Attachment A - SOW_Long COVID_withAppendices_Final.pdf

Attachment A Statement of Work (SOW)

Title: Technical Assistance (TA) for Long COVID for Health Centers Date: April 20, 2023

I. Background

The Health Resources and Services Administration (HRSA) is the primary Federal agency for improving access to health care by strengthening the health care workforce, building healthy communities, and achieving health equity. HRSA’s Bureau of Primary Health Care (BPHC) is responsible for the administration and oversight of the Health Center Program that supports over 1,400 health centers providing primary care to over 30 million people in medically underserved communities.

Since the beginning of the COVID-19 pandemic, BPHC has ensured health centers receive the tools they need to protect their communities against COVID-19, particularly vulnerable populations disproportionately impacted by the pandemic as well as deliver needed preventive and primary health care services to those at higher risk for COVID-19. The Centers for Disease Control and Prevention (CDC) defines long COVID as the occurrence of new, returning, or ongoing health problems four or more weeks after an initial infection with SARS-CoV-2.

Common symptoms include fatigue, dizziness, coughing and headache, and can potentially last for years.1 According to the CDC’s June 2022 Household Pulse Survey, out of the 40% of U.S.

adults who have contracted COVID-19 thus far, almost 20% of those adults still report having long COVID symptoms.2 Additionally, long COVID exacerbates other chronic diseases and co-occurring conditions adding a burden to the health of patients from medically underserved communities. Estimates indicate that up to 23 million individuals may be affected and in any given period, long COVID may be responsible for up to 1 million people being out of the workforce, exacerbating psycho-social barriers to post-COVID recovery and the path to holistic wellness.3 To help individuals access care and services, the Biden-Harris Administration has prioritized enhancing prevention and treatment for long COVID and associated chronic conditions including but not limited to diabetes, cardiovascular disease, chronic kidney disease, hypertension, obesity, and chronic liver disease, especially for those disproportionately affected by the pandemic.

1U.S. Department of Health and Human Services, Centers for Disease Control and Prevention. Long COVID or Post-COVID Conditions. https://www.cdc.gov/coronavirus/2019-ncov/long-term-effects/index.html. Last updated July 11, 2022.

2 U.S. Department of Health and Human Services, Centers for Disease Control and Prevention. Nearly One in Five American Adults Who Have Had COVID-19 Still Have “Long COVID”.

https://www.cdc.gov/nchs/pressroom/nchs_press_releases/2022/20220622.htm. Published June 22, 2022.

3 U.S. Government Accountability Office. Science & Tech Spotlight: Long COVID | U.S. GAO. Published March 2, 2022.

https://www.cdc.gov/coronavirus/2019-ncov/long-term-effects/index.html https://www.cdc.gov/nchs/pressroom/nchs_press_releases/2022/20220622.htm https://www.gao.gov/products/gao-22-105666

II. Purpose

The purpose of this contract is to procure training and technical assistance to HRSA-supported health centers in adoption and implementation of evidence-based or evidence-informed treatment to enhance diagnosis and management of patients with long COVID and other associated chronic conditions.

Technical assistance procured under this contract will address a critical need to strengthen health center capacity to diagnose, treat, and help manage long COVID, and other chronic diseases, including supporting case management, care coordination and enabling services for ongoing treatment and recovery. By fulfilling this Government requirement, health centers will be better equipped to meet the needs of medically underserved communities impacted by the COVID-19 pandemic.

III. Period of Performance / Place of Performance

The period of performance shall be one (1) 12-month Base period and one (1) 12-month Option period. The place of performance shall be at the Contractor’s facility.

IV. Tasks

Task 1: Federal Records and Information Guidelines

The Contractor shall:

In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

Not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

Task 2: Records and Information Management

The Contractor shall:

Manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters.

21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate record keeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

Task 3: Records Management Training

The Contractor shall:

Ensure that all employees having access to (1) Federal information or a federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher training during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html. At the end of the Records Management training, please send the "Certificate of Completion" to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing, as a result of staffing changes, shall be submitted with next required progress report.

Task 4: Kickoff Meeting and Minutes (Base Year Only)

The Contractor shall:

1. Within 10 business days after the Effective Date of Contract (EDOC), meet with the COR and program staff remotely to discuss the Contractor's understanding of the program, contract deliverables, Program Management Plan found in Task 6, and to clarify objectives and issues related to the contract.

2. Prepare a meeting agenda and submit to the COR for approval at least two (2) business days prior to the kick-off meeting, which shall include:

a. introduction of both Contractor and Government personnel performing work related to the contract;

b. brief overview of tasks, as written in the contract; discussion of, and agreement to the contents of a Program Management Plan to detail the specific activities, tasks, and requirements associated with each period of performance; and

c. review by both HRSA and the Contractor of the agreed-upon method to resolve, track, and report on issues.

3. Prepare and submit Kick-off Meeting Minutes to the COR within five (5) business days after the Kick-off meeting. The Kick-off Meeting Minutes shall include:

a. date and attendees by name and role on contract;

http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html

b. discussion of specific tasks, contents of the Program Management Plan by specific activities and requirements associated with each period of performance; and

c. final conclusions made by both HRSA and the Contractor of the agreed-upon method to resolve, track, and report on issues.

Task 5: Program Management

The Contractor shall:

1. Provide the necessary resources, technical assistance processes, and infrastructure to manage, perform, and administer the contract. The Contractor shall provide a single point of contact (e.g., Program Manager, including a deputy/alternate) between the Government and Contractor personnel within three (3) business days after the EDOC. This point of contact shall have full authority to act for the contractor on all matters relating to daily operations, and respond to Governments requests for contractual actions within one (1) business day of request.

2. Provide qualified personnel within identified timeframes and notify the Government of all issues the Contractor considers not within the scope of the contract immediately.

3. Advise the Government immediately of any problems affecting any scheduled events in writing to COR within one (1) business day of acknowledgement. The contractor’s management team will be responsible for providing only qualified subject matter experts and staff, as defined by the labor categories (Appendix A).

4. Identify, define, analyze, and summarize problems and challenges faced during the performance of the contract, and develop recommendations to solve the problems, and modify the Program Management Plan and Implementation Plan for ECHO model, accordingly. Any modifications to the Program Management Plan and Implementation Plan for ECHO model shall be submitted to the COR in writing for approval within three (3) business days of acknowledgement.

5. Present problem analysis and recommendations with time, effort, and impact estimates to the COR in writing within three (3) business days of acknowledgement. The problem analysis and recommendations shall include recommended options with actionable tasks, milestones, and recommended dates; identify dependencies, stakeholders, and the suggested order of operations in which to solve the task(s).

Task 6: Program Management Plan

The Contractor shall:

1. Develop and submit a Program Management Plan to the COR for approval within 10 business days after the kickoff meeting. The Program Management Plan shall include:

a. Recruiting. Proposal to recruit 100 health center organizations to four (4) cohorts;

b. Schedule for Technical Assistance Sessions. Schedule for video clinic Technical Assistance Sessions (4 video clinic cohorts, 25 health centers each) that shall occur biweekly (two times a month). The video clinic cohorts shall include the staff from the 25 recruited health centers and Contractor clinicians and specialists.

c. TA Training Curriculum. Training curriculum that shall include and be aligned with the services/activities identified in Task 11.

e. Health Center Team. Description of each participating health center team, which may include a lead clinician (i.e., physician, nurse practitioner, or physician's assistant), nursing staff, behavioral health staff, community health workers and medical assistants, who are part of a multidisciplinary primary care team;

f. Collaboration/Partnerships. Description of collaboration/partnership efforts with:

• national entities that provide project ECHO-like models to deliver virtual technical assistance for long COVID and chronic disease knowledge through a “hub and spoke model” of strategic engagement of federal, regional, and/or state level stakeholders;

• academic institutions and research/teaching hospitals; and

• community-based organizations with demonstrated expertise and experience working with medically underserved communities, communities disproportionately impacted by COVID-19.

g. Evaluation Measures. Evaluative measures to assess how effective the ECHO-like model was at improving the diagnosis, treatment, and management of long COVID and associated chronic diseases for patients at HRSA-supported health centers. This shall include but is not limited to:

• pre-program assessment to 100 selected health centers to understand baseline knowledge, skills, and capacity to diagnosis, treat, and manage long COVID and concurrently manage associated chronic conditions; and

• post-program assessment to 100 selected health centers to demonstrate any change in pre-program assessment results.

Task 7: Implementation Plan for ECHO-like Model

The Contractor shall:

1. Provide technical assistance to 100 HRSA-supported health centers using a Project Extension for Community Health Outcomes (ECHO)-like model. ECHO-like models were “inspired by the way clinicians learn from medical rounds during residencies, the ECHO Model® has evolved into a learning framework that applies across disciplines for sustainable and profound change”.5 Participants in an ECHO model “engage in a virtual community with their peers where they share support, guidance and feedback.”5 The Contractor will use this model to engage clinicians and specialists in ongoing distance learning video clinics to present real cases for discussion and recommendations. These models foster continuous learning, peer support, and mentoring to support participating clinical teams in testing and refining their knowledge.4 The Contractor will have expert teams of specialists, primary care physicians, and primary care team members to provide the distance learning training and support to HRSA-supported health center providers caring for patients experiencing long COVID symptoms and other chronic diseases.

2. Within ten (10) business days after COR approval of the Program Management Plan in Task 5, the Contractor shall deliver an implementation plan for the ECHO model to the COR and following approval, begin operationalizing all activities. The implementation plan shall include:

a. providing technical assistance to 100 HRSA-supported health centers using a Project Extension for Community Health Outcomes (ECHO)-like model. ECHO-like models were “inspired by the way clinicians learn from medical rounds during residencies, the ECHO Model® has evolved into a learning framework that applies across disciplines for sustainable and profound change”.5 Participants in an ECHO model “engage in a virtual community with their peers where they share support, guidance and feedback.”5

b. engaging clinicians and specialists in ongoing distance learning video clinics to present real cases for discussion and recommendations. These models foster continuous learning, peer support, and mentoring to support participating clinical teams in testing and refining their knowledge.5

c. utilizing expert teams of specialists, primary care physicians, and primary care team members to provide the distance learning training and support to HRSA-supported health center providers caring for patients experiencing long COVID symptoms and other chronic diseases.

d. policies and procedures to carry out the Program Management Plan activities. This may include recruiting health centers to participate and maintain that participation, collecting and analyzing evaluative measures, conducting video and any real-life case

4 University of New Mexico. About the Echo Model. https://hsc.unm.edu/echo/what-we-do/about-the-echo-model.html 7 Raveendran AV, Misra A. Post COVID-19 Syndrome ("Long COVID") and Diabetes: Challenges in Diagnosis and Management. Diabetes Metab Syndr. 2021 Sep-Oct;15(5):102235. doi: 10.1016/j.dsx.2021.102235. Epub 2021 Jul

28. PMID: 34384972; PMCID: PMC8317446.

8 Vimercati L, De Maria L, Quarato M, Caputi A, Gesualdo L, Migliore G, Cavone D, Sponselli S, Pipoli A, Inchingolo F, Scarano A, Lorusso F, Stefanizzi P, Tafuri S. Association between Long COVID and Overweight/Obesity. Journal of Clinical Medicine. 2021; 10(18):4143. https://doi.org/10.3390/jcm10184143 5 University of New Mexico. About the Echo Model. https://hsc.unm.edu/echo/what-we-do/about-the-echo-model.html 7 Raveendran AV, Misra A. Post COVID-19 Syndrome ("Long COVID") and Diabetes: Challenges in Diagnosis and Management. Diabetes Metab Syndr. 2021 Sep-Oct;15(5):102235. doi: 10.1016/j.dsx.2021.102235. Epub 2021 Jul

28. PMID: 34384972; PMCID: PMC8317446.

8 Vimercati L, De Maria L, Quarato M, Caputi A, Gesualdo L, Migliore G, Cavone D, Sponselli S, Pipoli A, Inchingolo F, Scarano A, Lorusso F, Stefanizzi P, Tafuri S. Association between Long COVID and Overweight/Obesity. Journal of Clinical Medicine. 2021; 10(18):4143. https://doi.org/10.3390/jcm10184143 https://hsc.unm.edu/echo/what-we-do/about-the-echo-model.html https://hsc.unm.edu/echo/what-we-do/about-the-echo-model.html https://hsc.unm.edu/echo/what-we-do/about-the-echo-model.html https://hsc.unm.edu/echo/what-we-do/about-the-echo-model.html presentations in accordance with Health Insurance Portability and Accountability (HIPAA) policies, etc.;

e. detailed schedule for biweekly video clinics and other technical assistance, including a plan to collect, review, and summarize relevant key information/findings from the activities to HRSA and other stakeholders;

f. detailed description of methods the Contractor will use to create, administer, and analyze the pre and post assessment evaluative measures; and

g. protocol to coordinate scheduled and/or ad hoc outreach to health centers and partnership organizations (i.e., national entities, academic institutions, hospitals etc.) for collaboration.

Task 8: Biweekly Monitoring Calls and Meeting Minutes

The Contractor shall:

1. Participate in biweekly teleconferences to discuss work performed to date, progress achieved towards meeting the objectives and milestones, summaries of deliverables submitted and date of delivery, difficulties encountered, activities projected and activities requiring input or approval.

2. Within 24 hours, request and schedule a teleconference with the COR when current or potential problems arise; and be prepared to describe the nature and impact of the current or potential problem, propose corrective action, and recommend any necessary adjustments to the approved procedures and schedule of deliverables.

3. For biweekly calls, the Contractor’s discussion shall include emerging issues, progress made toward the goal, and deliverables.

4. Keep meeting minutes and provide an electronic copy to the COR within three (3) business days after each call. The biweekly meeting agenda and subsequent meeting minutes shall include:

• date of meeting;

• names of attendees;

• summary of all discussion topics in the order outlined in the agenda;

• action items to be addressed;

• decisions that were made;

• individual(s) responsible for completing each action item;

• due dates for each action item;

• materials or any link to materials, if any, distributed at the meeting; and

• date of follow-up meeting (if any).

Task 9: Monthly Progress Reports

The Contractor shall:

1. Starting on the second month of the contract, on the third business day of every month, submit a monthly progress report that details the work from the previous month.

2. Submit the report via email, organize it using clear and concise headings, and attach an up-to-date Technical Assistance Monthly Report Appendix in a Microsoft Office Excel file.

3. Include the following information in each monthly progress report:

• summary of all training/technical assistance (e.g., distance learning clinics, didactic presentations, dissemination products etc.) delivered that month, and inclusion of quantitative and qualitative data, when available;

• issues or challenges that health centers are encountering;

• issues or challenges the Contractor is encountering;

• health center successes, achievements, and key milestones;

• health center feedback;

• planned activities in the upcoming month; and

• Monthly TA Report Appendix, submitted as an attachment to the monthly report that includes the below information in a well-designed, easily searchable Microsoft Office Excel file, using the contract number and health center name:

o contractor and provider(s) information;

o health center contractor number;

o health center name;

o name(s) of individual health center practice site(s);

o mailing address of individual practice site(s); and o names and titles of the provider team participating in the program.

• TA Session & Training information shall include:

o name(s) and date(s) of technical assistance activity (i.e., video clinics and didactic presentations);

o delivery of training(s)/activities (e.g., live, pre-recorded, written, etc.);

o name of Contractor staff conducting training;

o audience size for each session, if applicable; and o attendee names, title, and health center.

Task 10: Annual Report

The Contractor shall:

Within 30 business days prior to end of each performance period, submit a Draft annual report to the COR for review, summarizing findings and results of the contract year. The draft annual report shall be organized by clear and concise headings and submitted in a Microsoft Word.

Within 10 business days of receiving feedback from the COR, submit a final annual report to the COR for approval, incorporating HRSA’s feedback on the draft report. The annual report shall include:

a. Introduction: The health problem(s) and need for technical assistance.

b. Significance: The rationale of use and integration of an ECHO-like model for health care providers addressing long COVID and associated chronic conditions.

c. Health Center Feedback: A summary of technical assistance provided during the contract year, and a cumulative summary from the beginning of the initiative:

• highlighting areas of improvements and areas of concern;

• changes the Contractor made throughout the year to adapt to health center needs;

• changes health centers made and successes they achieved in response to the

ECHO-like model; and

• attendance and participation, including the types of providers.

d. Impact: The impact of the models on empowering primary care providers and increasing their capacity to diagnose, manage, and treat patients with long COVID and associated chronic conditions. This shall include relevant outcomes from evaluative measures that demonstrate the extent of the model’s impact.

e. Recommendations: Recommendations regarding the role and framework of ECHO-like models (e.g., hub and spoke) in providing training and technical assistance on complex health problems to primary care providers in community health centers that provide care to medically underserved populations.

f. Barriers/Limitations: The challenges and/or limitations to using the ECHO-like model to provide training and technical assistance to primary care providers in community health centers.

Task 11: TA Sessions/Training and Virtual Learning Community Participant Feedback Summary Report

The Contractor shall:

1. TA Sessions. Provide one (1) hour video clinic TA Sessions (4 video clinic cohorts, 25 health centers each) that shall occur biweekly (two times per month). These sessions will:

• deliver clinical content on long COVID to participating health center staff;

• be attended by the TA expert(s) and Clinicians, facilitated by the TA expert, and delivered by the Clinicians (e.g., clinicians with expertise on long COVID); Program Manager and other Contractor staff may be required if requested by the COR; and

• allow health centers to discuss and detail the impact and challenges they face regarding the diagnosis and treatment of long COVID and other chronic diseases.

2. TA Training. The Contractor shall provide virtual training for the following expected learning outcomes. Training shall include the list below:

• overview of what is known about long COVID and associated chronic conditions;

• implementing emerging evidence-informed practices for screening and diagnosing and treating long COVID and associated chronic conditions;

• appropriate prescribing of medications, therapies, and treatments;

• standard treatment guidelines and protocols, including clinical quality and safety;

• supporting patients’ own medical management and review of best practices for caretakers of long COVID patients; and

• care coordination strategies for patients to achieve and sustain recovery

• strategies for engagement with relevant community partners to ensure comprehensive care and address social determinants of health;

• implementation of current clinical and public health recommendations, including emerging information relevant to long COVID care and management of chronic conditions in medically underserved communities; and

• enhancement of clinical and operational workflows and billing; incorporation of new technologies (e.g., remote monitoring) or enhancements in models of care to improve the effectiveness of long COVID services and increase patient engagement

3. Within 30 business days prior to the end of each performance period, develop questions and use a survey mechanism to obtain feedback from participants of the TA sessions and TA training provided in the virtual learning community.

4. Submit a summary report of survey feedback to the COR within 10 business days prior to the end of each performance period.

Task 12: Virtual Learning Community

The Contractor shall:

1. Leverage HRSA communication/TA platform to facilitate a virtual learning community. This shall include how to communicate mechanisms to disseminate, receive information through an email list-serve or other communication mechanism to support asynchronous learning. This mechanism shall be for all HRSA-supported health centers from the technical assistance for long COVID and associated chronic conditions. The Contractor may collaborate with Primary Care Associations and national partners to support health centers.

2. Within 10 business days after the kick-off meeting, submit a plan for implementing the virtual learning community for COR approval. The virtual learning community implementation plan shall include:

a. provision of training and technical assistance on long COVID and associated chronic conditions, including consultation with subject matter experts;

b. overview of dissemination strategies and communication mechanisms;

c. designated communication mechanism where health centers can direct concerns, feedback, and questions relating to long COVID and associated chronic conditions;

d. response to technical questions from health centers as they relate to long COVID and associated chronic conditions; and

e. clean-up and maintenance procedures to ensure community is consistently updated.

Task 13: Single Technical Assistance Resource

The Contractor shall:

Within 10 business days prior to the end of each performance period, develop a single ancillary resource for each ECHO, in a format to be discussed with and approved by the COR within 30 business days prior to the end of each performance period, and to be distributed among the up to 100 health centers, but also the broader health center community.

Task 14: Security Requirements

The Contractor shall:

1. Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2. Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses, as needed.

3. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution. The Contractor will have access to claims data and protected medical information during the assessment of Program processes.

* See the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

4. Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by HHS or collected by the Contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records).

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

mailto:fisma@hhs.gov

5. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HRSA non-disclosure agreement, Attachment B. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition

6. Training

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/HRSA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete HHS/HRSA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. The training records shall be provided to the CO and/or COR within 30 business days after contract award and annually thereafter or upon request.

7. Rules of Behavior

a. The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, the HRSA Information Technology Rules of Behavior (included in the HRSA Information Security and Privacy Awareness Training), and any applicable system-level rules of behavior.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HRSA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable.

8. Incident Response

a. FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

b. A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for anything other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

c. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so, instructed by the Contracting Officer or representative, the Contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Security Operations Center (SOC), COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

• Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach.

• Not include any sensitive information in the subject or body of any reporting e-mail; and

• Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, HHS, and HRSA incident response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

9. Position Sensitivity Designations

a. All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The position sensitivity designation level that applies to this solicitation/contract is a non-sensitive Tier 2 moderate risk background investigation will be processed for the contractors working this program.

10. Homeland Security Presidential Directive (HSPD)-12

a. The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

* For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12

b. Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR, with a copy to the Contracting Officer, within 14 business days of the EDOC. Any revisions to the roster as a result of staffing changes shall be submitted within 14 business days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

11. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the Contractor shall follow the HRSA EPLC framework and methodology (https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared Documents/z_Old PMO Archives/Documents.aspx) and in accordance with the HHS Contract Closeout Guide (2012).

* HHS EA requirements may be located at:

https://www.hhs.gov/ocio/ea/documents/proplans.html

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared%20Documents/z_Old%20PMO%20Archives/Documents.aspx https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared%20Documents/z_Old%20PMO%20Archives/Documents.aspx https://www.hhs.gov/ocio/ea/documents/proplans.html minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 10 business days before an employee stop working under this contract.

e. Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or HRSA policies.

f. The Contractor (and/or any subcontractor) shall perform and document the actions identified in the HRSA Contractor Employee Separation Checklist when an employee terminates work under this contract within 10 business days of the employee’s exit from the contract. All documentation shall be made available to the CO and/or COR upon request.

Task 15: Use of Plain Language Guidelines and Other Government Laws and Regulations for all Products

The Contractor shall:

1. Follow the federal Plain Language Guidelines when developing products. The Plain Language Act of 2010 requires federal agencies to create communications that are clear and understandable to the public.

2. Produce content that follows federal plain language guidelines. All text content must aim for a Flesch-Kinkaid Reading Ease score of at least 60. HRSA’s Office of Communications’ liaisons use Readable to review, update, and score content. Contractor shall work with the COR and program communications liaisons and use Readable to review, score and enhance the content.

3. Use PlainLanguage.gov’s Checklist for Plain Language and HHS’s Plain Writing Checklist as guidelines.

4. Ensure that all materials adhere to federal copyright laws including the citation of sources in endnotes or footnotes; obtaining written permission to reproduce, reprint, or adapt existing materials used in the creation of materials under this contract; and including credits for images, which include photographs, pictures, illustrations, tables, charts, figures, and graphs.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fplainlanguage.gov%2Fguidelines%2F&data=05%7C01%7CSSrivastava%40hrsa.gov%7C203e8eb984634a0e76fe08dadebdff9a%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638067205309051195%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=EdepGtxxln%2BUbP%2FcG8ttwHeo42ZSJFR69tUCHvLGt28%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Freadable.com%2Fblog%2Fthe-flesch-reading-ease-and-flesch-kincaid-grade-level%2F&data=05%7C01%7CSSrivastava%40hrsa.gov%7C203e8eb984634a0e76fe08dadebdff9a%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638067205309051195%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=RRhPjC%2F58Ez1L6Ks2A9a6orVcwLjA5EAkQoVGBfFHJo%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Freadable.com%2F&data=05%7C01%7CSSrivastava%40hrsa.gov%7C203e8eb984634a0e76fe08dadebdff9a%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638067205309051195%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=8wMJdpWASN84eZHqq3bY3wdYMe91NDn0%2BWoEWkIeVEY%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.plainlanguage.gov%2Fresources%2Fchecklists%2Fchecklist%2F&data=05%7C01%7CSSrivastava%40hrsa.gov%7C203e8eb984634a0e76fe08dadebdff9a%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638067205309051195%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=Ig3D4kwyIVjDUM5wkLzqwB07%2BthEegE9qJZfKJ4P4FQ%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.hhs.gov%2Fweb%2Fbuilding-and-managing-websites%2Fmanaging-websites%2Fplain-writing-checklist%2Findex.html&data=05%7C01%7CSSrivastava%40hrsa.gov%7C203e8eb984634a0e76fe08dadebdff9a%7C14b77578977342d58507251ca2dc2b06%7C0%7C0%7C638067205309207451%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=waL2hdgFP3zpSJza2WdI575ZCu38InWI5KSzibXppuI%3D&reserved=0

5. Ensure that all materials adhere to the Government Printing and Binding Regulations, including the prohibition on commercial advertising which says, “No Government publication or other Government printed matter, prepared or produced with either appropriated or nonappropriated funds or identified with an activity of the Government, shall contain any advertisement inserted by or for any private individual, firm, or corporation; or contain material which implies in any manner that the Government endorses or favors any specific commercial product, commodity, or service.” -- (Title III--General Provisions, 13. Advertisements, Commercial.)

6. Ensure that all materials do not contain any non-federal logos (since logos are a form of institutional advertising); that materials do not contain contact information for non-federal organizations, except the website address for informational purposes; and that all materials do not contain any contact information for individuals.

7. Ensure that all materials do not contain the name of the contractor or subcontractors since this is also a form of advertising.

8. Ensure that all materials adhere to the prohibition against referring to lobbying in materials produced with appropriated funds. The prohibition against lobbying also includes grassroots lobbying, which is advocating for a change in legislation at the federal, state, or community level.

Optional Tasks

Optional Task One (1): Technical Assistance Sessions (May be exercised up to four (4) times during each contract performance period)

The Contractor shall:

Provide virtual TA sessions using the Project ECHO-like model to 25 health centers, as determined by the COR.

Optional Task Two (2): Dissemination – White Paper (May be exercised up to two (2) during each contract performance period)

The Contractor shall:

Draft a white paper, to detail the relationship between long COVID and chronic diseases. This paper may include what chronic conditions are more likely to result in a diagnosis of long COVID. This paper will ultimately be shared with the larger health center community.

V. Schedule of Deliverables

The Contractor shall:

1. Ensure all products and services delivered under this contract are compliant with Section 508 in accordance with the Health and Human Services Acquisition Regulation (HHSAR). These Section 508 Standards were issued by the United States Access Board (https://www.access-board.gov/) and published in the Federal Register, on January 18, 2017, as the final https://www.access-board.gov/ https://www.access-board.gov/ https://www.access-board.gov/ https://sharepoint.hrsa.gov/oo/oit/dcppm/Pages/final%20rule rule (https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule).