QMS_Statement_of_Work_N02CO67004-02.pdf

Statement of Work

January 11, 2016

QMS CPTAC SOW

Statement of Work

1 Scope/Objective

Independently, and not as an agent of the Government, the Contractor shall furnish all of the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the

Government as needed to perform the below Statement of Work (SOW).

The objective of this project is to establish a Quality Management System (QMS) across the funded activities of the Clinical Proteomics Tumor Analysis Consortium (CPTAC) program, with the goal of identifying non‐conforming data in a timely fashion to ensure data released to the public is of the highest quality possible.

Objectives of the project include:

Establish CPTAC‐Quality Management (QM) policies, processes and procedures in line with the program organization and goals;

Implement the QMS and train the staff within the Biospecimen Core Resources (BCR), Data

Coordinating Center (DCC), NCI‐Operations and Technical Support (OTS) Comprehensive Data

Resource (CDR), Proteomic Characterization Centers (PCC), Proteogenomic Data Analysis

Centers (PGDAC), and Proteogenomic Translational Research Centers;

Provide a means to identify, track and report non‐conforming data;

Establish and implement internal audit policies, processes, and methods to verify compliance with the QMS;

Provide regular and detailed reports of the status of data quality at all stages in the CPTAC workflow to the Contracting Officer (CO) and the Contracting Officer’s Representative (COR).

1.1 Tasks

1.1.1 Task 1: QMS Requirements Gathering

The Contractor shall undertake a review of the quality practices of the CPTAC program after reviewing the existing requirements document from the previous QMS contractor. Specifically, the Contractor shall focus on the roles and responsibilities of the DCC, GCC, PCCs, PGDACs, and PTRCs, report the quality management needs, and refine the Quality Management Goals of the CPTAC Program. A full requirements gathering process shall include the major stakeholders, to include staff from the Office of

Cancer Clinical Proteomic Research (OCCPR), BCRs, CDR, DCC, GCCs, PCCs, NCI OTS Contractor, and

Biospecimen Working Group Co‐Chairs. The Contractor shall add to the requirements document from the previous Contractor and shall not duplicate requirements gathering work.

The Contractor shall review the current policies and reports of the program, the program structure, the

Standard Operating Procedures (SOPs) for all of the CPTAC funded activities, and the information management systems to initiate the requirements process. After which, the Contractor shall meet with the COR, the necessary staff within the Office of Cancer Clinical Proteomics Research, the BCRs, DCC, PCCs, GCCs, PGDACs, PTRCs, OTS Contractor, and Biospecimen Working Group to ascertain the significant quality gaps and summarize their findings in a Requirements Document. Within four (4) months of the start date of the contract, the Contractor shall submit the Requirements Document. The audience for the Requirements Document will be the CPTAC Program Management, and therefore, shall reflect the specific needs of the Program Management.

1.1.2 Task 2: QMS Specifications and Proposal

The Contractor shall utilize the requirements information and the existing CPTAC QMS to outline a strategy and propose the specifications for the amendment of a program‐wide QMS. The proposed QMS shall meet the needs of the Quality Management Goals of the CPTAC Program, as well as support the program management requirements for oversight and reporting. The proposed specifications shall include the information management system the Contractor intends to employ.

The Contractor shall deliver, within five (5) months from the start date of the contract, a QMS

Specifications and Proposal document. This document shall include the requirements findings, describe a process to address the requirements as they pertain to a QMS, and articulate the activities necessary to instantiate a QMS that shall meet the productivity and quality goals, objectives, and requirements of the CPTAC Program. This document shall serve as the roadmap for the development of a QMS; it shall not serve as the Quality Manual. The purpose of the Specifications and Proposal document is to clearly define what is needed, why it is needed, and how it will be addressed.

Note to Offerors: The NCI will support the use of a Commercial‐Off‐The‐Shelf (COTS) or Open Source

Information Management Systems (IMS). The IMS shall only capture, manage, and report the data elements necessary to fulfill the agreed upon objectives. All license fees for COTS solutions shall be approved by the Contracting Officer’s Representative (COR) and the Contracting Officer (CO) prior to purchase.

1.1.3 Task 3: CPTAC Workflows

Utilizing the workflows from the previous Contractor, the Contractor shall develop a canonical workflow for all the major program activities, from tissue accession, through data generation, to information services. To accomplish this task, the Contractor shall utilize currently available Standard Operating

Procedures (SOPs) from the previous Contractor and other CPTAC entities, update and modify those workflows based on the requirements analysis from Task 1, and unify the SOPs into a single workflow.

The initial compilation of workflows shall be completed within six (6) months from the start date of the contract and submitted to the Government. This workflow will likely change over time and it shall be the responsibility of the Contractor to ensure all documentation is kept current. Where there are gaps in the program, not represented by a workflow or SOP, the Contractor shall alert the COR to ensure the appropriate documents are produced by the appropriate entities.

1.1.4 Task 4: Quality Manual

The Contractor shall amend the Quality Manual (QM) in conjunction with the COR and Office of Cancer

Clinical Proteomics Research (OCCPR). The Quality Manual shall describe the structure and detail of the

CPTAC QMS to all the stakeholders. The primary users of the QM will be the CPTAC management and funded participants.

The Quality Manual shall serve as the primary document to communicate and govern the QMS. The

Quality Manual shall describe the CPTAC quality policies along with the structure of the QMS. The

Quality Manual must provide a summary of the policies for each of the ten (10) Quality System

Essentials (QSEs) outlined in Task 5, to be included in the CPTAC QMS. The Contractor shall have seven

(7) months from the start date of the contract to submit the Quality Manual. The COR will approve the

Quality Manual in writing. As the quality documents and SOPs are generated, the Quality Manual shall also provide references to all of the CPTAC Program’s quality policies, processes, and procedures. The audience for the Quality Manual will be the CPTAC Program Management.

1.1.5 Task 5: Quality Management System Documents

Utilizing documents from the previous Contractor, the Contractor shall amend the necessary documents that outline the Policies, Processes, Procedures, and Forms and Records for the 10 QSEs outlined in the following table:

In‐Scope

QSEs

Out‐of‐Scope

QSEs

Documents and Records Personnel

Organization Facilities and Safety

Equipment

Purchasing and Inventory

Process Management

Information Management

Non‐conforming Event Management

Assessments

Customer Focus

Continual Improvements

These documents shall serve as the structure for the QMS and shall be clear, concise, and cogent. The

QMS policies shall be developed in conjunction with the COR, Office of Cancer Clinical Proteomics

Research (OCCPR) staff, and considered to be living documents, up for review at all times. The

Contractor shall manage these documents electronically, through the QMS Information Management

System (IMS). It is the intent of the OCCPR to employ a minimal QMS based on 10 of the 12 QSEs as outlined in the table provided above. It will be the responsibility of the Contractor to define the quality policies, processes and procedures around these ten (10) QSEs as they relate to the CPTAC program;

however, the Contractor shall not attempt to make the CPTAC Program or any part therein compliant with ISO 9001.

The Quality Management System Documents serve as the backbone of the QMS. There shall be four (4) documents for each of the ten (10) QSEs: Policies, Processes, Procedures, and Forms and Records.

Policies – state the program’s intent regarding each QSE. The compilation of the QSE Policies forms the heart of the Quality Manual.

Processes – document how quality management activities happen within the CPTAC program. The processes describe the activities necessary to accomplish the intent, the correct sequencing of activities for a successful outcome, and the entities responsible for the activities. The processes may take the form of workflows, charts, and tables.

Procedures – provide instructions on how to perform the steps in a given process activity. There shall be at least one (1) procedure for each process. The procedures can be built upon the currently available

SOP’s from the funded entities of the program.

Forms and Records – describes the structure of the forms used to record information.

The Contractor shall submit an initial draft of the Policies, Processes, Procedures, and Forms and

Records for each of the ten (10) QSEs no later than eight (8) months from the start of the contract. It is expected that these Quality Management System Documents shall be living and modified continuously over the life of the Program. Additionally, these documents must be managed within the CPTAC QMS

IMS. The finalized documents are due on or before the expiration date of the contract.

1.1.6 Task 6: QMS Information Management System

The Contractor shall implement an electronic record keeping system, capable of managing the information relevant to each of the ten (10) QSEs. Most importantly, the system shall focus on addressing the following QSEs:

Documents and Records

Information Management

Occurrence Management

Additionally, the QMS IMS shall be able to identify, manage and track non‐conforming data and outcomes. Occurrence management is a primary driver behind this task, so the ability to identify and report non‐conformities early in the workflow shall be vital. This shall require programmatic integration with the existing informatics infrastructure at the DCC and BCRs. Initially, the Contractor shall develop the IMS using the code base from the previous Contractor. QMS integration shall be completed within eight (8) months of the start date of the contract.

The Contractor shall instantiate an electronic information management system (IMS) to facilitate the establishment and ongoing maintenance of the overall QMS no later than six (6) months from the start date of the contract. The Contractor shall have discretion with selection of an IMS, but the IMS must be approved by the COR and the Contracting Officer in writing. The IMS shall meet the needs of the project, including integration with existing informatics systems (e.g. harmonization of data types and ontologies) as defined by the Requirements Document (Task 1), with extra capability in handling

Occurrence Management and reporting of data quality checks and assessments. The QMS IMS shall be managed by the Contractor, but hosted by the NCI Center for Biomedical Informatics and Information

Technology. The IMS shall also allow for complete accessibility of the data to the COR and the CPTAC

Program Staff including the ability to log in remotely, manage the data, and generate reports for any purpose. At a minimum, the IMS shall track the status of each sample by stage in the CPTAC pipeline, TSS, and tumor type.

Note to Offerors: The IMS may be a COTS or Open Source system, but will not be Government furnished, unless the Contractor is familiar with an adequate Government owned IMS, which may be considered.

1.1.7 Task 7: Staff Training

The Contractor shall perform a series of staff training activities to adequately train the staff of the BCRs and the DCC, as well as the NIH Program Management staff. Training activities may be a mix of on‐site, in‐person training, as well as virtual web meetings. The Contractor shall develop the content and scope of the training sessions. The Contractor shall plan on no more than two (2) on‐site training sessions per institution.

The Contractor shall train all the CPTAC Program Management staff and the staff of the two (2) BCRS and the DCC on the policies, procedures, and documents of the QMS. For the purpose of completeness, the Contractor shall assume that all relevant parties have no familiarity with a QMS. The Contractor shall have one (1) month to carry out the initial training and will be allowed to travel to the BCR and DCC locations. The Contractor shall train the COR or other designated NCI staff on the details of the QMS

IMS, for the purpose of managing the information and generating reports. The Government anticipates training will have multiple phases and will be an ongoing requirement, but should begin immediately after approval of the QMS Documents and the IMS are in place. A Staff Training Report shall be submitted one (1) month after the QMS IMS established and updated on a monthly basis.

1.1.8 Task 8: Assessments

The Contractor, alongside the COR, shall assess and audit the two (2) BCRs, the CDR, and DCC institutions, once per year, against the policies and procedures of the implemented QMS. In so doing, the Contractor shall determine what components of the QMS are most appropriate for assessment in order to meet the CPTAC Program QM goals, develop the assessment criteria in conjunction with the

NCI, and carry out the assessment process. The institutions to be assessed do not need to be compliant with any standards organization. The assessment shall ensure a high level of data quality over the life of the program.

This currently constitutes three (3) organizations (DCC, BCR, and OTS Contractor), and is not anticipated to change within the timeline of this project. The Contractor shall establish the assessment criteria, carry out the assessments, and provide a written summary of the assessments to the COR within thirty (30) calendar days of completion of the assessments. Assessments for each of the BCR and DCC institutions shall be executed on an annual basis, at a minimum, and as necessary to resolve data quality issues.

Additionally, the Contractor shall work with the BCR and DCC to establish automated data quality checks and audits. The types, number, and frequency of data quality checks and audits to be developed will be articulated in the Occurrence Management section of the Quality Management System Documents. The frequency of these checks shall be no less than once per month, and shall be summarized in a report to the CPTAC Program Management.

1.1.9 Task 9: Reporting

The Contractor shall develop reports designed to meet the throughput and quality metrics for the CPTAC

Program. A number of metrics regarding clinical meta‐data, biospecimen management, and tumor proteomics/genomics have already been identified, will be shared with the Contractor after contract award, and shall serve as a basis for a portion of the quality management reports. The COR will work with the Contractor to approve all report formats, content, and frequency. These reports will need to be an additional component of the QMS IMS. The reports will be tabulated information with graphical summaries and electronically accessible via the IMS.

The CPTAC Program Management are required to provide program updates to the NIH leadership on a routine basis, therefore, the Contractor shall work with the COR to establish the appropriate type, format, and frequency of reports to generate. At a minimum, throughput and data quality reports shall be provided to the CPTAC Program Management every fourteen (14) days, in accordance with the

Program reporting requirements. Additionally, the Contractor may be requested to generate reports concerning the real‐time status of data quality.

1.1.10 Task 10: Transition Tasks

The Contractor shall provide services to coordinate and integrate transition tasks. The transition plans shall include a plan for transitioning all the duties and responsibilities of the Contractor, to include assessments, reporting, and training, as well as a plan to migrate the information management system.

1. Provide a Transition‐In Plan, if required, for the coordination and implementation of the orderly, secure and efficient transition of all activities, materials, data and other documents from their predecessor.

a. The Transition‐In Plan shall describe the Contractor’s strategy for the transition of work from the incumbent Contractor to ensure continuity of services and must include plans for provision of key personnel; transfer of relevant files, records and materials to a secure server or storage space; and the transition of all activities.

2. Establish a Transition‐Out Plan, if required, for the transfer of contractual activities and products to a successor contract in conjunction with the COR.

a. The Contractor shall define a plan for transitioning the QMS to another entity at the end of the contract. To fulfill this task, the Contractor shall provide a detailed Transition‐Out Plan for transitioning all activities, information systems, data and records to the Government The draft and final Transition Plans shall include, but are not limited to the following elements:

QMS Processes

Review of current artifacts

QMS recurring artifacts

IMS hosting, administration, and reporting

Audit processes

Staff training for the new Contractor

A draft transition plan shall be submitted to the COR and CO ninety (90) calendar days before the end of the contract. The COR will review the plan and provide comments to the Contractor within fifteen (15) calendar days after receipt. A final version of the plan shall be provided to the COR and CO thirty (30) calendar days prior to the end of the contract. The transition period shall be the last thirty (30) calendar days of the contract. The Contractor shall perform the entire Statement of Work during the thirty (30) calendar day transition period in addition to the transition‐out activities

1.1.11 Task 11: Monthly Status Reports and Final Report

At a minimum, the Monthly Status Reports (MSR) shall include:

Activities completed

Activities planned for the next month

Issues to be addressed

Actual Cost vs. Projected Cost (monthly and cumulative)

Additional sections and topics may be added as identified by the Contractor or the Government.

A final report shall be submitted on or before the expiration date of the contract. This report is to include a summation of the work performed and results obtained for the entire contract period of performance. This report shall be in sufficient detail to describe comprehensively the results achieved.

1.1.12 Program Management

Travel

It is expected that the Contractor will need to travel to the sites of the two (2) BCRs (Grand Rapids, Michigan and one (1) location to be determined) and the DCC (location to be determined) on multiple occasions during the requirements phase, the training phase, and for auditing. The Contractor shall also travel to each of the GCC, PGDACs PCCs, and PTRCs.

Place of Performance

The work shall be performed at the Contractor’s facilities. It is anticipated that the Contractor’s Key

Personnel will need to meet multiple times per month with the Office of Cancer Clinical Proteomic

Research via teleconference and occasionally at the NIH campus.

Section 508 Standards

The following Section 508 standards are applicable to this Statement of Work (SOW):

1194.21 Software Applications and Operating Systems

1194.22 Web‐Based Internet and Intranet Information and Applications

1194.31 Functional Performance Criteria

1194.41 Information, Documentation and Support

1194.24 Video and Multimedia Products

Applicable IT Clauses and Requirements

All IT systems development or enhancement tasks supported by the Contractor shall follow the HHS

Enterprise Performance Life Cycle (EPLC) framework and methodology. Information about EPLC policy and framework is available at http://www.hhs.gov/ocio/policy/2008‐0004.001.html and http://www.hhs.gov/ocio/eplc‐lifecycle‐framework.pdf. The below IT clauses are applicable to this requirement:

- IT Security Plan, IT risk Assessment, FIPS 199 Assessment, and SC&A)

- HHSAR 352.224‐70 Privacy Act (January 2006)

- HHS‐OCIO Information Systems Security and Privacy Policy

- HHSAR 352.239‐73(b) Electronic and Information Technology Accessibility (January 2010)

- FAR Clause 52.224‐2, Privacy Act (April 1984)

- FAR Clause 52.227‐14, Rights in Data ‐ General (May 2014)

- FAR Clause 52.239‐1, Privacy or Security Safeguards (August 1996)

- Standards for Privacy of Individually Identifiable Health Information (HSPD‐12)

- HHSAR 352.239‐70 Standard for Security Configurations (January 2010)

- HHSAR 352.242‐71 Standard for Encryption Language (January 2010)

- HHSAR Clause 352.239‐72 Security Requirements For Federal Information Technology Resources

- Requirements for LOSS AND/OR DISCLOSURE OF PERSONALLY IDENTIFIABLE INFORMATION (PII)

‐NOTIFICATION OF DATA BREACH