Attachment A IDIQ ACHDNC 2020 SOW-Final .docx

Attachment A Statement of Work

Title: IDIQ to Support the Advisory Committee on Heritable Disorders in Newborns and Children

I. BACKGROUND

The Advisory Committee on Heritable Disorders in Newborns and Children (Committee) was established under the Public Health Service (PHS) Act, 42 U.S.C. 217a: Advisory councils or committees and Title XI § 1111 (42 U.S.C. § 300b-10). The Health Resources and Services Administration/Maternal and Child Health Bureau (HRSA/MCHB) provides coordination, management, and operational services to the Committee, with direction and guidance from the U.S. Department of Health and Human Services.

The purpose of the Committee is to provide the Secretary with recommendations, advice, and technical information regarding the most appropriate application of technologies, policies, guidelines, and standards for: (a) effectively reducing morbidity and mortality in newborns and children having, or at risk for, heritable disorders; and (b) enhancing the ability of state and local health agencies to provide newborn and child screening, counseling, and health care services for newborns and children having, or at risk for, heritable disorders. Specifically, the Committee makes systematic evidence-based recommendations to the Secretary on conditions that should be considered for addition to the Recommended Uniform Screening Panel (RUSP); and newborn screening for conditions that have the potential to significantly impact public health for methods used for screening.

II. PURPOSE

The purpose of this Indefinite-Delivery-Indefinite-Quantity (IDIQ) contract is to provide a Contracting mechanism for professional support to inform and support the work of the Committee as specified under 42 U.S.C. § 300b-10.

The services contemplated under this contract shall be provided upon issuance of task orders.

III. PERIOD OF PERFORMANCE/PLACE OF PERFORMANCE

The contract shall include a 12-month Base Year and four 12-month Option Periods. The place of performance will be at the Contractor’s Office.

IV. TASKS:

The contractor shall have staff and/or expert consultants qualified and experienced in a range of specialty areas as described within this statement of work.

The contractor shall provide all personnel, materials, facilities, services, and equipment necessary for the performance of work as stated in individual task orders issued under this IDIQ Contract. The following describes the typical tasks that may be required of the contractor in the performance of task orders awarded. Task orders shall not necessarily reflect/include the entire set of task areas listed below, but shall specify the actual tasks to be performed along with the project-specific information required for completion of the task orders. Each request for task order proposal (RFTOP) will clearly specify the requirement areas for that given task order.

Services shall include work in the areas of organization; administration; interviews of stakeholders; report writing; quality improvement; and content-specific expertise.

1. Conduct Evidence-based Reviews for Conditions Nominated for Inclusion on the RUSP

The Contractor shall:

· Conduct systematic, evidence-based reviews of rare conditions nominated for the Recommended Uniform Screening Panel (RUSP). The COR will assign the Contractor a medical/genetic condition to review as recommended by the Committee. The evidence-based review shall include:

· an overarching framework and key questions;

· an analysis of the condition including the case definition and clinical history;

· the corresponding newborn screening test(s), confirmatory test(s), and treatment(s);

· an analysis of the benefits and harms of newborn screening for the condition at a population level;

· assessment of the impact and cost of State public health newborn screening programs' ability to implement screening of new conditions;

· assessment of ethical considerations and values of the people and systems affected by changes to newborn screening.

The evidence-based reviews will inform the Committee’s decision-making process when considering the nominated condition.

· Convene and manage a team of experts, the evidence review group (ERG), to provide objective input on the systematic evidence review including providing expertise on the overarching framework and key questions; reviewing published and gray literatures; and abstracting data and weighing the quality and quantity of the data. The ERG will also provide input into the assessment of the benefits and harms of screening for a condition at a population level as well as input on state public health newborn screening programs’ ability to implement the screening of a new condition and the cost implications of implementing population based screening of the condition. The COR must approve all experts on the team.

· Convene and manage a Technical Expert Panel of up to 10 subject matter experts (SMEs) that have expertise in the rare condition that is under review by the Committee. Provide a list for approval of the SMEs to the COR within 3 weeks of EDOC.

· Develop a consumer-friendly summary for the public at the 8th grade reading level of the Committee’s evidence-based condition review and final decision. The summary shall be a maximum of 12 pages. Here is an example of a previous summary: https://www.hrsa.gov/sites/default/files/hrsa/advisory-committees/heritable-disorders/rusp/previous-nominations/sma-consumer-summary.pdf

· Develop draft and final reports of the evidence review.

· Present findings to the Committee at in-person or webinar meeting(s) as stated via the RFTOP.

2. Conduct an Updated Evidence-based Reviews on Conditions Currently on the RUSP

· Conduct an updated systematic, evidence-based review using the procedures set by the Committee on conditions currently on the RUSP to inform the Committee’s decision-making process.

· Include new information or any relevant updates on the following: the newborn screening and confirmatory test(s) (including performance of the tests in public and diagnostic laboratories; treatment; the benefits and harms of newborn screening for the condition at a population level including clinical outcome data for infants that have been identified; and/or the assessment of state public health newborn screening programs’ ability to screen for the condition.

· Provide a team of experts, the evidence-based review group (ERG), to provide objective input on the systematic evidence review including providing expertise on the overarching framework and key questions; reviewing published and gray literatures; and abstracting data and weighing the quality and quantity of the data. The ERG will also provide input into the assessment of the benefits and harms of screening for a condition at a population level as well as input on State public health newborn screening programs’ ability to screen for the condition and the cost associated to screening. The COR must approve all experts on the team.

· Convene and manage a Technical Expert Panel of up to 10 SMEs that have expertise in the rare condition that is under review by the Committee. Provide a list for approval of the SMEs to the COR within 3 weeks of EDOC.

· Develop a consumer-friendly summary for the public at the 8th grade reading level of the Committee’s evidence-based condition review and final decision. The summary shall be a maximum of 12 pages. Here is an example of a previous summary: https://www.hrsa.gov/sites/default/files/hrsa/advisory-committees/heritable-disorders/rusp/previous-nominations/sma-consumer-summary.pdf

· Develop draft and final reports of the evidence review.

· Present findings to the Committee at an in-person or webinar meeting as stated via the RFTOP.

3. Evaluate and propose revisions to the Evidence-based Review Process

· Analyze the evidence-review process and suggest revisions and refinement to the process.

· Evaluate the impact on the evidence-based review process.

· Present recommendations to the Committee for consideration.

4. Develop a Consumer-Friendly Summary of the Committee’s Evidence-based Condition Reviews and Decisions:

· Develop a consumer-friendly summary for the public (8th grade reading level) of the Committee’s evidence-based condition review and decision of the condition. The summary shall be a maximum of 12 pages. Here is an example of a previous summary: https://www.hrsa.gov/sites/default/files/hrsa/advisory-committees/heritable-disorders/rusp/previous-nominations/sma-consumer-summary.pdf

5. Participate in Committee Meetings in Rockville, MD

· Upon issuance of a task order the Government will direct the contractor to attend up to three (3) nights in Rockville area. The meetings will be in person or virtual.

6. Conduct research, provide advice, convene discussions and meetings, produce reports, and make policy recommendations to the Committee by providing expertise on the following: newborn screening for newborn and child medical/genetic conditions and associated clinical information, screening practices, treatment, public health impact, and evidence-based review processes

· For a topic, conduct research and analysis to provide information needed to inform the Committee’s discussions and development of recommendations. Activities shall include: identifying emerging issues, researching and analyzing relevant topic areas, facilitating and gathering expert opinions, identifying key questions and issues, identifying relevant experts and stakeholders, creating a methodology for acquiring information, and develop reports.

· For a topic, convene a one-day meeting of up to 15 SMEs at a federal facility. Provide a list for approval of the SMEs to the COR within 3 weeks of EDOC. SMEs shall have expertise in the topic area as assigned in the task order.

· For a topic, conduct a Technical Expert Panel of up to 10 SMEs. Provide a list for approval of the SMEs to the COR within 3 weeks of EDOC. SMEs shall have expertise in the topic area as assigned in the task order.

7. Records Management:

· Manage and maintain Federal records, including electronic records, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate recordkeeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

· Managing the records includes maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

8. Records Management Training:

· Ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HRSA Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training can be requested by emailing the records management team at recordsmanagement3@hrsa.gov . The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

V. Schedule of Deliverables

Section 508:

Regardless of format, all digital content or communications materials produced as a deliverable under this contract, must conform to applicable Section 508 standards to allow federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. Remediation of any materials that do not comply with the applicable requirements as set forth below, shall be the responsibility of the vendor.

HHS guidance regarding accessibility of documents can be found at http://www.hhs.gov/web/section-508/making-files-accessible/index.html.

Deliverables: Official deliverables and due dates provided for each task order SOW

(PowerPoint and PDF) 15 calendar days before each meeting

include Records Management Schedule and Disposition Plan

at recordsmanageme nt3@hrsa.gov.

30 Days after EDOC

Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

4) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

5) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HRSA non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Incident Response FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Security Operations Center (SOC), COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, HHS, and HRSA incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HRSA EPLC framework and methodology (https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared Documents/z_Old PMO Archives/Documents.aspx) and in accordance with the HHS Contract Closeout Guide (2012).

HHS EA requirements may be located here: https://www.hhs.gov/ocio/ea/documents/proplans.html

2) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

3) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 10 days before an employee stops working under this contract.

image1.gif