Attachment 1 - IDIQ Statement of Work (SOW).pdf

The CBER Biologics Effectiveness and Safety (BEST) Initiative #3: Data Sources for Surveillance of Biologics (BEST 3)

Solicitation Number: FDA-SOL-1224068

Statement of Work (SOW)

March 29, 2020

Table of Contents 1 Introduction

1.1 Background

1.2 Biologics Effectiveness and Safety (BEST) Objectives and Scope

1.3 Objectives

1.4 Scope

2. Tasks Description

2.1 Task 1: Data sources and Medical Records

2.1.1 Data Sources

2.1.2 Analytic Capabilities (Optional)

2.1.3 Medical Records

2.2 Task 2: Operations and Management

2.2.1 Task Order Management Plan

2.2.2 Establish Project-Specific Statement of Work and Procedures

2.2.3 Organization and Management Procedures

2.2.4 Risk Management

2.3 Task 3: Communications and Outreach

2.3.1 Annual in-Person Meeting

2.3.2 Annual Public Workshop

2.3.3 Publications

2.3.4 Secure Portal

2.4 Task 4: Transition Services

2.4.1 Transition-In

2.4.2 Transition-out

2.5. Representative Deliverables & Meetings

2.5.1 Delivery Instructions for Deliverables

3. Contract Constraints

3.1 Security and Privacy

3.1.1 Baseline Security Requirements

4. Other Requirements

4.1. Key Personnel

4.2. Government Furnished Information (GFI)/ Government Furnished Equipment (GFE)

4.3. Travel

4.4. Administrative

4.4.1 Period of Performance

4.4.2 Place of Performance

4.4.3 Government Points of Contact (POCs)

5. Labor Category Descriptions

1 INTRODUCTION

1.1 BACKGROUND

The U.S. Food and Drug Administration (FDA) is responsible for protecting the public health by assuring the safety, efficacy, and security of human and veterinary drugs, biologic products, medical devices, tobacco products, our nation’s food and blood supply, cosmetics and products that emit radiation. The FDA is also responsible for advancing the public health by helping to speed innovations that make medicines, devices, and foods more effective, safer, and more affordable; and helping the public get the accurate, science-based information they need to use medicines and foods to improve their health. As part of its mission, the FDA conducts monitoring of the safety of regulated products.

The Center for Biologics Evaluation and Research (CBER) regulates biologics which include vaccines, whole blood and blood components, blood-derived products, tissues and advanced therapeutics. Some examples of blood products include plasma-derived products such as immunoglobulins, coagulation products, fibrinogen concentrate, and fibrin sealants. Some of the products in the category of tissues and advanced therapeutics include acellular dermal matrix allografts, cornea transplants, allograft heart valves and cardiac conduits, amniotic membrane transplants, cellular therapies, and fertility-related donations such as oocytes and sperms.

Some examples of potential adverse events associated with childhood vaccines include fever, rash, febrile seizure. Some examples of potential adverse events associated with exposure to blood components include: transfusion-related acute lung injury (TRALI), septicemia, sepsis, acute infection following transfusion (AIFT), transfusion-associated circulatory overload (TACO), transfusion-associated graft versus host disease (TA-GvHD), hemolysis, and febrile non-hemolytic transfusion reaction (FNHTR).

Some examples of potential adverse events associated with exposure to blood products, tissues, and advanced therapeutics include: thrombosis (arterial, venous), hemolysis, sepsis, post-transplant infection or disease transmission (all potential transplantation transmitted diseases: HIV, HCV, CMV, Chagas, West Nile Virus, Lymphocytic Choriomeningitis Virus (LCMV), Rabies, Tuberculosis, Babesiosis, Zygomycosis, Coccidiodomycosis, multi-drug resistant E. coli, Balamuthia mandrillaris, Microsporidiosis, Zika), allograft removal, inhibitor development, and hypersensitivity reactions.

The FDA Amendments Act of 2007 (FDAAA 2007) included a provision for the building of an active postmarket risk identification and analysis system. In 2008, the FDA established the Sentinel Initiative and built a national electronic data system for monitoring the safety of FDA-regulated medical products. Mini- Sentinel and then Sentinel were established as a distributed database network consisting of numerous data partners who retain operational control over their data; a coordinating center run by the Harvard Pilgrim Health Care Institute (HPHCI) manages, receives, and processes FDA questions and returns summary results back to the FDA. The Center for Drug Evaluation and Research (CDER) leads the FDA Sentinel program and both CDER the Center for Biologics Evaluation and Research (CBER) use the Sentinel System to conduct surveillance and epidemiological studies.

CBER also conducts surveillance and epidemiological studies outside of the Sentinel System working collaboratively with federal partners such as the Centers for Medicare and Medicaid Services (CMS) and Veterans Health Administration and. private sector partners as well. In September 2017, CBER launched the Biologics Effectiveness and Safety (BEST) initiative and has awarded four contracts to support the effort including two recent five-year Indefinite Deliverables Indefinite Quantities (IDIQ) contracts to Acumen, IQVIA, IBM, and Dovel Technologies.

Because of limitations in administrative claims data obtained through previous contracts, this solicitation is specifically focused on obtaining new administrative claims data partners or claims and electronic health record (EHR) data sources that have access to full medical charts for tens of millions of patients. This contracting activity is part of CBER’s continuing efforts to develop the data sources and expanded infrastructure that it needs to fulfill its mandated regulatory responsibilities to conduct active postmarket risk identification and analysis, safety and effectiveness surveillance of biologic products. Specifically, we seek access to large sources of patient-centered data, especially administrative claims data that includes inpatient, outpatient, and emergency department settings with the additional requirement to obtain access to full medical charts of the patients whose claims data are provided by the data network. The contractor may conduct the proposed FDA work under a number of possible organizational structures and arrangements. The contractor(s) should be a primary source of medical administrative claims data such as an insurer or payer and may have their own team of epidemiologists, subject matter experts, programmers, and others who are experienced in conducting safety and effectiveness studies for drugs and biologics.

Alternatively, the contractor(s) may work with other organizations to manage and conduct the work.

1.2 BIOLOGICS EFFECTIVENESS AND SAFETY (BEST) OBJECTIVES AND SCOPE

The primary goal of this Contract is to obtain new data sources including administrative claims data or claims and EHR data with access to complete medical chart information, provided directly from primary sources such as an insurer, payer or provider. The FDA’s current access to this type of data is extremely limited. Access to new, larger amounts of these data for tens of millions of patients will enable CBER to better meet its mandated mission to conduct active surveillance of biologic products that ensure the safety and effectiveness of biologic products including vaccines, blood and blood products, tissues and advanced therapeutics. This contract builds and expands upon activities undertaken as part of previous FDA collaborative studies for biologic product safety and effectiveness, such as the Sentinel system, awarded to the HPHCI; and BEST, awarded to Acumen, IQVIA, IBM, and Dovel Technologies.

1.3 OBJECTIVES

The objectives of this contract are:

1. To provide FDA with distributed-type access to large-scale, United States (US) health care data covering tens of millions of patients.

2. To provide adjudicated administrative claims data but data sources may also include EHR using a distributed data network which may use a common data model (CDM) (potentially OMOP CDM). The data sources shall provide longitudinal health care data for participating patients.

3. To be a provider and primary source of the data such as a health insurer, payer, or provider.

4. To provide FDA with access to full medical charts of patients whose health care data are available for review, abstraction, and adjudication in the context of biologic products surveillance activities.

1.4 SCOPE

The Contractor shall, independently and not as an agent of the Government, provide all necessary resources and personnel to expand on the CBER BEST program for the postmarket safety and effectiveness surveillance of all biologic products. The scope of this program is the following:

1. The data sources shall provide health care data covering exposure to all US biologic products particularly vaccines, blood products, tissues and advanced therapeutics.

2. Processes to provide access to full medical charts of all patients stripped of any individual identifiers for review, abstraction, and adjudication in the context of surveillance activities.

3. Support for the CDM (if utilized) to accommodate granular clinical data and some ancillary clinical data such as laboratory test results (if available).

4. The available data for analyses are quality checked using a rigorous and structured approach. While access to longitudinal data for at least the past five years is required, the most recent data shall not be older than four months preferably. The minimum data elements required to be included in the data sources include, but are not limited to, demographic, granular clinical and ancillary clinical, health care utilization, laboratory test results, and geographic distribution in all care settings.

5. Support for data sources to include characteristics and capabilities to build a data network as a distributed database to provide access to health care data of a large US population. The data will include certainly administrative claims as well as EHR data sources (if available).

6. Support and tools for FDA to utilize the large database as follows:

a. Computing and informatics experts to design and execute queries and epidemiologic studies and to translate safety and effectiveness questions into a computer programming language to interrogate the database.

7. New capabilities developed to link health care data of mothers and their infants so that FDA can assess safety of biologic products during pregnancy.

8. Development of structure for the governance of the program.

9. Collaboration with other vendors and partners to form larger data networks and to leverage and build upon tools previously developed by other contractors for FDA.

2. TASKS DESCRIPTION

The following tasks constitute the performance of work expectations for the BEST program support.

2.1 TASK 1: DATA SOURCES AND MEDICAL RECORDS

The conduct of postmarket safety and effectiveness of biologic products under the BEST Initiative shall require the contractor to have access to data sources covering millions of patients and providing longitudinal data and to have access to full medical records of participating patients in the data sources.

2.1.1 Data Sources

The Contractor shall provide access to a large-scale database that includes near real-time (less than 4-month data lag), patient-centered, comprehensive demographic, clinical, and ancillary data from administrative claims (and EHR if available) data sources that are representative of the US population with access to complete patient medical chart information. The contractor shall use a CDM (for example, OMOP, if applicable). The databases shall have the following characteristics.

• Data to support surveillance of all biologic products

• Clinical and ancillary data, laboratory test results, demographics, and other related data elements

• Data with mother-infant linkage

• Storage capacity for different versions of databases

With respect to the data sources the contractor shall provide information about the type of data sources and the populations represented in these sources. Specifically, the contractor shall:

• Provide demographics of the patient population, type and geographic distribution of participating institutions, types of care settings, average length of follow-up for patients, number of current and historical enrollees in participating health plans

• Develop a data quality assessment plan for each database with respect to all coding systems used in the database such as ICD9, ICD10, HCPCS, CPT, and others.

• Develop a quarterly report to present the results of the data quality assessment plan for each database and develop an action plan to correct any deficiencies or missing data based on the quarterly report results

2.1.2 Analytic Capabilities (Optional)

In collaboration with a coordinating center (if applicable), the contractor shall develop analytic capabilities to conduct simple and complex data queries and studies to interrogate the databases. The queries can range from simple cohort identification or frequency distribution of events to complex assessment of association between exposures and outcomes adjusting for confounding.

The contractor shall provide the necessary personnel such as epidemiologists, experts on their databases, computer programmers, and project managers to maintain, update, and interrogate the databases, and run queries. The contractor shall participate in conducting simple and complex queries and epidemiologic studies to evaluate the safety and effectiveness of biologic products and to address regulatory issues initiated by the CBER staff. The contractor shall provide the capability and capacity in terms of data sources, scientific expertise, medical chart procurement, and operational management to run queries and studies.

The deliverables shall include access to data, participation in designing and implementing studies and preparing results. Deliverables must not exceed the agreed upon timeline between the contractor and the CBER staff.

To meet the requirements for performing queries and studies, the contractor shall:

• Collaborate with FDA to establish and meet timelines to prepare query and study results. Timelines will be dependent on complexity of the query or study and shall be established in the management plan and agreed upon by the contractor and CBER staff.

• Provide a secure portal for communication and data transfer.

• Collaborate with FDA in the publication of study results in agreement and compliance with CBER policies and procedures.

Queries and studies are divided into three categories:

• Simple queries consist of frequency distribution, prevalence, or incidence of an event.

• Complex queries consist of prevalence or incidence of multiple events within certain populations and in chronological relation to one another.

• Epidemiologic studies consist of evaluating the association between an exposure and an outcome while adjusting for confounding.

2.1.3 Medical Records

Some complex queries and epidemiologic studies may include a medical chart review component. This contract requires access to full medical chart of patients whose health care data are available in the databases. The contractor shall have the capability and capacity to obtain patients’ medical charts for certain queries and studies in a timely manner, to abstract the relevant data, and have clinicians adjudicate relevant exposures, outcomes, and covariates. FDA will not have direct access to the medical charts; the contractor shall provide the chart review results to FDA as part of query or study results in a de-identified and aggregate format.

2.2 TASK 2: OPERATIONS AND MANAGEMENT

The Contractor’s Program Manager (PM) and the Principal Investigator (PI) along with their supporting staff shall provide Program Management for the BEST Initiative requirements. These program management responsibilities shall include what is necessary to plan, coordinate, manage, communicate, report, and steward all respective task orders and activities throughout the period of performance.

The contractor shall ensure efficient operations between data sources and FDA to safeguard optimal delivery of activities such as CDM ETL, data transfer, meetings, telecons, and study results.

The Contractor shall:

• Develop a management plan containing written processes and procedures for collaborating with CBER to provide health care data, obtain and review medical charts, and participate in running queries and studies. Details of the collaboration will be determined on a task order basis, by mutual decision of all collaborative parties.

Collaboration includes sharing computer codes and summary and aggregate data, interpretation of findings, review of manuscripts, design of protocols, co-authorship of publications.

Additionally, the Contractor shall provide both program-level management services and task order-level project management services to establish control, management, monitoring, and notification mechanisms for the program requirements. Moreover, the Contactor shall work with the Government Contracting Officer (CO), Contracting Officer’s Representative (COR), and subject matter experts (SMEs) to ensure that tasks stay on track and important milestones are met.

Representative activities include, but are not limited to:

• Administering the program

• Throughout the period of performance, developing, maintaining, modifying, and updating plans to include task order (TO) risk management plans, staffing plan, standard operating procedures (SOP)

• Preparing and maintaining the Program Management Plan

• Preparing and submitting monthly progress reports and invoices

• Following escalation procedures for problems, issues, and recommendations, as encountered

• Safeguarding information

• Managing Contractor staff and providing sub-contractor management, to include the proper on-boarding and exit procedures are followed when Contractor employees start and leave BPA contract and/or task orders;

• Coordinating tasks and working collaboratively with FDA CBER staff to carry out the work of the contract per Sections 2.1 to 2.4

• Attending quarterly face-to-face meetings, if needed, with FDA CBER staff at the FDA White Oak Campus

• Reporting, communicating, presenting, and publishing of all BEST project findings shall be done in coordination with and concurrence of the CBER staff and the FDA COR

• Ensuring proper exit criteria are followed when contractor employees leave projects

• Providing risk mitigation plans and strategies per Section 2.2.4

• Conducting and participating in progress meetings, facility meetings, training meetings, performance meetings, program/project reviews, management briefings, stakeholder presentations, demonstration meetings, transition meetings, COR site visits, and post-requirements meetings as may be required for each individual task order

• Responding to ad-hoc data calls to refine or confirm project findings or address FDA questions or concerns concerning project findings

2.2.1 Task Order Management Plan

As tasked, for each task order released under this statement of work, the contractor shall deliver a Task Order (TO) Management Plan. The TO Management Plan (TOMP) shall include a Work Breakdown Structure (WBS), which shall contain all of the work elements described in the Task Order. The WBS elements shall also illustrate the sequence, timeline, and resources required for each work package.

Additionally, the TOMP shall include a schedule that details activities; dependencies and timeframes for meeting FDA objectives and deliverables; and an organizational chart identifying relationships, authorities, and responsibilities. The TOMP shall include a description of the management controls that the Contractor shall employ to meet the performance, cost, and schedule requirements; and other areas the Contractor deems relevant and important to the management of the Task Order. The Contractor shall ensure that activities are coordinated across task orders, if applicable, to promote cohesiveness among contracted activities.

The TOMP shall address all the action items from any Kickoff Meetings and other follow-on meetings, as appropriate. The Contactor shall update the TOMP when re-planning any activities. Changes to the TOMP are subject to approval of the COR.

The contractor shall devise a plan for the governance of the program that will include governance structure, relationships and responsibilities, policies and procedures that will be followed by all the parties involved in terms of governing the program.

2.2.2 Establish Project-Specific Statement of Work and Procedures The contractor shall work collaboratively with the FDA to develop and finalize the BEST projects statement of work (SOW) and a Management Plan (MP) and update them as needed to reflect the individual task order (ITO) activities. The Contractor shall work with the FDA to identify and meet all required review, approval and standard processes that comply with all relevant institutional, federal, state, and local laws and regulations to conduct the work such as Institutional Review Boards (IRB), data and information technology security such as Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA) and any others identified in the ITO. These procedures (i.e. the MP) shall address at a minimum the following: data collection, handling, sharing, ownership, and security;

management and tracking, consensus definitions, transfer, and sharing considerations for data summaries.

Moreover, the contractor shall develop and implement secure and robust data use, data quality control, tracking, management, and, each analysis and for all analyses.

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) supplies and services developed, acquired, or maintained under this contract or order must comply with the “Architectural and Transportation Barriers Compliance Board Electronic and Information Technology (EIT) Accessibility Standards” set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR part 1194. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and-standards/communications-and-it/aboutthe-section-508-standards .

2.2.3 Organization and Management Procedures

The contractor shall schedule and facilitate (to include notes, minutes, action items) meetings with FDA personnel to ensure efficient operations. These meetings shall include administrative and budgetary telecons every two weeks, monthly telecons for executives/leaders of the contract and FDA, as well as weekly scientific workgroup meetings for specific task orders.

http://www.access-board.gov/guidelines-and-standards/communications-and-it/aboutthe-section-508-standards http://www.access-board.gov/guidelines-and-standards/communications-and-it/aboutthe-section-508-standards

2.2.4 Risk Management

The Contractor shall identify and report for resolution to the Government any issues that prevent the Contractor from performing the work in any Task Order that the Contractor is unable to resolve independently. For each Task Order, the Contractor shall document and report the risks and opportunities within a risk registry. The Contractor shall maintain the risk registry and provide it to the COR on a monthly basis.

The risk registry shall contain, at a minimum, unless otherwise specified in the ITOs:

• Issue Number: a sequential numbering of all issues;

• Severity: assessment of issue severity i.e., likelihood and consequences (High/Medium/Low)

• Date Found: – date that issue was identified by the Contractor;

• Duration: number of days that issue has been open;

• Status: representing issue status as open or closed. The Contractor shall maintain a complete list of all issues – no issues typically should be deleted from the Contractor’s delivered list;

• Title: short description of issue;

• Updated: date for updated status;

• Details: narrative description of activities that have been completed to resolve issue;

• Assigned To: identify Government POC or Contractor that is assigned to resolve the issue;

• Solution or Workaround: description of the actions and activities taken to resolve or mitigate issue the issue.

2.3 TASK 3: COMMUNICATIONS AND OUTREACH

The contractor shall ensure ongoing communication and reporting to FDA. This includes the tracking, reporting, and outreach as necessary.

2.3.1 Annual in-Person Meeting

The contractor shall participate in the annual in-person meeting to discuss work related to the ongoing task orders, projects or tasks completed previously and the work plan that will be completed in the future.

2.3.2 Annual Public Workshop

The contractor shall participate in an annual public workshop and assist CBER to organize the workshop.

The purpose of the workshop will be to present the results from the BEST Initiative activities to the public and the scientific and regulatory community.

2.3.3 Publications

The contractor shall participate in developing drafts of protocols, reports, presentation materials (e.g., presentation slides and posters), and manuscripts.

Protocols, final reports, and final work products will be posted to a web-based resource library after clearance by FDA, the prime contractor, and subcontractors. The Parties agree this is a multi-site program and any publications as a result of studies shall be a multi-site publication coordinated by the prime contractor, subcontractors, FDA/CBER/OBE, and other involved sites. Authorship and other matters relating to publications shall be determined at the task order level.

2.3.4 Secure Portal

The contractor shall create and utilize a secure data transfer capability to allow secure file sharing and document storage for the contractor, subcontractors, CBER staff, and other collaborators. All the data transfer and document storage related to all queries and studies, and other activities shall be carried using the secure portal. The contractor shall obtain and meet all required review, approval and standards processes that comply with all relevant institutional, federal, state, and local laws and regulations to conduct the work such as HHS Information Security Program, Federal Information Security Management Act (FISMA), Health Insurance Portability and Accountability Act (HIPAA), the National Institute of Standards and Technology, Section 508 compliant, and any others identified in the ITO. These procedures (i.e. the MP) shall address at a minimum the following: data collection, handling, sharing, ownership, and security;

management and tracking, consensus definitions, transfer, and sharing considerations for data summaries.

The secure portal data security and privacy shall be in compliance with the HHS Information Security and Privacy Policy (IS2P). The security and privacy requirements to ensure federally-mandated security and privacy controls and standards shall be met according to FDA/CBER policies. Furthermore, the contractor shall deliver a user-friendly secure portal with graphical interface for conducting day-to-day executive.

2.4 TASK 4: TRANSITION SERVICES

Transition activities take place to efficiently transition all activities from the incumbent Contractor to the new IDIQ Contractor. As tasked, the Contractor shall be required to develop transition-out plans and conduct transition activities for task orders issued against this IDIQ vehicle.

2.4.1 Transition-In

As specified in each ITO, the Contractor shall transition-in and assume the responsibility for activities and duties from the prior (incumbent) Contractor in a manner that does not interrupt or negatively impact OAGS’ mission critical operations and activities. The purpose of the Transition-In requirement is to provide an orderly transition from the prior Contractor. For a period as specified by the ITO, the Contractor shall work with the incumbent contractor to affect a smooth transition of work.

Representative activities include, but are not limited to:

• Developing a Transition-In Plan to ensure full operating accountability and responsibility of the task orders.

• Familiarizing the incoming Contractor staff with FDA processes and requirements and work with the incumbent Contractor as related to transferring tasks and work activities being performed.

• Coordinating with assigned COR to obtain access to the required data, Government furnished equipment (GFE), systems / applications, and required training.

• Participating in Transition-in meetings and other technical exchange meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the incumbent Contractor.

• Certifying that employees working on the contract have completed their review and understand Integrated Services requirements, documentation, processes, and technical environments prior to the completion of the Transition-in activities.

• Verifying to the COR that all of the Transition-in documents are available.

2.4.2 Transition-out

The Contractor shall facilitate the transition-out of contracted activities and services to the Federal Government or, to a follow-on Contractor by the end of the contract period of performance.

The Contractor shall provide support for transition-out activities. During this period, the Contractor shall ensure no degradation in support provided under the task order. Between the turnover date designated by the COR and the end of the contract period of performance, the outgoing Contractor shall ensure all task order activities are closed out and provide sustainment support to complete the transition.

Representative deliverables include, but are not limited to:

• Developing and submitting a Transition-Out Plan and Schedule to the COR

• Providing the FDA with current versions of all documentation developed (i.e. Standard

Operating Procedures and Manual of Operations)

• Providing the FDA with a current inventory of all Government-Furnished Equipment (GFE) and Government Furnished Information (GFI) utilized by the Contractor along with full support in the reconciliation of this inventory

• Providing the follow-on contractor with the ability to “shadow” and participate in technical exchange meetings and opportunities to facilitate the transfer of information, processes, and data needed to continue the services being performed by the Contractor

2.5. REPRESENTATIVE DELIVERABLES & MEETINGS

Five (5) Year Ordering Period

Item No.

Description of Supplies/Service SOW Section

QTY Delivery Date

1. Kick Off Meeting N/A 1 Within 2-3 weeks of award

2. Develop and Implement a program

Management Plan

2.2 1 Deliver draft within 4 weeks of award and throughout the Period of Performance

3. Develop and Implement a Risk Management Plan

2.2 1 Develop within 4 weeks of award and implement throughout the Period of Performance

4. Assemble Staff Organizational Units

2.2 1 Assemble within 8 weeks of award and convene through the Period of Performance

5. Schedule and execute routine meetings

• Telecons: monthly executive/ leadership, monthly administrative meetings (as needed), and weekly scientific workgroup

2.2 1 Develop schedule within 8 weeks of award and convene through the Period of Performance

6. Prepare a Conflict of Interest Plan 3.0

1 Develop within 8 weeks of award and implement throughout the Period of Performance

7. Create and maintain a secure web-based infrastructure for file sharing (portal)

2.3 1 Develop within 16 weeks of award and preform ongoing updates and support throughout the Period of Performance

8. Establish web-based resource library

• Post all contract deliverables with accompanying instructions in resource library

2.3 1 Develop within 16 weeks of award and perform ongoing updates and support throughout the Period of Performance

9. Prepare monthly progress reports and invoices

2.2 4 Prepare at the end of each month for the previous month and previous period of Performance

10. Prepare a Transition-Out Plan and Schedule

2.4 1 Prepare 4 months prior to the end of Period of Performance

11. Participate in organizing and conducting an in-person annual meeting and an annual public workshop

2.3 1 Participate in the in-person meeting and workshop annually within 6 months prior to end of each 12-month Period of Performance

2.5.1 Delivery Instructions for Deliverables

Unless otherwise specified, all deliverables, reports or copies of reports shall be delivered to the COR via email. The monthly progress and financial reports shall also be submitted to the Contracting Officer and/or Contract Specialist assigned to the contract. Requirements for inspection and acceptance are as follows:

• The COR or the POC designated in each TO, will inspect and accept the services provided to ensure they meet the requirements detailed in the relevant IDIQ task order.

• The Government will accept products and services only if they conform to all terms and conditions of the contract statement of work and each TO.

• The Government will provide written notification of acceptance or rejection within ten (10) calendar days of receiving the service.

• The Government will reject non-conforming products and services. The Contractor shall correct any deficiencies within thirty (30) calendar days of when the Government issues the rejection notice. If the Contractor cannot correct the deficiencies within this time frame, the Contractor shall immediately notify the COR of the reason for the delay and provide a proposed corrective action plan within ten (10) calendar days.

In addition, the Contractor shall be proactive in informing the designated CBER COR of any issues, problems and recommendations that shall be addressed for the overall effective accomplishment of contract goals and deliverables. Recommendations for actions that need to be taken by FDA staff, or other Contractors shall be clearly defined and communicated (via email) to the responsible party and the FDA and have identified dates for completion.

3. CONTRACT CONSTRAINTS

The following constraints are applicable to this contract:

1. The Contractor shall ensure that all appropriate administrative and regulatory approvals are obtained. These include but are not limited to those that address human subject considerations;

and Office of Management and Budget (OMB) which will be detailed during the ITO process.

2. Interim data used in technical progress reports and other reports developed for the purpose of study monitoring shall not be released publicly. Premature release of such data could result in interpretations that prove to be unreliable or invalid once the study is completed and the full context for the data is known and lead the public and medical practitioners to pursue inappropriate measures.

3. The Contractor shall be responsible for knowledge of and compliance with all applicable federal information technology and information management laws, regulations, policies and standards at the government-wide, HHS and FDA levels.

i. The computer programs, data management systems, databases, and other resources used or developed through this contract shall comply with data standards and procedures established by DHHS and FDA (per http://www.fda.gov/ForIndustry/DataStandards/default.htm).

4. The Contractor shall not use confidential or otherwise privileged information shared by FDA with contractors to solicit or in any way encourage industry funding/financial sponsorship of http://www.fda.gov/ForIndustry/DataStandards/default.htm research projects to be performed by the contractor. In the event that a third party, such as a drug sponsor, independently requests that the contractor conduct research on a safety issue the contractor may conduct such research only if both of the following conditions are satisfied: (1) the contractor shall not divulge confidential and privileged information previously shared by the FDA; and (2) the contractor shall recuse itself from all subsequent conversations with FDA about the safety of the involved biologic product(s). In conjunction with the above, the contractor shall provide a Conflict of Interest Plan as outlined in FDA Clause 1337 Conflict of interest (see FDA 1337, Conflict of Interest).

5. The Contractor shall work collaboratively with FDA CBER during the task order proposal request;

projects will be mutually agreed upon by both parties, and final approval is required by the FDA CO. Communications, presentations, and publications require internal FDA clearance of up to 30 days. Generally, the FDA COR will offer final decision on products and FDA CO approval will be needed on any modifications to the contract or ITOs.

3.1 Security and Privacy

3.1.1 Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

2) Access (Physical or Logical) to Government Information: A Contractor

(and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

a. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

3) Safeguarding Information and Information Systems. In accordance with the

Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an FDA network or operated by the Contractor on behalf of FDA regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party. This includes notifying the FDA Systems Management Center (SMC) within one (1) hour of discovery/detection in the event of an information security incident.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS/FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing your ISSO.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

4) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II:

Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Confidentiality: [x] Low [ ] Moderate [ ] High

Integrity: [x] Low [ ] Moderate [ ] High Availability: [x] Low [ ] Moderate [ ] High Overall Risk Level: [x] Low [ ] Moderate [ ] High

Based on information provided by the Privacy Office, system/data owner, or other privacy representative, it has been determined that this solicitation/contract involves:

[x] No PII [ ] Yes PII

Personally Identifiable Information (PII). Per the OMB Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother’s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be:

[x] Low [ ] Moderate [ ] High http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa). As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for

Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization and the FDA IS2P Appendix T: Sanitization of Computer-Related Storage Media.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M- 06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by FDA or collected by the contractor on behalf of FDA shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and FDA policies. Unauthorized disclosure of information will be subject to the HHS/FDA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use FDA-provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee under this contract shall complete the FDA non-disclosure agreement (3398 Form, RFP Attachment D), as applicable. A copy of each signed and witnessed NDA shall be submitted to the CO and/or COR prior to performing any work under this acquisition.

11) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist procuring activity representative, program office and the FDA SOP or designee with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M- 03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

b. The Contractor shall assist the procuring activity representative, program office and the FDA SOP or designee in reviewing and updating the PIA at least every three years throughout the Enterprise Performance Life Cycle (EPLC) /information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

A. POSITION SENSITIVITY DESIGNATIONS

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract: [See the FDA Security Article, entitled Contractor Personnel Security Clearance Standards and Residency Requirements for the Position Risk Designation Tier(s) (i.e., 1, 2, and/or 4) that apply to this award.]

12) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or

COR as soon as it is known that an employee will stop working under this contract.

13) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or FDA policies.

14) The Contractor (and/or any subcontractor) shall coordinate with the COR via email, copying the Contract Specialist, to ensure that the appropriate person performs and documents the actions identified in the FDA eDepart system http://inside.fda.gov:9003/EmployeeResources/NewEmployee/eDepartDepartureSystem /default.htm as soon as it is known that an employee will terminate work under this contract within days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request. Contractor shall work with COR to access eDepart system.

B. RECORDS AND MANAGEMENT AND RETENTION

The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 - Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/FDA policies and shall not dispose of any records unless authorized by HHS/FDA.

In the event that a contractor (and/or any subcontractor)…