Draft SOW NIA Data Linkage.pdf

STATEMENT OF WORK (SOW):

The NIA Data Linkage Program (LINKAGE)

I. BACKGROUND

The mission of the National Institutes of Health (NIH), National Institute on Aging (NIA) is to “support and conduct…clinical, behavioral, social, and economic research on aging” and to “foster the development of research and clinician scientists in aging.” As part of its efforts, the NIA provides research resources by supporting data collection and distribution. These data are made available to approved researchers to analyze; the researchers disseminate information about health, economic, and social resources in aging. To leverage investment in these high-quality datasets and high- visibility research areas, the NIA looks for ways to enhance data utility for multidisciplinary research. Providing access to linked Centers for Medicare & Medicaid Services (CMS) data to NIA-funded researchers maximizes the value of current NIA investments.

Administrative data alone (e.g., CMS data) and/or adding administrative data to demographic, health, social studies, and clinical studies that are supported by the NIA enhances value and utility of data by facilitating research on health care utilization, health outcomes, and health expenditures, all of which can inform policy and programs and provide insight on older adult health.

NIA’s Strategic Plan/Goal G highlights the need to “support the infrastructure and resources needed to promote high-quality research,” particularly access to CMS claims data and for longitudinal, NIA-funded studies that are linked to CMS claims data. In response to this review, NIA funded the second iteration of the NIA Data Linkage Program (LINKAGE) in 2021.

To date, the NIA Data LINKAGE Program (LINKAGE) has offered NIA grantees access to CMS-linked datasets for research purposes. The current requirement seeks to expand the user base of the program, improve user experience within the LINKAGE Program, incorporate linkage to additional Federal datasets, and host NIA funded studies with sensitive data for research purposes, including those studies that are seeking centralized means for data storage and sharing.

II. PURPOSE

The primary objectives of this requirement are to (1) receive and review requests for CMS-linked datasets from Studies (2) obtain CMS data, conduct data linkage (3) process and create and research files and distribute linked datasets (4) produce and maintain data documentation and data updates (5) facilitate federated data services for standalone studies which does not use CMS data

(6) establish and maintain a website to relay program information and resources to the public;

(7) deliver technical assistance, support and training to data users; and, (8) Provide a Government-Owned, Contractor-Operated (GOCO) federated enclave for the storage, analysis, and distribution of linked and unlinked study datasets.

III. TASKS

The Contractor, independently and not as an agent of the Government, shall furnish all necessary services, qualified personnel, labor, facilities, equipment, materials, and supplies not provided by the Government required to perform the work described below.

Task 1: Receive and Review Requests for CMS-linked Data to NIA-funded Studies

The Contractor shall receive and review data use requests for CMS data linked data to NIA-funded studies and ensure compliance with existing CMS and NIA funded studies (e.g., survey data, clinical trials, etc.), use request policies (see https://www.resdac.org/), and data security policies. CMS data and CMS-linked data to NIA-funded studies are not public use files. The Contractor shall be responsible for assisting the NIA in reviewing submitted data use requests and manuscripts (if necessary) for adherence to CMS and NIA data release policies. Researchers interested in obtaining these data are required to submit a data request to the NIA with a description of how the data shall be used and how the data shall be protected. The Contractor shall maintain a data request form that data requestors shall use to request data as part of the Data Use Agreement (DUA) documentation.

There shall be a weekly call between NIA and the Contractor to discuss these requests. These data requests shall be reviewed prior to the weekly call by the Contractor for the following elements:

a. Data files requested: The CMS-linked data to NIA-funded studies include CMS claims files from 1999-present following minimum data necessary principles established by CMS.

Specifically, requestors are only allowed to obtain the data files that are relevant to their proposed project. The Contractor shall review each data request to determine if the data requestor is only requesting the data files needed for the proposed project. For example, if a data requestor plans to use Medicare data to examine patterns of health care utilization one year before and after Hurricane Katrina, but requested data for a decade, the Contractor shall reject the data use request, or seek a modification to the data use request. The Contractor shall review the data request to determine that the data requestor has requested all files needed for the analysis (e.g., proposing to assess prescription drug use, but not requesting the Medicare Part D prescription drug data; or proposing to use Medicare Advantage data (Part C), but instead requests hospital inpatient claims (Part A)). If the data requestor has not requested the correct files, the Contractor shall share with the NIA Contracting Officer’s Representative (COR) a written explanation to the data requester and COR of what data files need to be added to the request or should be removed from the request, depending on the specific situation.

b. Feasibility of the proposed project: The NIA requires that CMS-linked data to NIA-funded studies explain how the data shall be used and to describe specific files/variables from CMS-linked data to NIA- funded studies. The Contractor shall review the data requests to determine that the project is feasible to answer the research question, based on the attributes of the data. The purpose of this review is not to assess the scientific merit of the project, but rather to determine if the analytic project can be completed given the available data and minimum data necessary to be provided to the researchers. The Contractor shall be responsible for reviewing data requests and providing the NIA with written comments to the COR if there are concerns related to the feasibility of the proposed project.

c. Data storage: The NIA requires that all CMS data and CMS-linked data to NIA-funded studies be stored in a secured manner [within an authority to operate (ATO) environment], on a secure server with adequate firewall protection, and that the files are password-protected. Data shall not be stored on personal computers. The Contractor shall review requests for CMS-linked data to NIA-funded studies to ensure that the data storage requirements as outlined in the NIA/NIH Medicare DUA have been met.

d. The Contractor shall account for any unanticipated amendment requests (i.e., unexpected data requests from the study team due to unforeseen circumstances such as adding missing MDS files for a particular study which was not requested for the NIA/NIH/DUA) during the annual review and codify to the amendment request for processing as soon as the data is requested. The Contractor shall review and organize this new request and update information in a timely manner. The Contractor shall create and enter comments onto a standardized review form that the NIA COR shall review and approve within 1 month of the contract award, revising the form, as necessary. The form shall accept electronic signatures and shall integrate Software-as-a-Service (SaaS) tools. The Contractor shall budget appropriate funds to electronic signature and SaaS tool.

e. The Contractor shall use the SaaS tool to maintain proper workflow with each study, including integrating data requests and status updates within 3 months of the contract initiation

The Contractor shall also review and provide support for up to 50 NIA funded Studies in each performance period that shall participate in the LINKAGE Program to use the LINKAGE enclave for the sole purpose of data storage, analysis and sharing (i.e., when data is not linked with CMS data). The Contractor shall seek written COR approval to permit enclave use for data-sharing studies that are not using CMS-linked datasets.

All data requests shall be reviewed within 5 business days of receipt. By the end of these 5 days, the Contractor shall notify the COR in writing using the SaaS tool (which shall be used for tracking data requests) to determine if the request is acceptable or delineate what additional data or information must be submitted along with the original submission materials. The Contractor shall complete all follow-up reviews of revised data requests within 5 business days of receipt. Some studies will require prior approval from the study before the Contractor can begin the review process. The Contractor shall work with the study partner/manager to incorporate such steps in the SaaS tool to optimize and coordinate the review.

The Contractor shall establish an electronic tool to track DUA submissions and the approval process that meets Federal IT security requirements. The Contractor shall submit a plan for the tool within one month of award and once approved and shall implement the tracking tool to manage study and researcher DUAs within three months of the award.

NIA Privacy Board Meeting: The Contractor shall coordinate, facilitate, and hold privacy board review meetings for 1-hour minimum, once a week, where data use requests will be reviewed by the NIA Privacy Board. For each data request, the Contractor shall prepare a succinct summary highlighting the justification for CMS data need, data being requested, and Contractor recommendation. The NIA Privacy Board will vote on each request and the Contractor shall record such vote in the minutes. If the NIA Privacy Board denies a request, the Contractor shall notify the requestor and inform them of the reasons. Once the NIA Privacy Board completes its review and approves a request, the Contractor shall track approval requests and provide the approvals to the COR. If the COR does not approve the data use request within 1 business day, reminders shall be sent to the COR. If the COR does not respond within 3 business days of the original request, then requests shall be directed to the NIA alternate COR for a response, or their supervisor who shall direct inquiries to the NIA Office of Data Resources and Analytics (ODRA) Director or Deputy Director using the SaaS tool for approval. If there are any issues with this task, these should be escalated to the ODRA Director and Deputy Director or DUA approval. The Contractor shall build all forms to accept electronic signatures with verification of identification (e.g., driver’s license, federal ID) within the SaaS tool or utilize federal services such (e.g., Research Authentication Service (RAS), login.gov, etc.).

f. The Contractor shall prepare an annual report to describe the implementation of the data use agreement (DUA) and recommend changes and improvements. The report shall also include recommended changes that are due to updates in Federal regulations or policies. The contractor shall submit a report to the COR and present recommendations to the Privacy Board annually to inform the Board about key updates two weeks prior to the end of each contract period (base period or option period, if exercised).

g. The Contractor shall document the purchase of liability insurance in the amount of $30M or above to mitigate risk in the event of a data breach (includes linked and unlinked data) and list this contract under the terms of the insurance policy. The Contractor shall provide a letter or a certificate to document this requirement once per contract period (base or option period, if exercised) within 1 month of award to the COR. If changes are made to the policy, an updated letter should be submitted within two weeks after updates. If no changes are made to the policy, the Contractor does not need to resubmit the letter/certificate.

Deliverable 1.1: Agenda for NIA Privacy Board Meetings delivered no less than 2 business days prior to weekly meeting

Deliverable 1.2: Meeting minutes of NIA Privacy Board Meetings delivered within 2 business days of Privacy Board Meetings

Deliverable 1.3: DUA Report: Monthly report of number of data use requests received; data use requests processed; data use requests approved; data use requests denied; mean total cycle time for processing requests

Deliverable 1.4: DUAs for study and researcher review and approval Deliverable 1.5: Report on DUA Implementation and Improvements Deliverable 1.6: Letter or Certificate of liability insurance purchase Deliverable 1.7: DUA Tracking Tool Plan Deliverable 1.8 DUA Tracking Tool

Task 2: CMS Data Acquisition and Linkage

The Contractor shall have and maintain an existing CMS Data Use Agreement (DUA) with access to 100% CMS claims data (i.e., all beneficiaries) and all types of CMS files and as new files become available (see “Medicare Files” https://resdac.org/sites/datadocumentation.resdac.org/files/2021- 01/CMS%20Fee%20List%20for%20Research%20Files_25.pdf) for the period of 1999 and onward or maintain access to CMS data via Virtual Research Data Center (VRDC) through which data will be linked. The Contractor shall have access to CMS claims going forward. In the event that data files are not available (i.e., shipped files), the Contractor shall propose purchasing data from CMS (see optional task 1.2) and NIA shall pay for such data via Interagency Agreement (IAA). Further, if the Contractor shall be expected to access the CMS data via CMS’s Virtual Research Data Center (VRDC) and link CMS data to Study data, NIA shall pay for such seat via IAA.

The Contractor shall begin submitting CMS DUA requests to CMS on behalf of the NIA within 15 business days of receipt of the award. For Option Years, the Contractor shall ready a draft amendment package within 15 business days of each option period. The Contractor shall provide updates to submit CMS data requests at the earliest possible date that CMS accepts requests for data type(s) based on data availability. Any needed revisions to CMS data requests shall be submitted within 5 business days of the request from ResDAC. Any additional amendment necessary to the CMS DUA will be directed by the COR and draft amendment packages should submitted within 10 days of COR’s request.

The Contractor shall obtain approvals from CMS for linkages, as necessary. The NIA shall be the requestor of the data (i.e., DUA paperwork to be processed by the Contractor under this task) and the Contractor shall be the custodian of CMS data on the DUA and NIA will be the data requester.

The Contractor shall link CMS data with NIA-funded Study data and/or data from other sources.

The Contractor shall conduct up to 100 linkages in each performance period. The Contractor shall maintain the current existing NIA-funded studies linked with CMS data and shall update this inventory with new CMS data as they become available. Most of the NIA-funded studies either consent for linkages and/or collect various personally identifiable information (PII) (e.g., social security number, name, address) and have IRB waivers to link data, and the Contractor shall be expected to conduct linkages by optimizing the use of multiple PII data fields and/or hash algorithms when PII cannot be shared by the study owner with the Contractor.

All NIA-funded studies and other researchers must complete a NIA DUA to participate in this program and access CMS-linked data. The Contractor shall provide access to the NIA DUA on behalf of NIA and support interested NIA-funded Studies and Researchers with completing their NIA DUA.

The Contractor shall obtain PRA clearance or a waiver (as applicable) to disseminate the NIA DUA.

If needed, the Contractor shall prepare an OMB clearance package on behalf of NIA to disseminate the DUA within one month after COR request.

The Contractor shall submit a monthly linkage report that describes the status of the CMS DUA process, NIA DUAs executed and Studies that have been linked to CMS data in a section of the monthly progress report entitled, “CMS Data Acquisition and Linkage.”

The Contractor shall produce a white paper about the linkage methodology and the data inventory used in the program within 3 months of the award. The scope of the paper shall be approved by NIA within the first 2 weeks of the award in consultation with NIA ODRA director and Chief of Advanced analytics group. This white paper shall be posted to the website. The Contractor shall submit the methodology paper within 3 months of award in the base period. The white paper describing the linkage methodology shall be assessed for improvements and updated, annually. This assessment shall include but is not limited to an environmental scan/needs assessment of the current literature and incorporating automation The Contractor shall submit an annual update to this deliverable within 3 months of each performance period.

Deliverable 2.1: CMS DUA package

Deliverable 2.2: Monthly update on “Data Acquisition and Linkage” in Monthly Report Deliverable 2.3: DUA PRA Clearance Package Deliverable 2.4: Methodology paper Deliverable 2.5: Linkage environmental scan/needs assessment

Task 3: Processing and Creating Research Files

The Contractor shall develop research extracts and summaries of CMS administrative files at the person- level, tailored to satisfy the research needs of a wide-range of users. This task aims to create summary files in longitudinal formats that remove the burden of working with large and complicated claims data in multiple formats across multiple years. The Contractor shall conduct “batch processing” of multiple NIA-funded studies with CMS data to reduce processing and linkage time. In constructing these research files, algorithms shall be created to translate raw claims records into meaningful indicators of medical conditions and treatments. These files shall be formulated to provide user-friendly access to statistics describing individual respondents’ health status and usage of medical services as directed by the NIA COR in consultation of Chief of Advanced Analytics group. (e.g., development of summary variables such as the number of hospital days in any given year, etc.).

File development shall also include creating versions of research files designed to enhance information content while maintaining data confidentially through the masking of Health Insurance Portability and Accountability Act (HIPPA)-sensitive variables. This task assumes no change in data structures/elements but does require harmonization of variables across multiple years so longitudinal analyses can be performed consistently. This task shall require the Contractor to have the capability of making available the following research files by each linked study to researchers when directed by the NIA COR: (1) raw CMS data; (2) CMS data structures with existing summary files and formats, including harmonization of variable names across multiple years of CMS data (i.e., replicate file structures prepared by the current Contractor; (4) Chronic Condition Warehouse (CCW) format), and (6) creation of longitudinal files (6) synthetic CMS files linked with NIA data for training purposes. The Contractor shall submit a monthly Data File Report. The Report shall summarize the files that were linked, raw CMS data provided to approved researchers, summary files prepared, longitudinal files request, and synthetic files created.

The Contractor shall create a plan for developing longitudinal data files, a compendium of longitudinal files and associated data documentation for Study and Researcher use and submit a plan within 3 weeks of award. The plan shall include a white paper outline and a dissemination strategy draft plan outline. This plan shall be submitted within one month of the base period and updated annually.

The Contractor shall prepare a white paper for this product. The final white paper shall be submitted within six months of the beginning of the base period.

The Contractor shall prepare a dissemination strategy and materials for these products (e.g., feedback on need of longitudinal variables that are not available). The Contractor shall also facilitate feedback from Studies and Researchers. This feedback will be part of an established dissemination strategy to understand and embed improvements in option periods. The dissemination strategy and materials shall be submitted within two months of award and updated annually.

The longitudinal file compendium shall be advertised and made available within the enclave within six months of the base period. These files will be reviewed and updated bi-annually in each performance period (i.e., more data component will be added).

Deliverable 3.1: Monthly File Report (Files Linked, Raw CMS data provided to approved researcher-users, summary files prepared, longitudinal and synthetic files created)

Deliverable 3.2: Longitudinal file work plan Deliverable 3.3: Longitudinal file compendium and data documentation Deliverable 3.4: Updates to Longitudinal file compendium and data documentation Deliverable 3.5: Longitudinal file white paper and dissemination strategy

Task 4: Distribute Linked Research Files

The Contractor shall distribute linked research extracts to end-users in compliance with existing CMS and study data security policies (e.g., a study may require review of the research project and data security plan) via a secured cloud workspace, which will comply with CMS and NIA- CMS IEA policies and maintain either FedRAMP moderate or hold a moderate ATO. The process of extracting the data may vary for each data request.

The Contractor shall prepare a Study Linkage Report that summarizes a description of the linked dataset for each Study’s review. The Contractor shall deliver the first Study Linkage Report within 10 business days of NIA DUA execution and receipt of study’s Finder File. (The service level agreement (SLA) timeframe would begin when both NIA DUA and Finder File have been completed). The Contractor shall deliver CMS data and data documentation with 10 business days or earlier of the Study’s approval of the linkage.

The Contractor shall deliver an existing linked dataset for a Study running a second linkage within 7 business days of NIA DUA execution to a Researcher.

Minimally, each data distribution shall include the following elements:

a. Confirmation of request specifications;

b. Validation of approval for distribution of CMS-linked data through a review process from study managers, or make data available to the researcher directly (where appropriate), e.g., study managers provided prior approval to disclose data to researchers;

c. Validation of approval of CMS DUA procedures from the Contractor or CMS;

d. Verification of data extracts as specified in the CMS DUA from the Contractor or CMS;

e. Approval by NIA Privacy Board and COR;

f. Encryption and shipment of data files written to media (if directed by the NIA COR); and

g. Secure shipment/transfer of data files to the end-user in a secured cloud workspace.

The Contractor shall produce a Linkage Production Report to document the status of linkage production, quality assurance, distribution and approval activities across all Program participants. This deliverable shall be submitted with the Monthly Report.

Deliverable 4.1: Study Linkage Report Deliverable 4.2: Monthly Linkage Production Report provided in Monthly Report

Task 5: Daily Feed (Updates) of CMS Claims Data to NIA-Funded Studies

The Contractor shall obtain daily data (e.g., Shared System) from CMS, provide them to NIA-funded researchers, and link them to NIA-funded studies (including NIA-funded clinical trials).

These daily updates of CMS claim data are for NIA grantees to conduct real-time analyses for surveillance purposes associated within the scope of the study and approved by their respective institutional review boards (IRB) and CMS. These tasks shall occur if CMS provides approval and HHS is under a public health emergency. The Contractor shall institute programs that shall automatically update the data daily to reduce the involvement of human programmers for daily record updating. Quality assurance checks shall be conducted periodically (e.g., weekly, monthly, quarterly) as well as provide data and data documentation to the end-users via the cloud in a seamless manner. Depending on CMS DUA approval, the initial data release will likely lag by 7 to 14 days after a claim is filed and the Contractor is expected to conduct daily updates while maintaining the specified lag times approved by CMS. The Contractor shall support up to ten studies in each performance period (base period or option period, if exercised). The Contractor shall summarize these updates in the Monthly Report.

Deliverable 5.1: Daily Updates Report in Monthly Report

Task 6: Monthly Data Documentation

The Contractor shall maintain and further enhance data documentation (e.g., codebooks) for all linked research extracts of raw claims records and the research summary construction of CMS data monthly. This data documentation shall be machine readable and shall be built directly into the research extract files making specific data elements both easily searchable, understood and retrievable by potential users via the website described in Task 8. In addition to written material, documentation shall also be provided in accessible and easily searchable electronic formats and highlight consistency in variable naming conventions across multiple years of CMS data whenever viable. In addition to data layouts that report a label and description for each data element, the Contractor shall, in collaboration with study managers, develop detailed data documentation and tools for working with CMS data, including value formats and value frequencies, advising on specific data elements, and general guidance on the usefulness of CMS data for health services and health economics research. The data documentation tools shall be searchable by researchers (e.g., variables and Study metadata), and the Contractor shall utilize off-the-shelf data documentation tools/platforms from private vendors after consulting with the NIA COR. The Contractor shall provide all required software. Data documentation for each linked study should be released (on the web) no later than 15 days after Study approval.

Deliverable 6.1: Initial data documentation for all linked files delivered within 15 business days of initial linkage Deliverable 6.2: Annual data documentation updates for each Study and Researcher Deliverable 6.3: Monthly index of data documentation provided to Study and Researcher Users Deliverable 6.4: Integration of searchable tool

Task 7: Restructuring Research Files

CMS may modify their data structures which shall require algorithm development to create and maintain timely updates to ensure consistency with current summary files for NIA-funded

Studies. The Contractor shall notify the COR prior to beginning this task and discuss a restructuring plan. The COR shall approve the restructuring plan. The Contractor shall develop algorithms to create research extracts and summaries of CMS administrative files to ensure that the data files distributed remain consistent across multiple years. This shall accommodate changes in CMS’ data formats. The Contractor shall produce a Data Restructuring Report to describe a plan for restructuring, the revised algorithm/methodology, approach to data restructuring and outcomes for Studies and Researchers impacted by restructuring research files.

Deliverable 7.1: Data Restructuring Report

Task 8: Website

Public Website

The Contractor shall develop, design, manage, support, update, and enhance a public website to support dataset awareness and dissemination as directed by the COR. The public website is distinct from the Enclave website. The public website shall provide an overview of the program and information on resources available in the Enclave; however, it shall not include access to the Enclave.

The website shall adhere to all federal requirements and regulations related to websites and web applications including:

Privacy requirements, including ensuring the collection of any personally identifiable information (PII) follows Department and NIH privacy policy.

Compliance with Section 508, which requires federal agencies to make their electronic and information technology accessible to people with disabilities.

Meet the eight criteria in the 21st Century IDEA Act, including compliance with U.S.

Web Design Standards (USWDS).

Archiving website content in accordance with federal records management requirements and in alignment with the HHS Website Content Lifecycle Management (CLM) and Archive Guidance and the NIA Website Content Audit and Archive Guidance.

Adhere to the standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services established by the Federal Risk and Authorization Management Program (FedRAMP).

Obtain an Authority to Operate (ATO).

The website shall be hosted on NIA Office of Communications and Public Liaison’s (OCPL) existing servers and must be built in a Federal Risk and Authorization Management Program (FedRAMP) certified content management system. The Contractor shall be responsible for supporting the transition of content onto OCPL’s servers in close collaboration with OCPL’s contract team. The Contractor shall identify and demonstrate their ability to meet any necessary requirements for the transition to OCPL’s servers during the website development process.

OCPL will set up development, quality assurance, and production environments for the Contractor. The Contractor shall be responsible for all site development, design, maintenance, and publishing for the LINKAGE website, and OCPL’s web contractor will provide server support and communication about anything necessary to ensure ongoing security and control the impact to the NIA servers.

The primary function of the website is to:

1. Share Information: House information that researchers need to understand about data that are available through the LINKAGE Program. The website shall have resources that describe the LINKAGE Program, purpose and objectives, profiles of NIA-funded studies, and any other pertinent information for NIA-funded researchers and approved end-users to access. It shall also describe data available to researchers through the LINKAGE Program such as CMS data and record layouts for each file to be released to the researchers.

2. Facilitate Access to Participation in LINKAGE Program: Provide electronic DUA form and appendices for requestors to access and sign electronically. This form and associated appendices will be provided on a secure, password-protected platform that allows for researchers to prepare or upload their forms, track their review status, and document approval.

This component of the website will be housed behind a password-protected platform. This component of the site or platform can be accessed on a non-NIA.gov site.

3. Support Researchers: Provide information on accessing technical support for approved researchers and training materials. The Contractor shall assess, identify, develop, and maintain tools for user support which shall include web content, video tutorials (see Section 2.4.9) about each file type, and discussion boards to supplement documentation to facilitate data access.

The website shall have resources that describe this requirement’s activity, purpose and objectives, and any other pertinent information for NIA-funded researchers and approved end-users to access. It shall also describe CMS data and record layouts for each file to be released to the researchers. Lastly, it shall provide electronic DUA forms for requestors to access and sign electronically.

The initial website shall be completed within three months of award and updated as directed by the COR. The Contractor shall maintain and update either Federal platform and/or use a separate web presence to meet contract requirements when content cannot be posted to a Federal site.

Demonstration and Marketing of Research:

The Contractor shall establish a tiered marketing strategy to advertise the program through multiple channels including the public facing website and social media. The goal for marketing is to showcase the program, increase participation, and advertise key publications. The Contractor shall communicate on the availability of data via various channels, including but not limited to emails, blog posts, journal articles, and social media posts. The Contractor shall identify additional opportunities to raise awareness of the NIA Data LINKAGE program through various channels in addition to the venues mentioned previously. The Contractor shall develop promotional content, graphics, and materials in alignment with federal requirements (e.g., 508, plain language, etc.) and the NIA Style Guide, and support clearance of content in close collaboration with the COR.

Ongoing Website Management and Maintenance

The Contractor shall provide ongoing management and maintenance of the website in compliance with federal government regulations and guidelines. These activities shall be documented in the

Website Development and Management Plan.

Management and maintenance responsibilities include:

Ensuring websites and web services are designed in a secure environment and that allows the contractor to download and export all content with the intent of delivering it to OCPL and their contractor to set up the development, QA, production, and staging environments which will be delivered over a secure connection using Hypertext Transfer Protocol Secure (HTTPS) and up to date with current Internet protocol (IPv6).

Ensuring that access to websites, applications, and back-end systems is controlled and accessible only to those who meet access requirements. Access should follow all federal and NIH security regulations. NIH Login (or a secure equivalent approved by the NIA ISSO) should be used to control access to systems and websites.

Implementing and managing a search function that allows users to easily search the content of the website and ensuring that all public content can be indexed and searched by commonly used commercial search engines.

Ensuring that use of third-party websites and applications on the website comply with all privacy protection requirements (see OMB Memorandum M-10-23).

Ensure that the website and web services are compliant with digital best practices described in OMB Memorandum M-17-06 and legal requirements set forth in the 21st Century IDEA Act.

Making the information and services available to the public and ensuring they can access it on any device and ensuring that the public website is optimized for mobile devices.

Designing, producing, writing, editing, and maintaining content, publications, and graphics in HTML, image, video, and PDF formats and ensuring that all content and graphics are compliant with Section 508 requirements.

Reviewing and editing the websites for usability, content quality, and Section 508 compliance, with approximately 20-30 updates per month. submitted on an agreed upon cadence (weekly or bi-weekly). The Contractor shall review all new content submissions for Section 508 compliance and adherence to NIA style within two (2) business days of receipt.

The majority of submissions should be posted to the site within 1-3 business days. More complex content may require coordination with subject matter experts.

Providing routine maintenance of all sites, including updates, patches, link checking, archiving, and removal of obsolete content; and review of external links and disclaimer notification pages.

Providing technical support for the FedRAMP certified Content Management Systems

(CMS).

Ensuring the functionality and security of all web-based features (e.g., online forms) Designing usability tests as needed, implementing the tests, and reviewing and implementing relevant feedback from usability testing, customer responses, or surveys.

Provide technical support, and identify and resolve problems in a timely manner, including the establishment of a joint Change Control Board (CCB) to oversee substantial changes to the systems.

Quality Control

The Contractor shall:

1. Produce accurate, well-written and designed, error-free content and ensure that the website remains accurate, up-to-date, and accessible to everyone. Ensure the content is written in plain language, is as easy to read as possible, and meets the goals for the piece.

2. Develop an effective procedure to review and update the websites regularly for broken links and outdated content and ensure daily that all areas of the sites are functional.

3. Review the NIA websites routinely for compliance with HHS website standards and guidelines.

4. Ensure compliance with the Revised 508 Standards for digital accessibility, demonstrate an understanding for accessible software and websites best practices, and provide support for the use of automated tools and manual testing. With NIH CIT, NIA ITB, and HHS technical contacts, work to resolve any issues that arise.

The Contractor shall be responsible for maintaining a website that is 508 compliant and shall scan, test, and review the site on an ongoing basis. Assessment of 508 compliance shall be documented under quality control processes.

All new website content and updates including quality assurance activities shall be submitted as part of Website Updates report to the COR and designated NIA staff for review.

The Contractor shall create a technical portion of the CMS-linked data to the NIA-funded studies website and update information that is no longer current or accurate with the most recent information available. The purpose of this task is to identify and provide updates on data coding changes and changes in CMS data policies. For instance, CMS may change a policy and restrict the release of certain data or variables (e.g., Part D plan ID). The Contractor shall make the necessary updates to reflect the changes to the website as needed.

The Information may require changes due to a variety of reasons, such as those listed below:

a. Medicare coverage has changed over the years with the expansion of Medicare Advantage plans.

b. Codes for specific individual treatments have changed in association with cognitive impairment.

c. Entire coding schemes have changed, e.g., migration to National Provider Identifiers from Unique Physician Identification Numbers, the introduction of ICD-10 coding systems, etc.

d. Changes in data availability: CMS may not allow certain files to be released, or the NIA may want to highlight the availability of certain data.

The Contractor shall be responsible for investigating all codes and coverage information provided and associated with dementia care and cognitive impairment and highlight this information on the website.

On an annual basis, the Contractor shall submit an annual website plan. The plan shall discuss new site enhancements, management and maintenance activities including documented processes to show compliance with Federal website requirements, quality control processes, and other criteria as requested. The Contractor shall identify areas for improvements in their monthly project management activities as well as tracking milestones on a monthly basis.

The website analytics report shall be prepared in conjunction with NIA staff for content posted on nia.gov. A component of the report shall also describe usage of web content that is not hosted on a Federal site.

Deliverable 8.1: Website content development plan to build out content over the base period of the period of performance. The updated plan shall be delivered within 30 calendar days of award or option exercise.

Deliverable 8.2: Initial 508-compliant website posted within three months of award and updated based on direction of the COR.

Deliverable 8.3: Draft content additions delivered to COR no less than 20 calendar days prior to proposed posting date, or as directed by COR

Deliverable 8.4: Annual section 508-compliance report due at the end of each performance period or within 10 business days following content updates to the site

Deliverable 8.5: Marketing Plan delivered to the COR annually within 45 days of award. The Plan shall be updated on a quarterly basis.

Deliverable 8.6 Website Analytics Report shall be submitted monthly

Website Security

The Employee/Contractor (and/or any subcontractor) shall comply with applicable federal laws that include, but are not limited to, the HHS Information Security and Privacy Policy (IS2P), Federal Information Security Modernization Act (FISMA) of 2014, (44 U.S.C. 101); National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, Security and Privacy Controls for Federal Information Systems and Organizations; Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource; and other applicable federal laws, regulations, NIST guidance, and Departmental policies. NIA Security requires that all employees and contractors (and/or any subcontractor) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals within the EPLC that require artifact review and approval. The Employee/Contractor shall establish and maintain appropriate security measures to protect the integrity of the websites, their content, and related data files. The required security documentation for external (public facing) websites/web applications for both NIA Employees and Contractors can be seen below. The Contractor shall submit a report to document the Federal requirements met by the website.

External–- NIA Websites/Web Applications

The Requestor shall collaborate and assist with the NIA IT Security Team, abiding by the NIH Assessment and Authorization (A&A) Program:

1. Each system (website/web application) must be evaluated for the following:

a. Completion of e-Authentication Risk Assessment.

b. Completion of FIPS-199 Categorization.

c. Completion of Privacy Impact Assessment/Privacy Threshold Analysis, as required.

d. Compliance with NIH Multi-Factor Authentication requirements.

e. Compliance with NIH HTTPS/HSTS requirements.

f. Compliance with NIH Vulnerability Disclosure Program (VDP) requirements.

2. Each system (website/web application) must identify, document, and remediate weaknesses in line with NIA guidelines:

a. All Critical weaknesses related to the website Content Management System must be mitigated within 30 days.

b. All medium weaknesses related to the website Content Management System must be mitigated within 60 days.

c. A remediation project plan is required for weaknesses related to the website Content Management System not mitigated within the requirement timeframe.

3. Any security breach, incident, or potential incident shall be reported to the NIA ISSO and CIO as soon as possible and within 24 hours of identification with all relevant details.

External–- Third-Party Websites/Web Applications

NIA information systems are approved and authorized based on the standards defined in NIST SP 800-37 rev 2, Guide for Applying the Risk Management Framework to Federal Information Systems. NIST SP 800-37 rev 2 provides guidelines for the security assessment and authorizations of information systems supporting the executive agencies of the Federal Government, and these guidelines are applicable to all federal information systems other than those systems designated as national security systems, as defined in 44 U.S.C., Section 3542.

The Contractor shall collaborate and assist with the NIA IT Security Team, abiding by the NIH Assessment and Authorization (A&A) Program:

1. A system must be authorized before it is placed into production. Any new components to an authorized system shall be documented and assessed with any potential risk documented. Any component added will undergo NIH application testing, be HTTPS compliant, provide a Risk Assessment, and document any new POAMs. The testing and controls leveraged will be on the latest NIST 800-53 revision approved. The current Revision is five.

2. All systems will require re-authorization every 3 years at a minimum or when a significant change occurs.

a. Any significant changes occurring to NIH systems, networks, or to their physical environment, user community, etc., require a documented review of the impact on the security of the information processed and may require re-accreditation. This documented review must be agreed upon and signed by the System Owner, Information Systems Security Officer (ISSO), and Authorizing Official (AO) and included in the A&A package.

b. Continuous Monitoring is required throughout the system lifecycle.

c. An assessment of NIH selected security controls must be performed annually.

3. Each system within the authorization boundary must be evaluated for the following:

a. FIPS-199 Categorization

b. Annual Assessment and Security Test and Evaluation (ST&E) (For applicable security controls)

c. Plan of Actions and Milestones (POA&M)

d. Privacy Impact Assessment

e. Configuration Management Standards Checklist(s) as applicable

f. e-Authentication Risk Assessment

g. System Security Plan (SSP)

4. Each system (website/web application) must identify, document, and remediate weaknesses in line with NIA requirements:

a. All Critical weaknesses must be mitigated within 30 days.

b. All medium weaknesses must be mitigated within 60 days.

5. A POA&M is required for weaknesses not mitigated within the requirement timeframe. Any security breach, incident, or potential incident shall be reported to the NIA ISSO and CIO as soon as possible and within 24 hours of identification with all relevant details.

The annual report on website federal requirements shall be submitted in the last month of each performance period starting in OY2.

Deliverable 8.7: Annual Report on Website Federal Requirements

Online Repository

The Contractor shall create and maintain an up-to-date online repository (for example, GitHub or a similar FedRAMP certified platform) that shall allow approved users to upload and share their statistical code after research article publication for replication and reproducibility studies (i.e., a user should be able to create a login and deposit papers or analytic code). The Contractor shall index codes so that they are easily searchable along with the papers produced using the analytic code and data. If GitHub is selected, the Contractor shall use a NIA license for access to GitHub. The Contractor shall provide an update on the Online Repository in the Monthly Report.

Deliverable 8.8: Repository Update in Monthly Report

Task 9: Training, Education and Dissemination

Webinars

The Contractor shall prepare and update video training materials and conduct webinar sessions on the use of CMS-linked data with NIA-funded studies.

The Contractor shall create an outline of the training content within 60 calendar days of award.

The Contractor shall host six interactive webinars, annually illustrating how to use the linked data. The audience for the trainings is potential researcher-users of the linked datasets. These webinars will be used to advertise the LINKAGE Program. As part of some webinars, the Contractor shall create synthetic datasets for the training (all CMS claims shall be substituted with fake data).

The Contractor shall be responsible for submitting a webinar plan for approval, the logistics of the training such as (1) utilizing a learning management system or registration system, (2) promoting the event, (3) organizing registration, (4) purchasing, collating, and disseminating course materials, and (5) providing access to an enclave environment with SAS, STATA, and/or R for training.

The Contractor shall be responsible for identifying the topics to be covered in the webinars and shall be responsible for developing the PowerPoint presentations for each of these topics and delivering them via a qualified instructor that has experience using linked datasets. The Contractor shall submit the CV or resume of the presenter to the NIA for review, and approval no less than 60 calendar days prior to the delivery of the first webinar. Training topics may include, but are not limited to:

a. Overview of the CMS data;

b. Overview of CMS-linked data to NIA-funded studies and data request process for each study;

c. Overview of the Medicare Program;

d. Overview of the Medicare Managed Care Program and Medicaid data;

e. Structure of the Medicare data;

f. Utility of various CMS data files: Part D data, MDS data, etc.;

g. Measurements and analytical issues associated with outcomes; estimating the cost of care; comorbidity and risk adjustment; identification for specific cohorts (e.g., individuals diagnosed with Alzheimer’s disease (AD)/Alzheimer’s disease and related dementias (ADRD), or AD/ADRD, etc.);

h. NIA review process of accessing CMS claims data;

i. Training with synthetic CMS claims data to NIA-funded studies during the in-person training via cloud environment (DaaS).

The Contractor shall deliver the final PowerPoint presentations for the webinars to the NIA no later than 2 weeks before the training, and shall revise materials as directed by the NIA COR.

The final slides shall be made 508-compliant and posted to the project website for public viewing within 10 calendar days of the training events, along with the recording if directed by the COR.

The Contractor shall deliver presentations and track attendees using learning management tools and track future requests for CMS-linked data to NIA-funded studies generated as a result of training participation.

The Contractor shall respond to questions raised…