Attachments_NIH-16-012025_PDTFAB.pdf

List of attachments in Section J of the Combined Synopsis/Solicitation NIH-16-012025_PDTFAB

Attachment Statement of Work (with and NIH Security Enclosures)

Attachment 2: Pricing Table

Attachment 3: Task Order One (1) Request for Quotation

Attachment 4: Summary of Related Activities

Attachment 5: HHS Section 508 Product Assessment Template

Attachment 6: Proposal Summary and Data Record, Attachment 7: Small Business Subcontracting Plan

Attachment 8: Disclosure of Lobbying Activities, OMB form SF-LLL

Attachment 9: Invoice Instructions for NIH Fixed Price Contracts NIH (RC)-2

Attachment Past Performance Questionnaire

Attachment 1: Statement of Work

Attachment 1

STATEMENT OF W O R K

Project Title: Post Development Testing of the Functional Assessment Battery

Department: Rehabilitation Medicine Department, Clinical Center, National Institutes of Health

1.0 INTRODUCTION/BACKGROUND

The National Institutes of Health (NIH) Clinical Center (CC) Rehabilitation Medicine Department (RMD) performs cutting edge rehabilitation research and provides high quality rehabilitation services for patients with complex medical conditions. The Department initiates, collaborates in, and supports biomedical research conducted at the CC. The Epidemiology and Biostatistics (E&B) Section plays an important role in providing consultative support to researchers in the Rehabilitation Medicine Department, the Clinical Center and other NIH Institutes. The Epidemiology and Biostatistics Section's mission is to improve the lives of individuals with disabilities and their families by conducting meaningful, high quality research in three main areas: 1) health services, 2) health outcomes, and 3) public programs and health policies. We accomplish this mission through our extensive and innovative research portfolio and by supporting the statistical needs of RMD staff, addressing departmental data management and security issues, and providing training for the next generation of health services researchers.

The Section's capabilities are extensive because it is staffed to perform the broadest range of population based studies.

This Statement of Work (SOW) supports the research efforts of the RMD E&B Section. The specific area of focus for the services solicited is post-development testing of a tool known as the Functional Assessment Battery (FAB), created via our partnership with the Social Security Administration (SSA).

In August of 2007, the Social Security Administration (SSA) approached the National Institutes of Health (NIH) for advice on new technologies, diagnostic tools, and novel assessment methods that might inform their disability evaluation process. A resulting interagency agreement between the SSA and the NIH CC RMD highlighted two objectives that NIH would address:

analysis of existing SSA data and assessing the feasibility of developing Computer Adaptive Testing (CAT) instruments that could be integrated into the SSA's disability evaluation processes. Rapid assessment methods are needed that are compatible with SSA processes and that will yield easily interpretable results that can be efficiently and meaningfully integrated to provide accurate and uniform information about an individual's ability to engage in substantial gainful employment. Item Response Theory along with CAT technology has been used to support achievement of these objectives.

Developing CAT instruments for the purposes of examining capacity to work requires comprehensive assessment of individuals' functional abilities across a variety of domains (such

FINAL 6/1 1

as physical activities, basic and instrumental activities of daily living, and applied cognition) in relationship to functional demands in the workplace and features of the workplace, home, and community environments. technology is highly efficient by tailoring question administration to each respondent and reducing burden, yet producing a standardized score useful for outcome comparison. This approach permits use of a comprehensive range of questions capturing functional activity domains relevant to work.

Since the inaugural CC RMD IAA, NIH has been collaboratively developing an assessment instrument premised upon IRT/CAT methodology. A prototype called the Work Disability Functional Assessment Battery (WD-FAB) has been developed and captures self-reported functional outcomes in seven functional activity sub-domains.

2.0 O B J E C T I V E

The Objective of this effort is to continue with the development of the assessment tool prototype, WD-FAB, to examine and/or enhance the scientific rigor, refine and/or expand the scope of the instruments' item banks, translate the WD-FAB into other languages, while keeping its scientific integrity, develop and propose work necessary to aid in the development and design of instrument items and/or applications to assess work place functional demands. The ultimate goal of these combined efforts is to create an assessment instrument that is capable of being integrated into federal agency computing environments.

3.0 SCOPE OF W O R K

The contractor shall provide all resources necessary to accomplish the task(s) as described in the SOW. This SOW seeks to identify a contractor with substantial expertise in developing and testing computerized adaptive testing instruments designed to evaluate the functional abilities of adults relative to performance requirements for substantial gainful employment. This contractor wil l work collaboratively with NIH to develop and conduct rigorous testing of the WD-FAB instrument.

In collaboration with the NIH, the contractor wi l l develop a comprehensive and rigorous agenda to scientifically examine the WD-FAB; develop and propose detailed study designs; and, conduct scientific studies following approval of proposed study design. In addition, the contractor wil l be responsible for creating and testing data collection software platforms and developing a full systems integration strategy that includes instrument deployment and testing in the SSA computing environment. The contractor must actively engage and contribute to the dissemination of project findings.

Study design and development may take place at the contractor's location, although the contractor wi l l need to work closely with and the SSA staff via teleconferencing, electronic correspondence, and occasional face-to-face meetings at the NIH and/or the SSA to ensure that project objectives are met.

While collaboration with the NIH is required and the government reserves the ultimate right to approve or deny proposed studies, the awardee shall independently scope, design, and detail the

FINAL 6/1 2

studies required to test the psychometric properties of the FAB as well as any studies of FAB implementation for NIH review and approval. The Contractor shall include in their proposed study design, fundamental elements such as defining relevant sample populations, including approaches to access and recruit those populations, proposed sample size and associated power calculations.

4.0 REQUIREMENTS/TASKS

The Government anticipates awarding an Indefinite Delivery/Indefinite Quantity Contract with a 12 month base period and four (4) 12 month option periods. Funding is obligated only by the issuance of Delivery/Task Orders, sometimes referred to as Work Assignments.

Work may not commence without the issuance of a Delivery/Task Order.

The following Services/Task Areas are required to successfully deliver the objectives.

Services/Tasks are to be performed in accordance with the highest professional standards.

Specific Tasks Areas

The activities for which task orders may be issued include, but are not limited to the following:

Task Area 1: System Security

Demonstrate compliance with federal information security mandates, standards and requirements

Task Area 2: Study and Analytic Design

Develop and propose studies and analysis to comprehensively examine and/or enhance the scientific rigor of an existing CAT instrument, the WD-FAB. Develop and propose work necessary to aid in the development and design of instrument items and/or applications to assess work place functional demands. The contractor must contribute to the leadership and management of all aspects of studies selected for implementation.

Task Area 3: Software and System Integration

Develop and test project-specific software. Develop, propose, test and implement studies intended to integrate the developed instruments into federal agency computing environments/business practices.

Task Area 4: Dissemination

The contractor must contribute to the development and creation of project-related publications/communications/presentations.

FINAL 6/1 3

Task Area Objectives and Evaluation Criteria:

Area 1: Study and Analytic Design

Task Area 1.1. Item replenishment. The objective of this requirement is to refine and/or expand the scope of the instruments' item banks used to classify function across the entire range of human functioning. This requires conducting a field test to assess the performance of legacy and new items; reporting and interpreting raw data as regards performance; and proposing addition or deletion of survey items. New items should complement existing items to ensure complete and well-rounded evaluation of human function as relates to work capacity. In advance of beginning replenishment, the contractor must submit a proposal for completion of this work, which must provide information regarding participant recruitment, data collection, data analysis, and data interpretation, as well as a time line for completion of the activities proposed.

Task Area 1.2. The objective of this requirement is to translate the WD-FAB into other languages. At the request of the Government, the Contractor must submit a proposal for Government approval describing the process for translation of the WD-FAB into another language. The contractor may suggest languages into which they are capable of translating (e.g., Spanish, etc). The proposal must provide for preservation of scientific validity of assessment instruments in the new language as well as a time line for completion of the activities proposed.

Task Area 1.3. The objective of this requirement is to develop scientific studies and analysis related to the existing WD-FAB as well as studies related to quantifying the functional demands related to work and within specific occupations. After receipt of Request of Task Order Quotation, the contractor is expected to collaborate with the NIH to create and submit for approval, proposals describing study design and analytic process for psychometric studies that assess the performance of existing WD-FAB items. Examples of other potential studies include assessments of cultural sensitivity, user simulation studies, and demonstration projects. Other types of studies that may be issued as task orders under the current requirement include studies of aberrant WD-FAB response patterns. The contractor is expected to present to the Government proposals that outline the study design as well as provide a time line for completion of the activities proposed.

The contractor is expected to use their judgement and substantive expertise in testing methodology and study design to propose and design studies for the, Government's approval. The contractor should propose the methods that it believes appropriate to the study question within the Government Issued Request for Task Order Quotation. Should the contractor believe that gathering matter expert opinion is crucial to resolving questions related to FAB development, contractor may propose study designs that including in-person meetings of subject matter experts, e.g., Delphi processes, or remote conferencing actions.

The Government expects to have at least one study proposal in the queue at all times. The proposal must provide the amount of hours and labor mix that the contractor proposes to be necessary to perform the study developed under this task. Each proposal will be evaluated for merit and price reasonableness.

FINAL 6/1 4

Task Area 1.4: Analytic services and study execution. The objective of this requirement is to perform approved studies developed under Task 1.3. Studies developed under Task 1.3 may be broken up into separate tasks to be implemented as necessary to complete the project.

Task Orders awarded under Task Area 1 will be considered The contractor is expected to propose a project length and necessary Period of Performance suitable to complete the work, subject to review and approval of the Government.

Area 2: Software and System Integration

Task Area 2.1: Software coding and testing. The objective of this requirement is to provide the code necessary to run CAT instruments, including validated code for any new proposed items developed under task 1.3.

Task Area The objective of this requirement is to propose methods for integrating WD-FAB into federal agency computing environments/business practices. The contractor is expected to collaborate with the NIH to create and submit for approval proposals for studying the implementation of WD-FAB into the federal agency computing environments/business practices.

The contractor is expected to present to the Government proposals that outline the study design as well as provide a time line for completion of the activities proposed. The contractor is expected to use their judgement and substantive expertise in analytics and study design to propose and design studies for the Government's approval. The proposal must provide the amount of hours and labor mix that the contractor proposes to be necessary to perform the study developed under this task. Each proposal will be evaluated for merit and price reasonableness.

Task Integration services. The objective of this requirement is to perform approved studies and implementation activities developed under task 3.2. Activities developed under Task

3.2 may be broken up into separate tasks to be implemented as necessary to complete the project.

Task area 3: Dissemination

Task Area 3.1: Travel. The of this requirement is to provide for contractor travel to present at appropriate forums for results presentation and dissemination. This may include travel to meetings and/or conferences for presentation of seminal results.

Task Area WD-FAB Administration Manuals. The objective of this requirement is to create manuals that describe in detail how to administer the FAB. The goal of the manuals is to provide sufficient detail for parties not involved in FAB development to successfully administer the instrument to their populations of interest.

Additional task areas may be added as required by the government in support of this vehicle.

6.0 K E Y PERSONEL MINIMUM QUALIFICATIONS

FINAL 6/1 5

Mandatory requirements: Key Personnel must submit in their resume assurance that they meet the minimum qualifications of education and experience required for the position as stated below:

• Program Manager (Principle Investigator) o At least 5 years' experience developing, analyzing and building

Computerized Adaptive Testing (CAT) instruments o A PhD in a field related to Disability Research, Medicine and/or Physical or Occupational Disability Therapy.

o At least 5 years' experience managing for efforts in building Computerized Adaptive Testing (CAT) instruments o At least a Bachelor's degree in a field related to Disability Research, Medicine and/or or Occupational Disability Therapy.

The vendor must provide evidence of having developed at least one Computer Adaptive Testing instrument designed for the assessment of human functioning. At least one of the Contractor's KEY PERSONNEL must have authored a peer-reviewed published manuscript in a scholarly documenting instrument development.

7.0 D E L I V E R A B L E S

The desired outcome of the contract is to conduct comprehensive and rigorous examination of the WD-FAB; support integration of the WD-FAB into the federal environment and business practice; and, enhance utility of the WD-FAB by supporting efforts such as translation into other languages. Target attainment wil l be assessed by the contracting officer's representative following review of task order deliverables.

Deliverables shall be submitted electronically to the Contract Officer's Representative (COR) (to be determined at time of award).

Deliverable number

End result/deliverable Required by date Description

1 SSA Suitability Clearance letter

• Within 5 business of award

• Contractor must make contact with necessary SSA point of contact to begin security clearance

2 NIH Authorization to Operate (ATO)

• Effort must begin within 5 business days of award, and completed within 3 months of award.

• Contractor must begin good faith efforts to obtain an additional ATO from the NIH should the original ATO submitted with the proposal be with another agency.

3 Invoice • Monthly within 5 days the of each month.

• Each Task Order invoice wil l be sent as a hard copy to OFM, and pdf emailed to the CS and COR.

FINAL 6/1 6

4 Minutes from phone call conferences

• Within 5 days of each call.

• Shall include minutes from each bi-monthly phone call

5 Task Order summary • Monthly within 5 days of the 1 s t of each month

• Task Order summary spreadsheet with deliverables and progress notes.

5 End of Task Order Report • days ot completion of Task Order deliverables.

• Shall include total amount invoiced under the Task Order and the Statement "Final invoice for Task Order has been submitted, all invoicing is completed."

8.0 PERIOD OF PERFORMANCE / P L A C E OF PERFORMANCE

Period of performance of this Contract will include a month base period and four (4) month option periods and is estimated as follows:

Base Period: September 12, through September Option Period One (1): September 12, 2017 through September 2018 Option Period Two (2): September through September Option Period Three (3): September 12, 2019 through September 2020 Option Period Four (4): September 12, 2020 through September 2021

I f all Options are exercised, the Period of Performance is anticipated to begin September 12, and extend through September

Contract employees working under this contract shall be paid only for hours actually worked at the fixed hourly rates established in the contract. Payment to the contractor will not be made for temporary work stoppage due to circumstances beyond the control of the agency, such as acts of God, inclement weather, power outages, or temporary closing of facilities.

Place of performance to be announced and travel requests shall be included in individual Task Orders.

9.0 GOVERNMENT FURNISHED EQUIPMENT / S E R V I C E

The Offeror shall have the responsibility to furnish any materials and equipment necessary for the performance of the work required. Should government furnished equipment/service be specified in individual delivery and Task Orders, accountability procedures will also be specified.

The Government will provide Government Furnished Information, program documentation, and access to key organization and project management personnel, as required, for performance of this award.

FINAL 6/1 7

All work including analyzed research outcomes and production of manuscripts, abstracts, chapters and posters remain the property of the Federal Government. Al l data generated under this contract shall be the sole property of the Government.

10.0 S E C U R I T Y

NIH is a restricted campus. An identification badge is required for access for entry into buildings and also is shown to the Security Police/Sentry when entering the campus. Should the contractor be required to access the main NIH campus for execution of contract duties at any point, contractor is required to comply with all necessary NIH identification and access requirements, including inspection of private vehicles should the contractor drive on to the campus.

Since the contract employee(s) under this contract have access to and/or process information requiring protection under the Privacy Act of 1974, these positions are considered "IT Sensitive" positions. Compliance with Executive Order (EO) and OMB Memorandum M-05-24 are mandatory. Therefore, a National Agency Check for Trustworthiness (NACT) is required for each contract employee(s) under this contract. Each individual fingerprinted and required to complete the appropriate forms, usually a Standard Form 85-P, Questionnaire for Public Trust Positions. The contractor is responsible for obtaining the Standard Form 85-P, Questionnaire for Public Trust Position. The contractor shall advise their employees that a favorable report is required as a condition of employment under this contract. The contractor shall apply for the NACT within three (3) workdays after start of performance for each contract employee. The government will be responsible for all costs associated with the NACT. Offerors shall be advised adjudication constraints may prevent non-U.S. Citizens from performing in a timely manner. No waivers will be contemplated.

11.0 QUALITY CONTROL / QUALITY ASSURANCE S U R V E I L L A N C E PLAN

The contractor shall have a planned and systematic quality control process and Quality Control Plan (QCP) covering every aspect of the contractor's operation under the contract/task order, as applicable. Contractor shall implement its QCP for monitoring, analyzing, and improving quality, management and compliance with contract performance standards. The QCP shall specifically address and correct deficiencies identified by the contractor or which are brought to its attention by the Government.

The performance by the contract employees, the quality of services rendered, and any documentation or written material in support of same, will be subject to surveillance.

13.0 T R A V E L

Contractor wil l be required to travel during the performance of this contract to attend meetings, conferences, training, and to deliver services. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this SOW. Contractor wil l be authorized travel expenses consistent with the substantive provisions of the Federal Travel Regulation (FTR) and the limitation of funds specified in this contract. A l l travel must be

FINAL 6/1 8

proposed as part of the contractor's response to a TORFQ, and requires Government approval/authorization and issuance of Delivery/Task Order to the Contractor.

14.0 G E N E R A L INFORMATION

Smoking Policies within NIH Campus: The Contractor shall ensure that all employees comply with Tobacco Free Campus smoking policies while performing services under this contract. The use of all tobacco products (including cigarettes, cigars, pipes, smokeless tobacco, or other tobacco products) is prohibited at all times in all buildings and on all outside property or grounds, including parking areas on the NIH Bethesda Campus.

Safety: The Contractor employee shall be responsible for knowing and complying with all installation safety prevention regulations. Such regulations include, but are not limited to, general safety, prevention, and waste disposal.

Patent Rights: The Government retains a Government use license to all inventions arising from this work. The Government has unlimited rights to all documents/material produced under this contract. A l l documents and materials produced under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. A l l materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

Media Inquiries: The Contractor employee shall not respond to any media inquiries. Any inquiries from the media shall be immediately relayed to the COR and/or CO. There shall be no interviews, comments, or any other response without the knowledge and approval of the NIH Director.

Contract/order type - This requirement wi l l result in award of an indefinite delivery/indefinite quantity contract.

Misconduct or Disruption of Services: At any time during the performance period of this contract, the Contracting Officer or COR may request the Contractor employee be immediately removed from the premises or project i f they determine, at their unilateral discretion, that any of the Contractor employee's actions or impaired state to be a disruption to the workforce.

Productive Direct Labor Hours: The Contractor can only charge the Government for "Productive Direct Labor Hours", which are defined as those hours expended by Contractor personnel in performing work under this effort. This does not include sick leave, vacation, Government or contractor holidays, jury duty, military leave, or any other kind of administrative leave such as acts of God (i.e., hurricanes, snowstorms, tornadoes, etc.), Presidential funerals or any other unexpected government closures. The Government only pays for hours actually worked by the Contractor employee.

Organizational Conflict of Interest: Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary

FINAL 6/1 9

or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests as defined in FAR Subpart 9.5.

The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor's mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

17.0 DEFINITIONS AND ACRONYMS

CONTRACTING OFFICER (CO): A person with the authority to enter into, administer, or terminate contracts and make findings and determinations.

CONTRACTING OFFICER'S REPRESENTATIVE (COR): A Government employee selected and designated in writing by the contracting officer to act as his or her authorized representative in administering a contract. A COR is not authorized to modify a contract or change terms and conditions.

FINAL 6/1 10

Enclosure A

DATA AND PERSONNEL SECURITY

VIII. DATA SECURITY AND SAFEGUARDS .

SSA and NIH CRC/RMD wil l comply wi th applicable l imitat ions on use, t rea tment , and safeguarding of data under the Privacy Act of 1974 (5 § 552a); related Office of Management and Budget (OMB) guidelines; the Federal Informat ion Security Management Act of 2002( 44 U.S.C. § 3541) and related National Institute of Standards and Technology guidelines.

For addit ional in format ion on federal in format ion security requirements, see OMB directives and memoranda (e.g., OMB Circular Appendix III; and OMB memos (M) : M-04-04, M-07-

16)); the EGov Act of FISMA; and the NIST Federal Information Processing Standards (e.g., 199 and 200) and Special Publications (SP) 800 series.

NIH CRC/RMD must also ensure that its contractors and the contractors' subcontractors comply w i t h the

Federal in format ion security mandates, standards, and requirements and include these paragraphs and related paragraphs in NIH CRC/RMD's contracts. NIH CRC/RMD must ensure its contractors ensure tha t their subcontractors, if any, comply w i th the above-cited Federal in format ion security mandates, standards, requirements in protect ing SSA data.

A. Access and Usage Authorization

NIH CRC/RMD wil l restrict access to and use of all SSA data to only those authorized employees and agents (personnel) who need it in connection wi th the work described in this Agreement.

Upon request, NIH CRC/RMD wil l provide SSA's Project Coordinator w i th a list of all personnel w h o have/wi l l have access to SSA data.

B. Records Storage

NIH CRC/RMD wil l protect all SSA data, by storing such in format ion and records in areas tha t are safe f rom access by unauthorized persons.

C. Supervision and Control

All SSA data wil l remain under the immediate supervision and cont ro l of authorized NIH

CRC/RMD personnel in a manner tha t wil l protect the conf ident ial i ty of the information and records. NIH CRC/RMD wi l l fur ther ensure that unauthorized persons cannot retrieve any such in format ion and records by computer , remote terminal, or o ther

D. Safeguards

The safeguards shall provide a level and scope of security that is not less than the level and scope of security established by the Office of Management and Budget (OMB) in OMB Circular

No. A-130, Appendix III - Security of Federal Automated Informat ion Systems, which sets fo r th guidelines for security plans for automated information systems in Federal agencies and OMB

Memos and consistent w i th the E-Government Act, Title Ill-Federal Informat ion Security

Management Act (FISMA) and the National Institute of Standards and Technology (NIST) Federal

DATA AND PERSONNEL SECURITY

Informat ion Processing Standards (FIPS) and Special Publications (SP) 800 series

(ht tp: / /csrc, E. Restrictions on Release

Unless authorized under this Agreement, NIH CRC/RMD wil l not publish, disclose, release, or otherwise grant access to the SSA data covered by this Agreement to any person wi thout f irst obtain ing wr i t ten authorizat ion f rom the SSA signatory to this Agreement or his designee.

F. Reporting Attempts to Gain Inappropriate Access

All NIH CRC/RMD personnel wi l l be instructed to notify their supervisors of any attempts to gain inappropriate access to SSA data, whether by bribery, coercion, or other means, NIH CRC/RMD wi l l repor t any such instance to SSA's Data Custodian, who wi l l , in tu rn , immediately report it to the SSA Systems Security Officer.

G. Disclosure

NIH CRC/RMD acknowledges that an unauthorized release or disclosure of SSA data may violate the te rms of the Privacy Act and 42 U.S.C. § 1306 and subject the individual who disclosed the in format ion to both criminal and civil sanctions. NIH CRC/RMD wi l l in form all of its personnel granted access to SSA data that the release and disclosure of the in format ion may subject the individual who released the informat ion to civil and criminal penalties under 5 § 552a and

42 U.S.C. § 1306.

H. Reporting Theft or Loss of

Federal agencies are required to report incidents involving the loss of to the

Depar tment of Homeland Security's United States Computer Emergency Readiness Team (US-

CERT) wi th in one hour of report ing to the appropriate office and paper Pll incidents to the agency privacy office wi th in one hour of discovering the loss, SSA, in compliance w i th the OMB direct ive, requires the NIH CRC/RMD Data Custodian and all o ther NIH CRC/RMD authorized users of the Pll described in this Agreement to fo l low the procedures below for reporting a loss of o r suspected loss of said Pll to SSA: (1) Immediately notify the SSA Data Custodian; (2) Read the guidelines in At tachment 2 on SSA's policy and procedures for report ing the loss or potential loss of Pll; (3) Complete the Worksheet in At tachment 2 for report ing the loss or potential loss of Pll as soon as possible and send it to the SSA Data Custodian; and (4) Provide updates to the

SSA Data Custodian as they become available, Questions about Data

Whenever the NIH CRC/RMD is uncertain how to handle any SSA data under this

Agreement , NIH CRC/RMD must obtain wr i t ten instructions f rom the SSA Project Coordinator addressing this quest ion.

Suitability

FAR Personal Identity Verification of Contractor Personnel

(a) CRC/RMD ("the Contractor") shall comply with agency personal identity procedures Identified in the contract that implement Homeland

Office of Management and Budget (OMB) guidance M-05-24, and Federal Information Processing Standards Publication (FIPS PUB) Number

The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have physical access to a facility or access to a Federal information system.

PERSONNEL SECURITY CLAUSE -

NATIONAL SECURITY DESIGNATIONS

The regulatory authorities for the personnel security and suitability program In Executive Order (EO), EO and Title 5, Code of Federal Regulations (CFR) Parts 732, and 736, The Computer Security Act of and OMB Circular A-130, Appendix HI, Personnel Security

Contractor personnel are subject to the same personnel security and suitability requirements as SSA employees and must comply the following Personnel Security requirements:

Contractor personnel are considered Federal employees for purposes of applying provisions of the Privacy of )974,.Tax Reform Act of 1976, SSA and section of the Social Security Act on the confidentiality of and disclosure and protection of information entrusted to them.

The provisions of Executive Order 10450, Executive Order 12968 and Title 5 of the Code of Federal Regulations (CFR), parts and 736 require that; "Every competitive, excepted, and contractor position must be designated at a level of that commensurate with the responsibilities and other attributes (policy making, fiduciary, public contact, or public trust) of the position as they relate to the efficiency of the service, and;

All Federal service and contractor employees must be designated, terms of their national security sensitivity, to assure appropriate screening. The required background investigation is conducted to provide a basis for ensuring that the employment of an individual is consistent with the interests of the national security,"

The contractor shall provide the Information required for such background checks and agrees to abide by SSA personnel security and suitability determinations.

The following security requirements may apply to contractor personnel;

The National Agency Check Law and Credit (NACLC) is used as initial for contractors designated at the Level 2 Non Critical-Sensitive, or Level 3 Critical-Sensitive and who require access at the confidential or secret Je.vels, The Single Scope Background Investigation is the required investigation for contractors requiring Top Secret access.

This investigation includes:

National Agency Checks (Security/Suitability Investigations Index

Defense Clearance and Index Fingerprint Classification, and a search the FBI Investigative Index;

(""••Credit search or Records coverage*;

with References with social knowledge of the subject; and

• • L a w checks covering all locations of residence, employment, and education during the last years (depending on the clearance level required) and to locations of admitted arrest.

Each contractor employee designated at these levels must complete and submit the following appropriate forms for this investigation:

SF 86, Questionnaire for National Security Positions, Revised Two ED 258 Fingerprint Cards. (Rev, (The contractor will absorb the costs for obtaining fingerprints); and Credit Reporting authorization form*.

The PCRA, as amended on September requires that each contractor employee(s) be notified, in a document consisting solely of this a consumer report may be used for employment purposes; and that the applicant, employee, or contractor must authorize this use in writing before the consumer report is obtained, Additionally, the FCRA requires that, before taking adverse action based on a consumer the agency must provide the consumer with a copy of the and a copy of the Federal Trade Commission Consumer Rights Notice, To comply with these requirements, SSA requires the subject to sign and submit the FCRA authorization form along with the other investigative documents, Contact the Personnel Security Program Suitability Officer at the number below If you do not have any preprinted forms. Normally the contracting (CO) will provide the forms along with the award document, However, upon request, the above forms are available from the Personnel Security

Program Officer at 965-0594.

The contractor must provide a cover letter the name of employees whose forms are attached along with the contract number and the contractor's contact name and telephone number. The cover letter and attached completed forms must be submitted to the Personnel Security Suitability Program Officer, The Personnel Security Suitability Program Officer's address follows;

Social Security Administration Suitability Program Officer Room Annex

Security Boulevard Baltimore, Maryland 5

Contractors should only select personnel who meet the Government's suitability requirements in order to the likelihood that will be found unsuitable and not allowed to work under contract, possibly disrupting performance on the contract. Contractors may choose to perform similar background checks to those listed herein on being proposed to work on a government contract, Before you perform any checks, it that you contact the Personnel Security Suitability Program Officer at the number above.

Some of the Government's suitability factors are: delinquency or misconduct in employment; 2) criminal, dishonest, infamous, or notoriously disgraoeful 3) intentional false statement, deception, or fraud on application forms; 4) habitual use of intoxicating beverages to excess; 5) abuse of narcotics, drugs, or other controlled substances; and 6) reasonable doubt as to loyalty of the person involved to the Government of the United States. Other faotors that the Government may consider are: 1) the kind of position for which the person is applying or in which the person is employed; 2) the nature and seriousness of the conduct; 3) when the conduct occurred;

4) the applicants' or employee's age at the time of the conduct; 5) the circumstances surrounding the misconduct; 6) contributing social and environmental conditions; and 7) the absence or presence of rehabilitation or efforts towards rehabilitation.

For new contracts with incumbent contractors, the Initial information required for the preliminary investigation the contractor's name, the names of all applicable contractor personnel, and social security numbers for the contractor personnel. The Government may also require the date and place of birth, Current, complete, and accurate information is extremely important the overall investigative Certain contractor may be periodically

The Personnel Security Suitability Program Officer will review and adjudicate each completed investigation and will notify the contractor, CO, and Project Coordinator in writing of the satisfactory determination each contractor employee(s) investigated, When investigative results reflect adverse information, the Security and Suitability Program Officer will the subject for resolution. The Personnel Security and Suitability Officer will notify the contractor, investigation subject Project Coordinator, and CO if a subject cannot meet the requirements necessary for a favorable security/suitability decision and, therefore, may not be to work on the contract, Once the contractor is notified, the employee must be immediately removed from the contract. The contractor must confirm, in writing, the date of the employee's removal to. the Government.

Removal an employee(s) may require that a be named and the appropriate completed as quickly as possible in order that contract performance not be adversely impacted, The contractor should contact the CO if there are any contract performance to the removal. The denial resulting from the or removal of an individual determined unsuitable or unfit does not give rise to an equitable adjustment to the contract, Notes: A final suitability determination may require up to 75 days after submittal of the completed forms, For Secret and Top Secret access, CFR 732 require that the appropriate investigation be completed prior to granting access to classified or sensitive For certain Automated Systems positions, Circular requires the personnel security background screening is completed prior to an individual being authorized access to an SSA In the event that contractor personnel performing on this contract leave the company or are removed from or are either arrested or charged with a crime during the term of this contract, the shall notify the Personnel Suitability Program Officer, CO, and Project Coordinator immediately, the notification, the contractor shall provide the name of the employee(s), the type of court date, and, if available, the disposition of the charge(s), Contractor personnel are responsible for the security of any SSA information, physical resource, or IRS Tax information entrusted to them, and will provide protection in accordance with SSA-established requirements, Security

The purpose of the Plan (SSP) and related information system security authorization documents is to document to SSA's satisfaction that the appropriate actions be taken by NIH CRC/RMD and its contractors to be in compliance with the federal information security requirements for the protection of SSA data provided under this Agreement ("confidential Information"). The SSP and related information system security authorization documents must incorporate entitles and NIH, who be provided access to SSA confidential information, including any contractors and subcontractors, Federal information system security requirements cover all facets of the protection of SSA confidential information, not limited to information in digital format, NIH and its contractors shall conduct a risk assessment, select appropriate management, operational, physical, and technical seourity controls to mitigate risks, develop an SSP and related Information system security authorization documents that provides an overview of the architecture and security requirements of the system that be utilized for the collection, storage, maintenance, transmission, and disposal of confidential information for this Agreement, and conduct seourity control testing to ensure controls are correctly implemented, The SSP and related information system security authorization documents must include the risk assessment and the controls in place or planned for meeting SSA security For any controls not in place or for which NIH CRC/RMD or its contractors select controls, SSP must a rationale and proposed risk acceptance language. For any controls planned, the SSP must and have attached a plan of action and milestones with expected dates of completion and proposed risk acceptance language, SSA cannot provide confidential information to NIH. without first SSA and reviewing the required SSP and related seourity authorization documents and providing the NIH with concurrence operate the system, NIH must ensure that no persons will receive access to any confidential information who have not received SSA suitability clearances. may take up to 30 lendar days to review an SSP and related information system seourity authorization documents', and may return the documents for clarification or correction requiring a of part or all of the SSP and related information system seourity authorization documents.

CRC/RMD may from time to time request revisions to the approved SSP to accommodate changes in business process scope or changing security but NIH must continue to fully any approved SSP pending approval by SSA of any requested changes to that SSP, Because of the changing environment required to protect against various threats to confidential information and also of possible in the execution of work under this Agreement, SSA may define in more detail or change its protection requirements for confidential Information from time to time during the life of this Agreement, When such changes are made CRC/RMD will be notified and a revised SSP may be required from NIH CRC/RMD, and SSA will allow at least 30 days for the submission of the revised SSP, If revised SSP as approved by SSA requires cost adjustments to this Agreement, SSA and NIH CRC/RMD will negotiate any such adjustments in good faith. I f fails to submit an SSP by SSA, or CRC/RMD is unable to submit an SSP acceptable to SSA, or SSA and NIH cannot agree on necessary cost adjustments resulting from a revised SSP, then this Agreement may be terminated without prejudice to SSA.

After SSA approves CRC/RMD SSP and related information system security authorization documents or any revisions, security testing must be conducted by NIH CRC/RMD and the results must be reported to SSA. requires that NIH CRC/RMD and its such security (controls) assessment reports from a third-party. may require updating the SSP and related information system seourity authorization documents, SSA may engage third parties to at SSA's for reviews and inspections, including onsite inspections, and such parties will be treated as if they were SSA

SSA Policy and Procedures for Reporting the Loss or Suspected Loss of Personally Identifiable Information

Social Security's goal is to and protect the personally information (Pll) entrusted to the agency by reporting immediately the loss or suspected loss of Pll to the Department of Homeland Security's United States Computer Emergency Readiness Team (US-CERT), Loss of Pll could involve theft, malicious/deliberate breach or accidental mishandling of in electronic or in paper form, To accomplish our goal of safeguarding SSA requires that ail authorized users of the PII described in this Agreement follow the SSA procedures for a loss or suspected Pll to SSA as outlined below. Examples of include a person's name, date of birth, Social Security number, bank account information, address, health records and Social Seourity benefit data, for the Custodian and all Other Authorized Users of

When you lose or suspect you have lost PH, you must notify SSA immediately, Time is of the essence. Provide updates to your supervisor/manager as they become available, but do not delay your initial report to SSA, Please provide SSA with complete and accurate information about the details of the loss or possible PII loss, Use the attached Worksheet to document the following information about the

a. Staff personnel and area involved in the incident,

b. SSA custodian/contact information, A description of the loss or suspected (e.g., nature of loss, number of files or records and type of equipment or media) including the approximate time and location of the Joss, How was the data physically stored, packaged and/or contained password protected, encrypted, locked briefcase, personal etc)?

Have any individuals or external organizations other agencies, law enforcement or the press) been contacted or contacted you?

f. Have any other reports (e.g., local police, report to SSA) been filed?

Any other pertinent information.

Send the completed Worksheet to SSA and any other parties described in the Agreement or directly involved as soon as possible,

3. The information and details about an Incident are sensitive and you should share them only with those who have a need to know,

4. Provide updates to the SSA custodian as they become available.

Attachment 2, continued

Worksheet

Reporting Loss or Potential Loss of Personally Identifiable Information

Information about the individual making the report;

Name:

Position;

Organization;

Work: | Home/Other: | E-mail Address:

Check one of the

Management Official Security Officer Non-Management |

2. Information about the micro that was

Which of PII t re data contain?

Name Bank Account Info SSN Medical/Health Information of Birth Benefit Payment Info Place of Birth Mother's Maiden Name Address (describe);

Estimated volume of records

3. How the data was physically stored, packaged and/or contained? Paper or Electronic?

(circle one):

Laptop Tablet Backup Tape Workstation Server CD/DVD Blackberry Hard Drive Floppy USB Drive

Blackberry

Other (describe):

Yes No Not Sure

a. Was the device b, the device password protected?

If a laptop or tablet; was a VPN lost?

Cardholder's Name:

Cardholder's SSA logon

Hardware. Serial Number;

Worksheet - continued

Additional Questions i f Paper;

Yes Not Sure a, Was the information in a briefcase?

b. Was the Information in a cabinet or drawer?

c, Was the information in a looked vehicle trunk?

d, Was the information redacted?

Other circumstances!

4, I f the employee/contractor who was in possession of the data or to whom the data was assigned not the person making the report (as listed in information about this

Name:

Position:

Organization;

Phone Numbers:

Work: Cell: j E-mail Address:

5. Circumstances of the

a. When was it b, Brief description of how the loss/theft

When was it reported to the SSA custodian (time/date, SSA custodian name/title/component)?

6, Which reports have been filed? (include police, and report to SSA)

Report Filed Yes No Report Number Federal Protective Service Local Police

Yes No Report to SSA Other (describe)

7. Other pertinent information (include actions under way, as well as any contacts with other agencies, law or the

Enclosure B

NIH Information and Physical Access Security Acquisition/Solicitation Language

Rev. -

1. FEDERAL INFORMATION AND INFORMATION SYSTEMS SECURITY:

Include when contractor/subcontractor personnel will (1) develop, (2) have the ability to access, or (3) host and/or maintain Federal information and/or Federal information system(s). For additional information, HHS Information Security Program Policy at:

rity and

HHS Contractor Oversight Guide:

a. Information Type

[ ] Administrative, Management and Support Information:

[ X ] Mission Based Information:

Since the inaugural CC RMD IAA, NIH has been collaboratively developing an assessment instrument premised upon IRT/CAT methodology. A prototype called the Work Disability Functional Assessment Battery (WD-FAB) has been developed and captures functional outcomes in seven functional activity sub-domains. No PHI/PII data for the prototype.

b. Security Categories and Levels

Confidentiality Integrity Availability

Level: [ X ] Low Level: [ X ] Low Level: [ X…