Attach A - SOW_final 6.6..2024.pdf

Section J Attachment A

Attachment A Statement of Work (SOW)

Title: Teaching Health Center Graduate Medical Education Technical Assistance Center (THCGME TAC)

Date: June 6, 2024

I. BACKGROUND

The Teaching Health Center Graduate Medical Education (THCGME) Program, Section 340H of the Public Health Service (PHS) Act, was established by Section 5508 of Public Law 111–148. Public Law 117-2, the American Rescue Plan Act of 2021 (ARP), provided additional funding for the THCGME Program. The THCGME Program promotes training for primary care residents (including residents in family medicine (FM), internal medicine (IM), pediatrics (Peds), internal medicine pediatrics (Med-Peds), obstetrics and gynecology (OB/GYN), psychiatry (Psych), general dentistry, pediatric dentistry, and geriatrics) in community based ambulatory patient care settings. Graduate Medical Education (GME) follows graduation from medical and dental school and can take between three and seven years to complete, depending on the medical or dental specialty track chosen.

The Teaching Health Center Planning and Development (THCPD) Program is authorized by Section 749A of the Public Health Service Act (42 U.S.C. 293l-1) and funded by Section 2604 of the American Rescue Plan Act of 2021 (P.L. 117-2). The purpose of this grant program is to make awards to establish new accredited community-based primary care medical or dental residency programs and residency programs in FM, IM, Peds, Med-peds, OB/GYN, Psych, General Dentistry, Pediatric Dentistry, or Geriatrics to address shortages in the primary care physician and dental workforce shortages and challenges faced by in rural and underserved communities. This program aims to increase primary care physician and dental residency training in community-based patient care settings by providing funds to support the development of new programs in these settings, which are often located in underserved areas where resources may not be easily attainable.

The proposed contract will support: 1) the eighty-one (81) THCGME grantees (training nearly 1,100 FTEs in 2023) facing accreditation maintenance and renewal challenges; and 2) the THCs from the pool of nearly 1,400 HRSA-funded (non-THCPD) community health centers considering or in the process of developing residency programs. The large number of THCGME and HRSA-funded (non-THCPD) grantees necessitates a technical assistance center that can provide services across the scope of these grantees and the numerous specialties they encompass.

II. PURPOSE

The purpose of this requirement is to be complementary to the THCGME Program supporting the expansion and maintenance of THCGME funded community-based ambulatory residency training programs and subsequently increase the number of physicians and dentists choosing to practice in rural and medically underserved areas. HRSA previously entered into a cooperative agreement to provide a technical assistance center to specifically support the THCPD grantees, but currently there is not a technical assistance center that targets THCGME grantees and their unique needs. The THCGME Technical Assistance Center contract is intended to provide support to the THCGME grantees and address the accreditation challenges experienced by the teaching health centers participating in the THCGME Program.

The THCGME TAC will help to ensure that THCGME recipients have access to sources of information and expertise in all areas of residency development and operations. Assistance may be provided in stabilizing and strengthening operations as well as potentially developing additional FTE training slots and/or additional residencies in new specialties within a THCGME institution. Funding a central technical assistance provider to give direct support and facilitate peer learning between the THCGME recipients improves the efficiency of the THCGME Programs and prevents duplicative efforts and burden on the part of the recipients seeking individual support to achieve their program goals.

III. PERIOD OF PERFORMANCE/ PLACE OF PERFORMANCE

The period of performance shall be one (1) 12-month base period plus two (2) 12-month option periods.

The primary place of performance shall be off-site at the Contractor’s facility. Performance shall also be required at the teaching health centers.

IV. TASKS

Task 1. Federal Records Management

Task 1.1. Records and Information Regulation Guidelines

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of

44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

Task 1.2. Records and Information Management

The contractor shall manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate record keeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (https://www.ecfr.gov/current/title-36/section-1236.22);

NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

Task 1.3. Records Management Training

The contractor (and/or subcontractor) shall ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract.

The training is located at https://humancapital.learning.hhs.gov/courses/2023recordsmanagement/01_index.html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing because of staffing changes shall be submitted with next required progress report.

Task 2. Kickoff Meeting

The Contractor shall:

Task 2.1. Meet with the Contracting Officer Representative (COR) via HRSA approved web-based meeting platform (such as Microsoft Teams) no later than three (3) business days following the Effective Date of Contract (EDOC).

Task 2.2. Provide a written agenda for the kickoff meeting via email to the COR no later than two (2) business days following the EDOC. The agenda shall include the following:

Project Plan and Management including the following items:

o The THCGME Technical Assistance Center, o The All-Grantee Meeting, o The key personnel in charge of project, o The names of various contract personnel (staffing), and o Time frame for accomplishing the activities.

Reporting requirements, including format of deliverables and submission dates;

Review of timelines;

Plan for Contractor coordination and communications with the COR; and Any questions from the Contractor.

Task 2.3. Provide written minutes of the kickoff meeting with a summary of the topics discussed and the action items for both the Contractor and the COR via email to the COR no later than three (3) business days following the kickoff meeting.

Task 3. Teaching Health Center Graduate Medical Education Technical Assistance Center

(THCGME TAC)

The Contractor shall establish the HRSA-sponsored Teaching Health Center Graduate Medical Education Technical Assistance Center (THCGME TAC) and engage in any necessary preparatory activities to begin and continue operations of the THCGME TAC, including THCGME-TAC website development and portal management, technical assistance (TA) products and tools, and convening meetings with any key stakeholders and consortium members.

Task 3.1. Teaching Health Center (THC) Community of Practice.

Task 3.1.1. Implement routine consortium meetings with THC partners and key stakeholders;

establish communication structures with HRSA staff via email and through quarterly (every three months) meetings; and facilitate participation of and engagement with THCGME grantees.

Task 3.1.2. Hire content experts and advisors required to provide sufficient GME knowledge and community-based residency training expertise on a quarterly and ongoing basis during each period of performance.

Task 3.1.3. Plan and hold two (2) consortium meetings with HRSA staff and THC community of practice on a quarterly basis during each period of performance.

Task 3.1.4. Draft and send a meeting written agenda via email to the COR no later than seven

(7) calendar days prior to the meeting during each period of performance.

Task 3.1.5. Incorporate the COR’s comments and submit a final written meeting agenda via email to the COR via email no later than five (5) calendar days prior to the meeting during each period of performance.

Task 3.1.6. Send the final meeting agenda to HRSA, THCGME grantees, THC partners and stakeholders as determined by the COR no later than three (3) business days prior to the meeting during each period of performance.

Task 3.1.7. Record and send meeting minutes to HRSA, THCGME grantees, THC partners and stakeholders as determined by the COR no later than five (5) business days following the meeting during each period of performance.

Task 3.1.8. Develop all agendas, minutes and meeting materials in consultation with the COR, and all copies must be approved by HRSA prior to dissemination.

Task 3.2. THCGME TAC Resources

The Contractor shall:

Task 3.2.1. Assess and adapt Rural Residency Planning and Development (RRPD) Technical Assistance Center online portal, Models for THC Residency Program Development, readiness assessments, and THCGME website resources for THGME TAC content and accreditation milestones across all specialties.

Task 3.2.2. Promote the community-based workforce pipeline by supporting the development of new community-based residency programs in FM, IM, Peds, Med-peds, OB/GYN, Psych, General Dentistry, Pediatric Dentistry, and Geriatrics.

Task 3.2.3. Develop and host an online THCGME TAC website for grantees and the public, containing the online Medical and Dental portals, Residency Development models, quarterly assessments, and resources for THCGME TAC online content, including accreditation milestones across specialties.

The THCGME TAC website shall be hosted outside the HRSA environment and subject to similar security and documentation requirements for federal websites as outlined in this SOW.

Task 3.2.4. Collect, identify, and catalog resources for the THCGME TAC website.

Task 3.2.5. Provide monthly updates to the THCGME TAC website that will educate users on program impact and research and provide resources for the non-THCGME THCs, a list of services provided by the TAC, and a list of personnel and stakeholders of the TAC.

Task 3.2.6. Establish and maintain an email account, THCGME listservs for THCGME grantees, an X account (formerly Twitter), and other social media accounts to support the THCGME grantees .

Task 3.2.7. Track usage of the THCGME TAC website to ensure the resources available are those areas most requested by grantees, which is demonstrated by the cumulative number of clicks across the lifespan of the website and provide a detailed written summary of the website usage via email to the COR in a format approved by the COR on a quarterly basis during each period of performance.

Task 3.2.8. Update the THCGME TAC website with resources such as webinars (using Zoom, Microsoft Teams or other video conferencing platform approved by HRSA), articles, sample documents, and other tools.

Task 3.2.9. Add twenty-five (25) resources to the THCGME TAC website on an ongoing basis during each quarter during each period of performance. The website shall be sorted by resource type, section, and specialty, such as the following:

Webinars/presentations Articles/white papers Resource collections/websites Courses/conferences/curricula, and Rules/regulations.

Task 3.3. Targeted Technical Assistance

Task 3.3.1. Offer tailored TA through various mechanisms to meet individual THCGME grantee needs, and to support THCGME Program grantees’ efforts to establish and maintain community-based residency programs to achieve accreditation by the ACGME or CODA.

Task 3.3.2. Provide TA by utilizing THC content experts in a variety of specialties and the dissemination of information and resources via the All-Grantee Meeting content development, webinars (using Zoom, Microsoft Teams or other video conferencing platform. approved by HRSA), workshops, the THCGME TAC website, the THCGME portal, and THCGME social media platforms.

Task 3.3.3. Assess THCGME grantee needs to identify individuals and organizations with the necessary content expertise to best meet diverse THCGME grantee requests for guidance and support on an ongoing basis during each period of performance; and use lessons learned to enhance the collaborative learning experience while also collecting resources that will increase knowledge in the community-based GME field.

Task 3.3.4. Use available Models for THC residency program development to help new and existing grantees progress through the five stages of program development toward the goal of implementing an accredited and financially sustainable program: exploration, design, development, start-up, and maintenance. Each stage shall contain multiple goals, each with specific objectives.

Task 3.3.5. Match each grantee with an advisor who mentors them providing guidance throughout the process and provides feedback in quarterly assessments. The advisor and grantee meet quarterly to create a custom workplan identifying potential barriers and solutions to implementation, while also establishing a list of resources needed and grantee next steps.

Task 3.3.6. Make available consultative services for more in-depth TA as jointly determined by the grantees and advisors, and provide assistance with topics such as: Sponsoring Institution accreditation, ACGME accreditation, CODA accreditation, consortium development, ACGME site visits, resident and faculty recruitment, development and financing.

Task 3.3.7. Generate a program readiness score from quarterly assessment responses, which shall represent the number of completed objectives over the sum of all objectives and indicates where a program is in the stages of development toward graduated status.

Task 3.3.8. Provide a detailed written summary of the program readiness score via email to the COR in a format determined by the COR on a quarterly basis.

Task 3.4. Learning and Collaboration

Task 3.4.1. Develop a community of practice for HRSA grantees to connect with and learn from existing Teaching Health Centers.

Task 3.4.2. Maintain the community of practice to promote connectivity and dissemination of best practices to develop a community of support for grantees and facilitate cross-pollination of new and existing community-based residency programs.

Task 3.4.3. Consult with the COR when scheduling any meetings that pertain to the scope of work and at which the COR’s attendance would be appropriate (as determined by the COR).

Task 3.4.4. Offer webinars (using Zoom, Microsoft Teams or other video conferencing platform approved by HRSA), for THCGME grantees and other THCs interested in starting and/or maintaining residency programs monthly during each period of performance. The content of the webinars shall be developed based on grantee requests as approved by the COR.

Task 3.4.5. Record webinars and make the recordings available on the THCGME TAC website monthly during each period of performance.

Task 3.4.6. Collect evaluation data on each webinar to get feedback on the content provided, desired educational topics and program suggestions.

Task 3.4.7. Provide a summary of the monthly webinar attendee feedback to the COR no later than ten (10) business days following each webinar during each period of performance.

Task 4. Sustainable Funding Sources.

The Contractor shall assist THCs with identifying, qualifying for, and securing (as applicable) sustainable pathways of funding such as the Department of Veterans Affairs, state, or private GME funding.

Task 4.1. Assist HRSA BHW in collecting and reviewing grantee sustainability plans developed with advisor assistance. As accreditation is necessary for THCGME funding eligibility, much of the individualized assistance and consultative services focus on accreditation support.

Task 4.2. Supply grantees with updated timelines of ACGME committee review dates to ensure timely progress in meeting accreditation milestones on an ongoing basis during each period of performance.

Task 4.3. Plan, develop, and facilitate three (3) webinars (using Zoom, Microsoft Teams or other video conferencing platform approved by HRSA), quarterly during each period of performance pertaining to financing and including topics such as program agreements, the importance of why a Federally Qualified Health Center should become a Teaching Health Center, and state initiatives.

Task 5. THCGME Program Outcomes

Task 5.1. Gather, assess, and disseminate THCGME knowledge to improve the services provided by the THCGME TAC, track outcomes of the THCGME program, and disseminate findings to inform GME policy. The content and format of the analyses provided by the Contractor will be determined by the COR.

Task 5.1.1. Respond to ten (10) questions/requests from HRSA, HRSA grantees, and key stakeholders and partners on a quarterly basis during each period of performance.

Task 5.1.2. Monitor the THCGME inbox once daily to view and prioritize requests, route them to the appropriate expert, those individuals with ten (10) years or more experience in community-based GME residency training and ensure that responses are communicated promptly. Examples of potential requests to be developed include:

Update of cumulative THCGME match results file to include current year match results.

Fact sheet distributed to grantees and posted on THCGME TAC website describing the accomplishments of the THCGME grantees.

Overview of THCGME program grantee progress and projections on the number of residents in training.

Analysis of rural training occurring at current academic year THCGME residency programs.

Participation in community-based residency training interest group meetings.

Task 5.1.3. Draft a written response to questions/requests and submit via email to the COR no later than two (2) business days following receipt of questions/requests.

Task 5.1.4. Incorporate the COR’s comments and submit a final written response via email to the COR no later than two (2) business days following receipt of comments.

Task 5.1.5. Disseminate the final response to the HRSA, HRSA grantees, and key stakeholders and partners as determined by the COR no later than one (1) business days following approval by the COR.

Task 5.2. Analyze the overall impact of the THCGME TAC and THCGME program activities and funding on rural and underserved communities in consultation with COR.

The Contractor shall:

Task 5.2.1. Review the evaluation framework guidance provided by HRSA, ACGME and other resources available.

Task 5.2.2. Develop an initial evaluation framework to analyze the overall impact no later than ninety (90) calendar days from the EDOC.

Task 5.2.3. Incorporate the COR’s comments and submit a final written evaluation framework via email to the COR no later than five (5) business days following receipt of comments.

Task 5.2.4. Implement the final evaluation framework to analyze the overall impact and inform the annual report task within this SOW no later than two (2) business days following approval by the COR.

Task 5.2.5. Provide a written annual report summarizing contract activities, relevant policy issues, THCGME and THCGME TAC impact analysis, as well as any other relevant subject matter no later than thirty (30) calendar days prior to the end of each period of performance. Specific content and format of the report will be determined by the COR.

Task 5.2.6. Incorporate the COR’s comments and submit a final written annual report for approval via email to the COR no later than five (5) business days following receipt of comments.

Task 6. Websites and Materials Requirements

The Contractor shall ensure any report or document that may be posted on the THCGME TAC website is written in a format that indicates the document is a HRSA publication to include HRSA branding with the THCGME TAC website, portals and materials developed.

All websites, data, materials, reports, briefings, and other documents developed under this contract, whether finished or not, shall become the property of HRSA.

Task 7. Progress Reports and Conference Calls

Task 7.1. Detailed Monthly Reports

The Contractor shall submit progress reports containing information on activities carried out during the month, problem(s) encountered and their solutions, and hours of labor and expenditures by task. Details of cost reports reviewed shall be included in these reports.

The Contractor shall:

Task 7.1.1. Submit written progress reports via email to the COR no later than seven (7) calendar days from the beginning of the month for activities performed during the prior month.

Task 7.1.2. Respond to six (6) requests on a quarterly basis from the COR to prepare written responses no later than three (3) business days following receipt of request on activities pertaining to the contract.

Task 7.2. Reporting of Issues

The Contractor shall advise the COR, via email, of any matters coming to its attention during the performance of tasks, which may: 1) delay completion of contract tasks; 2) increase estimated costs; and/or 3) challenges/issues potentially impeding accreditation for any of the THCs no later than two (2) business days from when the issue is identified.

Task 7.3. Monthly Calls

The Contractor shall hold monthly calls with the COR throughout the contract year, to discuss any issues related to the contract tasks and include in these discussions detailed descriptions of the challenges and/or conflicts experienced with any of the teaching health centers, as well as the proposed resolutions and planned next steps.

The Contractor shall:

Task 7.3.1. Provide a written agenda for each monthly call with an outline of the topics to be discussed via email to the COR no later than two (2) business days prior to the subject monthly call during each period of performance.

Task 7.3.2. Provide written minutes of each monthly call with a summary of the topics discussed and the action items for both the Contractor and the COR via email to the COR no later than five

(5) business days following the subject monthly call during each period of performance.

Task 8. Use of Plain Language Guidelines and Other Government Laws and Regulations for all Products

The Contractor shall:

Task 8.1. Follow the federal Plain Language Guidelines when developing products. The Plain Language Act of 2010 requires federal agencies to create communications that are clear and understandable to the public.

Task 8.2. Produce content that follows federal plain language guidelines. All text content must aim for a Flesch-Kinkaid Reading Ease score of at least 60. HRSA’s Office of Communications’ liaisons use Readable to review, update, and score content. Contractor shall work with the COR and program communications liaisons and use Readable to review, score and enhance the content.

Task 8.3. Use PlainLanguage.gov’s Checklist for Plain Language and HHS’s Plain Writing Checklist as guidelines.

Task 8.4. Ensure that all materials adhere to federal copyright laws including the citation of sources in endnotes or footnotes; obtaining written permission to reproduce, reprint, or adapt existing materials used in the creation of materials under this contract; and including credits for images, which include photographs, pictures, illustrations, tables, charts, figures, and graphs.

Task 8.5. Ensure that all materials adhere to the Government Printing and Binding Regulations, including the prohibition on commercial advertising which says, “No Government publication or other Government printed matter, prepared or produced with either appropriated or non-appropriated funds or identified with an activity of the Government, shall contain any advertisement inserted by or for any private individual, firm, or corporation; or contain material which implies in any manner that the Government endorses or favors any specific commercial product, commodity, or service.” - (Title III-General Provisions, 13. Advertisements, Commercial.)

Task 8.6. Ensure that all materials do not contain any non-federal logos (since logos are a form of institutional advertising); that materials do not contain contact information for non-federal organizations, except the website address for informational purposes; and that all materials do not contain any contact information for individuals.

Task 8.7. Ensure that all materials do not contain the name of the contractor or subcontractors since this is also a form of advertising.

Task 8.8. Ensure that all materials adhere to the prohibition against referring to lobbying in materials produced with appropriated funds. The prohibition against lobbying also includes grassroots lobbying, which is advocating for a change in legislation at the federal, state, or community level.

Task 9: HHS Policy for Information Technology Procurements - Security and Privacy Language

I. Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/HRSA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/HRSA and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, HRSA Senior Official for Privacy (SOP), or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [ ] Low [X ] Moderate [ ] High Integrity: [ ] Low [ X ] Moderate [ ] High Availability: [ ] Low [X ] Moderate [ ] High Overall Impact Level: [ ] Low [ X ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/HRSA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/HRSA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/HRSA security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

Note to the Requiring Activity Representative: This information may be included after award in the event it is not yet available at the time of acquisition. Section d must be included in all contracts regardless of whether or not personally identifiable information (PII) is involved.

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 60 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and HRSA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation electronically to the COR.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided electronically to the COR upon request and at the conclusion of the contract.

m. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the HRSA non-disclosure agreement.

Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract and have access to HRSA’s network must complete the applicable HHS/HRSA Cybersecurity Awareness Training training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete HHS/HRSA Cybersecurity Awareness Training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete Role-Based Training for IT Admin annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior (included in the HHS/HRSA Cybersecurity Awareness Training), and any applicable system-level rules of behavior.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HHS/HRSA Cybersecurity Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of

Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the

NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send HRSA approved notifications to affected individuals following specific instructions from the HHS Privacy Incident Response Team (PIRT).

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) or 301-443-3333, COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS and HRSA privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

5. Position Sensitivity Designations All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

Sensitivity Level

Risk Level Level of Investigation per Federal Investigative Standards (2012)

Level of Investigation per 2022 Federal Personnel Vetting Investigative Standards

Form

Non-Sensitive Moderate Risk Tier 2 Moderate Tier SF 85P

6. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

Note to the Requiring Activity Representative: For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

7. Roster

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted electronically to the COR and/or CO within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation, including HRSA Disposition Plan to the CO and/or COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or COR and system ISSO within 14 days before an employee stops working under this contract.

e.…