D_Solicitation - SOW.pdf

Version 11-30-2016-1 FAR Part 11—Describing Agency Needs

STATEMENT OF WORK (SERVICES)

(SOW)

GENERAL INFORMATION

Title of Project:

Web Programming and Database Maintenance for the Healthy Aging in Neighborhoods of Diversity across the Life Span (HANDLS) study.

Statement of Need and Purpose:

The National Institute on Aging Intramural Research Program has embarked on a longitudinal study of the effects of race and socioeconomic status on healthy aging in a representative sample of community-dwelling residents from the Baltimore metropolitan region. This study, Healthy Aging in Neighborhoods of Diversity across the Life Span (HANDLS), requires expertise in database management, web design, the connection between web interfaces and data, and application life-time development techniques. This expertise must include knowledge and experience with usability as measured by the fewest clicks to accomplish a task with the fewest (or no) errors. In addition, this expertise must include experience with re-usable application design such that programs written for the present wave of data collection can be modified easily for data collection in subsequent waves. Moreover, the design of the program must accommodate several goals, including comprehensive data collection, ease of navigation, and the capacity for direct transfer to other tools for statistical analyses.

In addition to modifying existing web applications, expertise is required to complete the development of web-based data collection tools to support the clinical research conducted by the HANDLS study. The web-tool provides the ability to collect the clinical data in the mobile research vehicles and subsequently to synchronize the data to servers located in the Biomedical Research Center (BRC) in real time. This integrated web-based system requires ongoing maintenance and enhancements, as well as tools for monitoring performance, particularly disconnections. Moreover, these applications must account for security and confidentiality of the information and data collected, clinical informatics and database design that can be supported with open-source tools, and web applications that meet current design standards and accessibility requirements, including Section 508 for accessibility by individuals with disabilities. The website requires continued architecture of a system to replace the current authentication systems on the HANDLS servers to meet NIH standard. More, these tools shall retain full functionality after accommodating system security modifications and operating system upgrades, particularly those mandated by NIH. In addition, Section Investigators require that programming be done in conformance with NIH security policies using Perl with MySQL as well as various other Linux system services and applications. Work shall be performed on-site and off-site, and programmers must be on-call to resolve programming conflicts that arise either from their work or work performed by others.

Background Information and Objective:

The Healthy Aging in Neighborhoods of Diversity across the Life Span (HANDLS) study requires a Perl- CGI programmer to write dynamic web-based applications for collecting, summarizing, and reporting medical, physiological, and psychological data. The services provided will be writing novel applications and managing structured databases as well as upgrading and management of existing applications facilitating electronic collection, review, and distribution of clinical data for the HANDLS study. Additional services include design, testing, and implementation of applications to enhance functionality of existing applications. Maintenance, support, and extension of all deliverables are expected.

Period of Performance:

Base Year: 4/1/2021 to 3/31/2022 Option Year 1 4/1/2022 to 3/31/2023 Option Year 2 4/1/2023 to 3/31/2024 Option Year 3 4/1/2024 to 3/31/2025 Option Year 4 4/1/2025 to 3/31/2026

SCOPE OF WORK

General Requirements:

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government as needed to perform the Statement of Work below:

Specific Requirements:

The contractor shall provide a Database Programmer who will provide database management, web design, the connection between web interfaces and data, and application life-time development techniques. Work shall be performed on-site and off-site.

● Write and maintain applications using open source tool such as but not limited to HTML, HTML, Perl/CGI, Perl/CGI-templates, Python, and Ruby on Rails.

● Maintain, and when possible, convert applications in PHP using PDFlib to Perl/CGI.

● Deploy additional facilities required by these applications including but no limited to ImageMagick, Perl with template toolkit, Moose, CGI application toolkit, and Git server deployment, management, and use.

● Web application programmer shall have expertise in installing, managing, and maintaining Apache web server and MySQL server on production server and in a development environment.

● Provide expert advice on the strengths and weaknesses of migrating from present MySQL database environment to other open source database environments such as Maria or PostgreSQL.

● Re-usable application design such that programs written for the present wave of data collection can be modified easily for data collection in subsequent waves.

● The design of the program must accommodate several goals, including comprehensive data collection, ease of navigation, and the capacity for direct transfer to other tools for statistical analyses.

● Development of web-based data collection tools to support the clinical research conducted by the HANDLS study. The web-tool provides the ability to collect the clinical data in the mobile research vehicles and subsequently to upload the data to servers located in the Biomedical Research Center (BRC).

● This integrated web-based system requires ongoing maintenance and enhancements, as well as tools for monitoring performance, particularly disconnections. Intimate familiarity with the overall protocol and goals for the HANDLS study is required to perform this task, as is knowledge of the interconnections among various procedures and tracking databases.

● These applications must account for security and confidentiality of the information and data collected clinical informatics and database design that can be supported with open-source tools, and web applications that meet current design standards and accessibility requirements, including Section 508 for accessibility by individuals with disabilities.

● The website requires continued architecture of a system to replace the current authentication systems on the HANDLS servers to meet NIH standards.

● Ongoing modifications shall be performed when Linux system parameters or applications change with as much testing as possible accomplished on development devices before publishing programs for production use.

● Provide support for git and gitlab as a method for archiving and managing programming code.

● Adapt industry best practices to producing and maintaining the large code base and apply industry-standard procedures for assessing usability on a variety of platforms.

● Maintain code in a manner that yields the most easily modifiable procedures such that study changes do not require complete re-writes of code base.

LEVEL OF EFFORT:

500 hours per year during the period of performance

GOVERNMENT RESPONSIBILITIES

The government will provide access and maintain Federal information systems.

DELIVERY OR DELIVERABLES

Timely submission of deliverables is essential to successfully completing this requirement.

Scheduling deliverables depends on the COR’s ranking of priorities with deadlines set by mutual agreement with study requirements taking precedence. Deliverables will take the form of electronic files created on HANDLS development and production systems.

REPORTING REQUIREMENTS

The contractor shall provide verbal summaries to HANDLS staff and the COR at least monthly.

The contractor shall enumerate the program files and processes on which work was performed, strategies for changing the code, implementing it, and training staff in its use.

OTHER CONSIDERATIONS

Travel:

No travel is required.

Key Personnel:

The following positions are considered "Key Personnel" in support of this contract initiative. The listing of key personnel will become part of contract Clause H.XX, Key Personnel.

Perl-CGI web programmer and designer and structured database specialist

1. Bachelor’s degree or equivalent in engineering, science, or any liberal arts.

2. Minimum ten years’ experience in programming and at least four years experience web Perl/CGI and database programming HANDLS data. Experience with data are crucial because the HANDLS clinical management system is a real-time data entry and medical record database. Changes to one part of the system may have far-reaching consequences in other parts of the system and on the accuracy of the data. Therefore, only personell who are thoroughly familiar with the interconnections among the various data triggers and databases may program in this environment.

3. The proposed key personnel will become subject to the provisions of Health and

Human Services Acquisition Regulation (HHSAR) Clause HHSAR 352.237-75 KEY PERSONNEL, HHSAR 352.237-75 (December 18, 2015)

a. The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties. (End of Clause)

b. The following individual(s) is/are essential to the work being performed hereunder:

Name Title Michael Barry Perl-CGI web programmer and designer

Information System Security Plan:

Contractor personnel performing work under this contract shall satisfy all requirements for appropriate security eligibility as specified in SOW attachment in dealing with access to sensitive information and information systems belonging to or being used on behalf of the National Institute on Aging. To satisfy those requirements, a Level 5 Risk Background Investigation shall be conducted prior to performing work under this contract. Appropriate background investigation forms will be provided upon contract award and are to be completed and returned to DPSAC within 30 days for processing. Contractors will be notified when the investigation has been completed and adjudicated.

The Contractor must ensure that any computer system used in the course of this contract shall include the following features:

1. Any computer used in relation to this contract must be patched with most updated IT Security Patches.

2. Any Contractor computer used in relation this contract must have virus protection loaded and running with definition files that are updated on at least a daily basis.

3. Hard drives and portable media used for this contract must be encrypted using the FIPS 140-2 standard.

4. Contractors are required to take NIH Security and Privacy Training annually http://irtsectraining.nih.gov/

5. Contractor are required to sign the NIH non-disclosure agreement http://irtsectraining.nih.gov/NIH_Non-Disclosure_Agreement.pdf

6. Contractors are required to report any lost or stolen NIH data to the NIA ISSO within one hour of knowing of the lost or theft even if the data is on a Contractor furnished computer.

7. Contractors are required to adhere to the NIH IT rules of behavior which can be found at https://ocio.nih.gov/InfoSecurity/training/Pages/nihitrob.aspx

8. Any computers used in reference to this contract must be assessed for vulnerabilities.

9. Any computers used in reference to this contract must be backed up on an http://irtsectraining.nih.gov/ http://irtsectraining.nih.gov/NIH_Non-Disclosure_Agreement.pdf external hard drive which is password protected.

10. Any computers used in reference to this contract must have auditing enabled such that if an incident occurred then that event could be reconstructed.

11. Any computers that are used in reference to this contract must employ at a minimum username and password authentication or if possible two factor authentications.

12. Any computer used in relation to this contract must be password protected. All Password must meet the NIH standard such that users must choose passwords that have at least eight characters and at least three of the following types of characters:

a. capital letters

b. lower case letters

c. numeric characters

d. special characters (!@#$%^&*()_+|~-=\`{}[]:";'<>?,./)

Data Rights:

The National Institute on Aging, HANDLS study shall have unlimited rights to and ownership of all deliverables provided under this purchase order including reports, recommendations, briefings, work plans and all other deliverables. This includes the deliverables provided under the basic purchase order and any optional task deliverables exercised by the contracting officer.

In addition, it includes any additional deliverables required by contract change. The definition of “unlimited rights” is contained in Federal Acquisition Regulation (FAR) 27.401, “Definitions.”

FAR clause 52.227-14, “Rights in Data-General,” is hereby incorporated by reference and made a part of this contract/order.

Section 508—Electronic and Information Technology Standards:

Section 508 applies to all applicable deliverables. The Contractor shall ensure that all web content or communications materials produced for publication on or delivery via HHS websites

— including text, audio, or video — conforms to applicable Section 508 standards to allow Federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. HHS has established acceptance standards for Section 508 compliance (www.hhs.gov/web/508/testdocuments.html).

Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 (http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title36/36cfr1194_main_02.tpl) shall be the responsibility of the Contractor.

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, or used under this contract/order must comply with the "Electronic and Information Technology Accessibility Provisions" set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the "Access Board") in 36 CFR part 1194. Information about Section 508 provisions is available at www.section508.gov. The complete text of Section 508 Final provisions can be accessed at http://www.hhs.gov/web/508/testdocuments.html http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title36/36cfr1194_main_02.tpl http://ecfr.gpoaccess.gov/cgi/t/text/text-idx?c=ecfr&tpl=/ecfrbrowse/Title36/36cfr1194_main_02.tpl http://www.section508.gov/ https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule.

The Section 508 standards applicable to this contract/order are identified in the Statement of Work. The contractor must provide a written Section 508 conformance certification due at the end of each contract/order exceeding $100,000 when the contract/order duration is one year or less. If it is determined by the Government that EIT products and services provided by the Contractor do not conform to the described accessibility standards in the Product Assessment Template, remediation of the products or services to the level of conformance will be the responsibility of the Contractor at its own expense.

In the event of a modification(s) to this contract/order, which adds new EIT products or services or revises the type of, or specifications for, products or services the Contractor is to provide, including EIT deliverables such as electronic documents and reports, the Contracting Officer may require that the contractor submit a completed HHS Section 508 Product Assessment Template to assist the Government in determining that the EIT products or services support Section 508 accessibility standards. Instructions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found here:

https://www.hhs.gov/web/section-508/contracting/technology-products/product-accessibility-template/index.html.

Prior to the Contracting Officer exercising an option for a subsequent performance period/additional quantity or adding funding for a subsequent performance period under this contract, as applicable, the Contractor must provide a Section 508 Annual Report to the Contracting Officer and Project Officer. Unless otherwise directed by the Contracting Officer in writing, the Contractor shall provide the cited report in accordance with the following schedule.

Instructions for completing the report are available in the Section 508 policy on the HHS Office on Disability Website under the heading Vendor Information and Documents. The Contractor's failure to submit a timely and properly completed report may jeopardize the Contracting Officer's exercising an option or adding funding, as applicable.

Publications and Publicity:

Not applicable.

Confidentiality of Information:

Not applicable.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule https://www.hhs.gov/web/section-508/contracting/technology-products/product-accessibility-template/index.html https://www.hhs.gov/web/section-508/contracting/technology-products/product-accessibility-template/index.html