Attachment 1-IDIQ Statement of Work.pdf

Attachment 1 – Master IDIQ Statement of Work Evidence Reviews of Newborn Screening Genetic Conditions

MCHB IDIQ Solicitation #75R60226R00026

I. BACKGROUND

Newborn screening (NBS) is a critical public health program that enables early identification of infants affected by serious, life-threatening, or disabling conditions before the onset of clinical symptoms. The Health Resources and Services Administration/Maternal and Child Health Bureau (HRSA/MCHB) provides coordination, management, and operational services that support the maintenance of the Secretary of Health and Human Service’s Recommended Uniform Screening Panel (RUSP). The RUSP is a national guideline for newborn screening (NBS) that includes a list of conditions recommended for screening by the U.S. Secretary of Health and Human Services. The RUSP also serves as a guide for states to implement their newborn screening programs. Systematic evidence-based reviews are conducted for all nominated conditions considered for inclusion on the RUSP.

HRSA/MCHB provides support to a newborn screening stakeholder group that provides subject matter expertise, recommendations and technical information on the most appropriate application of technologies, policies, guidelines, and standards for: (a) effectively reducing morbidity and mortality in newborns and children having, or at risk for, heritable disorders; and (b) enhancing the ability of state and local health agencies to provide newborn and child screening, counseling, and health care services for newborns and children having, or at risk for, heritable disorders.

II. PURPOSE

This Indefinite-Delivery-Indefinite-Quantity (IDIQ) contract establishes a mechanism for HRSA/MCHB to efficiently commission systematic evidence reviews for nominated NBS genetic conditions on an as-needed basis over the IDIQ period of performance. Individual evidence reviews will be ordered through separately issued Task Orders (TOs) that define the specific condition(s), review scope, deliverables, timelines, and firm-fixed price for each review.

This vehicle ensures HRSA/MCHB has access to subject matter experts in heritable conditions, public health NBS programs, families and individuals identified with a condition via NBS, along with professional support for systematic evidence reviews without the delays of a condition-by-condition procurement.

III. PERIOD OF PERFORMANCE/PLACE OF PERFORMANCE

The contract shall include a 12-month Base Year and four 12-month Option Periods. The place of performance will be at the Contractor’s Office.

IV. TASKS:

The contractor shall have staff and/or expert consultants qualified and experienced in a range of specialty areas as described within this statement of work.

The contractor shall provide all personnel, materials, facilities, services, and equipment necessary for the performance of work as stated in individual task orders issued under this IDIQ Contract. The following describes the typical tasks that may be required of the contractor in the performance of task orders awarded. Task orders shall not necessarily reflect/include the entire set of task areas listed below, but shall specify the actual tasks to be performed along with the project-specific information required for completion of the task orders. Each request for task order proposal (RFTOP) will clearly specify the requirement areas for that given task order.

Task 1: Manual of Procedures (MOP) Development

1.1 Framework and Methodology Research (Rare Disease Focus)

• The Contractor shall synthesize best practices for evidence-based reviews in the context of rare genetic diseases, where randomized controlled trials (RCTs) are often lacking.

• Propose a methodological framework that outlines criteria for evaluating evidence derived from observational studies, natural history registries, and pilot screening programs. The framework must address standard newborn screening evaluation matrices (e.g., modified Wilson and Jungner criteria).

1.2 Draft Manual of Procedures (MOP)

• The Contractor shall draft the MOP. The manual must provide step-by-step instructions for personnel conducting the evidence reviews and include, at a minimum, the following sections:

o Topic Scoping and Protocol Development: Formulating specific key questions using frameworks appropriate for screening (e.g., Population, Test/Intervention, Comparator, Outcomes) focusing on asymptomatic newborns.

o Literature Search Strategy: Guidelines for searching standard medical databases (e.g., PubMed, Embase) as well as genetics-specific databases (e.g., OMIM, ClinVar) and strategies for capturing grey literature and state pilot study data.

• Screening and Selection: Procedures for identifying studies relevant to test accuracy (false positives/negatives), natural history of the genetic condition, treatment efficacy, and potential harms of screening (e.g., diagnostic odyssey, psychological impact on families).

• Data Extraction: Standardized templates for extracting data on multiplex screening modalities (e.g., tandem mass spectrometry, whole exome/genome sequencing), phenotype/genotype correlations, and long-term health outcomes.

• Quality Assessment/Risk of Bias: Tools for evaluating the methodological quality of diagnostic accuracy studies, case series, and registry data.

• Evidence Synthesis and Grading: Methods for synthesizing evidence on certainty and net benefit, specific to public health interventions and rare disorders.

• Public Health System Impact: Guidelines for outlining the requirements for state public health laboratories and follow-up programs to implement the screening.

The Contractor shall use the Final MOP to develop accompanying training materials to facilitate the implementation of the MOP among the evidence review teams and technical evaluation panels.

TASK 2: Conduct Evidence-based Reviews for Conditions Nominated for Inclusion on the

RUSP

The Contractor shall:

2.1 Conduct systematic, evidence-based reviews of rare conditions nominated for the Recommended Uniform Screening Panel (RUSP). The COR will assign the Contractor medical/genetic condition(s) to review. The evidence-based reviews will be considered when determining the recommendation of including the nominated conditions to the RUSP.

The evidence-based review shall include:

• An overarching framework and key questions;

• An analysis of the condition including the case definition and clinical history;

o Population characteristics, including age, birth prevalence, and genetic/biochemical subtype

• The corresponding newborn screening test(s), confirmatory test(s), and treatment(s);

o Screening test characteristics (sensitivity, specificity, positive predictive value, negative predictive value, false positive rate, cutoff values)

• Clinical outcomes (short- and long-term), including mortality, morbidity, developmental outcomes, and quality of life

• An analysis of the benefits and harms of newborn screening (including diagnosis and treatment) for the condition at a population level;

• Assessment of the impact and cost of State public health newborn screening programs' ability to implement screening of new conditions;

• Assessment of ethical considerations and values of the people and systems affected by changes to newborn screening;

• Health system and family/psychosocial impacts.

2.2 The Contractor shall assess the methodological quality and risk of bias of each included study using validated, condition- and study-design-appropriate tools.

2.3 Convene and manage a team of experts to provide objective input on the systematic evidence review including providing expertise on the overarching framework and key questions;

reviewing published and gray literatures; and abstracting data and weighing the quality and quantity of the data. The team of experts will also provide input into the assessment of the benefits and harms of screening for a condition at a population level as well as input on state public health newborn screening programs’ ability to implement the screening of a new condition and the cost implications of implementing population-based screening of the condition. The COR must approve all experts on the team.

• Prior to initiating substantive review activities, the Contractor shall conduct a conflict of interest screening for all personnel and SMEs involved in the evidence reviews.

• All personnel (including subcontractors) and SMEs must sign a non-disclosure agreement (NDA) to ensure all sensitive information regarding the evidence reviews remains confidential until the HRSA COR confirms public release.

• Promptly disclose to the HRSA COR any new COI that arises during the period of review.

2.4 Convene and manage a Technical Expert Panel of up to 10 subject matter experts (SMEs) that have expertise in the rare conditions that are under review. Provide a list for approval of the SMEs to the COR.

• Confidential screening and NDA requirements apply to the technical expert panel.

2.5 Develop draft and final reports of the evidence review.

2.6 Develop a consumer-friendly summary for the public at the 8th grade reading level of the evidence-based condition reviewed. The summary shall be a maximum of 12 pages.

TASK 3: Evidence Scans for Newborn Screening Conditions

The Contractor shall:

3.1 Develop a comprehensive scoping review protocol detailing the research questions, search strategy, inclusion/exclusion criteria, and data extraction framework. The protocol must be submitted to the HRSA Contracting Officer's Representative (COR) for approval prior to initiating the search.

3.2 Execute the approved literature search strategy across multiple electronic databases (e.g., PubMed, Embase, Cochrane Library). The literature search must include peer-reviewed literature and, if approved in the protocol, relevant grey literature.

3.3 Conduct title/abstract screening and subsequent full-text screening.

3.4 Chart and extract data from the final set of included studies. Extracted data should include study characteristics, screening methodologies, patient outcomes, and identified gaps in literature.

3.5 Synthesize the extracted data into a cohesive narrative report. The report must objectively map the available evidence without making definitive clinical recommendations.

TASK 4: Development of OMB Clearance Package

The Contractor shall provide the development of materials to obtain Office of Management and Budget (OMB) clearance under the Paperwork Reduction Act (PRA) of 1995 (44 U.S.C. Chapter 35). The Contractor shall be responsible for developing all necessary documentation for the Information Collection Request (ICR) package, drafting Federal Register Notices (FRNs), calculating public burden estimates, and assisting in responding to public comments and OMB passback questions.

4.1 Develop a comprehensive project management timeline that accounts for COR review, the

60-day public comment period, the 30-day public comment period, and the 60-day OMB review period.

4.2 The Contractor shall draft, format, and finalize all data collection instruments. This includes surveys, interview guides, focus group scripts, and web-based data entry screens.

4.3 The Contractor shall draft the OMB Supporting Statement Part A (Justification) and Part B (Statistical Methods, if applicable). The Contractor must conduct rigorous burden calculations (time and annualized cost to respondents).

4.4 The Contractor shall draft the 60-day and 30-day Federal Register Notices in accordance with HHS formatting guidelines. The notices must accurately reflect the purpose of the collection, the respondent groups, and the total estimated burden hours.

4.5 Following the publication of the 60-day and 30-day FRNs, the Contractor shall analyze all public comments received and draft proposed agency responses. During the OMB review phase, the Contractor shall assist the agency in drafting prompt and accurate responses to Office of Information and Regulatory Affairs (OIRA) desk officer passback questions.

TASK 5: Development of Request for Information (RFI) Package

5.1 Collaborate with COR and HRSA staff and clinical SMEs to draft Request for Information(s) (RFI). Identify the target industry audience (e.g., public health laboratories, pharmaceutical companies, clinical data registries, families and individuals with genetic conditions, etc.)

5.2 Monitor the RFI during the open period. Coordinate with COR and HRSA staff to draft accurate government responses to questions.

5.3 Synthesize all responses for specific conditions and provide a summary report with RFI data to include: the number of responses, types of respondents, etc.

5.4 Analyze responses and develop themes that will support the development of decision memos.

TASK 6: Conduct research, provide advice, convene discussions and meetings, produce reports, and make policy recommendations to HRSA/MCHB by providing expertise on the following: newborn screening for newborn and child medical/genetic conditions and associated clinical information, screening practices, treatment, public health impact, and evidence-based review processes.

6.1 For a topic, conduct research and analysis to provide information needed to inform the Committee’s discussions and development of recommendations. Activities shall include: identifying emerging issues, researching and analyzing relevant topic areas, facilitating and gathering expert opinions, identifying key questions and issues, identifying relevant experts and stakeholders, creating a methodology for acquiring information, and develop reports.

6.2 For a topic, convene a one-day meeting of up to 15 SMEs. Provide a list for approval of the SMEs to the COR. SMEs shall have expertise in the topic area as assigned in the task order.

6.3 For a topic, conduct a Technical Expert Panel of up to 10 SMEs. Provide a list for approval of the SMEs to the COR within 3 weeks of EDOC. SMEs shall have expertise in the topic area as assigned in the task order.

TASK 7: Scientific Writing and Journal Publication Support

7.1 Publication Plan and Glossary: A strategy document identifying target journals, key themes, target audiences, and a glossary of acronyms to ensure clarity.

7.2 Develop a detailed manuscript outline of the article including proposed headings, key findings to highlight, and necessary charts/graphs.

7.3 Complete first draft including abstract, introduction, methodology, results, discussion, and formatted references.

7.4 Revise final manuscript incorporating all Government feedback, ready for internal agency clearance.

7.5 Submit final manuscript to target journal, including cover letters and copyright transfer forms.

7.6 Draft responses to peer reviewers and revise manuscripts based on editorial feedback.

V. TASK ORDER REQUIREMENTS

Task orders awarded under this parent BPA contract shall include the following Contractor requirements, including the Section VI “IT Compliance Guidelines set forth below.

Project Management Workplan

• Include a project management work plan. The plan shall include:

ο Tasks, activities, milestones, deliverables, and communications strategies.

• Provisions for formal and informal written and oral communication with the Task Order COR on project progress.

• Status updates throughout the project period.

• Dates for submission of the monthly/quarterly progress reports.

• Risk identification, assessment, and mitigation strategies.

VI. IT Compliance Guidelines Task 1 - Federal Records Management

Task 1.1 - Records and Information Regulation Guidelines

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

Task 1.2 - Records and Information Management

The contractor shall manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate record keeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (https://www.ecfr.gov/current/title-36/section-1236.22);

NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

Task 1.3 - Records Management Training

The contractor (and/or subcontractor) shall ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this https://www.ecfr.gov/current/title-36/section-1236.22 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html contract, and thereafter completing the annual refresher course during the life of the contract.

The training is located at https://intranet.hhs.gov/sites/default/files/recordsmanagement/01_index.html. At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

Section 508

Section 508 requires that all external public facing content and non-public facing official agency communications be accessible. Regardless of format, all digital content or communications materials produced as deliverables under this contract must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities.

The contractor shall complete and submit the applicable HHS Section 508 Accessibility Complia nce Checklist per Section 508 deliverable. The checklist will serve as an artifact declaration of the Section 508 deliverable's compliance. Remediation of any Section 508 deliverables that do not comply with the applicable requirements as set forth below shall be the contractor's responsibility.

HHS guidance and checklists regarding accessibility of documents can be found at https://www.hhs.gov/web/section-508/accessibility-checklists/index.html.

VII. Use of Plain Language Guidelines and Other Government Laws and Regulations for all Products The Contractor shall:

• Follow the federal Plain Language Guidelines when developing products. The Plain Language Act of 2010 requires federal agencies to create communications that are clear and understandable to the public.

• Produce content that follows federal plain language guidelines. All text content must aim for a Flesch-Kinkaid Reading Ease score of at least 60. HRSA’s Office of Communications’ liaisons use Readable to review, update, and score content. Contractor shall work with the COR and program communications liaisons and use Readable to review, score and enhance the content.

• Use PlainLanguage.gov’s Checklist for Plain Language and HHS’s Plain Writing

Checklist as guidelines.

https://intranet.hhs.gov/sites/default/files/recordsmanagement/01_index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplainlanguage.gov%2Fguidelines%2F&data=05%7C02%7COCContractClearance%40hrsa.gov%7Ce016a8cf0cbb4ed9fef008dc8baf2062%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638538832893165203%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=920VmqYqrFyvFTrBYW%2FvDVE5fUmQKNTNMquLVI0mtYc%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Freadable.com%2Fblog%2Fthe-flesch-reading-ease-and-flesch-kincaid-grade-level%2F&data=05%7C02%7COCContractClearance%40hrsa.gov%7Ce016a8cf0cbb4ed9fef008dc8baf2062%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638538832893175987%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=5MkePO4PdBtTfMR1EMNDJTVdlGVn2f%2F1qyti3PPtH60%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Freadable.com%2F&data=05%7C02%7COCContractClearance%40hrsa.gov%7Ce016a8cf0cbb4ed9fef008dc8baf2062%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638538832893182358%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=Zinv1KJYLpfsoaNhB5Tsx7McNBqy1X2%2BbEJKpB0X%2B%2BY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.plainlanguage.gov%2Fresources%2Fchecklists%2Fchecklist%2F&data=05%7C02%7COCContractClearance%40hrsa.gov%7Ce016a8cf0cbb4ed9fef008dc8baf2062%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638538832893187985%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=as9m8%2FYoeVoW3QG6jkIj3DH9uPsLT0POeyGAZe0q4pw%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.hhs.gov%2Fweb%2Fbuilding-and-managing-websites%2Fmanaging-websites%2Fplain-writing-checklist%2Findex.html&data=05%7C02%7COCContractClearance%40hrsa.gov%7Ce016a8cf0cbb4ed9fef008dc8baf2062%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638538832893193772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=a1Cz7Athm%2BhZGQS8tWMBZxddc8l%2BoI2BbEXUJQxhcr8%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.hhs.gov%2Fweb%2Fbuilding-and-managing-websites%2Fmanaging-websites%2Fplain-writing-checklist%2Findex.html&data=05%7C02%7COCContractClearance%40hrsa.gov%7Ce016a8cf0cbb4ed9fef008dc8baf2062%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638538832893193772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=a1Cz7Athm%2BhZGQS8tWMBZxddc8l%2BoI2BbEXUJQxhcr8%3D&reserved=0

• Ensure that all materials adhere to federal copyright laws including the citation of sources in endnotes or footnotes; obtaining written permission to reproduce, reprint, or adapt existing materials used in the creation of materials under this contract; and including credits for images, which include photographs, pictures, illustrations, tables, charts, figures, and graphs.

• Ensure that all materials adhere to the Government Printing and Binding Regulations, including the prohibition on commercial advertising which says, “No Government publication or other Government printed matter, prepared or produced with either appropriated or non-appropriated funds or identified with an activity of the Government, shall contain any advertisement inserted by or for any private individual, firm, or corporation; or contain material which implies in any manner that the Government endorses or favors any specific commercial product, commodity, or service.” -- (Title III- -General Provisions, 13. Advertisements, Commercial.)

• Ensure that all materials do not contain any non-federal logos (since logos are a form of institutional advertising); that materials do not contain contact information for non-federal organizations, except the website address for informational purposes; and that all materials do not contain any contact information for individuals.

• Ensure that all materials do not contain the name of the contractor or subcontractors since this is also a form of advertising.

• Ensure that all materials adhere to the prohibition against referring to lobbying in materials produced with appropriated funds. The prohibition against lobbying also includes grassroots lobbying, which is advocating for a change in legislation at the federal, state, or community level.

Security Requirements Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity;

and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of mailto:fisma@hhs.gov

HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HRSA non-disclosure agreement at the Task Order Level, prior to performing work and prior to accessing any government information. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where

(1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), the Contractor (and/or any subcontractor) shall:

a. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

b. NOT notify affected individuals unless so instructed by the Contracting

Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Security Operations Center (SOC), COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

3) Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

3) Not include any sensitive information in the subject or body of any reporting e-mail; and

3) Encrypt sensitive information in attachments to email, media, etc.

c. Comply with OMB M-17-12, Preparing for and Responding to a Breach of

Personally Identifiable Information, HHS, and HRSA incident response policies when handling PII breaches.

d. Provide full access and cooperate on all activities as determined by the

Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HRSA EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

b. HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/pr oplans.html

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) shall notify the

CO and/or COR and system ISSO within 10 days before an employee stops working under this contract.

Personnel Security Requirements

Background Investigation Requirements

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

Position Sensitivity Designations

The following position sensitivity designation levels apply to this solicitation/contract:

• non sensitive, moderate risk public trust Tier 2 investigation

• non sensitive, high risk public trust Tier 4 investigation (this level applies when elevated rights are needed for system access.)

RESIDENCY REQUIREMENTS FOR FOREIGN NATIONALS

https://www.hhs.gov/ocio/ea/documents/proplans.html https://www.hhs.gov/ocio/ea/documents/proplans.html

Under the requirements for fitness for duty as described in EO 13467 and in conjunction with Homeland Security Presidential Directive-12 (HSPD-12), OPM can complete a background investigation only for persons who have resided in the U.S. for a total of at least three (3) of the past five (5) years. The residency requirements apply only to foreign nationals. If any prospective foreign national contractor/subcontractor employee does not meet the residency requirements, Please do not send their name forward as a potential team member.

BACKGROUND INVESTIGATIONS

The Contractor shall advise its prospective employees about the background investigation requirements stated herein.

If a Contractor employee changes job responsibilities under this contract, the Contractor shall notify the COR, and the Government will make a determination whether an upgraded investigation is required.

In the event there are any proposed personnel changes in the Contractor’s staffing roster previously submitted to the COR, the Contractor shall submit an updated roster to the COR, along with a brief explanation for the change. In turn, the COR will initiate the procedures stated herein to ensure any new contractor employees completes the investigation process up to and including if needed, obtain a PIV card in a timely manner

– prior to that individual commencing work under the contract.

For any individual who is cleared to start work but upon completion of the investigative process does not obtain a favorable background investigation he/she shall cease work on the contract immediately.

With the exception of costs associated with fingerprinting Contractor employees outside of the HRSA Personnel Security Office, the Government will conduct all required background investigations at no cost to the Contractor. The cost of fingerprinting Contractor employees at any location other than the HRSA Personnel Security Office will be borne by the Contractor. Every effort will be made to schedule contractors at a location that will not charge a fee for the fingerprints. Contractors who hold or have previously held a Government security clearance shall advise the HRSA Personnel Security Staff of the details of such clearance.

During a fingerprint appointment, each contractor employee must present two (2) forms of identification as part of the identity proofing process. One form of identification must be a State or federal government-issued photo identification document. Acceptable forms of identification are listed below.

List of acceptable documents for Identity Proofing one of which must be:

• Drivers License or ID card that is compliant with REAL-ID requirement

• US Passport or Passport Card

• Permanent Resident Card or Alien Registration Receipt Card (Form I-551)

• Employment Authorization Document that contains a photograph (Form I-766)

• US Military ID Card

• US Military dependents ID card

• PIV Card

Second form of ID can be one of the following:

• ID card issued by a federal, state, or local government agency or entity, provided that it contains a photograph

• voter’s registration card

• S. Coast Guard Merchant Mariner Card

• Certificate of U.S. Citizenship (Form N-560 or N-561)

• Certificate of Naturalization (Form N-550 or N-570)

• S. Citizen ID Card (Form I-197)

• Identification Card for Use of Resident Citizen in the United States (Form I-179)

• Certification of Birth Abroad or Certification of Report of Birth issued by the

Department of State (Form FS-545 or Form DS-1350)

• Reentry Permit (Form I-327)

• Employment authorization document issued by the Department of Homeland

Security (DHS)

• driver’s license issued by a Canadian government entity

• Native American tribal document

• S. Social Security Card issued by the Social Security Administration

• original or certified copy of a birth certificate issued by a state, county, municipal authority, possession, or outlying possession of the United States bearing an official seal (if name is now different you must also provide the legal document that changed the name)

An individual who receives an unfavorable report may appeal that finding by submitting a written request to the DSS at ps-updates@hrsa.gov

Background investigations will be conducted by the Defense, Counter Intelligence and Security Administration (DCSA)

PERSONAL IDENTITY VERIFICATION (PIV) CARDS

mailto:ps-updates@hrsa.gov

All Contractor employees (including subcontractors) must possess a PIV card that was issued based on a current background investigation that resulted in a favorable determination where one of the following applies:

• Will be working in HHS-owned or leased space (PIV card required)

• will have access to HHS equipment or systems (PIV card required)

All PIV cards shall remain the property of the Federal Government. At any time, if a Contractor employee is terminated or otherwise ceases work under the contract, or no longer requires a PIV Card for contract performance purposes, the Contractor shall collect the individual’s PIV card and immediately notify HRSA Personnel Security Staff in writing by submitting an email to ps-updates@hrsa.gov , with copies to the respective COR and Contracting Officer. The Contractor shall immediately return the PIV Card(s) to the COR who will immediately return them to the Division of Security Services.

Like PIV Cards, other Government-issued Access Cards are Government property, Contractors and Contractor Employees are hereby placed on notice that any abuse, destruction, defacement, unauthorized transfer or withholding (i.e., failure to return to the Government) may be punishable to the greatest extent of the law.

Unauthorized possession of a PIV Card, or any other type of Government-issued Access Card, and/or willfully allowing any other person to have or to use your Access Card, is prohibited and can be criminally prosecuted under 18 U.S.C. §§ 499 and 70I, which prohibit photographing or otherwise reproducing or possessing HHS identification cards in an unauthorized manner, under penalty of fine, imprisonment, or both. Wrongdoers may also be held financially responsible for any/all civil and equitable remedies – to include, but not limited to, damages for any pecuniary loss suffered by the Government as a result of any of the above-listed actions or failure to act.

mailto:ps-updates@hrsa.gov

Security Requirements