DRAFT SOW-Secure HIV-Trace_Sources Sought.docx

Draft Statement of Work Title: Secure HIV-TRACE O&M and DME

Period of Performance: June 15, 2023 – June 14, 2026

SECTION 1 – BACKGROUND

The Division of HIV Prevention (DHP) within the National Center for HIV, Viral Hepatitis, STD, and TB Prevention (NCHHSTP) promotes health and quality of life by preventing HIV infection and reducing HIV-related illness and death in the United States. HIV surveillance is conducted to characterize and monitor the HIV burden, determinants, and impact to guide public health action, prevent new HIV infections, improve health outcomes, and promote health equity.

DHP funds state and local health departments to conduct surveillance for HIV and provides standardized case definitions, data collection forms, reporting software and technical assistance and training. Within DHP, the Detection and Response Branch (DRB) improves health outcomes, prevents new HIV infections, and promotes health equity by leading national efforts to identify HIV clusters and outbreaks and support timely and tailored responses. Surveillance is critical to this mission both as a source of data to identify clusters and outbreaks and evaluate progress toward DRB’s goals. As a component of the National HIV Surveillance System (NHSS), 59 jurisdictions collect HIV nucleotide sequences from laboratories, store the data in the jurisdiction’s local HIV surveillance system, and report these sequences to CDC. Sequences are generated as a result of drug-resistance testing ordered by HIV medical providers, most often near the time of entry into care. Using HIV TRAnsmission Cluster Engine (HIV-TRACE), an application developed by the University of California, San Diego (UCSD), DRB conducts national transmission network analyses by performing pairwise comparisons to calculate genetic distances between sequences. DRB uses the results of such analysis to identify molecular clusters of highest concern, i.e., those indicative of rapid transmission. Detection and prioritization of growing HIV clusters is a critical component of the Respond pillar of the Ending the HIV Epidemic in the U.S. (EHE) initiative. Timely detection of rapidly growing HIV clusters is essential for effective response and part of an overall intervention designed to halt HIV transmission: cluster detection and response (CDR). It is essential that jurisdictions have continuous access to tools capable of identifying and monitoring such clusters at the local level in near real-time. Through a previously funded project, the CDC contracted with UCSD to build Secure HIV-TRACE, a secure, user-friendly, web-based application that applies methodology similar to that used at CDC for conducting molecular cluster detection analyses on national data. Secure HIV-TRACE allows jurisdictions to infer molecular clusters locally, facilitating prompt identification of networks of ongoing transmission, focused prevention efforts, and implementation of appropriate interventions in a timely manner, in order to avert further transmission.

State and local health departments maintain the regulatory authority and confidentiality protections to receive personally identifiable information, clinical and risk information, and laboratory reports on persons diagnosed with HIV. Health departments are also responsible for the provision of activities that protect the public’s health (i.e., case identification, prevention intervention, monitoring and tracking disease). Because health departments are uniquely positioned to conduct HIV surveillance and prevention activities, it is critical to build the bioinformatics capacity to infer, analyze, visualize, and interpret HIV transmission networks at the state and local level. Integration of HIV transmission network analyses into HIV surveillance programs helps jurisdictions use existing surveillance data and information available from other sources to promptly identify networks of ongoing transmission and implement appropriate interventions. Several biomedical HIV interventions have proven effective to prevent HIV, and rapid prioritization of individuals for these interventions and use of data to identify gaps in existing prevention and care programs are crucial.

CDC-funded surveillance programs at health departments are required to regularly use molecular data from surveillance to detect HIV clusters and drive response and intervention. The Secure HIV-TRACE application is the tool that CDC makes available to effectively and efficiently conduct these analyses locally. Continued maintenance of Secure HIV-TRACE is imperative to ensure that the application remains operational and meets CDC security standards for end users to reliably perform analyses on-demand. Further, as programmatic priorities and metrics for cluster detection and response evolve, development and enhancement of the application must evolve accordingly. The agency has also adopted a Data Modernization Initiative (DMI) to increasingly move toward system integration and improve the ability for data to be translated into high-quality information for swift decision-making. Applicable priorities for Secure HIV-TRACE include enhancing the application’s code for future development and modernization, assessing and leveraging opportunities for integration with other systems and tools, further aligning the application’s functionality with CDC programmatic guidance, and increasing user capacity and knowledge by developing and updating training resources. Additional priorities include (1) multijurisdictional cluster detection, and (2) adapting Secure HIV-TRACE to enable molecular cluster detection analyses with national data from CDC within the application. These additional priorities will further align national and local methodologies and facilitate communication on detection and monitoring of concerning clusters across jurisdictions.

SECTION 2 – PURPOSE

Secure HIV-TRACE is a secure, user-friendly, web-based application available to health departments to locally detect molecular clusters of HIV. The purpose of this contract is to provide ongoing operations and maintenance (O&M) and development, modernization, and enhancement (DME) and related support for Secure HIV-TRACE. Required and optional tasks may be categorized into the following broad areas:

1) Contract/project management and oversight (Tasks 1, Optional Task A)

2) Operations and maintenance (O&M) of system, including security (Task 2)

3) Development, modernization, enhancement (DME) of system (Tasks 3, Optional Task B, Optional Task C)

4) User support and training development (Tasks 4, Optional Task A)

SECTION 3 – SCOPE OF WORK

The Contractor, as an independent entity and not as an agent of the Government, shall furnish all necessary personnel, facilities, equipment, and materials (other than that provided by the Government) for the purposes of operations and maintenance (O&M) and development, modernization, and enhancement (DME) of Secure HIV-TRACE. Assigned personnel shall be qualified and trained with the necessary expertise to scientifically and technically fulfill the scope of work.

SECTION 4 – TASKS TO BE PERFORMED

The Contractor shall perform the following tasks:

TASK 1. Contract/Project Management and Oversight

The Contractor shall conduct management and coordination of the components of this contract by coordinating and tracking activities across the team, keeping processes moving and on schedule, and troubleshooting to resolve issues and bottlenecks. Contract staff shall attend all project meetings, as appropriate to their roles, to provide status updates, and create and disseminate meeting minutes to all project members.

Kick-off Meetings The Contractor shall coordinate and attend an initial half-day kick-off meeting with the CDC Contracting Officer’s Representative (COR) and the appropriate staff from DRB and DHP’s Office of Informatics and Data Management (OIDM) within 10 business days following the date of initial award. The meeting shall be held virtually via Microsoft Teams.

The kick-off meeting shall cover all tasks for the Base Period, and representatives from DRB and OIDM will be present. The meeting shall be held to ensure that all parties possess a clear understanding of contract requirements as awarded, resources, and roles/responsibilities. Meeting attendees will also discuss their approach for managing the project across the organization, progress reporting requirements, and communication protocols. The Contractor shall draft the meeting agenda ahead of time with input from and approval of the CDC COR.

The Contractor shall take meeting minutes and email them to the COR within 7 days after the kick-off meeting. Discussion from the kick-off meeting shall be used by the Contractor to provide a status report template, which will ultimately be reviewed with the COR on a monthly basis.

At the onset of each option year, the Contractor shall coordinate another half-day kick-off meeting with the COR and appropriate staff from DRB and OIDM within 10 business days following the beginning of the option period. The agenda shall be the same as the Base Period kick-off meeting with respect to core tasks and any optional tasks. These kickoff meetings must be held virtually via Microsoft Teams.

Work Plan An initial written work plan shall be submitted by the Contractor with the technical proposal (see “Evaluation Factors”), minimally including all essential interim and final deliverables, key staff responsible for tasks (including Contractor, CDC or other partners), and a schedule of key deadlines (including review cycles and absolute No Later Than (NLT) dates for key activities and deliverables) for contracting officer’s representative (COR) review and correction before acceptance. The work plan shall contain:

1) a series of specific reports and activities proposed by the Contractor following the kick-off meeting, to be developed by the Contractor during the course of the project, inclusive of the Contractor’s plan for ongoing monitoring and evaluation of services to assure high quality performance and customer satisfaction;

2) Contractor plan for employee management including how the Contractor will avoid any appearances of personal services for CDC The work plan shall be a distributable document for sharing with key CDC management/staff impacted by this project. Following the kickoff meeting, the Contractor shall submit a revised final written work plan 10 business days following the kickoff meeting. The work plan (and any schedule of interim deliverables) may be revised according to CDC acceptance of the updated work plan by the COR during the project with the restriction that these changes must not impact the overall period of performance, scope, or specifications of the award, or otherwise impinge on the authority of the contracting officer. It is the responsibility of the Contractor to fully understand what changes require contracting officer approval.

Monthly Reporting Provide a monthly report including updates on the specific reports and deliverables as described in the work plan expressly broken out. The monthly report shall include, at a minimum, the current status of the project, a description of activities during the prior month, actual and anticipated problem areas and risks, number of users affected by any known issues, suggested solutions, Gantt chart indicating development and testing schedule, and activities planned for the next month. As part of this report, the Contractor shall also provide monthly and cumulative totals for estimated and actual costs by category (e.g., labor, hardware, software, travel) and projected and actual percent completion toward tasks.

The Contractor shall develop the monthly report format for review and approval by the Contracting Officer’s Representative (COR). The monthly report shall be considered a substantial deliverable of the project, for review by key DRB and OIDM leadership as well as the project contracting officer representative, and used as:

1) a tracking tool for success of this project, and

2) documentation of effort/services as invoiced in the matching monthly invoice.

The monthly report is due NLT than the 5th calendar day of each month, covering the previous month’s progress.

Biweekly Conference Call A biweekly conference call shall be held with the designated CDC point(s) of contact with an invitation extended to the COR.. The call shall be initiated and led by the Contractor with the CDC POC(s). An agenda will be developed by the CDC POC(s) and distributed to the Contractor no less than 2 business days prior to the scheduled call for any needed input by the Contractor. The purpose of this call is ongoing review of task performance and associated deliverables, along with review of risks to the project timeline. The call shall also serve as an opportunity for the Contractor to elicit input, feedback, or subject matter expertise from CDC. The Contractor shall review the project’s progress against the Gantt chart in each call. Any required performance improvements shall be documented/reported in the monthly reports.

Change Requests Documentation The Contractor shall document the process for gathering and implementing change requests from project areas, from DHP Subject Matter Experts (SMEs), or from the Secure HIV-TRACE Change Control Board (CCB). All change requests to the Secure HIV-TRACE application (from CDC to the Contractor) shall be documented by the Contractor in one consolidated place/tool to reduce iterative emails. Version control tools such as GitHub or Trello are strongly preferred, however, this may also be accomplished using Excel or another tool mutually agreed upon. Changes and features being implemented shall be agreed upon by CDC and demonstrated by the Contractor through a visual mock-up prior to implementation in production (and as needed, a demonstration in the staging environment). The tool or document for version control shall be delivered no less than 2 months from Base Year award date with change requests documented continuously through the life of the project.

Change Control Board (CCB) The Secure HIV-TRACE CCB will meet at least monthly to review change requests, prioritize enhancements and repair of defects, and make recommendations. The Contractor shall support the CCB by scheduling the meetings and preparing and distributing meeting minutes. For activities without pre-defined deliverables, the Contractor shall provide information on the level of effort and complexity of suggested changes and fixes. The call shall be initiated and led by the Contractor with the CDC POC(s) and COR invited. An agenda will be developed by the CDC POC(s) and distributed to the Contractor no less than 2 business days prior to the scheduled call for any needed input by the Contractor. The Contractor shall provide the CCB with technical consultation, expert advice, informed recommendations, project status updates, performance metrics, alternative approaches, and technical information upon request. The discussion from the CCB meeting shall be documented in call notes, provided by the Contractor no less than 7 days following the call.

Planning, Coordination, and Management The Contractor shall:

Coordinate time-phased development and release plans for the application to align with the needs of state/local jurisdictions as well as national goals for cluster detection and response.

Coordinate time-phased development of relevant documentation/training materials to align with the needs of state/local jurisdictions as well as national goals for cluster detection and response.

Prioritize user-friendly improvements while ensuring adherence to NCHHSTP/DHP Security Policy.

Ensure coordination with other DHP data systems and implementation of integrated solutions in coordination with DHP and NCHHSTP.

Facilitate and coordinate IT project planning activities with DHP technical and project staff.

Provide resource assignment and resource management; develop and monitor schedules; develop level of effort estimates for activities without pre-defined deliverables; track tasks, outcomes, schedules, and variances.

Provide all required CDC Enterprise Performance Life Cycle (EPLC) deliverables and supplemental documents, including project charters, business cases, project management plans, and project process agreements. The Contractor shall use CDC EPLC and related templates, as required. Collect, organize, and present information for EPLC stage gate and other project reviews throughout a project’s life cycle.

Adhere to the CDC EPLC framework and promote IT project management best practices.

Proactively identify, log, notify appropriate CDC/DHP staff, and resolve IT project issues and risks.

Ensure each task is assigned a unique job number. The Contractor shall accurately track personnel hours to the appropriate job number.

Work with appropriate CDC Office of the Chief Information Officer (OCIO) staff to ensure that system changes and releases are implemented in a timely fashion according to enterprise operating standards.

Develop, maintain, and manage IT-related project documentation that is required by and compliant with the EPLC framework, Capital Planning and Investment Control (CPIC) directives, and IT Systems Security policies.

Final Report Prior to the conclusion of the contract, a final report and a sustainability/transition plan shall be delivered to CDC including all code, metadata, SOPs, libraries, and additional data required to sustain the application. The comprehensive project plan for transferring the application from the Contractor to the Government and/or the Government's designee includes systems' technical knowledge, application code, data/meta data, libraries, application documentation, architectural diagrams, SOPs, system specifications, passcodes and other essential information/materials required for installing and operating Secure HIV-TRACE systems, interfaces, components and/or artifacts. This report shall also include a final status of activities completed and a summary of successes and challenges throughout the project. The draft report shall be submitted to the COR no later than 2 months prior to the end of the contract with a final version submitted no later than 2 weeks prior to the end of the contract.

TASK 2. Operations and Maintenance (O&M) of System

The Contractor shall perform all tasks required to provide comprehensive operations and maintenance (O&M) support (as described by the CDC Enterprise Performance Life Cycle framework) of all existing Secure HIV-TRACE versions and iterations. Continual maintenance of Secure HIV-TRACE is imperative to ensure that the application remains operational and meets CDC security standards for end users to reliably perform analyses on-demand. Secure HIV-TRACE is housed within CDC’s Amazon Web Services (AWS) cloud environment, and the Contractor must provide demonstrated development expertise and experience within CDC’s AWS environment. Unless otherwise approved by the COR, all Secure HIV-TRACE maintenance, development, and testing shall be conducted in the CDC’s AWS environment only.

The contractor shall be responsible for minor modifications, routine security and software patches/upgrades, bug/error-fixes, annual operational analysis, and required Enterprise Performance Life Cycle (EPLC) and Capital Planning and Investment Control (CPIC) reporting. The Contractor shall provide a complete range of Secure HIV-TRACE technical and administrative support services to efficiently and effectively operate and maintain multiple Secure HIV-TRACE instances and server environments. Instances may include production, training, staging, and/or development with varying data types (i.e., synthetic or real data). The specific activities associated with this task that the Contractor shall complete includes:

Architecture and Design Provide expertise in solutions/system architecture and data structure design for developing innovative IT solutions to both routine and ad hoc data collection issues encountered in DHP operations.

Utilize CDC-supported, shared infrastructure and architecture, as new tools and services are available, as appropriate.

Participate in meetings and communicate verbally or in writing with appropriate CDC OCIO staff to ensure that DHP systems are implemented in a timely fashion according to enterprise operating standards.

Utilize enterprise data exchange services for data transfer.

Prepare Secure HIV-TRACE application for future integration and interoperability with OCIO’s Enterprise Data Analytics & Visualization (EDAV) platform, and other IT projects, activities, or products that contain, control, or share data with any service or product developed (1) under this contract and (2) for CDC.

Ensure that applications/systems meet the CDC Section 508 requirements across all platforms on which the applications/systems are available and complete 508 compliance checklist annually.

Optimize job processing by utilizing appropriate computing architecture, such as AWS ParallelCluster.

Adhere to OMB/HHS/CDC Enterprise Architecture guidelines and CDC IT network standards.

Operational Support and System Management Ensure Secure HIV-TRACE maintains full functionality in the CDC host environment and maintain continuity of services.

Ensure Secure HIV-TRACE computer applications, systems, data repositories, and components are properly maintained for high availability and reliable data integrity.

Provide on-going Operations and Maintenance support and application/system fixes for supported Secure HIV-TRACE systems and components, including upgrades and refactoring to upgrade components that have reached end of life.

Provide database administrator (DBA) support.

Provide IT system retirement and disposition plans that meet CDC requirements.

Provide support for activities related to complying with CDC records management activities (including systems and data disposition/retirement tasks).

Provide DHP and the Secure HIV-TRACE Change Control Board with technical consultation, informed recommendations, systems status and alternative approaches to improving the efficiency and effectiveness of Secure HIV-TRACE services.

Perform activities necessary to comply with CDC EPLC methodology requirements.

Capture and compile system error logs, record fix descriptions and periodically provide the Secure HIV-TRACE CCB with quantitative systems performance metrics and summary reports.

Ensure Secure HIV-TRACE systems are properly maintained to support high availability, optimal performance, and data integrity.

Troubleshoot connectivity issues with interfacing systems and/or data bases and coordinate with CDC network administrators to resolve issues.

Participate with CDC staff and/or CDC-designated hosting vendors in meetings or conference calls (with the frequency determined by the COR) and communicate verbally or in writing (as determined by the COR) to perform system maintenance and ensure Secure HIV-TRACE availability to users, including any system related maintenance issues that prohibit the availability of Secure HIV-TRACE to users.

Release Testing Testing applies to new versions of the existing application and any features/versions as a result of DME. IT application/system testing is the process of validating and verifying that the application/system (1) meets the requirements that guided its design and development, (2) works as expected, (3) can be implemented in the required hosting environment(s), and (4) satisfies DHP’s needs. The Contractor shall:

Verify that requirements are accurate, complete, and do not conflict with one another.

Provide test scenarios to designated DHP Subject Matter Experts (SMEs) during the design and development stage so that missing or incomplete scenarios can be included in the test plan prior to the initiation of testing.

Provide comprehensive test plans describing the application/system testing to be accomplished, detailed procedures, needed resources, roles/responsibilities, and the schedule for completion.

Conduct thorough IT application/system testing and readiness reviews, including unit testing, integration testing, validation testing, and implementation testing. The Contractor shall use synthetic data for testing. CDC shall make the decision when real data shall be used for testing.

Once integration testing is completed, deliver the IT application/system to CDC for User Acceptance Testing (UAT) in the CDC network environment. After final approval by DHP SMEs, the Contractor shall deploy the update to the live/production environment to jurisdictions.

Facilitate User Acceptance Testing (UAT) through development of test plans, test cases, test datasets, applied scenarios, user documentation, and timely change management; review UAT feedback, discuss problems, identify solutions with CDC SMEs; implement needed changes and re-test.

Deploy IT applications/systems and releases, including distribution and installation where appropriate.

Release Management and Schedule Application support and maintenance for Secure HIV-TRACE must be ongoing, including release management, to identify and resolve critical issues arising in the field. There shall be at least one, but no more than two major releases per year during this contract inclusive of both O&M and DME. These releases are in addition to all necessary emergency bug fixes. Currently, Secure HIV-TRACE software releases are web-based. Any change from this schedule must be approved by the COR and Secure HIV-TRACE CCB. The Contractor shall produce and maintain updates to the technical reference guide, release-specific notes, any Secure HIV-TRACE data models and other documentation. It is critical that future release planning processes are well-documented and communicated to all stakeholders. The timing of any updates to a CDC-hosted application must be coordinated with stakeholders.

Systems Security The Contractor shall:

Ensure that all products, activities, and tasks provided under this contract meet all applicable CDC IT systems security policies and procedures.

Provide support and ensure compliance with CDC IT Security Assessment and Accreditation (SA&A) activities and related documentation.

Complete the annual Security Assessment and Authorization (SA&A) review, maintain and update documents as needed, and identify system updates that could impact the security of Secure HIV-TRACE.

Provide all required system security documentation to ensure compliance with CDC security requirements. The documentation includes privacy impact assessments, SA&A artifacts, Plan of Action and Milestones (POA&Ms) artifacts, retirement plans, and disposition plans.

Recommend technical solutions to security challenges resulting from arising threats and/or evolving laws, policies, regulations, standards and mandates.

Participate in meetings and communicate verbally or in writing with IT security personnel and evaluate, test, and implement technologies to augment the security of IT components. Components include user authentication and validation, data encryption, secure key storage, PKI key management, Smart Card integration, and mitigation of identified system security vulnerabilities.

Perform activities necessary to comply with all applicable CDC IT security requirements e.g., identify vulnerabilities, apply necessary security controls, provide access and information in support of Secure HIV-TRACE SA&A activities and remediate identified POA&Ms.

Create and maintain security policy document with policies on auditing, breach, configuration management, disaster recovery, data integrity, data management, data retention, system access, risk management, system and information integrity (and modify as instructed by the CDC Security Steward). Initial creation and submission of document shall be NLT 3 months of Base Year award date with updates submitted as requested.

Document and submit security controls to CDC Security Steward.

Implement and maintain data access and user behavior alerts from system logs (e.g., CloudTrail log alerts using Splunk).

Business Analysis and Requirements Gathering The Contractor shall:

Provide technical expertise and support for business analysis and requirements-gathering using best practice methods and by applying principles of human-centered design, such as determination of user goals, needs, and behaviors that drives O&M and DME.

Comprehensively and accurately capture, document, and confirm the business, programmatic, and technical requirements.

Provide complete and accurate requirements and change control documentation that define specific DHP programmatic and technical requirements.

Evaluation The Contractor shall:

Continuously review the planned and implemented Secure HIV-TRACE application and features to achieve data standardization and harmonization among related systems or with other CDC systems capturing similar data.

Evaluate tools, emerging technologies, platforms, and implementation support requirements for meeting DHP needs. Provide up-to-date information and recommendations to the COR regarding relevant new tools and technologies.

Ensure Secure HIV-TRACE computer applications and systems are fully compliant with all applicable agency and federal IT policies, methodologies, regulations, standards, processes, procedures, and best practices.

Provide technical expertise and support for application/system design using best practice methods and the most appropriate deployment platform. Participate in meetings and communicate verbally or in writing with DHP and program stakeholders to evaluate and ensure (1) user-friendly design quality, (2) compliance with all applicable CDC IT and security requirements, and (3) interoperability with the CDC, NCHHSTP, and DHP network environments and technologies as required.

Increase transparency and accountability and improve IT capital investment reporting capabilities.

Evaluate the effectiveness of UAT conducted to identify any process improvements needed.

Documentation The Contractor shall:

Provide documents that are technically accurate, complete, properly organized, clearly written, grammatically correct, electronic, and accessible using standard desktop software.

Provide documents in a standard format (Microsoft Office suite), for example, MS Project for project schedules and MS Visio for process flow diagrams. The Contractor shall also provide documents in PDF format as required.

Develop, maintain, and provide project documentation for all software design, development, and modifications, as required by NCHHSTP and DHP. Project documentation includes implementation plans, risk logs, meeting summaries, change control board tracking and decisions, ad hoc reviews and summaries, detailed system architecture diagrams, data flow diagrams, process flow diagrams, logical data base schematic/diagram, code documentation, system corporate account/access information, data dictionaries, deployment instructions, and detailed project schedules.

Prepare written plans, procedures, and processes to support the distribution, deployment, implementation, and operation of Secure HIV-TRACE.

Provide technical information and documentation required by CDC EPLC framework methodologies (including Operational Analysis (OA) activities and documentation).

Provide technical information and documentation needed to maintain compliance with CDC IT systems security policies, including (1) re-certification and accreditation and (2) Plan of Action and Milestones (POA&Ms).

Provide all source code (all application code, data/meta data, data dictionaries, and libraries) used for operation of application in a repository approved by CDC (e.g., currently, GitHub). As required by the Federal Source Code Policy set out in OMB Memo M-16-21, all computer software produced in the performance of this contract shall be open source software and shall be available for Government-wide use and for use by the public with data use rights under FAR 52.227-14 Rights in Data - General, unless otherwise specified in writing by the contract officer. The Contractor (and/or any subcontractor) shall maintain, at all times, a working, current and fully-documented copy of all project or activity custom-developed source code in a repository from the CDC Recognized List of Source Code Repositories.

Create, enter, and maintain entries into CDC’s Enterprise Data Catalog (EDC) for all data/metadata Develop step-by-step instructions to ensure that procedures can be duplicated by new personnel.

TASK 3. Development, Modernization, and Enhancement (DME) of System

The scope of this task entails all tasks and activities required to provide comprehensive DME technical support of Secure HIV-TRACE systems and components (as described within the CDC EPLC framework). Scope includes EPLC & stage gate reporting, CPIC reporting, CCB support activities, technical consulting services, evaluating/recommending creative solutions, leveraging new and emerging technologies, and employing innovative techniques. Approaches shall be guided by CDC priorities, including the Data Modernization Initiative (DMI).

To ensure that DHP has the tools and methods needed to collect, analyze and manage HIV-related surveillance and programmatic data, the Contractor shall support DHP to develop, modernize and/or enhance its IT/information/data applications, systems and components supported by this Contract. Support activities include (1) modernizing outdated technology components to align with CDC’s shared infrastructure, as appropriate, (2) prioritizing and correcting identified defects, (3) proactively identifying and notifying DHP of technical/environmental risks, issues and barriers to project success, (4) providing program/project teams with expert technical advice, recommendations, alternative solutions, approaches and/or mitigation strategies as appropriate to advancing DME projects.

The Contractor shall deliver NCHHSTP/DHP releases of Secure HIV-TRACE designed to address (1) emerging public health requirements, (2) mounting security threats, (3) evolving legislative changes, (4) increased needs for data integration and interoperability, (5) new/emerging technology requirements and/or (6) user feedback. The Contractor shall develop, modernize and/or enhance no more than 1-2 releases of Secure HIV-TRACE while simultaneously maintaining, operating, or dispositioning other releases. There shall be at least one, but no more than two, major releases per year during this contract inclusive of both O&M and DME. Unless otherwise approved by the COR, all Secure HIV-TRACE maintenance, development, and testing shall be conducted in the CDC’s AWS environment only.

All DME activities shall be closely monitored and managed by the Contractor to ensure strict adherence to the CDC EPLC framework and alignment with CDC’s Data Modernization Initiative. The Contractor shall independently develop and maintain all required project artifacts, documents, and reports throughout the life cycle of each system/project as required by the CDC EPLC framework. Draft and final versions of required, EPLC deliverables and supplemental documents have phase-specific due dates as defined by the CDC EPLC framework in conjunction with the selected methodology, the COR, and/or OIDM.

HIV Evolution and Molecular Epidemiology Methodology Secure HIV-TRACE methodology applies principles of HIV evolution and molecular epidemiology to detect clusters and create transmission networks within the system. The Contractor shall provide expertise within, or working as part of, the project team to:

Effectively and efficiently refactor and document existing Secure HIV-TRACE codebase to enhance sustainability of code modifications and future O&M and DME; code may include Python, C++, JavaScipt, node.js; participate in meetings and communicate verbally or in writing with OIDM and other CDC staff to implement best practices in refactoring code base, as well as implement documentation that can be leveraged by other developers in maintenance tasks. Provide advantages and disadvantages and level of effort to migrate visualization to Cytoscape in order to better support bioinformatics use cases.

Refactor Secure HIV-TRACE codebase to modularize user interface, backend calculations and visualization, and develop a set of Application Programming Interfaces (APIs) to be utilized via a REST based architecture and tie together the different parts of the application.

Assess feasibility of a separation of user interface (UI) and backend computation. Implement separation where feasible in order to achieve separation of concern to improve modularization and long-term maintenance with the goal of having the option to swap components with minimal rework.

Describe how to set up a local development environment, run, and make modifications with examples provided to target environments in Windows, Linux, and Mac. This description must include detailed instructions with steps, examples, tools, and required dependencies.

Adapt and create cluster detection methodologies based on HIV evolution and molecular epidemiology principles.

Conduct advanced analyses of molecular HIV data, including within a data system that detects molecular clusters of HIV.

Provide advice for the use of specialized molecular analytic methods, including HIV evolution and diversification, transmission network analysis, phylogenetic analysis, phylodynamic analysis, phylogeographic analysis, HIV diversity, transmission of drug resistance, and viral fitness.

Assess Secure HIV-TRACE methodology versus methodologies of other molecular tools, including BEAST, TimeTree, TreeAnnotator, and LogCombiner.

Apply molecular methodological changes within a data system, including development of code that detects clusters of HIV.

Data Visualization and Metrics With sustainability, scalability, and interoperability/integration as guiding principles, the Contractor shall enhance visualization of data produced as a result of Secure HIV-TRACE analyses and related HIV surveillance metrics. Developed features shall align with programmatic priorities as directed by CDC SMEs. Activities by the Contractor shall include:

Align Secure HIV-TRACE functionality with CDC programmatic guidance for cluster detection and response.

Develop examples and templates of formats required for data uploads to Secure HIV-TRACE.

Create on-demand reports and/or dashboards for Secure HIV-TRACE administrators to monitor application usage by site/jurisdiction and user over time, including frequency and dates of use.

Create on-demand reports and/or dashboards for Secure HIV-TRACE administrators and users to monitor network metrics, such as regularity of network creation (i.e., cluster analysis completed), number of networks, number of uploaded sequences, number of national priority clusters.

As requested, create automated messages to users, such as monthly reminders to conduct molecular cluster detection in Secure HIV-TRACE.

Enhance system aesthetics, including expanded user options to customize existing data visualization.

Implement visualization of nodes without molecular sequences (including HIV diagnoses without sequences and nodes sourced from contact tracing or ‘partner services’).

Modernization and Interoperability The Contractor shall:

Provide NCHHSTP/DHP with IT support services and cost-effective, innovative solutions designed to address the unique requirements of the Secure HIV-TRACE application.

Recommend utilization of enterprise-level tools and services, including in computing cost in a cloud environment, such as through job processing optimization.

Provide methods, tools, and qualified resources necessary to provide strategic planning and implementation support, including: the development, update, and distribution of policies, information, and knowledge of CDC enterprise and shared resources.

Ensure the Secure HIV-TRACE project team and partners have ready access to expert technical advice and comprehensive support with all aspects of developing and implementing technical solutions.

Proactively identify and continuously pursue opportunities to reduce or eliminate redundant processes, systems, and unnecessary duplication of effort, systems, and data.

Facilitate the adaptation of new and emerging technologies where feasible.

Develop and implement Secure HIV-TRACE to meet DHP surveillance, research, programmatic needs, and emerging public health events and outbreaks, including new releases of existing DHP applications/systems to (1) incorporate additional requirements, correct defects, enhance functionality and (2) refresh technologies and platforms.

Provide technical expertise and support for application/system development, and implementation using best practice methods and secure data collection transfer and storage.

Perform assessments of, and modifications to, Secure HIV-TRACE to enhance aesthetics and user experience, using principles of human-centered design (including determination of user goals, needs, and behaviors that drives DME).

Identify ways to strengthen data reporting, management, and analytics to accelerate data into action; facilitate real-time, comprehensive data for improved decision-making.

Identify, develop, and implement data quality, data standardization, and data harmonization measures.

Proactively explore opportunities to leverage shared services and advance the integration of Secure HIV-TRACE information with related systems as appropriate.

Modify data exports from Secure HIV-TRACE to facilitate interoperability with other tools utilized by CDC and end users at health departments, such as REDCap, Power BI, and Tableau.

Adapt Secure HIV-TRACE to changes in systems, including the Enhanced HIV/AIDS Reporting System (eHARS) and the National HIV Surveillance System (NHSS), that house and generate data ingested by Secure HIV-TRACE.

Promote, participate in, and coordinate collaborations to identify mechanisms to allow integration or interoperability between Secure HIV-TRACE and other systems (including NHSS) or data lakes, such as through use of Application Programming Interfaces (APIs).

Participate in meetings and communicate verbally or in writing with CDC SMEs and stakeholders to gather business needs and map processes and workflows for interoperability or integration with future surveillance data lake and/or surveillance system.

Develop and implement effective mechanisms in Secure HIV-TRACE to achieve expanded system and data interoperability/integration.

Document all aspects of the development process including work plans, requirements, information architecture, and system design documents.

TASK 4. User Support and Training Development

Training development shall include Section 508-compliant training and user-friendly accompanying documentation to orient Secure HIV-TRACE users to the application’s features and the terminology used in the application, thus increasing the skills and capacity of health department staff to use Secure HIV-TRACE. The Contractor shall deliver all final content in an editable format to CDC. Full and final delivered files must contain both development files and published files. Product deliverable file requirements and any products produced shall include working or workable (layered) files (for examples, Adobe CC such as InDesign, Illustrator, Photoshop, After Effects, etc., MS Office such as Word, PPT, etc., or other layered native files format) and all assets (photos, illustrations, figures, list of fonts, etc.) with final projects. All products and deliverables shall be owned by, and belong to, CDC. Developed training materials shall adhere to CDC’s Section 508 Compliance Policy and Web Content Accessibility Guidelines 2.0 (WCAG 2.0).

User Support and Training Development The specific activities associated with this task the Contractor shall complete include:

Provide end users with training and comprehensive, technical support services for IT/information/data systems and applications developed and/or maintained under this contract.

Participate in meetings and communicate verbally or in writing with CDC staff and vendors and contractors performing services for NCHHSTP Divisions, Branches, Offices, and Programs to support the timely and accurate development of user manuals, training materials, and other user documentation.

Independently develop and/or remediate training materials, as required to comply with CDC 508 accessibility and usability standards.

Provide Secure HIV-TRACE end users with training sessions in a variety of forums such as traditional classrooms, lectures, live demonstrations, hands-on group training, one-on-one instruction, live webinars and digitally recorded sessions.

Digitize training presentations for on-demand access for applications, services, tools and components hosted on Secure HIV-TRACE.

Provide technical IT assistance and participate in meetings and communicate verbally or in writing with external parties that support Secure HIV-TRACE systems. External parties may include (1) federal, state and/or county public health officials/personnel, (2) commercial vendors, (3) private healthcare organizations and (4) various IT contracted personnel supporting participating jurisdictions.

Operate, maintain, and respond to a ‘help desk’ email box or ticketing system for end user questions and feedback. This shall include (1) assistance with user maintenance, (2) troubleshooting and resolving job processing errors, (3) support/training on application and feature use, and (4) describing methodologies underlying the Secure HIV-TRACE system functionality. Receipts shall be provided within one business day back to end users submitting tickets.

Resolve help desk tickets in accordance with the following guidelines to prioritize responses:

· An issue affecting all or a large number of users

· An issue preventing users to access critical applications or data or impacting critical functions

· An information security incident or vulnerability with a critical/high severity/risk

· Other as directed by the COR (e.g., removal of access rights for an unscheduled terminated user) Within 1 hour

· An application error affecting a small group of users

· An issue impacting important functions in a system

· An information security incident or vulnerabilities with a medium/high severity/risk Within 4 hours

· An issue affecting one person only

· An issue impacting a non-critical function in a system (e.g., downloading a non-essential file)

· A security incident or vulnerability with a low/medium severity/risk

· A question on how to use a non-critical functionality Before the end of the next working day

· A “cosmetic” request, to improve a system functionality “look and feel” or a minor non-functional change to a system Within 7 days

(*) The response time corresponds to the time to process the request, including analyzing and classifying the request, attributing a ticket to personnel, and dispatching of the assigned personnel. For “Urgent” and “High” issues, the Contractor shall resolve the issue within 24 hours of receiving it. The Contractor shall notify both the user who submitted the ticket and the COR (or the COR’s designee) if it will take more than 24 hours to resolve the issue.

TASK 5: Optional Task A. Training and Other Travel

The Contractor shall obtain prior approval from the COR and the CO before traveling. All travel must be in accordance with the Joint Federal Travel Regulations. There shall be occasional travel related to system maintenance, training, and contract management. Initial visits will be required to gain access to CDC systems and to obtain an agency badge.

The Contractor shall support Atlanta-based meetings by providing training sessions on the operation and use of Secure HIV-TRACE for the benefit of health department grantees and/or other end users (e.g., CDC staff). The Contractor shall support annual (one per year) Atlanta-based, HIV Surveillance Grantee Meeting by providing training sessions on the operation and use of Secure HIV-TRACE for the benefit of HIV grantees and/or end-users working within the various surveillance jurisdictions. Duties include all activities related to planning, presenting, facilitating, and conducting training sessions related to the implementation, operation and/or use of Secure HIV-TRACE system. At the conclusion of each Grantee Meeting, the Contractor shall provide CDC with the materials used during the training sessions.

The Contractor shall be required to travel to obtain a CDC agency badge (“Smart Card”) and schedule an in-person appointment for a picture. Primary and secondary source documents for identification are required, and some facilities may require two trips to obtain the agency badge. As of February 2022, the following cities have facilities for enrollment:

· Anchorage, AK*

· Atlanta, GA

· Boston, MA*

· Chicago, IL*

· Cincinnati, OH*

· Cleveland, OH*

· Dallas, TX*

· Denver, CO*

· Durham, NC

· Ft. Collins, CO

· Hyattsville, MD

· Kansas City, MO*

· Miami, FL*

· Morgantown, WV

· New York, NY*

· Philadelphia, PA*

· Pittsburgh, PA

· Salt Lake City, UT*

· San Francisco, CA*

· San Juan, PR

· Seattle, WA*

· Spokane, WA

*Please note that, as of February 2022, these facilities require two in-person visits.

TASK 6: Optional Task B. Integration of Molecular Cluster Detection with National Data

Molecular cluster detection with national data from CDC is currently completed by CDC staff outside of Secure HIV-TRACE. Although similar, national and state/local analyses have slight differences in methodology. Aligning these methods will enhance and streamline communication on detection and monitoring of concerning clusters across jurisdictions.

Integratio…