HealthVerity Contract 75D30121C11559.pdf

10. SUBMIT INVOICES

(4 copies unless other-wise specified) TO THE

ADDRESS SHOWN IN:

AWARD/CONTRACT

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING PAGE OF PAGES

1 40

2. CONTRACT (Procurement, Instruction, Identification) NUMBER 75D30121C11559

3. EFFECTIVE DATE

09/22/2021

4. REQUISITION/PURCHASE REQUEST/PROJECT NUMBER

00HCPNED-2021-57338

5. ISSUED BY CODE 8219 6. ADMINISTERED BY (If other than Item 5) CODE 8219 Centers for Disease Control and Prevention (CDC) Office of Acquisition Services (OAS) 2900 Woodcock Blvd, MS TCU-4 Atlanta, GA 30341-4004

Centers for Disease Control and Prevention (CDC) Office of Acquisition Services (OAS) 2900 Woodcock Blvd, MS TCU-4 Atlanta, GA 30341-4004

7. NAME AND ADDRESS OF CONTRACTOR (Number, Street, County, State and ZIP Code)

HEALTHVERITY, INC.

1818 MARKET ST LBBY 6

PHILADELPHIA, PA 19103-3602

8. DELIVERY

FOB ORIGIN X OTHER (See below)

9. DISCOUNT FOR PROMPT PAYMENT

Net 30

CODE 080099466 FACILITY CODE

11. SHIP TO/MARK FOR CODE 12. PAYMENT WILL BE MADE BY CODE 434

Centers for Disease Control and Prevention (FMO) PO Box 15580 404-718-8100

Atlanta, GA 30333-0080

13. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION:

10 U.S.C. 2304(c)( ) X 41 U.S.C. 3304(a)(1)

14. ACCOUNTING AND APPROPRIATION DATA

See Section B

15A. ITEM NUMBER 15B. SUPPLIES/SERVICES 15C. QUANTITY 15D. UNIT 15E. UNIT PRICE 15F. AMOUNT

“See Section B”

15G. TOTAL AMOUNT OF CONTRACT $ 13,756,000.00

16. TABLE OF CONTENTS

(X) SECTION DESCRIPTION PAGE(S) (X) SECTION DESCRIPTION PAGE(S)

PART I – THE SCHEDULE PART II – CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 34

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

X C DESCRIPTION/SPECS./WORK STATEMENT 7 J LIST OF ATTACHMENTS

X D PACKAGING AND MARKING 19 PART IV - REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 20

K

REPRESENTATIONS, CERTIFICATIONS AND

OTHER STATEMENTS OF OFFERORSX F DELIVERIES OR PERFORMANCE 21

X G CONTRACT ADMINISTRATION DATA 22 L

INSTRUCTIONS, CONDITIONS, AND NOTICES TO

OFFERORS

X H SPECIAL CONTRACT REQUIREMENTS 26 M EVALUATION FACTORS FOR AWARD

CONTRACTING OFFICER WILL COMPLETE ITEM 17 (SEALED-BID OR NEGOTIATED PROCUREMENT) OR 18 (SEALED-BID PROCUREMENT) AS APPLICABLE

17. X CONTRACTOR’S NEGOTIATED AGREEMENT (Contractor is required to sign this document and return 1 copies to issuing office.)

Contractor agrees to furnish and deliver all items or perform all the services set forth or otherwise identified above and on any continuation sheets for the consideration stated herein. The rights and obligations of the parties to this contract shall be subject to and governed by the following documents: (a) this award/contract, (b) the solicitation, if any, and (c) such provisions, representations, certifications, and specifications, as are attached or incorporated by reference herein. (Attachments are listed herein.)

18. SEALED-BID AWARD (Contractor is not required to sign this document.)

Your bid on Solicitation Number 75D301-21-Q-73692 including the additions or changes made by you which additions or changes are set forth in full above, is hereby accepted as to the terms listed above and on any continuation sheets. This award consummates the contract which consists of the following documents: (a) the Government's solicitation and your bid, and (b) this award/contract. No further contractual document is necessary. (Block 18 should be checked only when awarding a sealed-bid contract.)

19A. NAME AND TITLE OF SIGNER (Type or print) 20A. NAME OF CONTRACTING OFFICER

Lauren Peel

19B. NAME OF CONTRACTOR

BY __________________________________________

(Signature of person authorized to sign)

19C. DATE SIGNED 20B. UNITED STATES OF AMERICA

BY ___________________________________________

(Signature of Contracting Officer)

20C. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION STANDARD FORM 26 (REV. 3/2013)

Previous edition is NOT usable Prescribed by GSA - FAR (48 CFR) 53.214(a)

ITEM

75D301-21-C-11559

Section B - Supplies Or Services and Prices/Costs

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

0001 Privacy-Preserving Record Linkage (PPRL) of Patient-Level Real World Healthcare Data:

This is a Severable, Firm Fixed Price Line Item.

Period of Performance: 09/22/2021 - 09/21/2022

1 Job $6,844,026.00 $6,844,026.00

Line(s) Of Accounting:

921047T 2513 2021 75-2024-0943 C325111101 $4,999,999.92

9390EX5 2513 2021 75-2024-0943 C323111101

$1,724,026.08

939ZRKF 2513 2021 75-21-0950 5610118101

$40,000.00

939ZRPQ 2513 2021 75-21-0950 5610211101

$80,000.00

000101 Linkage of additional labs, per lab to the SARS-CoV-2 Data Cohort (Optional Task):

Task 1 (Additional labs)

This is a Severable, Firm Fixed Price Line Item.

This is a unfunded Optional Line Item that may be exercised at any point during the delineated period of performance.

The Government may require the delivery of this numbered line item in the quantity and at the price delineated herein. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days preceding the need.

Period of Performance: 09/22/2021 - 09/21/2022

1 Each $140,112.00 $140,112.00

000102 Linkage of additional labs, per lab to the HIV and/or viral hepatitis cohorts (Optional Task):

Task 3 (Additional labs)

This is a Severable, Firm Fixed Price Line Item.

This is a unfunded Optional Line Item that may be exercised at any point during the delineated period of performance.

The Government may require the delivery of this numbered line item in the quantity and at the

1 Each $140,112.00 $140,112.00 price delineated herein. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days preceding the need.

Period of Performance: 09/22/2021 - 09/21/2022

Option Year 1 Items:

ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE EXTENDED PRICE

1001 Privacy-Preserving Record Linkage (PPRL) of Patient-Level Real World Healthcare Data:

This is a Severable, Firm Fixed Price Line Item.

Period of Performance: 09/22/2022 - 09/21/2023

1 Job $6,351,526.00 $6,351,526.00

100101 Linkage of additional labs, per lab to the SARS-CoV-2 Data Cohort (Optional Task):

Task 1 (Additional labs)

This is a Severable, Firm Fixed Price Line Item.

This is a unfunded Optional Line Item that may be exercised at any point during the delineated period of performance.

The Government may require the delivery of this numbered line item in the quantity and at the price delineated herein. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days preceding the need.

Period of Performance: 09/22/2022 - 09/21/2023

1 Each $140,112.00 $140,112.00

100102 Linkage of additional labs, per lab to the HIV and/or viral hepatitis cohorts (Optional Task):

Task 3

This is a Severable, Firm Fixed Price Line Item.

This is a unfunded Optional Line Item that may be exercised at any point during the delineated period of performance.

The Government may require the delivery of this numbered line item in the quantity and at the price delineated herein. The Contracting Officer may exercise the option by written notice to the Contractor within 10 days preceding the need.

Period of Performance: 09/22/2022 - 09/21/2023

1 Each $140,112.00 $140,112.00

Summary of Pricing Base Period (Funded) $6,844,026.00 Base Period (Un-funded) $280,224.00 Option Year 1 $6,631,750.00 Total $13,756,000.00

Priorities and Allocations Authority (HHS ACQUISITION ALERT 2020-10)

HHS reserves the right to exercise priorities and allocations authority with respect to this contract, to include rating this order in accordance with 45 CFR Part 101, Subpart A—Health Resources Priorities and Allocations System.

B.1 Points of Contact

Vendor: David Kwasny Tele: (215) 499-8499 Email: dkwasny@healthverity.com

CDC: Matthew Guajardo Tele: (404) 498-6425 Email: ips7@cdc.gov

Contract Specialist: Michael Crow Tele: (770) 488-3208 Email: wyv2@cdc.gov mailto:dkwasny@healthverity.com mailto:ips7@cdc.gov mailto:wyv2@cdc.gov

B.2 Schedule of Milestones for Performance-based Payments

The following schedule in conjunction with the following payment schedule provides the milestones necessary to receive performance-based payments for CLINs 0001 and 1001. The determination of eligibility for receipt of payment will be made by the Contracting Officer upon written certifications from the COR that the milestone has been met. Delivery dates and milestone payment amounts for optional tasks will be set at the time of exercise.

Base Period:

Milestone Total Payment Amount

Census License $180,000

SARS-CoV-2 Data Cohort $2,475,000

Onboarding and data normalization of three additional commercial labs to SARS- CoV-2 Data Cohort

$420,320

Genomic Technology: Deploy a Census engine within a commercial laboratory system and create crosswalk for linkage

$137,800

Genomic Sequencing Crosswalk (for labs in HealthVerity Ecosystem) $316,000

HIV Cohort Labs linked to Closed Pharmacy Claims $474,100

Viral Hepatitis Labs linked to Closed Pharmacy Claims $649,400

Race Crosswalk $1,000,000

Delivery of Race Crosswalk-Enabled Datasets $50,000

Comparator Cohort $550,000

Mom/Baby Crosswalk $287,500

Delivery of Mom/Baby Crosswalk-Enabled Datasets $80,000

Data Asset Training & Complex Use Case Support $223,906

Total (Core Tasks) $6,844,026.00

Option Year 1:

Milestone Total Payment Amount

Census License $180,000

SARS-CoV-2 Data Cohort $2,475,000

Onboarding and data normalization of three additional commercial labs to SARS-CoV- 2 Data Cohort

$352,820

Genomic Technology: Deploy a Census engine within a commercial laboratory system and create crosswalk for linkage

$122,800

Genomic Sequencing Crosswalk (for labs in HealthVerity Ecosystem) $256,000

HIV Cohort Labs linked to Closed Pharmacy Claims $474,100

Viral Hepatitis Labs linked to Closed Pharmacy Claims $649,400

Race Crosswalk $1,000,000

Delivery of Race Crosswalk-Enabled Datasets $50,000

Comparator Cohort $200,000

Mom/Baby Crosswalk $287,500

Delivery of Mom/Baby Crosswalk-Enabled Datasets $80,000

Data Asset Training & Complex Use Case Support $223,906

Total (Core Tasks) $6,351,526.00

Section C - Description/Specification/Work Statement

Title: Privacy-Preserving Record Linkage (PPRL) of Patient-Level Real World Healthcare Data to Advance COVID-19 Response and Other CDC Priorities

C.1 – BACKGROUND:

Access to timely and comprehensive data on the spread and impact COVID-19 remains critical to understanding and combatting the COVID-19 pandemic. The U.S. Centers for Disease Control and Prevention (CDC) is using electronic healthcare data for public health purposes to inform situational awareness, predictive modeling, and strategic, tactical, and policy decision making; to help track the spread and intensity of COVID-19 infection and identify areas that are highly impacted by COVID-19; to understand spectrum of illness, disease burden, risk factors for severe disease, and outcomes; and to understand the impact of COVID-19 on healthcare systems and communities.

Ideally, in critical public health moments such as the current pandemic, data on individuals can be leveraged from a closed system to longitudinally identify all the medical touchpoints and tests in order to specifically define and inform on the public health problem. In reality, there are no data sources available with national coverage that are comprehensive and able to provide a detailed record on individuals necessary for surveillance. An alternative to accessing a closed single source of data is to have the ability to combine multiple data sources into a longitudinal, interoperable, real-world healthcare data view. This type of comprehensive data is uniquely suited to provide novel insight into new and emerging priority questions related to SARS-CoV-2 variants, vaccinations, testing, re-infection, health impact, natural history, and long-term effects of COVID-19.

C.2 - PURPOSE:

The purpose of this contract is to obtain a unique large volume data source (> 50 million individuals or larger) of de-identified, patient-level, real world healthcare data that is interoperable and can be linked across medical and pharmacy claims (including both open and closed systems), chargemaster, electronic medical record (EMR), and laboratory data at the patient-level using privacy-preserving record linkage (PPRL).

The required data are drawn from a variety of US sources, including provider-submitted claims, adjudicated insurance claims, PBM billing, and US laboratory chains, and shall contain data from the following sources:

Medical claims data: These data shall include two primary types 1) those that reflect a patient’s medical activity from the health plan, and 2) those that measure activity from the data provider.

Pharmacy data: These data shall include health plan data, dispensing data from pharmacies, pharmacy system vendors, clearinghouses, and pharmacy benefit managers.

Electronic Medical Records: These data shall include diagnoses, drugs, lab results, clinical and physical observations/vitals, problems, allergies, and some unstructured data elements like clinical notes, scanned documents and image files.

Lab Data: These data shall include information from clinical laboratories, with pathology and genomic labs encompassed. Data shall include the test order, the result, and if available, the interpretation and interpretive range for the result.

Hospital Chargemaster Data: Data collected from hospital billing systems and chargemaster systems shall include visit-level diagnoses, procedures, and specific drug/product/resource utilization by day of stay (versus higher level visit utilization that would be available on claims only), inpatient source of admission, location of care by day of stay (ER, IP, ICU, etc.), length of stay, and discharge disposition, and inpatient lab results (when available).

Race/Ethnicity Data: Race/ethnicity data sourced from EMR and/or consumer records.

Consumer Data (if available): These data shall include grocery spending habits, demographics, ethnicity, financial, lifestyle, social media usage, and obituary and death record data.

Priority uses of data provided pursuant to this contract include the following:

1. Linking SARS-CoV-2 genomic sequencing data from commercial laboratories to follow patients longitudinally (both retrospectively and prospectively) to better understand patient demographic and clinical characteristics and outcomes associated with different SARS-CoV-2 variants;

2. Conducting clinical and epidemiologic studies of SARS-CoV-2 positive patients using longitudinal patient records to assess co-morbidities, clinical severity, and late sequelae;

3. De-duplicating laboratory records at the patient level across six commercial laboratories to monitor for SARS-CoV-2 re-infection and vaccination breakthrough;

4. Prospectively monitoring a cohort of pregnant women who received COVID-19 vaccination or were diagnosed with COVID-19 and a subset of mom-baby linkages from patients receiving care in closed systems; and

5. Assessing changes in testing patterns for hepatitis and HIV as well as prescription medication use and adherence to treatment among hepatitis positive and HIV positive patients over the course of the pandemic (i.e., to assess indirect effects of COVID-19 mitigation strategies on changes in healthcare seeking behavior). This longitudinal, interoperable, real world healthcare data shall fill multiple gaps in CDC’s current COVID-19 healthcare data portfolio and can be used to address numerous priority or questions in the CDC COVID-19 Science Agenda. These data shall include keys, also described as tokens or HealthVerity IDs (HVIDs), that link clinical variables such as laboratory values, biometric information, prescriptions, diagnoses, and therapeutic outcomes, that can be used to develop insights based on provider-patient treatment decisions and health outcomes. CDC personnel must be able to use open source tools, including Python and R, within a Jupyter Notebook front-end for maximum flexibility, speed to development queries.

This is the first large, real world data set acquired for use by CDC. This data source has high impact potential for the COVID-19 response and surveillance efforts because it offers CDC scientists and the COVID-19 response task force personnel the opportunity to conduct complex analysis and develop use-cases on disease patterns, progression, and health outcomes; evaluate clinical guidelines uptake, treatments and interventions; and conduct public health surveillance type queries. The PPRL data is a novel and innovative data source that will be used for addressing COVID-19 priorities of multiple Response Task Forces (DAV, HSWS, Epi, Lab, CICP) and CDC programs

(NCEZID, NCIRD, NCBDDD, NCHHSTP, NCCDPHP).

C.3 – SCOPE OF WORK:

The contractor shall deliver monthly analysis-ready PPRL data. Delivery of the data set shall include all applicable records from the contractor’s ecosystem for all patients with 1 or more HVID assignments between December 2018 and current date. The data shall encompass medical claims, pharmacy data, electronic medical records, lab data, hospital chargemaster data, and race/ethnicity data . The contractor shall include keys to link variables such as clinical measures, laboratory values, prescriptions, diagnoses, and therapeutic outcomes, with data dictionaries within data sources or centralized databases and between data sources or decentralized databases through the HVID.

The contractor’s data shall include critical COVID-19 data including COVID diagnosis, diagnosis with COVID related symptoms, tested for SARS-CoV-2(NAAT and/or antibody), and treated with COVID related products.

These COVID-19 specific data shall be integrated with electronic health records, longitudinal medical and pharmacy claims and other diverse data sources with central or decentralized databases. The contractor shall also provide training and professional services relating specifically to the data provided pursuant to this contract.

The contractor shall provide CDC data for agency-wide use as outlined below:

1. Longitudinal, interoperable, real world healthcare data (medical and pharmacy claims, EMR, hospital chargemaster, laboratory) for a COVID-19 cohort of 55M unique patients (as of Feb 2021) who received COVID-19 diagnostic test (positive or negative result), diagnosis, or vaccination;

2. Ability to link SARS-Cov-2 genomic sequencing data with the COVID-19 cohort;

3. Linked laboratory and pharmacy data for 11.5M hepatitis tested (positive or negative result) patients and

5M HIV tested (positive or negative result) patients;

4. Sources data on up to 5M patients without COVID-19 to use as comparator groups in epidemiologic studies addressing specific populations of interest to CDC;

5. Ability to link healthcare data to patient race obtained from EMR and/or consumer source data; and

6. Ability to track >130k pregnant patients via the COVID cohort and a subset of mom-baby pairs for patients seeking care in closed systems.

CDC shall retain the ability to use the data extracts received during each 12-month contract period following contract completion, and will dispose of the data thereafter in accordance with applicable Federal records management policies.

C.4 - TASKS TO BE PERFORMED:

Task 1: SARS-CoV-2 Data Cohorts The data ecosystem for this task includes data for medical claims, pharmacy claims, chargemaster, laboratory and EMR data sources.

Task 1.1 The contractor shall provide CDC with their linking software, Census. Licensing Census technology allows the contractor to activate any CDC data source that contains Protected Health Information or Personally Identifiable Information (PHI/PII), and map it to an HVID, while preserving patient privacy management and Health Insurance Portability and Accountability Act (HIPAA) compliance. The linking software shall be delivered once during the base year, and updates shall be provided as they become available during the base year and any exercised option years.

Task 1.2 The contractor shall provide CDC with the data ecosystem for patients who have been tested for (negative or positive result), treated for, or diagnosed with COVID-19, or who have COVID-19-like symptoms (fever, cough, shortness of breath or difficulty breathing, fatigue, sore throat, muscles or body aches, headache and or new loss of smell) reported in a medical encounter.

For this task, patients shall be included in the data offering if they are (1) Diagnosed with COVID, diagnosed with COVID related symptoms, tested for SARS-CoV-2 (NAAT and/or antibody; positive or negative result), treated with COVID related products, or (2) Included within the SARS-CoV-2 Genomic Linkage (see task 2).

For all patients meeting these criteria, the contractor shall include all recorded data from December 2018 forward, for all available medical claims (including insurance provider and type), pharmacy claims (including insurance provider and type), chargemaster, and EMR data in the data ecosystem. The contractor shall deliver analysis-ready HVID linked data that are interoperable using a token. The HVID shall be linkable a) longitudinally over time, b) across data ecosystem sources and c) within specific data sources. These data will help address critical research questions by providing a complete picture across the spectrum of healthcare at the patient level. These data shall be delivered monthly during the base year and any exercised option years.

Task 1.3 Data dictionaries shall be provided for medical claims, pharmacy claims, chargemaster, laboratory and EMR data sources, and shall be updated as required. Data dictionaries shall be delivered once during the base year and once for any exercised option years.

Task 2: Adding to SARS-CoV-2 Genomic Sequencing

The contractor shall provide HVIDs for all the genomic samples in order to search for patient records in the contributing medical, pharmacy, or chargemaster data in their ecosystem. To accomplish this, the contractor shall provide the Census software and linking mechanism for the labs that do not contribute lab data to the contractor’s data ecosystem, in addition to leveraging the HVID for the SARS-COV-2 tests from labs that are already contributors to their ecosystem. The contractor shall both use the data provided to CDC by their established partners and set up a similar linking HVID for data that is outside of the contractor’s data ecosystem.

Task 2.1 For SARS-Cov-2 laboratory testing data not currently in the contractor’s data ecosystem, the contractor shall establish a relationship with the data source and deploy a Census engine within the laboratory’s system to create a HVID de-identified HIPAA compliant token using the laboratory’s protected PHI/PII information. In that way, protected PHI/PII information remains within the protected environment of the data supplier, and is removed for reporting, leaving only the de-identified HVID token. For the NAAT/PCR tests that are identified for genomic sequencing, the HVID token shall be available within the genomic sequencing test records to crosswalk and flag if there is overlapping HVID information in the contractor’s data ecosystem. The tokenization technology shall be deployed once in the base year once for any exercised option years if updates become available.

Task 2.2 For commercial laboratory data for which both CDC and the contractor have independent relationships, and for samples that the contractor has set up HVID linking tokens for in Task 2.1, the contractor shall establish a crosswalk file from the laboratory’s accession number for the genomic sequence data to the HVID associated with the original NAAT/PCR test. Laboratory records with the identified positive NAAT/PCR test shall be flagged and identified if the HVID also is identifiable within the contractor’s data ecosystem. This flagged file shall be sent to CDC weekly and the HVID will allow CDC to leverage the data supplied monthly in Task 1 to inform research and surveillance initiatives on the patient-level healthcare landscape. The contractor shall deliver a flagged HVID linked cross walk table weekly during the base year and any exercised option years.

Task 3: HIV and viral hepatitis lab data linked to pharmacy claims The contractor shall link unique patients with HVID that have had a HIV or viral hepatitis lab test (all hepatitis viral types; positive and negative results) with laboratories and across the different laboratories with the pharmacy claims within its data ecosystem. The data ecosystem for this task includes data for pharmacy claims and laboratory data sources and developed out of closed pharmacy claims.

Task 3.1 For laboratories that provide data to CDC and are currently in the contractor’s data ecosystem, a crosswalk shall be created for all records with a HIV test (positive or negative result) that links to available closed pharmacy claims. Using a crosswalk, the contractor shall redeliver the complete dataset, encompassing labs and pharmacy claims for patients who have been tested for HIV and have available pharmacy claims associated with the laboratory tested HVID. The HIV testing data shall be delivered quarterly during the base year and any exercised option years.

Task 3.2 For laboratories that provide data to CDC and are currently in the contractor’s data ecosystem, a crosswalk shall be created for all records with a viral hepatitis test (A, B, C, D and E), that links to available pharmacy claims.

Using a crosswalk, the contractor shall redeliver the complete dataset, encompassing labs and pharmacy claims for patients who have been tested for viral hepatitis and have available pharmacy claims associated with the laboratory tested HVID.

The data cohorts provided to CDC shall include history back to December 2018. The viral hepatitis testing data shall be delivered quarterly during the base year and any exercised option years.

Task 4: Patient Race and Ethnicity The contractor shall utilize EMR and/or consumer source records to deliver patient race and ethnicity datasets to CDC in an interoperable, HIPAA compliant manner through additional crosswalk-enabled deliverables. The data ecosystem for this task includes EMR and/or consumer data sources.

Crosswalk enabled deliverables shall be developed by pairing up HVIDs and the corresponding race and ethnicity category, allowing CDC to connect patient race to medical claims, pharmacy claims, chargemaster, EMR and laboratory data from Task 1 with the HVID. These deliverables shall support Tasks 1, 2, 3 and 5 and shall be delivered to CDC as a separate set of interoperable race-enabled datasets. To ensure data provided are HIPAA compliant, the contractor shall account for the necessary trade-offs when providing race and ethnicity level detail.

Doing so will ensure that all data delivered to the CDC are de-identified in compliance with HIPAA regulations.

These crosswalk enabled deliverables shall be delivered in the same frequency as the corresponding task across the base and option year if exercised.

Task 5: Provide a comparator cohort (up to 5 million patients)

In order for CDC to analyze the impact of COVID for specific disease or therapy areas, comparator cohorts are needed to provide the ability to analyze non-covid patients. The data ecosystem for this task includes data for closed medical claims, closed pharmacy claims and the option to link EMR data sources. Patients shall be selected out of closed claims to ensure complete enrollment. Closed medical claims like closed pharmacy claims are data derived from health insurance providers and most of a patient’s healthcare activities during a specific enrollment period.

Task 5.1 The contractor shall provide data from their ecosystem for up to 5 million patients across up to 5 different therapy areas with the flexibility for CDC to choose specific disease or therapy areas. As part of this cohort, the contractor shall include 500,000 linked babies from the mom/baby cohort as one of the 5 therapy areas to further support mother/baby analysis. All closed pharmacy and closed medical data shall be made available based on the specific disease or therapy area provided.

The contractor shall deliver up to 5 analysis-ready HVID linked data cohorts during the base year and any exercised option years that are interoperable using the HVID token, and which shall be updated quarterly. The data cohorts provided to CDC shall include history back to December 2018, and shall be leveraged to link with other purchased datasets in Task 1–Task 4.

Task 6: Mother/Baby Cohort Task 6.1 The contractor shall deliver comprehensive HIPAA-compliant crosswalk-enabled deliverables that includes HVIDs to link mothers and their babies together. The data shall be developed out of the closed claims only.

Using this crosswalk, the contractor shall deliver Mom/Baby deliverables to CDC. These deliverables shall provide a linkage showing the maternal and infant relationship and shall link to medical claims, pharmacy claims, chargemaster, EMR and lab data where that same HVID is identified. The data shall update quarterly to allow CDC to follow these pairs prospectively across Tasks 1-3 and 5.

The contractor shall deliver analysis-ready HVID linked crosswalk enabled deliverable files with two HVIDs showing the maternal-infant relationship. These mom/baby crosswalk-enabled deliverables link mothers and their infants together through patient specific HVIDs that can in turn be connected to RWD to better understand and study outcomes of mothers and their infants across Tasks 1-3 and 5.

The mother/baby cohort testing datasets shall be delivered quarterly during the base year and any exercised option years.

Task 7: Additional Support Services

Task 7.1: Training Services The contractor shall provide an estimated 12 hours of training on the data asset per 12-month contract period, to include the base year and exercised option year. Trainings shall be live (not historically recorded) and shall occur remotely (via video- or tele-conference). Training content shall be jointly determined by PCC and CDC in advance.

Examples of training content include best practices for variables in the relational datasets, insight to understand inconsistencies in similar variables across datasets, and scenarios when one variable is preferable over another.

Task 7.2: Complex Use-Case Support The contractor shall provide an estimated 48 hours of technical and professional support in response to complex use-case scenarios identified in advance by CDC per 12-month contract period, to include the base year and exercised option years. Use case support includes guidance on research questions, training and best practices. Complex use case support does not include analytics.

Task 8: Regular Meetings

The contractor shall participate in:

Task 8.1 A project kickoff meeting with CDC and provide a meeting agenda, and

Task 8.2 Monthly check-in meetings with CDC to assess status of deliverables and address outstanding questions or concerns.

C.5 - Security and Privacy Requirements

A. Baseline Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

c. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

d. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

e. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Information Security Categorization. In accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of

Information and Information Systems to Security Categories, Appendix C, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

Based on information provided by the ISSO, Privacy Office, system/data owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] Yes PII

4) Personally Identifiable Information (PII). Per the Office of Management and Budget (OMB) Circular A- 130, “PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual.” Examples of PII include, but are not limited to the following: social security number, date and place of birth, mother‘s maiden name, biometric records, etc.

PII Confidentiality Impact Level has been determined to be: [X] Low [ ] Moderate [ ] High

5) Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.”

The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, reusing, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST

SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

6) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

See the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

7) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and CDC policies. Unauthorized disclosure of information will be subject to the HHS/CDC sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

8) Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol shall comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

9) Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS).

In addition, HTTPS shall enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, the HTTPS is not required, but it is highly recommended.

10) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

11) Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to the COR upon request and at the conclusion of the contract.

12) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the OpDiv non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

13) Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – The Contractor shall assist the OpDiv Senior Official for Privacy (SOP) or designee with conducting a PTA for the information system and/or information handled under this contract to determine whether or not a full PIA needs to be completed.

a. If the results of the PTA show that a full PIA is needed, the Contractor shall assist the OpDiv SOP or designee with completing a PIA for the system or information within 30 days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

B. Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/OpDiv Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

C. Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual OpDiv Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information” (03 January 2017) states:

Definition of an Incident:

An occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Definition of a Breach:

The loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

It further adds:

A breach is not limited to an occurrence where a person other than an authorized user potentially accesses PII by means of a network intrusion, a targeted attack that exploits website vulnerabilities, or an attack executed through an email message or attachment. A breach may also include the loss or theft of physical documents that include PII and portable electronic storage media that store PII, the inadvertent disclosure of PII on a public website, or an oral disclosure of PII to a person who is not authorized to receive that information. It may also include an authorized user accessing PII for an other than authorized purpose.

The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

Contracts with entities that collect, maintain, use, or operate Federal information or information systems on behalf of CDC shall include the following requirements:

1) The contractor shall cooperate with and exchange information with CDC officials, as deemed necessary by the CDC Breach Response Team, to report and manage a suspected or confirmed breach.

2) All contractors and subcontractors shall properly encrypt PII in accordance with OMB Circular A-130 and other applicable policies, including CDC-specific policies, and comply with HHS-specific policies for protecting PII. To this end, all contractors and subcontractors shall protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

3) All contractors and subcontractors shall participate in regular training on how to identify and report a breach.

4) All contractors and subcontractors shall report a suspected or confirmed breach in any medium as soon as possible and no later than 1 hour of discovery, consistent with applicable CDC IT acquisitions guidance, HHS/CDC and incident management policy, and United States Computer Emergency Readiness Team (US-CERT) notification guidelines. To this end, the Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of

Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC) or CDC Computer Incident Response Team (CSIRT) within 24 hours via email at csirt@cdc.gov or telephone at 866-655-2245, whether the response is positive or negative.

5) All contractors and subcontractors shall be able to determine what Federal information was or could have been accessed and by whom, construct a timeline of user activity, determine methods and techniques used to access Federal information, and identify the initial attack vector.

6) All contractors and subcontractors shall allow for an inspection, investigation, forensic analysis, and any other action necessary to ensure compliance with HHS/CDC Policy and the HHS/CDC Breach Response Plan and to assist with responding to a breach.

7) Cloud service providers shall use guidance provided in the FedRAMP Incident Communications Procedures when deciding when to report directly to US-CERT first or notify CDC first.

8) Identify roles and responsibilities, in accordance with HHS/CDC Breach Response Policy and the HHS/CDC Breach Response Plan. To this end, the Contractor shall NOT notify affected individuals unless and until so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, all notifications must be pre-approved by the appropriate CDC officials, consistent with HHS/CDC Breach Response Plan, and the Contractor shall then send CDC- approved notifications to affected individuals;

and,

9) Acknowledge that CDC will not interpret report of a breach, by itself, as…