J.4_Seed Task Order 1.pdf

Attachment J.4

For the purposes of responding to the solicitation, the offeror should assume that 13,550 total hours will be utilized in performance of this task order.

STATEMENT OF WORK

IDIQ – Executive Consulting Services - Task Order #1

C.1 BACKGROUND

The Office for Civil Rights (OCR), a staff division at the HHS Office of the Secretary, ensures that individuals receiving services from HHS-funded programs are not subject to unlawful discrimination, that civil rights laws promote health equity in HHS funded and administered by HHS to the extent possible, that regulated entities comply with applicable privacy and security requirements promulgated under HIPAA and HITECH, and individuals can exercise their rights to access their health information and can trust in the privacy and security of their health information. By rooting out insidious discrimination and removing unlawful barriers to HHS-funded services, OCR carries out the HHS mission of improving the health and well-being of all Americans and providing essential human services. By promoting health equity and protecting the right of individuals to access their health information while protecting the privacy and security of this information, OCR helps empower people’s health care decision-making and helps ensure the integrity of the health care system, both of which promote better health outcomes for the Nation.

OCR protects these rights by:

Teaching health, social service workers, and other stakeholders about civil rights laws, health information privacy, and patient safety confidentiality laws.

Educating communities about civil rights and health information privacy rights.

Investigating civil rights, health information privacy, and patient safety confidentiality complaints to identify discrimination or violations of the law and taking action to correct problems up to and including enforcement actions, compliance actions, and imposing civil monetary penalties.

Drafting regulations within the scope of applicable authorities.

C.2 OBJECTIVE

The Contractor will support the Office for Civil Rights (OCR) in obtaining highly skilled executive consultants and management/administrative analysts. These highly trained and highly skilled consultants and analysts are integral to the success and performance of OCR and further OCR’s mission as described above thru various mission support activities.

C.3 SCOPE

This contract is to provide OCR support in consultative services, strategic planning, program management, administrative services and all related advisory activities required by OCR.

The contractor shall oversee its personnel in performance of this task order. The Government anticipates that no more than 2% of hours under task orders issued against this contract will be performed by the project manager, unless approved in advance by the COR.

C.4 TASK AREAS

C.4.B – Task Area 2 – Investigation Support: The Contractor will assist headquarters with mission support activities involving investigations of complaints and compliance reviews concerning Health and Human Services divisions, State and local governments, and private entities by making recommendations to the Director or other Federal designee about findings and disposition.

The Contractor will support regional and headquarter staff by independently reviewing and assessing information security data relating to the security programs and safeguarding of protected health information of HIPAA covered entities and business associates.

C.4.D – Task Area 4 – Administrative Support: The Contractor will provide general administrative and analytical support to headquarters and regional staff with minimal oversight. They will assist staff with mission support activities related to investigations of complaints and compliance reviews within OCR’s divisions, including regional staff.

C.4.2 – Program Area support Labor Categories

C.4.2.A - Management Analyst III, Program Specialist

1. Provides consultation and makes recommendations under OCR’s compliance and enforcement authorities regarding case investigations, conduct of compliance reviews, and case resolution and enforcement strategies concerning Health and Human Services divisions, State and local governments, and private entities.

2. Provides mission support, policy and regulatory impact analysis (RIA) to the OCR Director and Division Directors on issues of policy, impact of administrative rules, compliance, and enforcement mechanisms.

3. Provides policy and regulatory impact analysis on the implementation of policies and procedures under OCR’s compliance and enforcement authorities.

4. Provides high- quality research and analysis by processing and investigating cases, conducting compliance reviews in support of OCR’s nationwide goals.

5. Supports OCR officials’ intra- and inter-agency efforts to develop, coordinate and implement OCR mission activities pertaining enforcement.

6. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities, complainants, covered entities and business associates, advocacy groups, and other stakeholders as required.

7. Provides outreach activities, such as outreach to stakeholders, media relations and special initiatives, in support of OCR’s mission activities, program goals and strategic objectives.

Minimum educational experience is a law degree (J.D.) from a law school accredited by the American Bar Association (ABA) or a Master’s degree from an accredited university or specialized experience equivalent to the GS-15 level in the Federal Government.

C.4.2.B - Management Analyst II, Program

1. Provide mission support and policy analysis services to OCR Regional Mangers in developing case-related guidance for front-line OCR investigators and makes recommendations regarding regional operations to ensure consistency in compliance activities and application of policies.

2. Makes recommendations to the OCR Regional Managers about the findings and disposition of cases and compliance reviews.

3. Provides mission support, policy, and regulatory impact analysis (RIA) to the OCR Director and Division Directors on issues of policy, impact of administrative rules, compliance, and enforcement mechanisms.

4. Provides research and recommendations regarding implementation of policies and procedures under OCR’s compliance and enforcement authorities to the OCR Regional Manager.

5. Conducts and analyses HHS program-related research.

6. Assists with analyzing clearances implicating the office’s mission and makes recommendations to the COR for processing.

7. Provides outreach activities, such as outreach to stakeholders, media relations and special initiatives, in support of OCR’s mission activities, program goals and strategic objectives.

Minimum educational experience is a law degree (J.D.) from a law school accredited by the American Bar Association (ABA) or a Bachelor’s degree from an accredited university or specialized experience equivalent to the GS-13/14 level in the Federal Government

C.4.2.C - Management Analyst I, Program

1. Provide mission support and policy analysis services to COR in developing case-related guidance for front-line OCR investigators and makes recommendations regarding regional operations to ensure consistency in compliance activities and application of policies and administration.

2. Conducts and analyses HHS program-related research.

3. Provides general administrative and analytical support to the Divisions.

4. Develops a system for tracking the goals and accomplishments of the Division.

5. Develops spreadsheets, analyzes information, and provides reports. The spreadsheets could track complaints, information about covered entities and relevant stakeholders, and information needed to meet reporting requirements for OCR.

6. Interfaces with appropriate staff within OCR to get needed information and arrange meetings.

7. Provides logistical support for Division activities.

Minimum educational experience is a one-year law school completed from a law school accredited by the American Bar Association (ABA) or a Bachelor’s degree from an accredited university or specialized experience equivalent to the GS-12 level in the Federal Government.

C.4.2.D – HIPAA Subject Matter Experts/Technical Analyst

1. Reviews security and privacy complaints, data breach notification and cybersecurity incident reports, and other correspondence and evidence to determine whether the complaint, self-report or breach notification report indicates non-compliance with the HIPAA Security Rule. Reviews data provided by the healthcare organizations across the nation to assess the overall impact of security and privacy incidents.

2. Provides subject matter expertise with evaluating and determining the technical sufficiency of submissions from HIPAA covered entities and business associates in response to data and documentation requests (i.e. Assessing reports related to security baselines, penetration tests, vulnerability assessments, and digital forensics).

3. Document processes, standard operating procedures and system requirements;

develops reports summarizing the analysis along with formulating recommendations for OCR to consider for future action.

4. Develops written reports with technical security analyses, summaries, and recommendations for action, reports on root causes of problems, efficiency, and support needs.

5. Provides expertise in the development and evaluation of health information privacy policies and technologies, specifically regarding protected health information; de-identified / re-identified health information; limited data sets.

6. Provides subject matter expert analysis, evaluation, and recommendations based on national security standards (NIST), industry best practices (ISO) and implementation specifications of the HIPAA Security Rule.

7. Provides expert guidance in designing, implementing, and managing information security, data protection, and risk management programs, including policies, procedures, and controls for protected health information based on HIPAA requirements.

8. Provides advisory expertise in the areas of risk analyses, vulnerability assessments, incident response, security architecture, physical security, business continuity and disaster recovery, enterprise mobility, threat intelligence and analysis, security awareness and online safety, and resolution of highly.

Minimum educational experience is a Bachelor’s degree from an accredited university with the focus on Cybersecurity, Computer Science, Information Sciences or other comparable fields of study. Preference will be given to candidates with relevant industry certifications from CISSP, CISM, CIPP/CIPT/CIPT.

C.4.4 – Administrative Support

C.4.4.A - Administrative Assistant II

1. Provides general administrative and analytical support.

2. Provides scheduling and calendar management services to specific executives as directed by the COR.

3. Conducts routine office functions with minimal direction.

4. Provides support to OCR with the day-to-day functions of the regional and/or headquarters offices.

5. Develops and/or maintains spreadsheets, reports, and other documents with minimal oversight.

6. Conducts routine office functions with minimal direction and has experience with a variety of computer applications, including Microsoft Word and Excel.

7. Excellent organizational, written, and oral communication skills are required.

8. Ability to produce, track and manage multiple deliverables with overlapping deadlines in a high-performing environment.

9. Experience working effectively within a team and independently in a busy environment.

10. Interfaces with appropriate governmental staff as well as federal and state agencies and other regulated entities, the media, complainants, covered entities and business associates, advocacy groups, and other stakeholders as allowed.

11. Provides logistical support as needed for the COR including assisting with preparing ordering lists for supplies and materials, managing property and equipment, preparing items for mail services, and other inherently general administrative functions.

Minimum educational experience is Bachelor’s degree from an accredited college/university or experience equivalent to the GS-11 level or higher in the Federal Government

C.4.4.B - Administrative Assistant I

1. Provides general administrative and analytical support.

2. Conducts routine office functions as directed.

3. Provides assistance to the OCR with the day-to-day functions of the regional and/or headquarters offices.

4. Maintains existing spreadsheets, reports, and other documents with minimal oversight.

5. Conducts routine office functions with minimal direction and has experience with a variety of computer applications, including Microsoft Outlook, Word and Excel.

6. Excellent organizational, written, and oral communication skills are required.

7. Ability to produce, track and manage multiple deliverables with overlapping deadlines in a high-performing environment.

8. Experience working effectively within a team and independently in a busy environment.

9. Provides logistical support as needed for the OCR including assisting with preparing ordering lists for supplies and materials, managing property and equipment, preparing items for mail services, and other inherently general administrative functions.

Minimum educational experience is an Associate’s degree from an accredited college/university or experience equivalent to the GS-9 level or higher in the Federal Government.

C.4.5 – Post-award Orientation

If determined to be necessary by the Contracting Officer, and in accordance with FAR 42.5, the Contracting Officer will coordinate the post-award orientation between the Government and Contractor within thirty (30) days of award. The Contractor shall attend the post-award meeting which may be held virtually or in-person at the Government’s discretion not to place an undue burden on the Contractor.

C.4.10 Project Deliverables

C.4.10.A

1. The contractor shall provide the COR with electronic files of all developed material. Reports and other materials should be prepared using Word, Excel or Access. Project Plans shall be delivered in Microsoft Project. Graphics materials should be delivered using Adobe projects. If other software programs will be used, COR approval must be obtained. All data files, original artwork, disks, and other media materials produced as a result of this contract shall be delivered to the COR. Electronic versions should also be provided to the COR.

The contractor shall obtain COR approval before delivering products using cloud solutions.

2. Media materials prepared for the OCR website should be formatted so that they can be downloadable, and 508 compliant. Electronic files shall meet HHS specification for reproduction by a printer. The contractor shall work with the COR to resolve any problems with files prior to the acceptance of final deliverables by the COR. All media materials produced under this contract must be submitted first to the COR and shall not be released without COR approval.

3. Meetings or conference calls with the COR shall be held as needed to discuss specific information or needs and project progress and provide information.

Meetings shall be held telephonically and/or at HHS headquarters in Washington, D.C.

SECURITY AND POSITION SENSITIVITY

To perform the work specified herein, contractor personnel will require access to proprietary, privacy protected and/or sensitive data, regular access to HHS-controlled facilities and/or access to HHS information systems. The Government anticipates the position sensitivity under this effort to be Public Trust Level 5.

REPORT(S)/DELIVERABLES AND DELIVERY SCHEDULE

Item No.

Deliverable Deliverable Recipient

Objective Due

1 Proposed Project Plan

COR Defining the responsibilities, timeline, risks and milestones of contract objectives

TBD

3 Weekly Status

Reports COR Report documenting tasks & issues weekly. Include general summarized activities for all contractors and amount of time applied for each division with OCR

Weekly, every Friday by 3:00 pm (EDST) until the contract is completed

4 Bi-Weekly Funds Status Report

CO and

COR

Provide bi-weekly status of funds report to CO and COR. Reports should include a burn rate showing how funds are spent.

Bi-weekly, every Friday by 3:00 pm (EDST) until the contract is completed

5 Monthly Summary

COR Report documenting labor and funds remaining. Report should be ongoing for the POP.

Last day of every month, by Friday by 3:00 pm (EDST) until the contract is completed

8 Administrative and Mission support

COR Provide administrative and analytical support for OCR’s mission activities

TBD

9 Regulatory Impact Analysis

COR Provide consultation regarding, administrative rule making and draft regulatory comments reviews

TBD

10 Investigations and compliance review

COR Participates in investigations of complaints and compliance reviews undertaken by the office’s divisions

TBD

12 Writing and editing support

COR Development and execution of various outreach, educational and training products

TBD

13 Document Management

COR Provides support to OCR to improve document management program including scanning support and paper disposal

TBD

14 Final Report COR Prepare, edit and provide a final report to the COR including a summary of activities performed during each POP. Report will summarize weekly and monthly activities and provide a final

No later than ten (10) days following OCR’s receipt of all deliverables accounting of the contract. A draft report will be provided for comments before issuance of the final report.