NIA Clinical Unit Onsite Lab Services - Statement of Work - GINC.pdf

Statement of Work (SOW)

A. GENERAL INFORMATION

1. Title of Project: Reference clinical laboratory services for the National Institute on Aging

(NIA) Clinical Unit.

2. Background Information: The National Institute on Aging (NIA), one of the 27 Institutes and Centers of NIH, leads a broad scientific effort to understand the nature of aging and to extend the healthy, active years of life. The Intramural Research Program (IRP) of the National Institute on Aging (NIA) provides a stimulating setting for a comprehensive effort to understand aging through multidisciplinary investigator-initiated research, in this regard.

One of the IRP's program activities includes the Clinical Research Core (CRC) part of the NIA Clinical Unit within the Office of the Scientific Director. The CRC seeks to elucidate normative values and separate normal aging findings from disease states. The CRC’s goal is to prolong disease-free states with age. The CRC serves as an infrastructure to facilitate the creation and development of therapeutic targets for the treatment of age-related disease across the Intramural Research Program. The CRC performs research that has direct clinical applications to aging and disease states and, as such, collects participant specimens depending on the testing procedures required per protocol study. The NIA CRC requires reference clinical laboratory services that provide tests results of participant specimens, some required with a short turnaround time. The lab results must be provided with a short turnaround time because the test results determine which research tests may be performed safely on the participants. For some research tests, the lab tests are taken and results provided on the same day. The lab results become official documentation of the participant’s medical record.

3. Purpose or Objective of the Requirement: The purpose of this requirement is to obtain reference clinical laboratory services as stated in the incumbent’s Directory of Laboratory Testing Services. The list of services may be modified. The contractor shall provide all resources necessary to accomplish the tasks and deliverables described in this Statement of Work (SOW).

4. Type of Contract Contemplated: Purchase Order, Open Market, and the expected value will be provided (inclusive of options).

5. Period of Performance: The period of performance is twelve months (12) from the date of award, plus four (4) one-year options.

B. CONTRACTOR REQUIREMENTS (SCOPE OF WORK)

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the tasks as specified herein. Specifically, the contractor shall:

The Contractor shall be responsible for performing pre-analytic processing, analysis, and result interpretation for clinical and anatomical pathology specimens as requested by the NIA Clinical Unit physicians. Services shall include the transportation of clinical laboratory specimens to the contractor’s laboratory(ies) if off-site from the NIA Clinical Unit (including providing the shipping/pickup containers), the performance of analytical testing as defined by the Contractor’s reference test manual, the reporting of analytical test results and consultative services as required to assimilate the full scope of its laboratory operations to the ordering facility.

• Specimen Pick-up and Report Delivery: Laboratory will provide a reference specimen pick-up and report delivery service daily Monday-Friday of each week and on the evening shift (3pm- 11pm) on Memorial Day and Labor Day. The remaining holidays do not require lab services and shall include: New Year’s Day, Independence Day, Thanksgiving Day, and Christmas Day.

• Turnaround Time (TAT): Laboratory shall deliver or transmit results of a routine nature (general routine chemistries) to NIA within specified timeframe (to be determined in agreement with NIA upon award). Some lab results, as specified by NIA, to be provided to NIA on the same day the specimen is received by the Laboratory’s testing facility. The Laboratory must make reasonable efforts to transmit or deliver results of tests performed on specimens of a special nature (special chemistries, tissues, etc.) to NIA within the times set forth in the Laboratory’s then current turn-around-time schedule and as agreed upon with

NIA.

• Specimen Collection and Handling Requirements – Price list must indicate whether test demographic information is available upon request in either hardcopy or electronic format, listing any e-mail addresses or web links necessary to obtain the Requirements.

• Sample Preparation: Each ordering activity will prepare (collect and handle) and package laboratory specimens in accordance with the requirements defined in the Contractor's commercial specimen collection guide. The packaging and transportation procedures must be of a quality that ensures the integrity of the specimen throughout the shipment process.

• Proper tracking of specimen: Tracking must be maintained from the initial pickup/shipping of the specimens from the ordering activity throughout the testing process at the Contractor’s laboratory.

• Consultation: Laboratory staff must be available to consult with NIA in person or by telephone during normal Laboratory working hours to discuss laboratory procedures and to provide the status of test results. The Contractor shall provide telephone number(s) and contact personnel to be used by the ordering activity to address questions regarding their commercial services. The Contractor shall include names and telephone numbers of technical directors and pathologists available for consultation.

• Testing: The testing methodology and reference ranges for a test must be defined in the laboratory user manual. The Contractor shall advise facility of any changes in methodology, procedure, reference ranges and any new tests introduced no later than two weeks prior to test change implementation.

In the event that the Contractor discontinues and/or substitutes a new test, the Contractor shall notify the NIA Project Officer prior to the intended change. Any such change may be sufficient cause for changing to an alternate contractor for the assay(s) for the duration of the contract at the sole discretion of the Project Officer.

All clinical reference laboratory testing shall be executed in accordance with standard industry practices. All test methods shall be FDA approved. Any non-FDA approved method being performed shall have a documented validation plan. Upon request the validation plan and validation results shall be made available.

Test Result Reporting: A report is defined as a final copy of laboratory testing results. This report shall be received by remote terminal where applicable. If results are previously telephoned, the report must include the name of the individual notified of the results. Each test report shall include all information as required by Regulatory Agency Requirements.

Contractor shall provide test results via one of the following methods:

1. In-person

2. Fax transmission

3. The vendor will provide laboratory results by the below methods:

o Access to the Contractor’s computer system by the ordering facility, i.e. web-site, installation of software on the Government computer, installation of Contractor hardware with required software;

o Inter-connectivity between Contractor computer system and Government computer system, i.e. results are automatically transmitted from the Contractor computer directly into the Government computer system without human intervention (i.e. HL7 Transfer).

o Ensure electronic transmission and technical details of security settings provided by NIA.

o Lab results are available electronically and provide ability to generate reports.

All completed and/or partial test results shall be reported to the ordering activity within awarded Turnaround Time (TAT), except where specified. Contractor shall provide all required hardware and software (including installation) and related consumable supplies to support the transmission of electronic data for each ordering activity at no additional charge.

Any necessary “additional required connections” shall be the responsibility of the contractor.

All equipment, software and hardware remain the property of the contractor.

• Critical Tests: The Contractor shall immediately telephone the NIA physician or requesting Clinician to report Critical Value or test results that may indicate a life-threatening condition.

Appropriate notification information will be provided at the time of task order award.

• Procedure Guidance: The Contractor shall make available, either through its electronic catalog or upon request, the following information:

o Specimen collection and handling requirements;

o Test reference intervals adjusted for ages, sex, or race, when required;

o Test specific sensitivity, specificity, and interferences, when required;

o Result code (electronic transmissions only);

o Test critical values, if any; and o Location of test performance by test name (i.e. name of primary laboratory, name of separate branch division of primary lab, name and address of secondary/subcontracted laboratory must be cited).

• Documentation: The Contractor shall ensure that all required documentation is, at a minimum, timely, legible, and accurate. Contract personnel shall indicate responsibility for the content and accuracy of all prepared and transcribed reports. The Contractor shall have a system in place to identify the personnel performing the test analysis.

• Retention of Specimens: Upon completion of the testing, the Contractor shall retain all specimens as required by regulatory agencies.

• Utilization Reports: The Contractor, upon request, shall provide to each ordering activity, at a minimum, the utilization reports customarily provided to commercial customers. The report shall, at a minimum, identify the test code, test name, YTD volumes, unit cost, YTD expenditures, and turnaround times.

• Price List: The price list should include Medicare allowable costs.

• Contract Quality Assurance/ Quality Control: The Contractor facilities, test methodologies

(defined as the principle of the method), validation studies, and quality control information may be examined by representatives of the Government at any time during the life of the contract.

The Contractor shall comply with all applicable OSHA, Federal, State, laws, and regulations as required for performing the type of services required.

• HIPAA Compliance: Incumbent acknowledges it is a “covered entity” under the Health and Portability and Accountability Act of 1996 (HIPAA) and agree to comply with the requirements thereof, as well as all other applicable laws and regulations pertaining to patient privacy.

• Licensing and Accreditation: Only fully licensed/accredited laboratories actively engaged in providing the specific services and laboratory testing outlined in this solicitation will be considered. The Contractor must continuously hold a Certificate of Compliance or Certificate of Accreditation from the Centers for Medicare and Medicaid Services as meeting the requirements of the Clinical Laboratory Improvement Amendments of 1988 or must demonstrate accreditation by a regulatory agency with deemed status from the Centers for Medicare and Medicaid Services, e.g. The College of American Pathologists, and/or other state regulatory agencies, as appropriate, and as mandated by federal and state statues. The

Contractor must maintain valid certifications throughout the performance period of this contract.

The Contractor shall provide a copy of all relevant permits/licenses and certifications inclusive of any sanctions current or pending throughout the United States of America prior to contract award. In addition, the Contractor shall be responsible for providing a written guarantee or evidence that all subcontractors have appropriate licensure and accreditation to perform tests that the primary contractor cannot perform prior to contract award.

The Contractor shall maintain current accreditation and notify the Contracting Officer of any lapse in state license, CLIA certification, or clinical pathology certification. The Contractor shall provide a copy of the renewed licenses/certificates to the Contracting Officer before expiration. Immediate (within 24 hours) notification must be given to ordering activity upon adverse action by a regulatory agency.

• Malpractice Liability Insurance: Malpractice liability insurance shall be by a commercial insurance company in the business of providing the required insurance coverage of not less than $1,000,000.00 per occurrence. The Contractor shall provide a copy of the Medical Malpractice Insurance Certificate before award of the contract.

The Contractor shall notify the contracting officer in writing of any malpractice investigation or licensure or certification suspension which concerns the Contractor or any employees, within 24 hours of notification of an investigation or suspension.

C. GOVERNMENT RESPONSIBILITIES

• NIA will grant the incumbent access to the Clinical Unit located in the Baltimore metropolitan area when specimens are picked up, if the vendor is located off-site.

D. DELIVERY OR DELIVERABLES

1. Description of Tasks and Associated Deliverables: Hard copies of test results are to be provided within 4 hours of specimen pick-up from the NIA.

E. TRAVEL

Not applicable.

F. CONTRACTOR EXPERIENCE REQUIREMENTS – KEY PERSONNEL

G. SECURITY REQUIREMENTS

ARTICLE H. NIH INFORMATION AND PHYSICAL ACCESS SECURITY

This acquisition requires the Contractor to:

• Develop, have the ability to access, or host and/or maintain Federal information and/or

Federal information system(s).

• Access, or use, Personally Identifiable Information (PII), including instances of remote access to or physical removal of such information beyond agency premises or control.

• Have regular or prolonged physical access to a “Federally-controlled facility,” as defined in FAR Subpart 2.1.

The Contractor and all subcontractors performing under this acquisition shall comply with the following requirements:

a. Information Type

[X] Administrative, Management and Support Information:

C.2.8.9 Personal Identity and Authentication Information

[X] Mission Based Information:

D.19.1 Scientific and Technological Research and Innovation

D.20.1 Research and Development

b. Security Categories and Levels Confidentiality Level: [ ] Low [X] Moderate [ ] High Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level: [ ] Low [X] Moderate [ ] High

Overall Level: [ ] Low [X] Moderate [ ] High

Position Sensitivity Designations

The following sensitivity level(s), clearance type(s), and investigation requirements apply to this contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (BI).

[X] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[ ] Level 1: Non-Sensitive Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Agency Check and Inquiry Investigation (NACI).

The Contractor shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Project Officer, with a copy to the Contracting Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx

Suitability Investigations are required for contractors who will need access to NIH information systems and/or to NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH ID Badge. Each contract employee needing a suitability investigation will be contacted via email by the NIH Office of Personnel Security and Access Control (DPSAC) within 30 days. The DPSAC email message will contain instructions regarding fingerprinting as well as links to the electronic forms contract employees must complete.

Additional information can be found at the following website:

http://idbadge.nih.gov/background/index.asp

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

Personnel Security Responsibilities

1. The Contractor shall notify the Contracting Officer, Project Officer, and I/C ISSO within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination or security clearance stops working under this contract. The Government will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

2. The Contractor shall provide the Project Officer with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and suitability determination level held by the former https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx http://idbadge.nih.gov/background/index.asp incumbent. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

3. The Contractor shall provide the Project Officer with the name, position title, and suitability determination level held by or pending for departing employees.

Perform and document the actions identified in the Contractor Employee Separation Checklist (attached) when a Contractor/subcontractor employee terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

Commitment to Protect Non-Public Departmental Information and Data

1. Contractor Agreement

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- Public Law 96-511 (Paperwork Reduction Act)

2. Contractor Employee Non-Disclosure Agreement

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non-Public Information – Contractor Employee Agreement A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under this acquisition.

Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data Breach The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team via email (IRT@mail.nih.gov) within one hour of discovering the incident. The Contractor shall follow-up with IRT by completing and submitting one of the following two forms within three (3) work days:

NIH PII Spillage Report [https://ocio.nih.gov/InfoSecurity/ISSO/Documents/PII_Breach- Spillage_Checklist.doc ]

NIH Lost or Stolen Assets Procedures https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf mailto:IRT@mail.nih.gov

[https://ocio.nih.gov/InfoSecurity/Policy/Documents/ISSO_Stolen_Device- Media_Handling_Procedures.doc ]

Data Encryption

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the Project Officer, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Information Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/cryptval.

2. The Contractor shall secure all mobile devices, including non-HHS laptops and portable media that contain sensitive HHS information by using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted information can be decrypted and accessed by authorized personnel.

Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by “OMB Guidance to Federal Agencies on Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

Encryption key management shall comply with all HHS and NIH policies (http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store information shall be encrypted until it is sanitized or destroyed in accordance with NIH procedures. Contact the NIH Center for Information Technology for assistance (https://ocio.nih.gov/InfoSecurity/Policy/Documents/SanitizationGuide.doc).

Physical Access Security In accordance with OMB Memorandum M-05-24, the Contractor shall ensure that background investigations are conducted for all contractor/subcontractor personnel who have (1) access to sensitive information, (2) access to Federal information systems, (3) http://csrc.nist.gov/cryptval http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf regular or prolonged physical access to Federally-controlled facilities, or (4) any combination thereof. OMB Memorandum M-05-24 is available at http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf. Agency personal identification verification policy and procedures are identified below:

HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook (02-01- 05): http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html

Using Secure Computers to Access Federal Information

1. The Contractor shall use an USGCB compliant computer when processing information on behalf of the Federal government.

2. The Contractor shall install computer virus detection software on all computers used to access information on behalf of the Federal government. Virus detection software and virus detection signatures shall be kept current.

Common Security Configurations

1. The Contractor shall ensure new systems are configured with the applicable Federal Desktop Core Configuration (FDCC) (http://nvd.nist.gov/fdcc/download_fdcc.cfm) and applicable configurations from http://checklists.nist.gov, as jointly identified by the Operating Division (OPDIV)/Staff Division (STAFFDIV) Contracting Officer’s Technical Representative (COTR) and the Chief Information Security Officer (CISO).

2. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and/or patching will not alter the configuration settings specified in: (a) the FDCC (http://nvd.nist.gov/fdcc/index.cfm); and (b) other applicable configuration checklists as referenced above.

3. The Contractor shall ensure applications are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

4. The Contractor shall ensure applications designed for end users run in the standard user context without requiring elevated administrative privileges.

5. Federal Information Processing Standard 201 (FIPS-201)-compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

6. The Contractor shall ensure that all of its subcontractors (at all tiers) comply with the above requirements.

Special Information Security Requirements for Foreign Contractors/Subcontractors

When foreign contractors/subcontractors perform work under this acquisition at non-US Federal Government facilities, provisions of HSPD-12 do NOT apply.

http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html http://nvd.nist.gov/fdcc/download_fdcc.cfm http://checklists.nist.gov/ http://nvd.nist.gov/fdcc/index.cfm

Personally Identifiable Information (PII) Security Plan

The Offeror shall submit a PII Security Plan with its technical proposal that addresses each of the following items:

1. Verify the information categorization to ensure the identification of the PII requiring protection.

2. Verify the existing risk assessment.

3. Identify the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

4. Verify the adequacy of the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

5. Identify any revisions, or development, of an internal corporate policy to adequately address the information protection requirements of the SOW.

6. For PII to be physically transported to or stored at a remote site, verify that the security controls of NIST Special Publication 800-53 involving the encryption of transported information will be implemented.

http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

7. When applicable, verify how the NIST Special Publication 800-53 security controls requiring authentication, virtual private network (VPN) connections will be implemented.

8. When applicable, verify how the NIST Special Publication 800-53 security controls enforcing allowed downloading of PII will be implemented.

9. Identify measures to ensure subcontractor compliance with safeguarding PII.

The details contained in the Offeror’s PII Security Plan must be commensurate with the size and complexity of the contract requirements based on the System Categorization specified above in the subparagraph entitled Security Categories and Levels. The Offeror’s PII Security Plan will be evaluated by the Government for appropriateness and adequacy.

H. DATA RIGHTS

The National Institute on Aging shall have unlimited rights to and ownership of all deliverables provided, including clinical laboratory test results. This includes the deliverables provided under the basic contract and any optional task deliverables exercised by the contracting officer. In addition, it includes any additional deliverables required by contract change. The definition of “unlimited rights” is contained in Federal Acquisition Regulation (FAR) 27.401, “Definitions.” FAR http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf clause 52.227-14, “Rights in Data-General,” is hereby incorporated by reference and made a part of this contract/order.

I. SECTION 508 – ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS

Not applicable.

J. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

1. The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

Name: Taryn E. Mabe National Institute on Aging (NIA) Intramural Research Program (IRP) Office of the Scientific Director 251 Bayview Boulevard Room 4C023 Baltimore, Maryland 21224 Telephone Number: (410) 558-8310 Fax: (410) 558-8103 E-mail address: mabete@mail.nih.gov

2. The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

3. Alternate COR: N/A

4. The Contracting Officer is the only person with authority to act as agent of the

Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

5. The Government may unilaterally change the COR designation for this contract.

mailto:mabete@mail.nih.gov