DRAFT PWS-Diaper Outcomes (for RFI).pdf

DRAFT PERFORMANCE WORK STATEMENT

Administration for Children and Families

Office of Planning, Research, and Evaluation

Examining Outcomes of Diaper Distribution Programs

Performance Work Statement for the

Examining Outcomes of Diaper Distribution Programs

Performance Work Statement (PWS) for

Examining Outcomes of Diaper Distribution Programs

1.0 General

1.1 Introduction

The mission of the Administration for Children and Families (ACF) within the Department of Health and Human Services (HHS) is to foster health and well-being by providing federal leadership, partnership, and resources for the compassionate and effective delivery of human services. The mission of the Office of Planning, Research, and Evaluation (OPRE) is to study the ACF programs and the children and families they serve through rigorous research and evaluation projects. ACF’s Office of Community Services (OCS), in partnership with OPRE, launched the Diaper Distribution Demonstration and Research Pilot (DDDRP), also known as the Diaper Distribution Pilot in response to Congressional authorization of the Diaper Distribution Demonstration Program in FY2022. OPRE is collaborating with OCS on the current task order.

The purpose of this task order is to advance ACF and service providers’ understanding of implementation and outcomes of diaper distribution programs by answering the following research questions: (1) among families who received Diaper Distribution Pilot services, how did diaper need and other short- and intermediate-term outcomes change after one year of services?, and (2) at an organizational and programmatic level, how did short- and intermediate-term outcomes change after one year of services?

1.2 Objective

The objective of this task order is to advance ACF and service providers’ understanding of implementation and outcomes of diaper distribution programs by answering the following research questions: (1) among families who received Diaper Distribution Pilot services, how did diaper need and other short- and intermediate-term outcomes change after one year of services, and (2) at an organizational and programmatic level, how did short- and intermediate-term outcomes change after one year of services? Activities to answer these questions may include designing, planning, conducting, and reporting the results from a pre-post outcomes study that involves quantitative, and potentially qualitative, data collection with Diaper Distribution Pilot grant recipients and the families they serve both at baseline and after one year of services. The Contractor must also provide technical assistance to support grant recipients in data collection, management, and reporting.

1.3 Scope of Work

The Contractor must furnish the necessary qualified personnel, equipment, materials, supplies, services, facilities, and otherwise do all that is necessary for, or incidental to, the performance of the work set forth below. Activities may include designing, planning, conducting, and reporting the results from a pre-post outcomes study that involves quantitative, and potentially qualitative, data collection with Diaper Distribution Pilot grant recipients and the families they serve both at baseline and after one year of services.

The Contractor must also provide technical assistance to support grant recipients in data collection, management, and reporting. The Contractor is expected to work with the https://acf.gov/ocs/programs/dddrp https://acf.gov/ocs/programs/dddrp

Contracting Officer’s Representative (COR) to refine the activities and proposed plans once the contract is awarded.

1.4 Background

According to 2023 data from a nationally representative survey conducted for the National Diaper Bank Network, diaper need, or the gap between sufficient diapers to keep a child dry and what their caregiver can provide, affects almost half of families in the United States.1 This represents an increase from previous studies which found that one in three families were struggling to provide enough diapers to change their child frequently enough. Lack of sufficient diapers can lead to health consequences, such as diaper rash, severe dermatitis, infections, and hospitalization. This gap can also lead to other severe consequences, such as high levels of stress, anxiety, and guilt among caregivers; lack of childcare options; and caregiver economic instability from missing too many days of work or missing other opportunities to increase economic independence.2

To help address diaper needs and increase economic security, Congress authorized the Diaper Distribution Demonstration Program in FY2022. In response, OCS, in partnership with OPRE, launched the Diaper Distribution Demonstration and Research Pilot, also known as the Diaper Distribution Pilot. This program, administered by OCS, provides funding to expand existing diaper distribution services through a robust network of community partners that provide anti-poverty services. In addition to providing diapers, grant recipients and their partners, including Community Action Agencies (CAA), social service agencies, and diaper banks, connect families to economic mobility and family support services such as job training, educational support, Early Head Start, and more.

Additionally, recipients and their partners are required to participate in federal evaluation efforts.

Since 2022, the Diaper Distribution Pilot has awarded $48 million to 4 cohorts of grant recipients across 24 states and 4 tribal communities. More information on the Diaper Distribution Pilot, including profiles for each of the 28 grant recipients, can be found on the OCS website.

In 2023, OPRE awarded the Diaper Distribution Demonstration and Research Pilot (DDDRP) Evaluation (also known as the DDDRP Evaluation). The goal of the DDDRP Evaluation was to deepen understanding of diaper distribution operations and lay the groundwork for rigorously measuring the potential impacts of diaper distribution programs. This contract was awarded to Westat with a sub-contract to Public Profit and Dr. Jennifer Randles.

The DDDRP Evaluation conducted an implementation evaluation and laid the groundwork for future research related to the Diaper Distribution Pilot. The implementation evaluation consisted of three main components with corresponding research questions:

1 https://nationaldiaperbanknetwork.org/wp-content/uploads/2023/06/NDBN-Diaper-Check- 2023_Executive-Summary-FINAL.pdf 2 https://acf.gov/sites/default/files/documents/opre/evcap_diaper_distribution_brief_jan2023%20.pdf https://acf.gov/ocs/programs/dddrp https://acf.gov/ocs/programs/dddrp https://acf.gov/opre/project/diaper-distribution-demonstration-and-research-pilot-dddrp-evaluation https://acf.gov/opre/project/diaper-distribution-demonstration-and-research-pilot-dddrp-evaluation https://nationaldiaperbanknetwork.org/wp-content/uploads/2023/06/NDBN-Diaper-Check-2023_Executive-Summary-FINAL.pdf https://nationaldiaperbanknetwork.org/wp-content/uploads/2023/06/NDBN-Diaper-Check-2023_Executive-Summary-FINAL.pdf https://acf.gov/sites/default/files/documents/opre/evcap_diaper_distribution_brief_jan2023%20.pdf

1. The process evaluation: How do Diaper Distribution Pilot grant recipients implement their programs?

2. The participant experience and outcomes assessment: What are the experiences of the caregivers who participate in the program?

3. The feasibility assessment: How could we best design a credible and reliable future impact study for the Diaper Distribution Pilot?

The DDDRP Evaluation team conducted interviews with grant recipients and subrecipient staff and facilitated focus groups with caregivers who received diapers from the Diaper Distribution Pilot. They also utilized data sources such as grant-collected data (including participant demographics, services received, and outcome data); grant materials (such as quarterly progress reports, participant recruitment materials, and staff training materials); and secondary data sources describing the communities where the grants operate. More information on the implementation evaluation design can be found here.

Data from the first three cohorts of the Diaper Distribution Pilot suggests that diaper distribution models vary greatly. Grant recipients partner with organizations such as CAAs, diaper banks, food banks, community organizations, and local government programs to distribute diapers to families with low incomes, and many enroll families that are already receiving other services from their programs. Grant recipients also utilize different strategies for obtaining and distributing diapers to families in need. For example, purchasing diapers directly from distributors or receiving free diapers through diaper drives and donations. More information on federally funded approaches to diaper distribution can be found in this overview brief and this brief on buying diapers in bulk.

Findings from the DDDRP Evaluation implementation evaluation and future outcomes study design are forthcoming and will be posted to the DDDRP Evaluation page. The current contracted work of the DDDRP Evaluation project is expected to end by March 2027 and will be developing measures of diaper need and use of diaper mitigation strategies and the draft design for the outcomes study to be conducted under this task order.

The DDDRP Evaluation’s activities represented a substantial and unique investment in the evidence building efforts of diaper distribution programs. For the next phase of this work, ACF is interested in better understanding the outcomes of the Diaper Distribution Pilot for:

• The families that receive services, including reductions in diaper need and diaper-related health issues as well as increases in child care access and employment, education, and training for caregivers, and

• The organizations that implement services, including increased capacity to distribute diapers and increased efficiency in service delivery.

Authorizing legislation. This project is under the authority of Section 1110 of the Social Security Act [42 U.S.C. § 1310] and more specifically by direction of the Consolidated Appropriations Act, 2022 [P.L. 117-103], which has been extended, most recently, by the https://acf.gov/sites/default/files/documents/opre/opre-dddrp-eval-design-july24.pdf https://acf.gov/opre/report/diapers-families-need-overview-federally-funded-approaches-diaper-distribution https://acf.gov/opre/report/buying-diapers-bulk-early-findings-and-recommendations-diaper-distribution-pilots https://acf.gov/opre/project/diaper-distribution-demonstration-and-research-pilot-dddrp-evaluation

Consolidated Appropriations Act, 2026 [P.L. 119-75]. In the Consolidated Appropriations Act, 2022, funding was added to the Social Services Research and Demonstration (SSRD) budget for “carrying out a diaper distribution pilot program to provide grants to social services agencies or other non-profits specifically for diaper and diapering supply needs.” Research and evaluation are required by SSRD legislation for research and demonstration pilot programs.

ACF's Evaluation Policy demonstrates ACF’s commitment to conducting rigorous, relevant evaluations and to using evidence from evaluations to inform policy and practice. The five principles of ACF’s Evaluation Policy are: rigor, relevance, transparency, independence, and ethics. It is expected that the work described in this task order will be carried out in accordance with the Evaluation Policy.

1.5 Type of Contract Contemplated

Firm-Fixed-Price (FFP)

1.6 Period of Performance

The period of performance of this task order is a non-severable Base Service Component of 36 months from date of award.

1.7 Place of Performance

The work to be performed under this task order will be performed at the Contractor’s address and may include multiple states and localities.

1.8 Recognized Holidays

Federal holidays listed here: https://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

2.0 Contractor Work Scope/ Requirements

The contractor must furnish the necessary qualified personnel, equipment, materials, supplies, services, facilities, and otherwise do all that is necessary for, or incidental to, the performance of the work set forth below. The Contractor is expected to work with the Contracting Officer’s Representative (COR) to refine the activities and proposed plans once contract is awarded.

Applicable Documents

• Plain Language Checklist

• Suggested Assumptions

• Applicable documents also include the ACF Policy on Generative Artificial

Intelligence Tools, the ACF Policy on AI Activation Toolkit, applicable HHS/ACF OCIO policies, and applicable HHS privacy, security, records, and incident response policies.

https://www.acf.hhs.gov/opre/report/acf-evaluation-policy

2.1 Specific Requirements/Tasks

Service Component 1: Base Purpose: To conduct all activities necessary to design and conduct the outcomes study of the Diaper Distribution Pilot

End product of value: Final report summarizing findings from the study.

Overview of tasks: This service component is organized into the following tasks:

• Task 1 – Manage the Project

• Task 2 – Active Engagement

• Task 3 – Complete Preparatory Activities for the Evaluation

• Task 4 – Conduct the Evaluation

• Task 5 – Privacy and Data Security Activities and Monitoring

• Task 6 – Data Archiving

• Task 7 – Provide Evaluation Technical Assistance

• Task 8 – Prepare Interim and Final Products from the Study

• Task 9 - Transfer of Materials

Working with the COR, the Contractor must be responsible for the following tasks. See the Schedule of Deliverables for all deadlines.

ACF is committed to ensuring that data collected as part of this contract are maintained and stored securely. For the purposes of this PWS, Personally Identifiable Information (PII) is defined as information that can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, alone or when combined with other personal or identifying information, which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, and so on.

SC1 – Task 1 – Manage the Project

Task 1 does not include IT services.

SC1 – Subtask 1.1 – Project Kick-off Effective communication between the Contractor and the federal government, coordinated through the COR, is essential to the success of the project and begins at the very start of the contract with the project kick-off. For this subtask, the Contractor must organize a project kick-off with the Contracting Officer’s Representative (COR), federal staff from OCS, OPRE, other federal staff, and the Contractor.

The Contractor must initiate communication with the COR to begin planning the project kick-off. Topics to discuss at the kick-off include, but are not necessarily limited to, clarification of OPRE and OCS’s objectives for the project, the importance of conducting work on an efficient schedule, methodologies to be employed, timelines for early project deliverables, and anticipated challenges and potential solutions. The Contractor must provide a proposed agenda and materials for the kick-off as well as a memorandum summarizing major decisions reached and next steps after the kick-off.

SC1 - Subtask 1.2 - Ongoing Communication, Clearances, and Training Ongoing, effective, timely communication between the COR and the Contractor is essential to the success of this contract.

Ongoing communication should be both verbal (e.g., scheduled every other week video conference calls, discussed in this subtask) and written (e.g., monthly progress reports, discussed in the following subtask). The Contractor must propose a schedule for every other week video calls with the COR. The purpose of these calls is to discuss current activities, obtain input and guidance from federal staff, review progress made on project tasks, and identify and discuss emerging challenges. The Contractor must determine who from their staff will participate in these discussions. The schedule for calls may be changed as agreed upon by the COR.

The Contractor must be responsible for providing agendas for the calls, any materials the COR will need to review prior to the call, and summaries of the discussions on the calls, including major decisions reached and follow-up issues identified.

Advance Clearance Information: As requested by the COR and to facilitate timely clearance processing, the Contractor must provide clearance related information for each staff member working on the contract. This includes indicating previous HHS/federal work, prior federal background checks, active clearances, and justifications for any required Government Furnished Equipment (GFE) such as laptops or PIV cards. The Contractor must also identify any required access to Government held systems.

Mandatory Training: All personnel who receive a Tier 1+ clearance must complete security awareness training. Tier 2+ personnel (Privileged Users) must complete mandatory privileged user training before system access is granted, regardless of whether they receive a GFE/laptop.

As requested by the COR, the Contractor must send proof of training completion for all required staff.

SC1 - Subtask 1.3 – Project Management and Progress Reports Effective management of the entire project, including resolving problems, maintaining an on-time schedule for activities and deliverables, and communicating with the COR are essential to achieving the Government’s objectives. The Contractor must institute a strategy to ensure effective management for a contract of this scope and scale. Anticipated deviations must be reported to the COR in a timely manner, generally within 48 hours of identification.

In addition, the Contractor must submit detailed written monthly progress reports throughout the period of the service component. Progress reports must include: (1) activities performed in the month by task, including – a description of the progress made in completing each task, problems encountered or remaining from prior months, and proposed approach to resolve problems; and

(2) monthly and cumulative expenditures, by service component and by task, as well as the balance remaining by service component and by task.

Either as part of the progress report, or as a separate standalone product, the Contractor must develop a data inventory to document information about the data assets created or utilized while executing the contract. The data inventory must document information about the current status, size, and format of the data; whether data are individual or aggregate-level; whether data are identifiable (i.e., contain sensitive or personal information); whether there is associated metadata available including codebooks and data dictionaries; and whether there are limitations on use or disposition described in data use agreements or informed consent forms. The data inventory must be updated at least every six (6) months throughout the period of performance, or more frequently as directed by the COR.

Progress reports must be submitted to the COR monthly and before or concurrently with submission by the Contractor of invoices related to that period discussed in the progress report.

SC1 - Subtask 1.4 – Decision Log The Contractor must maintain written records (e.g., memos, discussion notes, email correspondences) and a log of decisions made during the project, including the main points discussed prior to coming to a decision and the rationale for the decision. At the request of the COR, the Contractor must submit a copy of the decision log describing any key decisions made.

SC1 - Subtask 1.5 – Develop Project Description The Contractor must create a Project Description for use by the Contractor and ACF/OPRE that provides an overview of the project and communicates its purpose. The first draft of the project description must be submitted to the COR. The Contractor must revise the draft project description based on COR feedback and must submit a revised version. The Contractor must continue to update the project description over the course of the contract at the request of the COR to ensure that the project description provides up-to-date information about the project.

SC1 – Subtask 1.6 – Use of Artificial Intelligence (AI) by the Contractor in Contract Performance If the contractor plans to use, or may use, AI technologies at any point during contract performance, the contractor must submit an AI compliance and risk management plan, in accordance with the Deliverables section of this contract.

The AI Compliance and Risk Management Plan is required to:

o Identify the specific tasks or functions where AI will be used.

o Explain how AI-generated data will be stored, used, retained, or deleted.

o State whether the AI technologies are open-source, proprietary, or any other type.

o Include applicable model cards or system documentation describing the AI technologies used.

o Describe how bias in AI models and outputs will be identified, monitored, and mitigated, including the origin, quality, and weighting of data.

o Explain the AI safeguards in place, including compliance and risk management practices, protections against unauthorized data access, and steps taken to manage bias and reduce risk in alignment with applicable AI policies and directives.

o Describe internal policies governing AI use, including transparency, accountability, data integrity, accuracy, protection of sensitive or proprietary information, foreseeable risks, and potential social impacts.

o Explain how the contractor will assess and prevent unfair or disparate impacts, address privacy, civil rights, and civil liberties concerns, and prevent misuse, unauthorized use, or corruption of AI systems.

o Confirm that the AI solution will not make or support decisions based on unlawful discrimination in violation of federal civil rights laws, including Title VII of the Civil Rights Act, the Americans with Disabilities Act (ADA), and the Age Discrimination in Employment Act (ADEA).

o Describe how applicable technological or voluntary consensus standards will be incorporated to reduce acquisition and operational risk.

Review and Approval The Government reserves the right to review and approve or disapprove the proposed use of AI technology under this contract. The contractor must obtain written approval from the contracting officer for the AI compliance and risk management plan before using any AI tools or technologies.

Deliverable Timeline The contractor must submit the AI compliance and risk management plan before implementing any AI technologies under the contract. The Government will review the plan prior to authorizing AI use. If the contractor later proposes to use new or different AI technologies, an updated plan must be submitted and approved by the Contracting Officer before those technologies are implemented.

SC1 – Task 2 – Active Engagement

Task 2 does not include IT services.

The key objectives of this task include the following:

• Actively and robustly engaging staff and participants of the Diaper Distribution Pilot (at the grant recipient and subrecipient level) in the design and implementation of the evaluation and, later, interpretation of findings.

• Identifying intermediaries who reach other practitioners in this program space and engaging these intermediaries at different points in the project’s development and timeline.

• Identifying academic experts, researchers, practitioners, and policymakers whose practical and empirical knowledge can inform key aspects of the project and engaging those experts at different points in the project’s development and timeline.

• Encouraging the use of research evidence produced by this project by supporting the participating programs in understanding the implications of the research.

ACF defines active engagement as the intentional involvement in all phases of the inquiry process of groups and individuals who are invested in the outcomes of the research or evaluation

– including academic experts, researchers, practitioners, policymakers, program participants, and others. The goal of active engagement is for both practice and empirical knowledge to inform tasks at all key stages of the project. This type of engagement can improve the rigor and relevance of ACF research and evaluation and facilitate the uptake of findings. The nature or frequency of engagement may vary for different groups or individuals, but opportunities to provide input should be considered at multiple points throughout the project. If appropriate, a Memorandum of Understanding with some individuals and groups may be warranted. To protect the independence and objectivity of the evaluation, all active engagement activities must ensure there is neither appearance nor reality of a conflict of interest.

SC1 – Subtask 2.1 – Active Engagement Memo The Contractor must identify an approach to active engagement activities, including engaging staff and participants of the programs in the design and implementation of the evaluation and interpretation of findings and sharing that approach via a memo.

Additional activities the Contractor could consider proposing in their approach include –

• Once products summarizing study findings are generated, sharing them with earlier identified intermediaries to assist in promoting the lessons learned and findings with the broader field.

• Conducting debriefs with the grant recipients once summary products are complete to help grant recipients and their partners think about how to use the results.

• Engaging other programs/program practitioners in the relevant program areas to use the findings to inform their work.

The memo should describe: proposed groups and individuals to engage, project tasks and activities where active engagement will occur, engagement methods for achieving specific goals, and other details as requested by the COR. Additionally, the memo should include explicit discussion of how active engagement input will be obtained in a transparent way, consistent with ACF’s evaluation policy, while safeguarding the objectivity and independence of research and evaluation functions from undue influence and from both the appearance and the reality of bias throughout the planning for and execution of active engagement. The Contractor must submit a draft and revised memo to the COR and must update the memo as needed.

SC1 – Subtask 2.2 – Conduct Active Engagement The Contractor must carry out the agreed upon active engagement activities and must report out on the conduct of those activities. For any engagement of specific individuals approved by the COR, the Contractor must submit draft materials and final materials to the COR prior to each engagement. Additionally, the Contractor must submit written summaries of engagements to the COR after each engagement.

The Contractor must also share updates on any other active engagement work conducted under this task in the monthly progress reports (e.g., submissions to intermediary organization newsletters, email blasts to a listserv, etc.). These updates should outline any challenges or issues related to active engagement activities, and proposed remedies to those challenges.

SC1 - Task 3 – Complete Preparatory Activities for the Evaluation https://acf.gov/opre/report/acf-evaluation-policy

Task 3 includes IT services.

The key objective of this task is to complete preparatory work necessary for the study, including finalizing the study design, developing data collection instruments, completing regulatory and human subjects clearances, and, if needed, obtaining and maintaining an authority-to-operate

(ATO).

SC1 – Subtask 3.1 – Finalize Study Design The key objective of this task is to make final conceptual, measurement, and operational decisions for the study.

The Contractor must finalize any outstanding decisions regarding the study design with input from the COR, drawing heavily from the materials that were produced by OPRE’s Diaper Distribution Demonstration and Research Pilot (DDDRP) Evaluation project [Contract #GS00F009DA / 140D0423F0298]. The COR will furnish the Contractor with any products associated with that project that are not already public by the start of this contract. In addition to the published materials mentioned in the Background section of this PWS, these products will include a report entitled Diaper Distribution Demonstration and Research Pilot: Future Outcomes Study Design which provides a comprehensive outline of an approach to conducting the study under this task order.

As needed and with the COR’s input, the Contractor must produce a table outlining the key decisions that need to be finalized related to the study design. As needed, the Contractor must then produce a memo that outlines the strengths and weaknesses of different decision options and make recommendations to the COR based on their assessment of what is likely to produce the highest quality evidence while being optimally feasible to implement.

The final design memo should describe all aspects of the technical approach to the study including but not limited to the following:

• Research questions and hypotheses

• Study design

• Power analyses

• Anticipated response rates for the survey, overall, and for key measurement items

• Measures

• Data sources

• Data collection plan including proposed schedule and logistics for data collection

• Analysis approach and methods, including statistical methods to be used

• The approach for handling missing data

• Proposed timeline for the study’s implementation

SC1 – Subtask 3.2 - Develop Data Collection Instruments and Regulatory and Human Subjects Clearances

The key objective of this subtask is to develop the materials needed to obtain Office of Management and Budget (OMB) Paperwork Reduction Act (PRA) approval and Institutional Review Board (IRB) approval for the evaluation and any research needs associated with this service component, as needed.

OMB Approval As needed, the Contractor must prepare any required publication notices and clearance package materials for OMB. The Government’s current understanding is that the approval process (including ACF review) takes at least 240 days for a standard information collection request and at least 90 days for the clearance process for a generic information collection request.

An initial OMB package will include: 30- and 60-day Federal Register notices, supporting statements for data collection, study recruitment materials, consent forms, full set of data collection instruments to be used in the study, and sample retention materials.

Any necessary draft and revised materials must be delivered to the COR for review. The timeline should, at minimum, take into consideration the timeline for the planned launch of the study.

ACF will submit all final materials to OMB. The Contractor must address comments received from OMB and revise the instruments and materials as needed until approval is received from

OMB.

IRB Approval To ensure that human subjects are protected, the Contractor must prepare the materials needed to gain approval from their firm’s IRB and any other relevant IRBs necessary for the proposed approach. The Contractor must submit draft and revised IRB materials to the COR for review.

The Contractor must provide the COR with the final materials submitted to their IRB and a copy of the final, approved IRB materials.

If the approved study design includes collection of PII, the Contractor must seek a Certificate of Confidentiality from the National Institutes of Health (NIH), if appropriate. If the Contractor obtains a Certificate, they must provide ACF with a copy of the approval, as well as any materials submitted. This must be noted in the Contractor’s OMB package. If appropriate, ACF may require the Contractor to submit draft materials before they are submitted to NIH. As part of their proposal for the Certificate of Confidentiality, the Contractor must have approval from an

IRB.

SC1 – Subtask 3.3 - Obtain ATO The key objective of this subtask is to secure an Authority to Operate (ATO), as needed, in anticipation of study activities.

All contractor systems, tools, applications, platforms, AI-enabled services, and third-party services that collect, store, transmit, process, generate, or analyze Federal information for this contract must obtain an ATO or other written authorization required by HHS/ACF before use. If the Contractor does not have an environment with an ATO, but ACF determines one is needed, the Contractor must plan to secure one and submit that plan, including alternative options, to the COR. The Contractor should choose the most efficient and effective method in consultation with the COR and related ACF staff.

Should the Contractor be required to secure an ATO, the Contractor must achieve compliance with HHS/ACF standards, meaning the Contractor must create and supply any necessary documents required by ACF’s Office of the Chief Information Officer (OCIO) to assess and verify the security of environment where data will be stored and participate in the ACF OCIO’s process for securing an ATO. Contractors must provide the following deliverables:

• System Security Plan (SSP) – Overview of system security controls, updated annually

• Security Assessment Plan/Report (SAP/SAR) – Assessment results, updated annually

• Interconnection Security Agreement (ISA) – Documents security responsibilities for system interconnections

• Plan of Action and Milestones (POA&M) – Tracks and mitigates security risks, updated quarterly

• Contingency Plan – Developed and tested annually

• E-Authentication Questionnaire – Ensures appropriate authentication levels

SC1 – Task 4 – Conduct the Evaluation

Task 4 includes IT services.

The key objective of this task is to conduct the evaluation of the Diaper Distribution Pilot, including registering the study, planning for, recruiting, training, and monitoring data collection staff, conducting and monitoring data collection, and planning for and conducting data analysis.

SC1 – Subtask 4.1 – Register the Study ACF values transparency in research and evaluation. To that end, the Contractor must register the study with an appropriate registry prior to the initiation of data collection (e.g., Open Science Framework). Contractors are encouraged to also pre-specify their analysis plan, if appropriate.

The Contractor must submit draft and revised Registration Materials to the COR for review and approval prior to registering the study. These materials must be submitted and updated by the Contractor as needed.

SC1 – Subtask 4.2 – Plan, Recruit, Train, and Monitor Data Collection Staff The Contractor must develop a plan for recruiting data collection staff, for comprehensive training to ensure they have the necessary skills to perform their duties, and for monitoring their performance. The Contractor must plan for recruiting and hiring data collection staff who are qualified to interact with study participants from heterogenous backgrounds, including backgrounds that vary by English language fluency. The plan must document how -

• Sufficient field staff will be recruited and deployed

• Appropriate translation of various study materials will be ensured

• Data collectors will be trained and a timeline for their training

• Necessary levels of staffing will be maintained and/or how new data collection staff will be onboarded

• Data collectors’ performance will be assessed and monitored

The Contractor must submit the draft and revised recruiting, training, and monitoring data collection staff plan to the COR.

All persons who collect or have access to raw data must be trained in confidentiality issues and must provide signed assurances of nondisclosure of confidential information. The Contractor must maintain these records and provide them to the COR upon request.

Following approval of the plan, the Contractor must recruit field staff and conduct thorough training of all individuals involved in research and data security protocols. The training must be completed before data collection efforts begin.

All field data collection must use ACF-approved secure devices, applications, and transmission methods. Devices used to collect or access study data must be encrypted, password-protected, configured for automatic locking, capable of remote wipe, and prohibited from storing data locally unless approved by the COR. Paper forms, if used, must be minimized, tracked, stored securely, and transferred using approved procedures.

SC1 – Subtask 4.3 – Conduct and Monitor Data Collection According to the approved study design plan (SC1 - Subtask 3.1 – Finalize study design), and assuming OMB approval of the information collection, the Contractor must implement approved data collection protocols. Data collection activities must ensure as high a response rate as possible from the full research sample, aiming for a response rate of about 80 percent to follow-up surveys. The Contractor must recommend and undertake corrective actions to achieve high response rates.

In regular progress reports, the Contractor must share progress on the data collection activities by study site. These reports must include tables detailing progress on the data collection efforts, including response rates. The reports must also outline any challenges or issues related to data collection activities, and proposed remedies to those challenges.

In collecting data, the Contractor must adhere to the procedures outlined in the data security monitoring plan referenced in SC1 - Task 5 (Privacy and data security activities and monitoring).

If administrative data is used, the Contractor must conduct all activities needed to ensure successful acquisition of administrative data to successfully carry out the approved study design.

This may include but is not limited to: identifying administrative data sources; establishing and/or maintaining administrative data agreements with appropriate federal, state or other entities; and any activities necessary to ensure data are held or acquired before they expire. Data agreements must be established and maintained so that outcome data on participants can be acquired with the lowest rate of missing data possible and in time to be included in any necessary analyses.

All field data collection must use ACF-approved secure devices, applications, and transmission methods. Devices used to collect or access study data must be encrypted, password-protected, configured for automatic locking, capable of remote wipe, and prohibited from storing data locally unless approved by the COR. Paper forms, if used, must be minimized, tracked, stored securely, and transferred using approved procedures.

SC1 - Subtask 4.4 - Data Analysis Plan The Contractor must draft and revise a Data Analysis Plan for this study, which will be submitted to the COR and included in the registration of the study. The analysis plan should include a discussion of the analysis methods that are most appropriate to address the research question(s) and explain the reasoning behind the recommended approach.

SC1 – Subtask 4.5 – Data Analysis The Contractor must conduct all activities necessary to prepare the data collected for analysis.

Using the plans approved under SC1 - Subtask 3.1 (Finalize study design) and SC1 – Subtask 4.4 (Data Analysis Plan) as a guide, the Contractor must then undertake analyses necessary to successfully examine the data collected as part of this study. If deviations from the study plan and/or additional analyses are needed, the Contractor must submit recommended methods and approaches to the COR for review and approval.

SC1 - Task 5 - Privacy and Data Security Activities and Monitoring

Task 5 includes IT services.

Background. This task order involves Personally Identifiable Information (PII) and/or Controlled Unclassified Information (CUI). PII is defined as information that can be used to distinguish or trace an individual’s identity, such as their name, social security number, biometric records, alone or when combined with other personal or identifying information, which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, and so

on. CUI is any information the Government creates or possesses that requires safeguarding under law, regulation, or Government-wide policy, but is not classified. Both PII and CUI must be maintained and ultimately destroyed in accordance with NIST SP 800-88 and applicable law, including the Privacy Act of 1974, HIPAA, FISMA, FOIA, the Federal Records Management Act, NIST Special Publications, OMB Circulars and Memoranda, GAO guidance, HHS/ACF policy, and DISA STIG hardening guidelines.

Maintaining CUI. The Contractor must undertake appropriate activities to maintain the confidentiality, integrity, and availability of all CUI, including (a) following the relevant policies, procedures, controls, and standards required by the HHS/ACF Information Security Program and (b) using any applicable templates, policies, forms, and other agency documents.

The Contractor must document the privacy impacts of this contract by completing a Privacy Impact Assessment or equivalent document that will be provided by the COR after award.

If the Contractor is not required to seek an ATO (see SC1 – Subtask 3.3 - Obtain ATO), the Contractor must document how the Contractor maintains data security for this contract by providing a detailed Data Security Plan (DSP) that discusses how they will protect all CUI. The Contractor must also provide documentation of these security measures when necessary to demonstrate the information documented in the DSP.

The Contractor must conduct and document an initial security and privacy risk analysis before collecting or receiving study data and must update the risk analysis at least annually and whenever there is a material change to systems, tools, data flows, vendors, AI use, staffing, or data sensitivity. The Contractor must maintain a risk management plan that identifies risks, mitigation actions, responsible owners, target completion dates, and residual risk.

If needed, the Contractor must submit a draft and revised DSP to the COR. The DSP must then be updated annually, or more often as needed based on changes to the project. The Contractor must submit an annual Report on Compliance with the DSP. The DSP must comply with the recent versions of the following documents as required by HHS/ACF: NIST SP 800-18, Federal Information Processing Standard (FIPS) 199, FIPS 200, NIST SP 800-53, DISA STIG, SP 800- 171, OMB Memorandum M-05-22, and other applicable NIST, HHS, and ACF policies and guidance.

In consultation with the COR and consistent with guidance that will be provided by the COR, the DSP must specifically address data security and privacy controls, including but not limited to:

• A description of the CUI, including more specific details about the type, quantity, and nature of any other PII or sensitive data.

• Identifying the assigned personnel and roles associated with the project and associated data security and privacy safeguards.

• The assurances provided to respondents or participants about the privacy of their information.

• How CUI is collected, accessed, transmitted, and stored, including confirmation that user access controls, account management, and encryption standards and procedures meet the HHS/ACF standards. This should include discussions of procedures for both IT and non- IT based transmission and storage.

• A description of the environment(s) in which the CUI will reside.

• The training procedures in place for all project staff at all levels of the project and specific instructions to all staff related to handling CUI.

• Documentation of the incident response procedures, which comply with the applicable

HHS/ACF policies, discussed further below.

• The disposition of the CUI at the end of the contract.

The Contractor must maintain audit logs for systems containing CUI, PII, PHI, or sensitive study data; review logs on a defined schedule; document anomalous activity; and make logs available to ACF upon request. The Contractor must conduct access reviews at least quarterly and within five business days of staff departure or role change. Access must follow least-privilege principles and must be removed promptly when no longer needed.

Before collecting or receiving any health-related information, the Contractor must document whether the data constitute PHI or ePHI under HIPAA and whether the Contractor, ACF, grant recipients, subrecipients, or data providers are acting as covered entities or business associates. If HIPAA applies, the Contractor must not receive or process PHI/ePHI until all required agreements, including any Business Associate Agreement, are executed and approved.

The Contractor must not enter, upload, transmit, summarize, analyze, or otherwise process non-public information, CUI, PII, PHI, source data, transcripts, administrative data, or draft deliverables in any public, commercial, or third-party generative AI or AI-enabled tool unless the tool has been approved in writing by the COR, CO, and appropriate ACF security officials and has an ATO or other required authorization. The Contractor must disclose all proposed AI, machine learning, automated coding, transcription, translation, data extraction, or analysis tools before use.” ACF’s genAI policy states that only HHS/ACF-owned genAI tools with an ATO may receive non-public information, and even then users should be cautious with sensitive PII.

As directed by the COR, the Contractor must complete the privacy, security, and related trainings required by HHS/ACF, then provide to the COR the certificates of completion for each training. This may include Contractor Information Security Awareness, Privacy, and Records Management training.

ACF Incident Response Policy All suspected or confirmed security or privacy incidents, including incidents involving AI/genAI tools, unauthorized disclosure, lost devices, misdirected email, unauthorized access, or exposure of non-public information, CUI, PII, or PHI, must be reported to the COR and CO within one hour of awareness and, as directed by ACF policy, to the ACF Incident Response Team at acf_irt@acf.hhs.gov. The Contractor must preserve logs, prompts, outputs, files, and other evidence relevant to the incident.

Security incidents and privacy incidents are defined as:

• Security Incident: The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system.

• Privacy Incident: The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users have access or potential access to PII in usable form, whether physical or electronic, or where authorized users access PII for an unauthorized purpose.

mailto:acf_irt@acf.hhs.gov

The one-hour clock begins the moment a member of the Contractor’s staff becomes aware of the incident or the possibility of an incident.

The Contractor must diligently cooperate to ensure an effective incident response, which may involve (a) sending notices about the incident, (b) providing identity monitoring services to impacted individuals, and/or (c) providing requested images, log files, and event information. In both the initial report and any work to resolve the incident, the Contractor must work to protect all CUI from a secondary incident.

If the Government determines that the incident occurred because the Contractor did not conform to the requirements in this contract, remediation will be the responsibility of the Contractor at its own expense.

SC1 - Task 6 – Data Archiving

Task 6 includes IT services.

SC1 – Subtask 6.1 – Data Archive Identification ACF is interested in making data and analyses supported through federal funds available to other researchers. For this subtask, the Contractor must identify an appropriate data archive repository and make a recommendation to the COR. The recommendation, which can be communicated via email, must include summary information about the data archive such as the entity that houses it, the benefits of working with that data archive, and an assessment of its visibility to and use by researchers who conduct research on human services and/or relevant topics to this contract. The COR will make the final determination about the data archive to be used for this contract.

SC1 – Subtask 6.2 – Plan for Working with the Agreed Upon Data Archive With the COR’s approval, the Contractor must reach out to the data archive identified in SC1- Subtask 6.1 (Data Archive Identification) and obtain the necessary information from the data archive to create a data archiving plan. The data archiving plan will outline the procedures and parameters for all aspects of data/information collection (e.g., informed consent, data maintenance, etc.) necessary to support archiving information and data collected under the contract. The Contractor must submit a draft and revised data archive plan to the COR.

It is expected that the plan includes the following information, at minimum:

• Communication plan with the archiving entity, informed by the archiving entities’ processes

• Identification of the types of data that will be shared with the archive

• Considerations of the level of restriction and access for different types of data

• Inclusion of consent form language that accurately represents any plans to share or transfer data to other researchers as well as to store data collected containing PII and data linkages for longer-term preservation

• Methods of data storage to support archiving

• Data and analyses file construction and documentation that will support data archiving and duplication of all analyses

• Procedures to ensure data are prepared in accordance with archive requirements (e.g., documentation requirements, level of masking, etc.)

• A timeline for when the data is expected to be deposited with the archive, including the schedule for archiving different types or waves of data

• Development of a data…