COVID-19 Low Literacy Messaging SOW DRAFT.docx

Statement of Work

Requisition #00HCBCD9-2020-46611

Title of Project:

COVID-19 and Emergency Preparedness Messaging to Improve Communication to and Engagement of People with Disabilities and other Vulnerable Populations who have Extreme Low Literacy

C.1 Background and Need:

In December 2019, the novel coronavirus (COVID-19) emerged in Wuhan, China and, since that time, has quickly become a global pandemic – with cases reported in every country. The U.S. Centers for Disease Control and Prevention (CDC) is working to provide life-saving up-to-date information to keep people healthy in the U.S. and around the world. COVID-19 has brought about a renewed call for public health action to address the needs of people with disabilities and other vulnerable populations - not only during COVID19, but also to build sustainable public health capacity to meet ongoing and future public health and emergency response situations. Without effective communication tools, mechanisms, and messages that resonate with people with varying types of disability, the health and safety of these populations and the community at large is at risk. Lessons learned from communications research and product development and dissemination can also be applied to future emergency response scenarios as well as ongoing enhancements to the health care system that serves vulnerable populations.

The Community Intervention and At-Risk Task Force (CIARTF) resides within the Emergency Operations Center at CDC. The CIARTF seeks to develop messages for people with different types of disabilities as well as their caregivers and health care providers who serve this population in order to emphasize the importance of COVID-19 prevention, testing, and treatment. In order to enhance the reach and use of these messages and materials, the CIARTF seeks to develop messages geared toward people with basic and below basic literacy skills (extreme low literacy).* Many people with disabilities fall under one of these two groups. Formative testing is needed to understand the unique COVID-19 messaging needs of people with varying disability types who have basic and below basic literacy skills, as well as messaging needs for people without disabilities who have basic and below basic literacy skills due to other factors (e.g., non-English native speakers, native and indigenous populations, low education and SES status). Formative testing is also needed to identify the best mediums and avenues for disseminating these COVID-19 messages and materials. In addition, the CIARTF seeks to utilize these findings to inform the creation of national standards for below basic literacy to update and adapt existing COVID-19 messages and materials for people with disabilities. This work and these findings will have the immediate application to COVID-19, but the intention is to inform sustainable practices that can be applied to ongoing and future public health responses.

Direct-to- persons with disability communication An estimated one in four, or 61 million adults in the U.S.1 and over one billion worldwide2, has a disability. Okoro et al3 (2018) found differences in disability prevalence – ranging from 13.7% of adults reporting limitations in mobility, 10.8% in cognition, 6.8% in independent living, 5.9% in hearing, 4.6% in vision, and 3.7% in self-care. Some people with disabilities live independently, while others receive caregiver support or reside in a congregate care setting. For example, according to the American Association on Intellectual and Developmental Disabilities (AAIDD)3, most people in the U.S. with Intellectual and Developmental Disabilities live with their families and many need long term caregiving support. Others live in community or small congregate care settings with individualized or small group support.

Although having a disability itself is not a risk factor for poor health outcomes or other health conditions, people with disabilities face many challenges to achieving optimal health and accessing high quality health care. Studies show that, compared to people without disabilities, people with disabilities have more depression and anxiety, lack of access to health care, and engage more often in risky health behaviors like smoking and a lack of physical activity.4-6 Poor health outcomes can result from a lack of access to health care resources, lack of health care provider knowledge about the unique needs related to different types of disabilities, transportation difficulties, and lower income among people with disabilities.7 There has been recent and increasing attention being paid to accessibility for people with disabilities; however, this is not just physical access, but communication access as well.

Healthy People defines health literacy as “the degree to which individuals have the capacity to obtain, process, and understand basic health information and services needed to make appropriate health decisions.”8 According to the U.S. Department of Health and Human Services’ (2010) National Action Plan to Improve Health Literacy,8 almost 20 years of research point to the sobering finding that most U.S. adults can’t understand health information in the way that it is usually presented. An astounding 90% of adults report difficulty acting on the information that is routinely given out in health care and community settings.9-11 This lack of understanding can result in poor health outcomes, some of which can be life-threatening, negatively impacts the ability to find useful and relevant health information, make positive health decisions, and act on important health guidance.12 While no one group of people is more susceptible to limited health literacy, people with lower socioeconomic levels and members of minority groups are disproportionately impacted.13 As outlined in an article in Pharmacy and Therapeutics, “Poor health literacy is a stronger predictor of a person’s health than age, income, employment status, education level, and race. Groups with the highest prevalence of chronic disease and the greatest need for health care have the least ability to read and comprehend the information needed to function as patients.14 Limited health literacy is also associated with a large number of adverse health outcomes.”15-21 While limited health literacy is of great national concern, an additional challenge is how to reach the almost 30 million U.S. adults who have “below basic” health literacy skills.24 These individuals generally have difficulty following simple directions. In addition, according to a report of the National Adult Literacy Survey, “the 54 million adults with any type of disability, difficulty, or illness are especially vulnerable and more likely to perform at the lowest literacy levels.”22 Developing and using communication strategies that can reach people with disabilities, in particular disabilities that impact one’s cognition and adaptive functioning such as people with Intellectual and Developmental Disabilities, can help ensure that important public health messages are understood and actionable by as wide an audience as possible. These can include the use of symbols, graphics, and visuals that can help facilitate understanding of concepts for people with basic or below basic health literacy skills. Finally, many infectious disease outbreaks such as the recent COVID-19 disproportionately impact persons in congregate and long-term care facilities – settings where many people with IDD reside. Ensuring that these settings, and the individuals in these settings, receive critical public health information in a way that meets their literacy needs, can help keep residents healthy.

With U.S. adults, both with and without disabilities, of all literacy levels trying to keep themselves and their loved ones safe during the current COVID-19 pandemic, the need for relevant, effective, and timely literacy resources, and in particular below basic health literacy resources, is perhaps more critical than ever.

Reaching People with Disabilities through Health Care Providers Health professionals need to be aware of how to effectively communicate with patients who have a range of disabilities, including IDD, and have the tools needed to be able to have effective communication with their patients. These professionals play a critical role in identifying and intervening with people with disabilities, as well as with their caregivers. However, data show that health care providers report communication challenges as a primary barrier to providing high quality care for people with disabilities.23 Similarly, according to a national survey, challenges communicating with clinicians was noted significantly more often among persons with disability than persons without disability. Specific concerns that were noted included patients feeling as if they were not being listened to or being engaged in decisions about their own health or treatment options.24 These challenges can be especially difficult for the millions of U.S. adults with extreme low literacy skills.

While the Americans with Disabilities Act (ADA) and Section 504 of the Rehabilitation Act of 1973 (Section 504) require that health care providers use tools and resources that support effective communication with their patients, for people with disabilities, it appears that ineffective patient-provider communication remains a significant concern. National standards can help health care providers and public health professionals and organizations overcome these barriers. These standards can also help to ensure that potentially lifesaving COVID-19 messages are reaching people with disabilities, and many other vulnerable populations, in a relevant and actionable way.

*From Cutilli CC, Bennett IM. Understanding the health literacy of America: results of the National Assessment of Adult Literacy. Orthop Nurs. 2009;28(1):27‐34. “Below basic literacy level is described as ‘no more than the most simple and concrete literacy skills. Individuals with this skill level range from being nonliterate to having the ability to find simple information in everyday prose text and in simple documents such as charts or forms and use numbers found on quantitative material to complete simple mathematical operations (addition). This level of literacy is well below that needed to function within the healthcare setting. Basic literacy level refers to ‘skills necessary to perform simple and everyday literacy activities’ (Kutner et al., 2007, p. 4). Individuals at this level are able to read, understand, and use information in short, simple, everyday prose text, documents, and quantitative material (one-step problem with simple arithmetic operation).”

C.2 Project Objective:

The objectives of this project are 1) to develop relevant, accessible, actionable, and timely messages and materials for people with at least one of 6 functional disability types3 and other vulnerable populations who have basic and below basic health literacy skills about important COVID-19 information including but not limited to prevention, symptom identification, testing, and treatment. 2) to provide relevant technical assistance, guidance and resources for caregivers of people with disabilities, disability-serving partner organizations, and health care providers to deliver messages to patients with disabilities and other vulnerable populations who have basic and below basic health literacy skills about the prevention, testing and treatment of COVID-19; and 3) to use findings to inform the creation of health communication national standards for people with disabilities and other vulnerable populations who have basic and below basic literacy skills. These standards will be applicable beyond the current COVID pandemic and will help support capacity of public health organizations and professionals to address future public health responses.

C.3 Scope of work:

Activities shall include the development and dissemination of multi-tiered, accessible, interactive, and English and Spanish resources for

· People with at least one of 6 functional disability types who have basic and below basic health literacy skills,

· Other vulnerable populations who have basic and below basic health literacy skills,

· Caregivers of people with disabilities,

· Disability-serving partner organizations, and

· Health care providers The contractor shall develop and disseminate resources about important COVID-19 information including but not limited to prevention, symptom identification, testing, and treatment. Resources can include the use of symbols, visuals, and graphical elements to communicate critical health information.

Activities shall also include the development of national standards for effective health communication for people with disabilities and other vulnerable populations who have basic and below basic literacy skills. These standards will be applicable beyond the current COVID pandemic and will help support capacity of public health organizations and professionals to address future public health responses.

The contractor, as an independent organization and not an agent of the Government, shall furnish all labor, equipment, materials, supplies, and other costs required to carry out the requirements of this project.

Specific requirements:

Task 1: Project Management

A. Kickoff Meeting The Contractor shall conduct a kick-off meeting by teleconference with the sponsor Project Officer and other government staff identified by the Contracting Officers Representatives and Technical Monitor within 5 days of the effective date of this agreement to review the activity plan submitted by the contractor in response to the contract request and jointly make adjustments as appropriate. The Contractor shall provide written notes of the meeting to the kick-off meeting participants within one week of the conference call.

B. Work Plan Following the kick off meeting, the contractor shall develop a written work plan, minimally including all essential interim and final deliverables, key staff responsible for tasks (including contractor, CDC or other partners), schedule of key deadlines (including review cycles and absolute No Later Than (NLT) dates for key activities and deliverables) and clarifications or updates specific to each task in greater detail than may have been included in the original proposal (for Contracting Officer Representative (COR) review and correction before acceptance). The work plan must contain:

i. a series of specific reports and activities proposed by the contractor following the kick-off meeting, to be developed by the contractor during the course of the project, inclusive of the contractor’s plan for ongoing monitoring and evaluation of services to assure high quality performance and customer satisfaction.

ii. hours of operation,

iii. contractor plan for employee management including how the contractor will avoid any appearances of personal services by the CDC, and

iv. the contractor’s plan to maintain services during emergencies, such as government shutdown, building closure, inclement weather, telework, etc. or similar (infrequent) surge efforts for peak room usage for large scale events.

The work plan should be a distributable document for sharing with key CDC management/staff impacted by this project, as needed. The work plan is due no later than 5 working days following the kickoff meeting. The work plan (and any schedule of interim deliverables) may be revised according to CDC acceptance of the updated work plan by the COR during the project with the restriction that these changes must not impact the overall period of performance, scope, or specifications of the award, or otherwise impinge on the authority of the contracting officer. It is the responsibility of the contractor to fully understand what changes require contracting officer approval.

C. Monthly Reporting The Contractor shall deliver a written monthly report in electronic format to the CDC Contracting Officer’s Representative (COR) and Contracting Officer.

The report will include:

· A description of activities during the prior Quarter

· Copies of any materials developed

· Challenges and suggestions for solutions

· Changes in project staff

· Other information as requested by the Project Officer

D. Conference Calls The contractor shall communicate via conference call or email with CDC at least twice per month throughout the period of performance.

Task 2: Environmental Scan

a. Environmental scan of existing literature and resources to guide study approach, material development, implementation

i. previous relevant research and programmatic efforts related to communication for people with at least one of 6 functional disability types and other vulnerable populations (e.g., non-English native speakers, native and indigenous populations, low education and SES status) with extreme low literacy

ii. challenges associated with messaging related to people with at least one of 6 functional disability types and other vulnerable populations with extreme low literacy and list of current messages to be tested,

iii. provider practices around communicating with people with at least one of 6 functional disability types and other vulnerable populations with extreme low literacy, and

iv. existing resources and outlets for dissemination used to promote health messages to people with at least one of 6 functional disability types and other vulnerable populations with extreme low literacy

Task 3: Development of Concept and Message Testing Plan

a. Conduct virtual interviews with subject matter experts (SMEs) to solicit feedback on existing draft concepts/products and current CDC messaging (prior to OMB approval) - in both English and Spanish

i. identify a list of 9 SMEs and develop interview questions

ii. conduct interviews and summarize interview data

b. Concept and Message Testing Plan – Develop a concept and message testing plan that includes information on how insights from people with at least one of 6 functional disability types who have basic and below basic literacy skills, their caregivers, members of other vulnerable populations who have basic and below basic literacy, and healthcare providers who serve people with disabilities will be obtained. Separate consideration might need to be given to disability types. For example, people with vision loss will have different challenges with literacy as compared to people with another functional disability.

c. The main focus of the testing plan is to:

i. Test existing concepts developed through other emergency response communications work

ii. Test messaging commonly used by CDC and its partners

iii. Test messaging in both English and Spanish

The plan should include what methods will be used to obtain insights from these audiences, including where the data collection will take place geographically and how such locations are determined. Note: Given the social distancing recommendations, in particular for people with medical issues or underlying medical issues, data collection methods will be limited to remote, virtual methods such as online message/concept testing options.

This plan (including research approach, moderator guides, data collection tools, and other materials required by OMB) will serve as the basis for the OMB clearance package.

OMB Clearance Package – development of a draft OMB package (Information Collection Request) containing all relevant questions, data collection tools, and background information necessary; plan to use the expedited GenIC Health Message Testing System, or HMTS (OMB number 0920-0572).

Task 4: Implementation of Concept and Message Testing Plan

a. Implement the Concept and Message Testing Plan – Implement the plan to:

i. Using existing COVID-19 communications resources along with new draft concepts, conduct robust virtual, remote, and online in-depth interviews, focus groups, and social listening, in both English and Spanish, with

· People with one of 6 functional disability types with basic and below basic literacy skills (considering unique needs by disability type),

· Caregivers of people with one of 6 functional disability types,

· Disability-serving partner organizations, and

· Healthcare providers who serve people with disabilities

· People without disabilities who have basic and below basic literacy skills due to factors that include non-English native speakers, native and indigenous populations, low education and SES status, etc.

to determine communication needs related to COVID-19 as well as future emergency response situations for people with disabilities and other vulnerable populations with basic and below basic literacy skills. This would also include identification of audience-appropriate outlets for dissemination of developed materials, messages, and resources.

If relevant from assessment conducted in Tasks 2 and 3, scope of work would include using previously developed materials and messages to

· Assess continued relevance

· Assess relevance to people with one of 6 functional disability types

· Assess additional needs

· Assess audience-appropriate outlets for message and material dissemination

ii. Vendor will consider need to work with an organization with subject matter expertise (e.g., academic institution) in extreme low literacy to develop symbolic, below basic, and basic communication messages, materials, and resources to be tested. This would include scripts for American Sign Language (ASL) videos, and forms of literacy for people who are blind and with low vision, ranging from tactile symbols and object calendar boxes to print and braille.

b. Summarize Testing Findings – Analyze and summarize testing findings (include all topline summaries, transcripts, etc.)

Task 5: Messaging, Materials, and Dissemination Plan Development

a. Develop up to 10 materials, messages, and resources for target audiences

i. Using findings from Task 4, develop suite of extreme low literacy messages, materials, and resources on topics including prevention, testing and treatment of COVID-19, in both English and Spanish, for:

i. People with one of 6 functional disability types with basic and below basic literacy skills, and

ii. People without disabilities who have basic and below basic literacy skills due to factors that include non-English native speakers, native and indigenous populations, low education and SES status, etc.

ii. Using findings from Task 4, develop suite of extreme low literacy messages, materials, and resources on topics including prevention, testing and treatment of COVID-19, in both English and Spanish, that can be used by:

i. Caregivers of people with one of 6 functional disability types,

ii. Disability-serving partner organizations, and

iii. Healthcare providers who serve people with disabilities and other vulnerable populations with extreme low literacy to communicate effectively with people with disabilities and other vulnerable populations who have extreme low literacy skills

iii. Using findings from Task 4, develop suite of extreme low literacy messages, materials, and resources that can be applied to future emergency response scenarios.

i. This would include scripts for ASL videos, and forms of literacy for people who are blind and with low vision, ranging from tactile symbols and object calendar boxes to print and braille. Innovative ways to reach target audiences are desired.

b. Identify, and develop a plan for, the most relevant outlets and avenues for dissemination of materials, messages, and resources for target audiences to include:

i. Written

ii. Graphics/visuals

iii. Narrated information/scripts

iv. Web content

v. Television

vi. Radio

vii. Social media

Task 6: Development of national standards on emergency response communication best practices for people with disabilities with basic and below basic literacy skills and their caregivers.

a. Using findings from Tasks 1 - 5, develop a draft and final version of a national standards best practices document that can be applied to development of emergency response communication for people with disabilities with basic and below basic literacy skills and their caregivers

b. Develop a group of experts with representatives from multiple partner groups, including but not limited to, academicians with extreme low literacy expertise, people with disabilities, partner organizations who serve vulnerable populations, caregivers, and healthcare providers

c. Using findings from Tasks 1 - 5, develop curriculum for target audience including, but not limited to, health care providers, caregivers, and ASL interpreter trainings that integrates national standards on emergency response communication best practices for people with disabilities with basic and below basic literacy skills

d. Using findings from Task 4, develop content for, and coordinate execution of, up to 3 webinars to disseminate findings to audiences including:

i. People with disabilities who have basic and below basic literacy

ii. Caregivers of people with disabilities

iii. Disability-serving partner organizations and other partners who serve vulnerable populations with have basic and below basic literacy

iv. Health care providers

v. Public health organizations

Task 7: Development of an evaluation report

a. Report would include process and outcome evaluation metrics throughout the project period to include reach, frequency, and impact measurement

Task 8: Draft development of up to 3 peer-reviewed publications

a. In collaboration with sub-awardees and CDC, develop up to 3 peer-reviewed publications on:

a. Communications research process and outcomes

b. National standards

c. Evaluation

Task 9: Submission of Final Products

a. Submit final portfolio of materials to CDC to include

i. Summary report of SME feedback on draft concepts and messaging

ii. Final analysis and summary report from concept and message testing with all target audiences

iii. National standards best practices final document

iv. Up to 10 final communication products

v. Final PowerPoint presentation summarizing key findings from the formative research and showcasing new communication products

vi. Final Evaluation report

vii. Draft peer-reviewed publications

C.4 Technical Requirements:

The contractor shall create materials, messages, and resources for people with disabilities and other vulnerable populations who have basic and below basic literacy skills, caregivers of people with disabilities, disability-serving partner organizations, and health care providers.

The contractor shall create health communication national standards. These standards will be applicable beyond the current COVID-19 pandemic and will help support capacity of public health organizations and professionals to address future public health responses.

All resources created will be made freely available to the public, and in English and Spanish-language as needed and relevant. All electronic materials shall be compliant with government requirements for 508 accessibility.

C.5 Reporting Schedule:

The Contractor shall communicate via conference call or written report with CDC monthly throughout the period of performance.

C.6 Period of Performance:

The period of performance for this award is 24 months from the date of contract award.

C.7. Place of Performance:

Given the current COVID-19 situation and impact on travel and on personal health, testing with target audiences will be done virtually. However, target audiences selected for testing should be demographically and geographically diverse.

C.8 Special considerations: TBD

C.9 Government Furnished Property: N/A

C.10 References:

1. Okoro CA, Hollis ND, Cyrus AC, Griffin-Blake S. Prevalence of Disabilities and Health Care Access by Disability Status and Type Among Adults — United States, 2016. MMWR Morb Mortal Wkly Rep 2018;67:882–887. DOI: http://dx.doi.org/10.15585/mmwr.mm6732a3external icon.

2. UN World Health Organization (WHO), World Report on Disability : Summary, 2011,WHO/NMH/VIP/11.01,available at: http://www.refworld.org/docid/50854a322.htmlexternal icon; accessed January 7, 2015

3. AAIDD. Joint Position Statement of AAIDD and The Arc: Long term support and services. 2020. Available at https://www.aaidd.org/news-policy/policy/position-statements/long-term-supports-and-services

4. Okoro CA, McKnight-Eily LR, Strine TW, Crews JE, Holt JB, Balluz LS. State and local area estimates of depression and anxiety among adults with disabilities in 2006. Disability & Health Journal. 2011;4(2):78-90.

5. Thompson WW, Zack MM, Krahn GL, Andresen EM, Barile JP. Health-Related Quality of Life Among Older Adults With and Without Functional Limitations. American Journal of Public Health. 2012 2012/03/01;102(3):496-502.;

6. Courtney-Long E, Stevens A, Caraballo R, Ramon I, Armour BS. Disparities in Current Cigarette Smoking Prevalence by Type of Disability. Public Health Reports. 2014 May/June; 129(3):252-60.

7. CDC. Disability and Health Information for Health Care Providers. 2019; Available at https://www.cdc.gov/ncbddd/disabilityandhealth/hcp.html

8. U.S. Department of Health and Human Services. (2000). Healthy People 2010 (2nd ed.) [with Understanding and Improving Health (vol. 1) and Objectives for Improving Health (vol. 2)]. Washington, DC: U.S. Government Printing Office.

9. U.S. Department of Health and Human Services, Office of Disease Prevention and Health Promotion. (2010). National Action Plan to Improve Health Literacy. Washington, DC.

10. Nielsen-Bohlman, L., Panzer, A. M., & Kindig, D. A. (Eds.). (2004). Health literacy: A prescription to end confusion. Washington, DC: National Academies Press.

11. Kutner, M., Greenberg, E., Jin, Y., & Paulsen, C. (2006). The health literacy of America’s adults: Results from the 2003 National Assessment of Adult Literacy (NCES 2006-483). Washington, DC: U.S. Department of Education, National Center for Education Statistics.

12. Rudd, R. E., Anderson, J. E., Oppenheimer, S., & Nath, C. (2007). Health literacy: An update of public health and medical literature. In J. P. Comings, B. Garner, & C. Smith. (Eds.), Review of adult learning and literacy (vol. 7) (pp 175–204). Mahwah, NJ: Lawrence Erlbaum Associates.

13. Berkman, N. D., DeWalt, D. A., Pignone, M. P., Sheridan, S. L., Lohr, K. N., Lux, L., et al. (2004). Literacy and health outcomes (AHRQ Publication No. 04-E007-2). Rockville, MD: Agency for Healthcare Research and Quality.

14. Health literacy: Report on the Council of Scientific Affairs, Ad Hoc Committee on Health Literacy for the Council on Scientific Affairs, American Medical Association. JAMA. 1999;281(16):552–557.

15. Institute of Medicine. Health Literacy: A Prescription to End Confusion. Washington, D.C.: National Academy of Science; 2004.

16. DeWalt DA, Berkman ND, Sheridan SL, et al. Literacy and health outcomes: A systematic review of the literature. J Gen Intern Med. 2004;19:1228–1239.

17. Paasche-Orlow MK, Wolf MS. The causal pathways linking health literacy to health outcomes. Am J Health Behav. 2007;31(Suppl 1):S19–S26.

18. Rothman RL, Dewalt DA, Malone R, et al. Influence of patient literacy on the effectiveness of primary care-based diabetes disease management program. JAMA. 2004;292:1711–1716.

19. Schillinger D, Bindman AB, Wang F, et al. Functional health literacy and the quality of physician–patient communication among diabetes patients. Patient Educ Couns. 2004;52(3):315–323.

20. Wils A. On Accelerating the Global Literacy Transition. Cambridge Mass: Harvard University, Kennedy School of Government; 2002.

21. Schillinger D, Barton LR, Karter AJ, et al. Does literacy mediate the relationship between education and health outcomes? A study of a low-income population with diabetes. Public Health Rep. 2006;121(3):245–254

22. Kirsch, I. S., Jungeblut, A., Jenkins, L., & Kolstad, A. (1993). Adult literacy in America: A first look at the findings of the National Adult Literacy Survey (NCES 93275). Washington, DC: U.S. Department of Education.

23. The World Report on Disability. Geneva: World Health Organization and The World Bank; 2011.

24. Smith DL. Disparities in patient-physician communication for persons with a disability from the 2006 Medical Expenditure Panel Survey (MEPS). Disabil Health J. 2009;2(4):206.

C.11 Deliverables:

The Contractor shall submit the following deliverables to the CDC Contracting Officers Representative and Technical Monitor no later than the timeframe specified.

Schedule of Deliverables All deliverables intended for communication to the public must comply with Public Law 111–274, the Plain Writing Act of 2010. For Plain Language information and the Federal Plain Language Guidelines see www.plainlanguage.gov.

The schedule of interim deliverables may be adjusted by mutual agreement between the contractor and the CDC Technical Monitor and COR, as long as the end of the period of performance is not changed without express written approval by the CDC Contracting Officer.

C. 12. Point of Contact

Technical Monitor

TBD

COR

TBD

Requirements for Information Security and/or Physical Access Security Information Security Requirements

1. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

· Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

· Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

· Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed..

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A-130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

4) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

5) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

6) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

7) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

8) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

9) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

10) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR and ISSO within 30 days of contract award.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

11) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

12) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the CDC Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the CDC SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

b. The Contractor shall assist the CDC SOP or designee in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC specific Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, and any CDC-specific rules, as applicable.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual CDC Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/CDC CSIRT teams within 24 hours, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or…