSA launched the

HRSA Organ Procurement and Transplantation Network Modernization Initiative to strengthen accountability and performance in the organ donation and transplantation system by focusing on critical areas such as improved technology, governance, and operations. In 2023, Congress updated the nearly 40-year-old National Organ Transplant Act of 1984, including increasing contractor competition to enhance performance and innovation. The OPTN Board of Directors is charged with the lifesaving responsibility of overseeing the nation’s organ procurement and allocation policies and processes. Board of Directors’ functions include organ procurement and allocation policymaking, OPTN membership standards and monitoring, OPTN governance, quality improvement and patient safety, and oversight of OPTN operations.

https://www.hrsa.gov/optn-modernization

This IDIQ is the first of multiple planned contract vehicles under the revised statute. The Board

Support contractor shall be a non-profit organization capable of supporting an independent OPTN

Board of Directors to ensure mission-driven governance, strong oversight of conflicts of interest policy, and a highly effective, representative board. The Board of Directors of the OPTN shall not be officers or executives of any OPTN contractors. Other HRSA contractors supporting OPTN operations may include non-profit and for-profit organizations. The single organization awarded the OPTN Board

Support Contract will not be eligible for other OPTN contracts. HRSA will issue task orders for specific services under this Board Support IDIQ.

About the Organ Procurement and Transplantation Network Board of Directors

The governing statute for the OPTN directs that the OPTN have a board of directors that includes representatives of “organ procurement organizations …, transplant centers, voluntary health associations, and the general public.” 42 U.S.C. § 274(b)(1)(B)(i). It further requires that the board of directors establish an executive committee and other committees, whose chairpersons are selected to ensure continuity of leadership for the board. § 274(b)(1)(B)(ii). Further, enacted in 2023, the Securing the U.S. Organ Procurement and Transplantation Network Act amended 42 U.S.C. § 274 (the National

Organ Transplant Act) to require that awards made by HRSA to support the OPTN board of directors be distinct from other awards made to support the operation of the OPTN. The OPTN is also subject to regulatory oversight through the OPTN final rule at 42 C.F.R. part 121. 42 CFR § 121.3(a)(1) includes compositional requirements for the OPTN Board of Directors.

The OPTN Board of Directors is a group of volunteers that oversee and govern OPTN operations and budget, OPTN policy development informed by public input, OPTN member quality and standards, and data collection and submission requirements. The Executive Committee, chaired by the OPTN

President, continues the work of the Board of Directors between meetings of the entire board, including taking action on emergency issues as necessary.

Board of Directors’ responsibilities include:

• Developing, reviewing, approving, and enforcing policies for organ allocation, procurement, and transplantation;

• Establishing committees as necessary to perform functions of the OPTN and to provide input and support for the Board of Directors’ policy development responsibilities;

• Overseeing OPTN operational functions, including finance, electronic organ matching, data collection, and OPTN committee nominations;

• Supporting, establishing, and enforcing OPTN membership criteria and transplant and organ procurement organization program requirements; and

• Conducting reviews and evaluations of OPTN members and taking actions consistent with the

OPTN Final Rule and OPTN Bylaws for OPTN member non-compliance.

Operating committees support the work of the Board of Directors by carrying out critical oversight activities and functions necessary for the effective operations of the OPTN, serving in an advisory capacity to the Board of Directors.

IV. PERIOD AND PLACE OF PERFORMANCE

See section F.1 and F.2 of the contract.

V. TASK AREAS

Task Area 1: Services to Support Board of Directors Independence and the Board

Nominating Committee

At the direction of the COR, the Contractor shall:

1. Provide a plan to HRSA for the OPTN to hold a special election to establish a new independent

OPTN Board of Directors. The plan shall include seating a transitional nominating committee and mechanisms for soliciting public input on committee membership and Board nominations.

The committee shall consist of members of the OPTN community and be vetted for conflicts of interest. Support a special election for a new OPTN Board of Directors and support seamless transition to the new independent OPTN Board of Directors not more than 6 months from the task order award.

2. Provide recommendations and work with the newly elected Board to update existing OPTN bylaws and procedures addressing OPTN Board of Directors nominations and elections process and OPTN committee nomination and selection processes for transparency, fairness, and effectiveness in recruiting and seating Directors and committee members that reflect the multiple communities the organ transplant community serves. Support the implementation of the recommendations once approved.

3. Support communications with the public and community on the updated bylaws and procedures for OPTN nominations, Board elections, and committee member selection process.

4. Provide the services necessary for the OPTN Nominating Committee to conduct annual Board of Directors and OPTN committee composition reviews, needs assessments, and recruitment plans in accordance with applicable federal laws, OPTN policies, and contract requirements.

5. Provide the services necessary for the Nominating Committee to manage and execute the annual nomination and elections process for the Board of Directors and nominations and selection process for OPTN committees.

Task Area 2: Review of OPTN Board Structure and Composition

At the direction of the COR, the Contractor shall:

1. Review current OPTN Board of Directors structure and composition requirements within

NOTA, the OPTN final rule, and OPTN bylaws, and review and analyze stakeholder feedback, public input, and industry best practices to produce a report for HRSA on the most effective governance structure for the OPTN Board of Directors. Support the implementation of the recommendations once approved.

2. Review and in consultation with HRSA, work with the Board to update Board of Directors whistleblower and member code of conduct policies and procedures and conflict of interest policy, including a process for regular review of potential conflicts, to reflect best in class standards for avoiding conflicts affecting Board decision-making. Support the implementation of the recommendations once approved.

3. Develop process to support communications and community/public input on Board of Directors decision-making and recommendations. Support the implementation of the recommendations once approved.

4. Support HRSA in developing materials to update the OPTN Final Rule as necessary.

Task Area 3: Strategic Planning and Board Development

1. Strategic planning: Support the OPTN Board of Directors to develop a strategic plan that outlines the OPTN’s goals and objectives for the next 3-5 years, including a SWOT analysis, a review of the OPTN’s charter and vision statements, and a detailed action and performance management plan for achieving the Board’s goals and objectives.

2. Board orientation: Develop an orientation program for new board members that focuses on the OPTN statutory and regulatory requirements and mission, as well as the roles, responsibilities, code of conduct, and conflicts of interest policy for board members. Support the implementation of the orientation program once approved.

3. Board training: Develop a training program for board members that includes topics such as governance, financial management, and strategic planning as well as applicable federal laws, regulations, OPTN policy and bylaws, and contract requirements. Support the implementation of the training program once approved.

4. Board assessment: Conduct regular assessments of the board’s performance including OPTN member feedback to identify areas for improvement and ensure that the board is meeting its goals and objectives.

5. Board communication: Develop a communication plan for the board that includes regular meetings, reports, and other forms of communication to keep board members informed and engaged. Support the implementation of the communications plan once approved.

Task Area 4: Services to Support Board of Director Management Including Membership and

Staffing

At the direction of the COR, the Contractor shall:

1. Develop and implement a plan, to be approved by HRSA, to continuously monitor and address potential or actual Board member conflicts of interest, including ensuring Board members have signed annual attestations/disclosures, notifying HRSA of potential or actual conflicts, retaining all records related to conflicts, and managing mitigation processes.

2. Review all Board members’ conflict disclosures for completeness and accuracy and report to

HRSA on the results of this task. All new policies and procedures shall apply to all Board members once approved.

3. Obtain, provide, and manage indemnification insurance, including Directors & Officers (D&O)

Insurance, for Board members.

4. Support the Board of Directors, in consultation with HRSA, in hiring an OPTN Executive

Director, including recruitment and selection. The process must be objective, ensure no conflicts of interest, and otherwise meet the OPTN Executive Director requirements in the

OPTN Final Rule. Develop a plan for managing the OPTN Executive Director, including paying any salary using contract funds, setting Board performance expectations and goals for the position, and conducting annual Board performance evaluations. The process must also ensure that the Executive Director is not subject to HRSA oversight and is not providing personal services to the government.

5. Facilitate internal and external reviews and evaluations of recommendations to OPTN policy updates and process improvements, including validating and stress-testing recommendations or alternative approaches through stakeholder engagement.

6. Develop and implement a process to regularly solicit public feedback on OPTN priorities and projects and incorporate feedback in annual planning.

7. Provide all services necessary to support Board of Director operations and implement approved policies and procedures.

8. Provide the services necessary for the Board of Directors to complete reviews of all proposed policies, policy changes, or policy variances for compliance with applicable federal laws, OPTN policies, and contract requirements. This includes services to coordinate Board of

Directors review with OPTN Operating Committees and HRSA.

9. Provide all services, including expertise, necessary for the Board of Directors to review and monitor revenue, registration fees, expenditures, and financial records. This includes services to compile financial reports of OPTN expenditures by contractors and coordinating with OPTN operations contractor(s), for example those providing services to the Finance Committee, as necessary. Provide independent financial analysis and audits of OPTN finances and activities.

10. Ensure Board of Directors access to specialized operations and management knowledge, subject matter experts, and topical skillsets allowing the Board of Directors to understand, evaluate, implement, and fully perform their governance, operational, and management oversight and functional responsibilities. This includes providing research and analytic services to facilitate Board management and oversight of the areas of finance and budget development, legal requirements, information technology, and other technical expertise. [Note: Support for

OPTN committee research and analytic services will be provided in OPTN operational contracts.]

Task Area 5: Administrative Services

1. Coordinate across the OPTN, HRSA, HRSA contractors, and other entities supporting the

OPTN, to ensure two-way communication, discussion, information sharing, and timely Board of Directors and HRSA access to all relevant information needed to oversee the OPTN and

OPTN decision-making by the OPTN Board of Directors. This includes coordinating information transfer related to all operational activities of the OPTN functions being supported by entities under other OPTN contracts.

2. Provide all program and project management services to the Board of Directors to ensure that the Board of Directors is able to effectively track, monitor, and implement effective oversight of all activities in progress across the OPTN. This includes tracking progress, cost, schedule, quality assurance, and management considerations for OPTN activities.

3. Provide logistics, planning, and other services for virtual, in-person, and hybrid meetings and events, including reasonable accommodations as needed. Platforms for hosting virtual meetings and virtual components of hybrid meetings will be provided by other OPTN entities.

Responsibilities include facilitating effective discussions, drafting related documents and agendas, coordinating records management and archiving with other entities supporting the

OPTN, and other documentation requirements.

4. Coordinate with other OPTN entities responsible for records management and retention to ensure retention, dissemination, and archiving of OPTN Board of Directors records, including documentation related to Board of Directors decisions and actions, briefing papers, reports, meeting summaries, communications, templates, and key operating documents.

5. Facilitate web posting and regularly updating OPTN Board communications, actions, pending items, agendas, and other materials.

Task Area 6: General Requirements

6.1 OPTN Branding and Reporting

6.1.1 Branding

At the direction of the COR, all contractors shall brand all OPTN products produced under contracts associated with this IDIQ as OPTN products. OPTN contractor products shall be approved by a process established by the Board and/or HRSA. OPTN products can only contain OPTN branding. Contractors shall not brand any OPTN product as a product of the entity supporting the OPTN or as joint OPTN products. Additionally, no contractor shall brand any product not produced or approved to support the OPTN as an OPTN product.

6.1.2 Reporting

At the direction of the COR, all contractor shall contribute to the development of internal and external reports as necessary for the Board or HRSA to meet statutory and regulatory requirements, including information such as data and analyses on organ donation and transplantation, OPTN policies and policy development, OPTN system activities, and longitudinal analyses that describe trends over time in organ donation and transplantation.

6.2 Coordination Among All Entities Supporting the OPTN

This subtask encompasses work and requirements to cooperate and collaborate with all entities supporting the OPTN while delivering the services necessary for the OPTN to meet its obligations.

1. All entities contracted to support the OPTN, including the Board Support Contractor, shall meet on a regular basis to be determined by HRSA to report on the status of deliverables and action items and shared metrics, conduct strategic planning, collaborate on innovative reforms, identify and address risks, and implement the HRSA OPTN Modernization

Initiative.

2. All entities contracted to support the OPTN, including the Board Support Contractor, shall enter into data use agreements for OPTN data with other entities contracted to support the

OPTN, as necessary and at the direction of HRSA.

• Implement all appropriate privacy and security protections for OPTN-related materials, as outlined in the attachments and future task orders.

• Share all data and information necessary to enable OPTN and all entities supporting the OPTN to successfully perform. This includes assisting with access to OPTN data, process and procedure documentation, and other data necessary to complete

OPTN activities. NOTE: Any potential restrictions on the part of contractors to sharing data and necessary information must be identified at the time of task order award.

3. All entities contracted to support the OPTN, including the Board Support Contractor, shall regularly meet with the OPTN Board of Directors and all appropriate Board of Directors

Committees on a basis to be determined by the Board and provide requested OPTN-related materials and updates as part of the Board’s oversight activities.

4. All entities contracted to support the OPTN, including the Board Support Contractor, shall report to HRSA all data, information, and other requested OPTN-related materials to support HRSA’s oversight and congressional, statutory, regulatory, financial and other reporting requirements and oversight function.

5. All entities contracted to support the OPTN, including the Board Support Contractor, shall continually monitor, manage, and adjust processes, procedures, and functionality to integrate work with other entities supporting the OPTN.

6. All entities contracted to support the OPTN, including the Board Support Contractor, shall continually monitor, identify, and mitigate risks and proactively inform HRSA of any issues that prevent performance or successful implementation of efforts.

7. All entities contracted to support the OPTN, including the Board Support Contractor, shall conduct and participate in retrospectives to work collaboratively with other entities supporting the OPTN to identify issues and achievements, develop recommendations for improvement, and report on outcomes.

6.3 Transition Activities

This subtask encompasses services required to enable the transition of any contract activities from incumbent contractors to other entities, including HRSA, the OPTN, HRSA contractors, and other entities supporting the OPTN. This includes both transition-in at the start of performance and transition-out at the end of performance.

1. Develop a transition plan for HRSA review and approval outlining the details of any transition (including applicable implementation roadmaps, risk management, privacy, back-up protocols, document transfer and processes) and implement approved plans to ensure successful transition.

2. Coordinate and implement the transition of any existing OPTN function or activity

(including but not limited to processes, protocols, data collection or analyses, templates, systems) in such a way that ensures users have a seamless experience. This may include collaboration, coordinating, and training for multiple entities supporting the OPTN.

6.4 Use of Plain Language Guidelines and Other Government Laws and Regulations for all Products

At the direction of the COR, the Contractor shall:

1. Follow the federal Plain Language Guidelines when developing products. The Plain

Language Act of 2010 requires federal agencies to create communications that are clear and understandable to the public.

2. Ensure that all materials adhere to the Government Printing and Binding Regulations, including the prohibition on commercial advertising, “No Government publication or other Government printed matter, prepared or produced with either appropriated or nonappropriated funds or identified with an activity of the Government, shall contain any advertisement inserted by or for any private individual, firm, or corporation; or contain material which implies in any manner that the Government endorses or favors any specific commercial product, commodity, or service.” -- (Title III--General

Provisions, 13. Advertisements, Commercial.)

3. Ensure that all materials do not contain any non-federal logos outside of the OPTN

(since contractor logos are a form of institutional advertising); that materials do not contain contact information for non-federal organizations outside of the OPTN or

OPTN affiliated individuals.

4. Ensure that all materials adhere to the prohibition against referring to lobbying in materials produced with appropriated funds.

6.5 Records Management Requirements

6.5.1. Records and Information Regulations Guidelines

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act

(FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

6.5.2. Records and Information Management

The Contractor shall manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the

Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate record keeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records

(https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA

Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing

Environments.

Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

6.5.3. Records Management Training

The contractor (and/or subcontractor) shall ensure that all employees having access to (1)

Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer

Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

6.6 Security and Privacy Requirements

I. Procurements Requiring Information Security and/or Physical Access Security http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor

(and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal

Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/HRSA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

▪ Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

▪ Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

▪ Availability, which means ensuring timely and reliable access to and use of information.

ii. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

iii. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/HRSA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the

CO/COR or HHS/HRSA security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor

FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally

Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as

"information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The

Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling

CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of

CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a

Contractor system operated on behalf of the agency, or NIST SP 800-

171, Protecting Controlled Unclassified Information in Nonfederal Information

Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any

HHS records may be made available or disclosed must be notified in writing by the

Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate. See

Appendix A for baseline deliverables.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS

140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and HRSA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information

(including PII).

iv. Verify that the encryption solutions in use have been validated under the

Cryptographic Module Validation Program to confirm compliance with current

FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

2. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of

Compromise (IOCs) provided by HHS Computer Security Incident Response Center

(CSIRC)/HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) within 24 hours, whether the response is positive or negative. In accordance with

FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally

Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally http://csrc.nist.gov/publications/ mailto:hrsacsirt@hrsa.gov identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information

(PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send HRSA approved notifications to affected individuals following specific instructions from the HHS Privacy

Incident Response Team (PIRT).

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Computer Security Incident Response Team

(hrsacsirt@hrsa.gov) or 301-443-3333, COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

▪ Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

▪ Not include any sensitive information in the subject or body of any reporting e-mail; and

▪ Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of

Personally Identifiable Information, and HHS and HRSA privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the

Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

3. Contract Initiation and Expiration mailto:hrsacsirt@hrsa.gov

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance

Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the

HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals

(specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation, including HRSA Disposition Plan to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with

NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or

COR and system ISSO within 14 days before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR.

Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or HRSA policies.

Appendix A: Deliverables

Policy

Section

Deliverable

Title/Description Due Date

Incident

Response

Incident Report (as incidents or breaches occur)

As soon as possible and without reasonable delay and no later than 1 hour of discovery

Incident

Response

Incident and Breach

Response Plan Upon request from government

Policy

Section

Deliverable

Title/Description Due Date

Incident

Response

• Incident reports (as needed)

• Incident

Response Plan

Incident Reports – must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer

Security Incident Response Center

(CSIRC)/HRSA Computer Security Incident Response

Team (hrsacsirt@hrsa.gov) within 24 hours

Report all suspected and confirmed information security and privacy incidents and breaches to the

HRSA Computer Security Incident Response Team as soon as possible and without unreasonable delay, no later than one (1) hour

Incident Response Plan – Upon request from government

6.7 Section 508 Requirements

The contractor shall ensure all products and services delivered under this contract are compliant with Section 508 in accordance with the Health and Human Services Acquisition

Regulation (HHSAR). These Section 508 Standards were issued by the United States

Access Board (https://www.access-board.gov/) and published in the Federal Register, on

January 18, 2017, as the final rule…