EHR Data Pilot Program SOO Amendment 1.docx

STATEMENT OF OBJECTIVE

NATIONAL ELECTRONIC INJURY SURVEILLANCE SYSTEM (NEISS) – Obtaining Information from Electronic Health Records

1. DESCRIPTION OF SERVICES

The Consumer Product Safety Commission (CPSC) collects data from a random sample of hospital emergency departments nationwide. This allows the agency to make national estimates of consumer product injuries. The current practice involves a hospital employee or 3rd party coder reviewing every medical record in a NEISS hospital and determining which records were associated with a consumer product (roughly 10% of patients seen in emergency departments). The coder then hand codes information from the medical record into a proprietary software application for quality control review and ultimately acceptance by CPSC. Currently, the agency reviews roughly 4 million medical records and codes roughly 400,000 that involve consumer products into the NEISS system. This proof-of-concept project is intended to identify ways to replace a process that is manual, laborious, and prone to human error. CPSC seeks to make use of Electronic Health Records (EHRs) that are either delivered directly to the agency or to a 3rd party to be filtered for consumer product associations and for coding of the key NEISS variables[footnoteRef:2]. These EHRs would include both structured and unstructured data including the clinical notes (intake, triage, nurses’, doctors’ and discharge notes). The EHRs clinical notes are an essential component as they are the place where consumer products are likely to appear as well as a synopsis of the injury scenario. Ideally, the resulting data would be highly comparable data to the historic NEISS data and thus trend analyses between legacy NEISS data and data collected via this new approach would not be adversely impacted. [2: https://www.cpsc.gov/s3fs-public/JANUARY-2025-NEISS-CPSC-only-Coding-Manual-Rev-1.pdf?VersionId=RxQ0jRb8mHK.z2CrX2iG385fkC8sZjnm]

2. SERVICES AND PRICES

The Contractor shall provide pricing in accordance with the Instructions to Offerors section at the end of this document.

3. CONTRACT TYPE

This is a fixed price, not to exceed contract for a proof-of-concept solution to achieve the objectives outlined in this SOO. It includes a base period and option years. Option years may include further delivery of prospective data and/or continued delivery of artificial intelligence/machine learning (AI/ML) services.

4. BACKGROUND

A. The U.S. Consumer Product Safety Commission (CPSC) administers the Consumer Product Safety Act, the Flammable Fabrics Act, the Federal Hazardous Substances Act, the Poison Prevention Packaging Act, the Refrigerator Safety Act, the Consumer Product Safety Improvement Act, and other acts related to consumer product safety.

B. The primary purpose of these acts is to protect the public against unreasonable risks of injury or death associated with consumer products. The Consumer Product Safety Act specifically states that the Commission will conduct research, studies, and investigations on the safety of consumer products and offer training in product safety investigation and test methods.

C. The Commission collects information on injuries associated with consumer products by several data systems, including NEISS. This system consists of statistically selected hospitals that report information on product-associated emergency department cases to the Commission on a daily basis. Some hospitals use an employee to identify and code the relevant information and to transmit it electronically to CPSC via an encrypted computer or through a secure web-based system. Other hospitals elect to allow a third party to identify, code, and transmit the data. The data collected from the hospitals are compiled and provided to Commission analysts to identify consumer products that are associated with serious and/or prevalent injuries that are treated in hospital emergency departments. Since these data are collected from statistically selected hospitals, estimates can be projected to the national population as to the number and type of injuries involving individual consumer products. Manufacturers, distributors, retailers and consumers, as well as the Commission and other government agencies, use such data in de-identified form, which shall be de-identified pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). 45 CFR §164.514(b)(1) or 45 CFR §164.514(b)(2), to assess the safety of consumer products, and to determine which products require further in-depth study to identify specific hazard patterns that may be associated with them. CPSC is a Common Rule Signatory meaning it adheres to the Federal Policy for the Protection of Human Subjects under 16 CFR Part 1028 under 5 U.S.C. 301; 42 U.S.C. 300v-1(b).

D. When a product is selected for more in-depth study, the Commission supplements the basic emergency department data collected through the NEISS with a follow-up inquiry on selected injury events. In such a case, either the patient's name, address and telephone number is obtained by the Commission from the hospital or the hospital directly contacts the patient (or parent of child patient) seeking permission for the hospital to supply the patient’s name, address and telephone number to CPSC for a follow-up inquiry. The patient (or parent of child patient) is contacted and, with his/her consent, information about the product's use and causal factors is obtained, typically in a web-based structured questionnaire. Some examples of past questionnaires are injuries related to fireworks, furniture tip-over, and electric scooters. Patient identification is destroyed by the Commission when the inquiry is completed. By combining this information with the basic emergency department surveillance data, the Commission can better understand consumer product-related injuries and evaluate specific hazard and injury patterns together with potential corrective actions.

E. The Consumer Product Safety Act provides that "No person shall be subject to civil liability to any person (other than the Commission or the United States) for disclosing information at the request of the Commission." 15 U.S.C. 2076(d).

F. The CPSC is authorized by Congress under law to collect data on consumer product-related deaths and injuries. The CPSC is considered a public health authority under the medical requirements of HIPAA (see HIPAA Federal Register Notice attached). Hospitals are thus permitted to disclose protected health information without authorization for specified health purposes (i.e., participate in the NEISS).

5. OBJECTIVES

The objective of this SOO is to provide the Commission with timely (i.e., within 10 business days) consumer product injury data from hospital emergency departments that will allow the agency to use AI/ML to identify all consumer product-related injuries and code all the variables in the NEISS. This proof of concept includes the potential expansion to additional emergency departments not part of the current NEISS sample, as well as other treatment settings for product related injuries including clinics, urgent care, etc. The agency currently obtains about 400,000 coded consumer product injury records annually after the review of more than 4 million records. CPSC seeks to reach a similar or larger scale in terms of the records the agency obtains annually, however, it does not require contractors meet that number of records for their proof of concept project.

6. DATA ELEMENTS SOUGHT:

For each of these records, data is entered into the agency’s proprietary software to capture the date of treatment, the victim’s age and sex, the location of the incident (where known, for example at home, school, industrial place, etc.), fire involvement (where known), the victim’s race/ethnicity (where known), up to two body parts involved, up to two diagnoses, the date of birth for children under age 2 (where known), whether an injury involving a child was intentional self-harm, the disposition (e.g. treated and released, admitted to the hospital, left without being seen, etc.), up to 3 CPSC product codes, drug or alcohol involvement, and a brief narrative description of the incident. A hospital case number is also included (but never published by the agency) to permit traceability for purposes of quality control and potential victim recontact. An example of a coded NEISS record can be seen here:

7. COMPONENTS TO CONSIDER IN RESPONDING

Independently, and not as an agent of the U.S. Consumer Product Safety Commission (CPSC), the Contractor shall provide the personnel and facilities necessary to electronically transmit data on specified cases treated in the NEISS hospitals’ emergency departments.

In pursuit of timely injury data reporting, multiple solutions may be acceptable in reaching the desired end state. CPSC desires solutions that prioritize accuracy of records and access to data. The following solutions may meet CPSC’s requirements. Contractors must identify their solution and how it meets the objectives of this SOO.

A. EHRs with Clinical Notes from Existing NEISS Hospital(s)

1. An essential step into converting an electronic health record to a fully coded NEISS record is the availability of training data. CPSC’s current and historical NEISS data is suited for this purpose provided the NEISS record can be linked to the Contractor’s EHR records. Thus, EHRs from at least some existing NEISS hospitals are important to the overall success of the solution for the proof of concept project.

2. The Contractor could provide retrospective EHR data from hospitals currently on the NEISS for which the Contractor has access. Retrospective data prior to 2021 would not be deemed useful, 2024 data would be most valuable, followed by 2023 data, then 2022 data, and finally 2021 data.

3. After review and AI/ML modeling by CPSC staff, the Contractor could incorporate any exclusion criteria determined from the AI/ML modeling in subsequent data deliveries (example: exclude all records that do not have an ICD-10 CM code of S or T). This could occur on an iterative basis.

4. The Contractor could provide prospective EHR data from hospitals for which the Contract has access. Prospective data would ideally not exceed 10 days in excess of the date of treatment and include/exclude any inclusion/exclusion criteria identified by CPSC’s AI/ML modeling. Data delivered in more than 60 days (after an initial proof of concept phase) would be considered too slow compared to current data delivery.

5. The Contractor could propose a solution using AI/ML models for identifying relevant EHR records that involve consumer products and/or for coding NEISS records from EHRs (as an alternative to these being built entirely by CPSC staff). Any such solution must provide the agency means of evaluating model performance (i.e. the ability to compare EHRs to the resultant coded NEISS records).

B. EHRs with Clinical Notes from non-NEISS Hospital(s) The Contractor could provide prospective EHR data from hospital emergency departments not on the current NEISS for which the Contractor has access. Prospective data ideally would not exceed 10 days afterthe date of treatment and include/exclude any inclusion/exclusion criteria identified by CPSC’s AI/ML modeling. After an initial proof of concept phase, data delivered more than 60 days after treatment would be considered too slow compared to current data delivery.

The Contractor could propose a solution using AI/ML models for identifying relevant EHR records that involve consumer products and/or coding NEISS records from EHRs (as an alternative to these being built entirely by CPSC staff). Any such solution must provide the agency means of evaluating model performance (i.e. the ability to compare EHRs to the resultant coded NEISS records).

C. EHRs with Clinical Notes from non-emergency department settings

The Contractor could provide prospective EHR data from non-emergency department settings including direct admits, doctor’s offices, and urgent care centers for which the Contractor has access. Prospective data would ideally not exceed 10 days after the date of treatment and include/exclude any inclusion/exclusion criteria identified by CPSC’s AI/ML modeling. After an initial proof of concept phase, data delivered more than 60 days (after an initial proof of concept phase) after treatment would be considered too slow compared to current data delivery.

The Contractor could propose a solution using AI/ML models for identifying relevant EHR records that involve consumer products and/or coding NEISS records from EHRs (as an alternative to these being built entirely by CPSC staff). Any such solution must provide the agency means of evaluating model performance (i.e. the ability to compare EHRs to the resultant coded NEISS records).

D. Artificial Intelligence and Machine Learning Support

The Contractor could seek to propose services for building AI/ML models for identifying relevant EHR records that involve consumer products and/or coding NEISS records from EHRs (as an alternative to these being built entirely by CPSC staff). These services could be used to accelerate the use of AI/ML being built by CPSC. Any such proposal must provide the agency means of evaluating model performance (i.e. the ability to compare EHRs to the resultant coded NEISS records). Among the options for consideration might be the contractor playing a supporting role for the agency in construction of its own AI/ML models and/or converting the EHR data from its original native form to one more suited to AI/ML modeling.

8. PERIOD OF PERFORMANCE

The period of performance is date of award through one year, with four option periods of one year each.

9. POTENTIAL PERFORMANCE ASSESSMENT PLAN

A. The Contracting Officer's Representative (COR) will conduct an evaluation based on the completeness and accuracy of the EHR records delivered and the timeliness with which they are transmitted to CPSC should that be the proposed approach. Separate scoring would be done for AI/ML services as shown in Performance Objectives I-b and II-b.

B. Performance would be measured using a five-point (Excellent, Very Good, Satisfactory, Minimal, and Poor/Unsatisfactory) rating system. When performance is below standard, the Contractor would be notified in writing. Performance standards and points awarded are as follows:

Performance Threshold After the initial proof of concept phase, the electronic health records are provided within 10 days of the emergency department visits.

How Measured The COR will monitor the timeliness and obtain timeliness data (span between the date of treatment and the date received by the agency for prospective data) from a log maintained by CPSC staff. The date received will be determined as the date that the EHR is delivered in an acceptable form).

How Rated The timeliness rate is the % of cases received within 30 days of treatment.

The COR will obtain quality data from a log maintained by CPSC staff. The log will include a count of the number of reports that were missing essential elements.

Essential elements are treatment date, age and sex of the victim, the disposition, the diagnosis/es, body part(s) involved, and clinical note information (doctor’s notes, nurse’s notes, intake notes) needed to identify a consumer product and create an incident narrative synopsis.

Points

Rate

The COR will obtain quality data from a log maintained by CPSC staff. The log will include the number of records correctly identified as containing a consumer product. The F1 score will be the basis. F1 = 2*Precision*Recall/(Precision + Recall) Precision = True Positive / (True Positive + False Positive) Recall = True Positive / (True Positive + False Negative)

The COR will obtain quality data from a log maintained by CPSC staff. The log will include a count of the number of reports that were missing essential elements.

Essential elements are treatment date, age and sex of the victim, the disposition, the diagnosis/es, body part(s) involved, and the CPSC product code and an intelligible incident narrative synopsis.

10. ADMINISTRATION AND REPORTING

A. The Contractor shall meet weekly with the COR to review Contract performance and quality of work (unless the COR decides to cancel the meeting). More frequent communication is anticipated on an ad-hoc basis.

B. The Contractor shall be responsible for employing qualified personnel to perform the services required by this Contract.

C. The Contractor shall develop a staff vacancy plan that will document how they will rapidly fill any vacancies caused by staff attrition.

D. The Contractor shall submit quarterly invoices within 10 business days of the completion of that quarter.

11. PLACE OF PERFORMANCE

Performance of work will be remote at the contractor’s place of business.

12. GOVERNMENT-FURNISHED MATERIALS

All materials/equipment required in the performance of this contract shall be furnished by the Contractor. If the contractor proposes a solution that involves direct access to CPSC systems, a CPSC-issued laptop and ID credential may be provided.

13. KEY PERSONNEL

A key point of contact must be identified who understands the technical nature of the project to answer CPSC’s questions.

14. QUALITY CONTROL

The contractor shall develop and maintain a quality control program to ensure qualified and professional personnel are being provided and that their performance is in accordance with the criteria stated within this SOO and commonly accepted commercial practices. At a minimum, the contractor shall develop quality control procedures that address the areas identified in the SOO.

15. REFERENCES

https://www.cpsc.gov/Research--Statistics/NEISS-Injury-Data https://www.cpsc.gov/s3fs-public/JANUARY-2025-NEISS-CPSC-only-Coding-Manual-Rev-1.pdf?VersionId=RxQ0jRb8mHK.z2CrX2iG385fkC8sZjnmhttps://www.ecfr.gov/current/title-16/chapter-II/subchapter-A/part-1028 https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section301&num=0&edition=prelim https://uscode.house.gov/view.xhtml?req=granuleid:USC-2012-title42-section300v&num=0&edition=2012

16. APPENDIX – Additional Documents CPSC maintains an “Authorization-to-Operate” for Microsoft Azure and General Support System Cloud. Upon award of a contract, the vendor will be provided with these documents as necessary to complete their tasks.

CLAUSES:

Contract clauses include those required for access to CPSC proprietary data systems. If the proposed technical solution does not require contractor access to CPSC systems, “LC 30 Security and Personal Identity Verification Procedures,” “LC 10 Background Security Checks performed by the Contractor,” and section (a) and (d) of “LC 37 Security and Privacy” will be removed at award.

LC1A CONTRACTOR’S NOTE

Deliveries and/or shipments shall not be left at the Loading Dock. All deliveries shall be considered “inside deliveries” to the appropriate room at the Consumer Product Safety Commission (CPSC) and in accordance with the instructions below. When scheduling deliveries the purchase order number shall always be referenced and all packages shall clearly display the Purchase Order Number on the outside of the cartons and/or packages, to include the packing slip.

ATTENTION GOVERNMENT VENDOR

A. DELIVERY INSTRUCTIONS:

1. DELIVERY INSTRUCTIONS FOR LARGE OR HEAVY ITEMS:

If the shipment or item being delivered requires use of a loading dock, advance notification is required. The contractor shall contact the Shipping and Receiving Coordinator at 301-892-0586 or Constantia Demas (301) 504-7544 forty-eight (48) hours in advance of the date the items are to arrive to schedule use of the loading dock.

LOADING DOCK HOURS OF OPERATION:

9:00 am to 11:00 am or 1:30 pm to 4:00 pm Monday through Friday (except holidays)

Please notify contact person if there is a change in the delivery date. For changes, delays, or assistance please contact CPSC as follows:

Facilities Management Support Services (301) 504-7091 and

The COR – See page 1 of award

Upon arrival, the driver should contact the CPSC Guard, 301-504-7721, at the loading dock to obtain assistance in using freight elevators and to gain access to CPSC security areas.

2. DELIVERY INSTRUCTION FOR SMALL ITEMS

When delivering or shipping small items, the contractor and/or carrier service shall report to the 4th floor lobby, North Tower, 4330 East West Highway, to sign in with the CPSC guard. Upon completion of signing in, the contractor shall deliver all shipments to the Mail Room, Room 410. After delivery, delivery personnel shall promptly depart the building.

MAIL ROOM HOURS OF OPERATION:

Monday through Friday (except holidays) – 7:30 am to 5:00 pm

B. BILLING INSTRUCTIONS

Pursuant to the Prompt Payment Act (P.L. 97-177) and the Prompt Payment Act Amendments of 1988 (P.L. 100-496) all Federal agencies are required to pay their bills on time, pay interest penalties when payments are made late, and to take discounts only when payments are made within the discount period. To assure compliance with the Act, vouchers and/or invoices shall be submitted through the Invoice Processing Platform (IPP). At a minimum, each invoice document submitted through IPP shall include the documentation required in the contract.

ELECTRONIC INVOICING AND PAYMENT REQUIREMENTS

Invoice Processing Platform (IPP) is a secure web-based electronic invoicing and payment information service available to all Federal agencies and their supplier by the U.S. Treasury's Bureau of Fiscal Service. IPP allows Federal agencies and their suppliers to exchange electronic purchase orders, blanket POs, invoices, and payment information in one easy to access web portal. This service is free of charge to government agencies and their suppliers, including services and support.

(a) Definitions. As used in this clause- (1)”Payment request” means a bill, voucher, invoice, or request for contract financing payment with associated supporting documentation. The payment request must comply with the requirements identified in FAR 32.905(b), “Payment documentation and process” and the applicable Payment clause included in this contract.

(b) The Contractor shall submit payment requests electronically using the Invoice Processing Platform (IPP). Information regarding IPP is available on the Internet at www.ipp.gov. Assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email ippgroup@stls.frb.org or phone (866)973-3131.

PAYMENT AND INVOICE QUESTIONS

For payment and invoice questions, contact the Accounts Payable Branch at (304) 480-8000 option 7 or via email at AccountsPayable@fiscal.treasury.gov.

Customer Service inquiries may be directed to Nancy Kneisler at .

OVERPAYMENTS

Accounts Receivable Conversion of Check Payments to EFT: If the Contractor sends the Government a check to remedy duplicate contract financing or an overpayment by the government, it will be converted into an electronic funds transfer (EFT). This means the Government will copy the check and use the account information on it to electronically debit the Contractor’s account for the amount of the check. The debit from the Contractor’s account will usually occur within 24 hours and will be shown on the regular account statement.

The Contractor will not receive the original check back. The Government will destroy the Contractor’s original check but will keep a copy of it. If the EFT cannot be processed for technical reasons, the Contractor authorizes the Government to process the copy in place of the original check.

C. INSPECTION & ACCEPTANCE PERIOD

Unless otherwise stated in the Statement of Work or Description, the Commission will ordinarily inspect all materials/services within seven (7) business days after the date of receipt. The CPSC representative responsible for inspecting the materials/services will transmit disapproval, if appropriate, to the contractor and the Contracting Officer. If other inspection information is provided in the Statement of Work or Description, it is controlling.

D. NO AUTOMATIC RENEWALS

If any license or service tied to periodic payment is provided under this agreement (e.g., annual software maintenance or annual lease term), such license or service shall not renew automatically upon expiration of its current term without prior express consent by an authorized Government representative.

(End of Clause)

LC 9 Key Personnel

a. The following individuals, listed by name and title, have been identified as key personnel for performance under this contract:

b. The personnel specified above and/or in the schedule of the contract are considered to be essential to the work being performed hereunder. If these individuals are unavailable for assignment for work under the contract, or it is anticipated that their level of involvement will be significantly different from the negotiated level, the Contractor shall immediately notify the Contracting Officer and shall submit justifications (including proposed substitutions) in sufficient detail to permit evaluation of the impact on the program. The Contracting Officer shall review, and may ratify in writing, such substitutions. Prior to substitution of key personnel, the Contractor shall obtain the written consent of the Contracting Officer.

(End of Clause)

LC 10 Background Security Checks performed by the Contractor

a. All Contractor employees proposed and/or presently in service under this contract and any new Contractor employees to be utilized for performance of this contract may be subjected to background checks. Information regarding background and security checks to be performed on personnel shall be included with the proposal and contract award. These checks shall be performed at Contractor expense. The results of such checks shall be provided to the Government.

b. Identical background and security checks shall also be performed on new or substitution personnel prior to entering into service under this contract.

c. By execution of this contract, the Contractor certifies none of the employees working under this contract have been convicted of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five (5) years.

d. The Government reserves the right to remove from service any Contractor employee for any of the following:

(1) Conviction of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five (5) years.

(2) Falsification of information entered on security screening forms or other documents submitted to the Government.

(3) Improper conduct once performing on the contract, including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct prejudicial to the Government regardless of whether the conduct is directly related to the contract.

(4) Any behavior judged to pose a threat to personnel or property.

e. Failure by the contractor to comply with the terms of this clause may result in termination of the contract.

(End of Clause)

LC 22 Handling of Confidential Information

a. If the Contractor obtains confidential business information about any company in connection with performance of this contract, either from the CPSC, the other company itself, or any other source, the Contractor agrees that it will hold the information in confidence and not disclose it either to anyone outside the CPSC or to any Contractor employee not involved in performance of this contract.

b. At the completion of performance of this contract, the Contractor shall return any confidential information, obtained as described above, either to its owner or to the CPSC. No such information shall be retained by the Contractor. Furthermore, the Contractor agrees not to use any such confidential business information for any purpose other than performance of this contract. During contract performance, the Contractor shall maintain confidential business information obtained as described in this article in a safe or locked file cabinet to which only employees performing work under this contract shall have access. A log shall be maintained to reflect each entry to the safe or cabinet. The Contractor shall provide to the COR, and keep current, a list of all employees with such access. The Contractor shall require each such employee to execute an affidavit as set forth in the attached “Affidavit of Disclosure” and the original and one copy of each affidavit shall be sent to the COR.

c. A site inspection of the Contractor's security measures for confidential information may be performed by the CPSC COR prior to contract award and at any time during contract performance as deemed necessary by the COR. Approval of the security measures may be a prerequisite to contract award and continued performance.

d. Failure by the contractor to comply with the terms of this clause may be treated as a default pursuant to the terms of this contract.

(End of Clause)

LC 24 Nondisclosure of any Data Developed Under this Contract

a. The Contractor agrees that it and its employees will not disclose any data obtained or developed under this contract to third parties without the consent of the U. S. Consumer Product Safety Commission Contracting Officer Representative (COR).

b. The Contractor shall obtain an agreement of non-disclosure from each employee who will work on this contract or have access to data obtained or developed under this contract.

(End of Clause)

LC 30 Security and Personal Identity Verification Procedures

a. The performance of this contract requires contractor employees to have access to CPSC facilities and/or systems. In accordance with Homeland Security Presidential Directive-12 (HSPD-12), all such employees must comply with agency personal identity verification (PIV) procedures. Contractor employees who do not already possess a current PIV Card acceptable to the agency shall be required to provide personal background information, undergo a background investigation (NACI or other OPM-required or approved investigation), including an FBI National Criminal History Fingerprint Check prior to being permitted access to any such facility or system. CPSC may accept PIV issued by another Federal Government agency but shall not be required to do so. No contractor employee will be permitted access to a CPSC facility or system without approval under the PIV process.

b. Contracted employees must meet the following citizenship requirements:

1. A United States (U.S.) citizen; or,

2. A national of the United States (see 8. U.S.C. 1408); or,

3. An alien lawfully admitted into the United States for permanent residence as evidenced by an alien Registration Receipt Card form I-151

c. Within five (5) days after contract award, the Contractor shall provide a list of contracted personnel, including full name, social security number, and place (city and state) and date of birth to the designated Contracting Officer’s Representative (COR). This information will be used to determine whether personnel have had a recent Federal background investigation and whether or not further investigation is required.

d. For each contractor employee subject to the requirements of this clause and not in possession of a current PIV Card acceptable to CPSC, the Contractor shall submit the following properly-completed forms: Electronic Standard Form (SF) 85 or 85-P, "Questionnaire for Non-sensitive Positions," SF 87 Fingerprint Chart, Optional Form (OF) 306, and a current resume. The SF-85 is available from the Office of Personnel Management’s (OPM) secure website. The CPSC Office of Human Resources will provide the COR with the other forms that are not obtainable via the internet.

e. The Contractor shall complete the electronic security form and deliver the other completed forms indicated in paragraph d above to the COR within five (5) days of written notification from the COR of those contractor employees requiring background investigations.

f. Upon completion of the investigation, the COR will notify the Contractor in writing of all investigation determinations. If any contractor employees are determined to be unsuitable to be given access to CPSC, the Contractor shall immediately provide identical information regarding replacement employees. The Contractor is responsible for providing suitable candidates and fulfilling staffing requirements under the contract so that there is no break in service. This approval process applies to contract start up and any required replacement personnel. Failure to prequalify potential replacement personnel will not serve as an excuse for failure to provide performance. Non-performance due to failure to provide suitable contractor employees may result in a Termination for Cause or Default.

g. CPSC will issue a PIV Card to each on-site contractor employee who is to be given access to CPSC facilities and systems. The employee will not be given access prior to issuance of a PIV Card. CPSC may revoke a PIV card at any time if an investigation or subsequent investigation reveals that the personnel are unsuitable.

h. PIV Cards shall identify individuals as contractor employees. Contractor employees shall display their PIV Cards on their persons at all times while working in a CPSC facility and shall present cards for inspection upon request by CPSC officials or security personnel. The contractor shall be responsible for all PIV Cards issued to the contractor’s employees and shall immediately notify the COR if any PIV card(s) cannot be accounted for.

i. CPSC shall have and exercise full and complete control over granting, denying, withholding, and terminating access of contractor employees to CPSC facilities and systems. The COR will notify the Contractor immediately when CPSC has determined that an employee is unsuitable or unfit to be permitted access. The Contractor shall immediately notify such employee that he/she no longer has access, shall remove the employee and shall provide a suitable replacement in accordance with contract requirements and the requirements of this clause.

j. By execution of this contract, the Contractor certifies that none of the employees working under this contract have been convicted of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five (5) years. During contract performance the contractor shall immediately notify CPSC if one of its employees working under this contract has been convicted of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five years.

k. The Government reserves the right to have removed from service any Contractor employee for any of the following:

1. Conviction of a felony, a crime of violence, or a misdemeanor involving moral turpitude, such as a conviction of larceny within the last five (5) years.

2. Falsification of information entered on security screening forms or other documents submitted to the Government.

3. Improper conduct during performance of the contract, including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct prejudicial to the Government regardless of whether the conduct is directly related to the contract.

4. Any behavior judged to be a threat to personnel or property.

l. The COR shall be responsible for proper separation of contracted employees at the Consumer Product Safety Commission. The COR shall ensure that each contractor employee completes CPSC’s official out processing procedures. The contracted employee shall report to the CPSC Facilities Security Specialist to obtain a Contractor Employee Accountability and Clearance Record. This record shall be completed as part of the official out-processing procedures and returned along with the PIV Card, key fobs, keys and any other previously issued material.

m. Contractor employees shall comply with applicable Federal and CPSC statutes, regulations, policies and procedures governing the security of the facilities and system(s) to which the contractor's employees have access.

n. Failure on the part of the Contractor to comply with the terms of this clause may result in termination of this contract for cause or default.

o. The contractor shall incorporate this clause in all subcontracts.

(End of Clause)

Additionally FAR clause 52.204-9 Personal Identity Verification of Contractor Personnel has been incorporated by reference.

LC 34 Technology Additions/Substitutions

a. Due to the rapidly changing field of information technology (IT) and potential advancements during performance of this contract, the contractor may propose technological upgrades, additions and substitutions to enhance performance of IT delivered under the contract. The Contractor shall request changes in writing to the Contracting Officer and shall provide full documentation on any proposed additions/substitutions.

b. Any proposed changes must comply with these conditions:

1) The additional/substituted item(s) shall be fully compatible with item(s) in the CLIN as appropriate;

2) The additional/substituted item(s) shall meet or exceed all specifications applicable to the original item(s);

3) The additional/substituted item(s) shall meet all of the marketability requirements of the specification to ensure field-proven, COTS systems and configurations.

c. Any proposed change, if accepted by the Government, shall be made via a written modification to the contract.

d. The fact that the Contractor requests, and the Government accepts, an addition/substitution shall not automatically extend the required delivery dates of any items. Upon approval and acceptance of a replacement, CPSC and the Contractor may mutually agree to a reasonable extension of the required delivery dates.

(End of Clause)

LC 37 Security and Privacy

(a) Agency rules of conduct that the Contractor and the Contractor’s employees shall be required to follow:

In performing its duties related to management, operation, and/or access of systems containing personally identifiable information (PII) under this contract, the Contractor, its employees and subcontractors shall comply with all applicable privacy and security requirements and rules of conduct as specified by the following:

1. Contractor employees must comply with agency personal identity verification (PIV) requirements in order to logically access Government systems.

2. System access granted under this contract is only for work required to perform official duties specified in the contract. The performance of any unrelated and/or unauthorized activity is prohibited.

3. Access to Government information systems (where applicable) will only be for the period stated in the contract. Thereafter, all accounts, passwords, and access associated with the contract will be terminated.

4. Disclosure of any system account information or system passwords to any unauthorized party is prohibited.

5. Exhibiting or divulging the content of any record or report to any person except in the performance of official duties specified in the contract is prohibited.

6. Using any data accessed with a Government system account for unauthorized purposes is prohibited.

7. No official record, report, database, or copy thereof, may be removed from Government premises or Government systems without prior written permission.

8. Contractor employees are prohibited from modifying, altering, or otherwise changing any Government system component or configuration except in the performance of official duties specified in the contract. Contractor employees are prohibited from issuing any system command or running any software, scripts, or programs on Government systems without prior authorization.

9. Contractor employees must not disclose sensitive or personal privacy-related information to any unauthorized party.

10. Contractor must notify the Government Contracting Officer and Contracting Officer Representative (COR) immediately upon the termination of any Contractor or subcontractor employee so that system accounts, remote access, or other forms of system access can be terminated.

11. The use of Contractor-owned laptops or other portable media storage devices to process, transmit, or store PII is prohibited under this contract [unless the Contractor is authorized to access Government systems through the agency’s virtual desktop infrastructure environment].

12. The Contractor must notify the Government Contracting Officer, Contracting Officer Representative (COR), the agency’s Information Systems Security Officer (ISSO), and the Chief Privacy Officer (CPO) immediately upon the discovery—or suspected discovery—of any type of security incident, malicious activity, or privacy breach affecting or that might potentially affect the Government’s network, specific systems, or Government-owned information in any form or format.

13. Contractor employees with access to Government systems must agree to agency Rules of Behavior and shall complete annual security and privacy awareness trainings and any role-based security and privacy trainings necessary, as determined by CPSC’s Office of Information Technology (EXIT).

14. Contractors must comply with EXIT’s Change Control Process (CCP), Solution Development Life Cycle (SDCL) and Security & Privacy processes.

15. Contractor shall make changes to CPSC infrastructure only if approved through EXIT’s CCP.

16. Contractor shall not utilize any software or application that the US government has deemed unsafe or a threat to national security. If use of such software is required to fulfill the obligations of the contract, an exemption from CPSC’s Information Security Office must be obtained prior to use of said software.

17. Contractor shall provide a self-attestation that they are following NIST’s Secure Software Development Framework and provide a Software Bill of Materials (SBOM) in accordance with OMB M-22-18.

(b) A list of the anticipated threats and hazards that the Contractor must guard against.

The Contractor must use reasonable measures to guard against the following threats and hazards:

1. Unauthorized disclosure or use of sensitive system information—including system architecture, system configuration, system accounts, and system passwords.

2. Unauthorized disclosure or use of the contents of any information obtained from Government systems—including system records, system reports, or databases.

3. Unauthorized modification or alteration of any Government system component or configuration.

4. Unauthorized circumvention, avoidance, or deception of any Government security system, measure, or control.

5. Unauthorized installation and/or use of hardware, software, firmware, portable media storage, or mobile devices on Government systems.

6. Unauthorized use of Government systems—including hardware, software, system accounts, Internet access, and email accounts—for activity which is not required to perform official duties under this contract.

(c) A description of the safeguards that the Contractor must specifically provide.

1. The Contractor shall limit access to any information related to this contract to those employees and subcontractors who require the information in order to perform their official duties under this contract.

2. The Contractor, Contractor employees, and subcontractors must physically secure PII when not in use and/or under the control of an authorized individual, and when in transit to prevent unauthorized access or loss.

3. When PII is no longer needed or required to be retained under applicable Government records retention policies, it must be destroyed through means that will make the PII irretrievable. The Contractor must provide a certificate of destruction when PII is destroyed.

4. The Contractor shall only use PII obtained under the contract for purposes of the contract and shall not collect or use such information for any other purpose without the prior written approval of the Contracting Officer.

5. At expiration or termination of this contract, the Contractor shall turn over to the Government, all PII obtained under the contract that is in its possession.

6. In the event of any actual or suspected breach of PII, the Contractor shall immediately report the breach to the Contracting Officer, the Contracting Officer’s Representative (COR), the agency’s Information Systems Security Officer (ISSO), and the Chief Privacy Officer (CPO).

7. In the event that a PII breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, the Contractor shall, as directed by the Contracting Officer and at no cost to the Government, take timely action to correct or mitigate the violation, which may include providing notification and/or other identity protection services to affected persons for a period of at least 24 months from discovery of the breach. The Contractor should follow the Commission’s Privacy Breach Response Policy and Plan during the investigation and remediation of any potential privacy breaches. All notifications and offers of services to potentially affected persons must be reviewed and approved by the Commission’s Breach Response Team before sending. If the Government elects to provide and/or procure notification or identity protection services in response to a breach, the Contractor shall be responsible for reimbursing the Government for those expenses. The Contractor shall incorporate the substance of this clause, its terms and requirements in all subcontracts under this contract and require written subcontractor acknowledgement of same. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

(d) Requirements for a program of Government inspection during performance of the contract that will ensure the continued efficacy and efficiency of safeguards and the discovery and countering of new threats and hazards.

Work to be performed under this contract requires the design, development, operation, or disposal of a Federally-controlled information system containing personally identifiable information or handling personally identifiable information. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of personally identifiable information, the Contractor shall permit the Government access to, and information regarding, the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases, when requested by the Government, as part of its responsibility to ensure compliance with privacy and security requirements. The Contractor shall otherwise cooperate with the Government in assuring compliance with such requirements. Government access shall include independent validation testing of controls, system penetration testing by the Government, Federal Information Security Management Act data reviews, and access by agency Inspectors General for its reviews.

Definitions.

“Personally Identifiable Information” (PII) means information that can be used to distinguish or trace an individual’s identity, such as his or her name, social security number, or biometric records, that alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth or mother’s maiden name. Please see the CPSC Privacy Breach Response Policy and Plan for additional examples of PII.

“Privacy Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses PII or (2) an authorized user accesses or potentially accesses PII for an other than authorized purpose.

“Security Incident” means an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

(End of clause)

LC 38 Ending Illegal Discrimination and Restoring Merit-Based Opportunity

Contractor/Grantee agrees that compliance in all respects with all applicable Federal anti-discrimination laws is material to the government’s payment decisions for purposes of section 3729(b)(4) of title 31, United States Code.

Contractor/Grantee certifies that it does not operate any programs promoting…