NIA CT Scans Services-Statement of Work - GINC.pdf

As of March 31, 2017 Page 1

Statement of Work (SOW)

A. GENERAL INFORMATION

1. Title of Project: Radiology Services (computed axial tomography (CAT) scans) of NIA Clinical Unit Participants

2. Background Information: The National Institute on Aging (NIA), one of the 27 Institutes and Centers of NIH, leads a broad scientific effort to understand the nature of aging and to extend the healthy, active years of life. The Intramural Research Program (IRP) of the National Institute on Aging (NIA) provides a stimulating setting for a comprehensive effort to understand aging through multidisciplinary investigator-initiated research, in this regard.

One of the IRP's program activities includes the Clinical Research Core (CRC) part of the NIA Clinical Unit within the Office of the Scientific Director. The CRC seeks to elucidate normative values and separate normal aging findings from disease states. The CRC’s goal is to prolong disease-free states with age. The CRC serves as an infrastructure to facilitate the creation and development of therapeutic targets for the treatment of age-related disease across the Intramural Research Program. The CRC performs research in various protocol studies that have direct clinical applications to aging and disease states. NIA recruits voluntary participants to take part in the various research protocol studies performed by the CRC staff. Part of a participants’ visit may include having a computed axial tomography (CAT) scan performed for which the NIA requires on-site support services. All BLSA protocol participants have a CAT scan done, and some of the other protocol studies include CAT scans of research participants as part of their testing as well.

3. Purpose or Objective of the Requirement: The contractor shall provide all resources necessary to accomplish the tasks and deliverables described in this Statement of Work (SOW). The contractor shall provide computed axial tomography (CAT) radiology services for research participants as required by the specific protocol(s).

4. Type of Contract Contemplated:

Contract, Open Market, and the expected value will be provided (inclusive of options).

5. Period of Performance: The period of formance is twelve months (12) from the date of award, plus four (4) one-year options.

As of March 31, 2017 Page 2

B. CONTRACTOR REQUIREMENTS (SCOPE OF WORK)

Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the tasks as specified herein. Specifically,

• The Vendor shall make available facilities and equipment for complete head and total body CAT scan radiology testing.

• The Vendor shall make available facilities and equipment for CAT scanning located on-site where the NIA Clinical Unit is located. Participants must be able to complete CAT scanning during their visit at the NIA Clinical Unit.

• CAT scanning services shall be performed on research participants on an as-needed and priority basis or as scheduled by NIA. Tests that are scheduled in advance are based on faxed requests provided to the Contractor by the Government. The Contractor must accept fax communication.

• CAT scanning services shall be performed on research participants under NIA IRP credentialed physicians’ orders or Nurse Practitioner orders. Procedures may include bone and abdomen CAT scans, and other CAT scans as required based on new research protocol requests.

o Tests shall include CAT Scan Services (CPT Codes 76497 BC-BLSA CT PROTOCOLS and 77078 BC-CT BONE DENSITY AXIAL SKEL), and other head and total body CAT scan tests as required based on Institutional Review Board (IRB) approved research protocols.

o A minimum of 12 and a maximum of 16 scans shall be required per week, or a minimum of 624 scans and a maximum of 832 scans per year.

• Upon completion of radiology tests, the Contractor is to send the images electronically to NIA in DICOM format.

• The Vendor will store and maintain CAT scan radiology testing data in DICOM format for 48 hours after the scan of the research participant. Retrieve this information for the Government within this timeframe as requested by the Contracting Officer’s Representative.

Destroy testing data after the 48 hours have elapsed unless otherwise indicated by the Government. Incumbent acknowledges it is a “covered entity” under the Health and Portability and Accountability Act of 1996 (HIPAA) and agree to comply with the requirements thereof, as well as all other applicable laws and regulations pertaining to patient privacy.

• All radiology services must be provided between the hours of 7:00 AM and 5:00 PM local time Monday through Friday by American Board of Medical Specialties Certified or equivalent.

C. GOVERNMENT RESPONSIBILITIES

No Government furnished property shall be provided. Data will be provided to the Contractor for performance of work efforts. All data provided to the Contractor must be treated as

As of March 31, 2017 Page 3 confidential, potentially personally identifiable, and must be handled securely, in accordance with the Health and Portability and Accountability Act of 1996 (HIPPA).

D. DELIVERY OR DELIVERABLES

The Contractor shall provide the following reports and deliverables in relation to this requirement:

1. A report is defined as a final copy of the CAT scan performed.

2. The contractor shall provide the DICOM format file images of research participant radiology results to participants immediately following radiology appointments.

3. All completed and/or partial test results shall also be reported directly s to the NIA system within 4 hours of each scan. The results images shall be digitally sent to the Government via a secure network connection between the Contractor and the NIA. Each test report shall include all information as required by Regulatory Agency Requirements.

The Contractor shall provide test results via the following method:

• Inter-connectivity between Contractor computer system and Government computer system, i.e. results are transmitted from the Contractor computer directly into the Government computer system without human intervention (i.e. DICOM Transfer).

• Ensure electronic transmission and technical details of security settings provided by NIA.

4. If requested, the contractor shall also provide Encrypted Media (CD, Hard drive) copies of scan images to the NIA.

E. TRAVEL

Not applicable.

F. CONTRACTOR EXPERIENCE REQUIREMENTS – KEY PERSONNEL

• All radiology services must be provided by American Board of Medical Specialties Certified, or equivalent, Radiologists with the following qualifications:

1. Successful completion of a residency program in radiology which was accredited by the Accreditation Council for Graduate Medical Education. The contractor shall provide certificates of such completion for all radiologists supporting this requirement upon request.

2. A valid and unrestricted radiology medical license issued by a state, territory, or commonwealth of the United States of America. The licenses must be valid for the entirety of the requirement period(s) of performance and must be available upon request.

3. Basic Cardiac Life Support Certification and Advanced Cardiac Life Support Certification. Certification documents must be available upon request.

G. SECURITY REQUIREMENTS:

As of March 31, 2017 Page 4

ARTICLE H. NIH INFORMATION AND PHYSICAL ACCESS SECURITY

This acquisition requires the Contractor to:

• Develop, have the ability to access or host and/or maintain Federal information and/or

Federal information system(s).

• Access, or use, Personally Identifiable Information (PII), including instances of remote access to or physical removal of such information beyond agency premises or control.

The Contractor and all subcontractors performing under this acquisition shall comply with the following requirements:

a. Information Type

[ ] Administrative, Management and Support Information:

[X] Mission Based Information:

D.19.1 Scientific and Technological Research and Innovation

D.20.1 Research and Development__

b. Security Categories and Levels

Confidentiality Level: [X] Low [] Moderate [ ] High Integrity Level: [ ] Low [X] Moderate [ ] High Availability Level: [X] Low [] Moderate [ ] High Overall Level: [ ] Low [X] Moderate [ ] High

Position Sensitivity Designations

The following sensitivity level(s), clearance type(s), and investigation requirements apply to this contract:

[ ] Level 6: Public Trust - High Risk. Contractor/subcontractor employees assigned to Level 6 positions shall undergo a Suitability Determination and Background Investigation (BI).

[ ] Level 5: Public Trust - Moderate Risk. Contractor/subcontractor employees assigned to Level 5 positions with no previous investigation and approval shall

As of March 31, 2017 Page 5 undergo a Suitability Determination and a Minimum Background Investigation (MBI), or a Limited Background Investigation (LBI).

[X] Level 1: Non-Sensitive Contractor/subcontractor employees assigned to Level 1 positions shall undergo a Suitability Determination and National Agency Check and Inquiry Investigation (NACI).

The Contractor shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff (including subcontractor staff) working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a federal information system(s). The roster shall be submitted to the Project Officer, with a copy to the Contracting Officer, within 14 calendar days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 15 calendar days of the change. The Contracting Officer will notify the Contractor of the appropriate level of investigation required for each staff member. An electronic template, "Roster of Employees Requiring Suitability Investigations," is available for contractor use at https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster _10-15-12.xlsx

Suitability Investigations are required for contractors who will need access to NIH information systems and/or to NIH physical space. However, contractors who do not need access to NIH physical space will not need an NIH ID Badge. Each contract employee needing a suitability investigation will be contacted via email by the NIH Office of Personnel Security and Access Control (DPSAC) within 30 days. The DPSAC email message will contain instructions regarding fingerprinting as well as links to the electronic forms contract employees must complete.

Additional information can be found at the following website:

http://idbadge.nih.gov/background/index.asp

All contractor and subcontractor employees shall comply with the conditions established for their designated position sensitivity level prior to performing any work under this contract.

Contractors may begin work after the fingerprint check has been completed.

Personnel Security Responsibilities

1. The Contractor shall notify the Contracting Officer, Project Officer, and I/C ISSO within five working days before a new employee assumes a position that requires a suitability determination or when an employee with a suitability determination https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/SuitabilityRoster_10-15-12.xlsx http://idbadge.nih.gov/background/index.asp

As of March 31, 2017 Page 6 or security clearance stops working under this contract. The Government will initiate a background investigation on new employees requiring suitability determination and will stop pending background investigations for employees that no longer work under this acquisition.

2. The Contractor shall provide the Project Officer with the name, position title, e-mail address, and phone number of all new contract employees working under the contract and provide the name, position title and suitability determination level held by the former incumbent. If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

3. The Contractor shall provide the Project Officer with the name, position title, and suitability determination level held by or pending for departing employees.

Perform and document the actions identified in the Contractor Employee Separation Checklist (attached) when a Contractor/subcontractor employee terminates work under this contract. All documentation shall be made available to the Project Officer and/or Contracting Officer upon request.

Commitment to Protect Non-Public Departmental Information and Data

1. Contractor Agreement

The Contractor, and any subcontractors performing under this contract, shall not release, publish, or disclose non-public Departmental information to unauthorized personnel, and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

- 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

- 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

- Public Law 96-511 (Paperwork Reduction Act)

2. Contractor Employee Non-Disclosure Agreement

Each employee, including subcontractors, having access to non-public Department information under this acquisition shall complete the Commitment to Protect Non- Public Information – Contractor Employee Agreement A copy of each signed and witnessed Non-Disclosure agreement shall be submitted to the Project Officer prior to performing any work under this acquisition.

https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf https://ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf

As of March 31, 2017 Page 7

Loss and/or Disclosure of Personally Identifiable Information (PII) – Notification of Data Breach The Contractor shall report all suspected or confirmed incidents involving the loss and/or disclosure of PII in electronic or physical form. Notification shall be made to the NIH Incident Response Team via email (IRT@mail.nih.gov) within one hour of discovering the incident. The Contractor shall follow-up with IRT by completing and submitting one of the following two forms within three (3) work days:

NIH PII Spillage Report [https://ocio.nih.gov/InfoSecurity/ISSO/Documents/PII_Breach- Spillage_Checklist.doc]

NIH Lost or Stolen Assets Procedures

[https://ocio.nih.gov/InfoSecurity/Policy/Documents/ISSO_Stolen_Device- Media_Handling_Procedures.doc]

Data Encryption

The following encryption requirements apply to all laptop computers containing HHS data at rest and/or HHS data in transit. The date by which the Contractor shall be in compliance will be set by the Project Officer, however, device encryption shall occur before any sensitive data is stored on the laptop computer/mobile device, or within 45 days of the start of the contract, whichever occurs first.

1. The Contractor shall secure all laptop computers used on behalf of the government using a Federal Information Processing Standard (FIPS) 140-2 compliant whole-disk encryption solution. The cryptographic module used by an encryption or other cryptographic product must be tested and validated under the Cryptographic Module Validation Program to confirm compliance with the requirements of FIPS PUB 140-2 (as amended). For additional information, refer to http://csrc.nist.gov/cryptval.

2. The Contractor shall secure all mobile devices, including non-HHS laptops and portable media that contain sensitive HHS information by using a FIPS 140-2 compliant product. Data at rest includes all HHS data regardless of where it is stored.

3. The Contractor shall use a FIPS 140-2 compliant key recovery mechanism so that encrypted information can be decrypted and accessed by authorized personnel.

Use of encryption keys which are not recoverable by authorized personnel is prohibited. Key recovery is required by “OMB Guidance to Federal Agencies on Data Availability and Encryption”, November 26, 2001, http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf.

mailto:IRT@mail.nih.gov http://csrc.nist.gov/cryptval http://csrc.nist.gov/drivers/documents/ombencryption-guidance.pdf

As of March 31, 2017 Page 8

Encryption key management shall comply with all HHS and NIH policies (http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf) and shall provide adequate protection to prevent unauthorized decryption of the information.

All media used to store information shall be encrypted until it is sanitized or destroyed in accordance with NIH procedures. Contact the NIH Center for Information Technology for assistance (https://ocio.nih.gov/InfoSecurity/Policy/Documents/SanitizationGuide.doc).

Physical Access Security In accordance with OMB Memorandum M-05-24, the Contractor shall ensure that background investigations are conducted for all contractor/subcontractor personnel who have (1) access to sensitive information, (2) access to Federal information systems, (3) regular or prolonged physical access to Federally-controlled facilities, or (4) any combination thereof. OMB Memorandum M-05-24 is available at http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf. Agency personal identification verification policy and procedures are identified below:

HHS Office of Security and Drug Testing, Personnel Security/Suitability Handbook (02-01- 05): http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html

Using Secure Computers to Access Federal Information

1. The Contractor shall use an USGCB compliant computer when processing information on behalf of the Federal government.

2. The Contractor shall install computer virus detection software on all computers used to access information on behalf of the Federal government. Virus detection software and virus detection signatures shall be kept current.

Common Security Configurations

1. The Contractor shall ensure new systems are configured with the applicable Federal Desktop Core Configuration (FDCC) (http://nvd.nist.gov/fdcc/download_fdcc.cfm) and applicable configurations from http://checklists.nist.gov, as jointly identified by the Operating Division (OPDIV)/Staff Division (STAFFDIV) Contracting Officer’s Technical Representative (COTR) and the Chief Information Security Officer (CISO).

2. The Contractor shall ensure hardware and software installation, operation, maintenance, update, and/or patching will not alter the configuration settings specified in: (a) the FDCC (http://nvd.nist.gov/fdcc/index.cfm); and (b) other applicable configuration checklists as referenced above.

http://intranet.hhs.gov/infosec/docs/guidance/hhs_standard_2007.pdf http://www.whitehouse.gov/omb/memoranda/fy2005/m05-24.pdf http://www.hhs.gov/oamp/policies/personnel_security_suitability_handbook.html http://nvd.nist.gov/fdcc/download_fdcc.cfm http://checklists.nist.gov/ http://nvd.nist.gov/fdcc/index.cfm

As of March 31, 2017 Page 9

3. The Contractor shall ensure applications are fully functional and operate correctly on systems configured in accordance with the above configuration requirements.

4. The Contractor shall ensure applications designed for end users run in the standard user context without requiring elevated administrative privileges.

5. Federal Information Processing Standard 201 (FIPS-201)-compliant, Homeland Security Presidential Directive 12 (HSPD-12) card readers shall: (a) be included with the purchase of servers, desktops, and laptops; and (b) comply with FAR Subpart 4.13, Personal Identity Verification.

6. The Contractor shall ensure that all of its subcontractors (at all tiers) comply with the above requirements.

Special Information Security Requirements for Foreign Contractors/Subcontractors

When foreign contractors/subcontractors perform work under this acquisition at non-US Federal Government facilities, provisions of HSPD-12 do NOT apply.

Personally Identifiable Information (PII) Security Plan

The Offeror shall submit a PII Security Plan with its technical proposal that addresses each of the following items:

1. Verify the information categorization to ensure the identification of the PII requiring protection.

2. Verify the existing risk assessment.

3. Identify the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

4. Verify the adequacy of the Contractor’s existing internal corporate policy that addresses the information protection requirements of the SOW.

5. Identify any revisions, or development, of an internal corporate policy to adequately address the information protection requirements of the SOW.

6. For PII to be physically transported to or stored at a remote site, verify that the security controls of NIST Special Publication 800-53 involving the encryption of transported information will be implemented.

http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

7. When applicable, verify how the NIST Special Publication 800-53 security controls requiring authentication, virtual private network (VPN) connections will be implemented.

8. When applicable, verify how the NIST Special Publication 800-53 security controls enforcing allowed downloading of PII will be implemented.

9. Identify measures to ensure subcontractor compliance with safeguarding

PII.

http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf

As of March 31, 2017 Page 10

The details contained in the Offeror’s PII Security Plan must be commensurate with the size and complexity of the contract requirements based on the System Categorization specified above in the subparagraph entitled Security Categories and Levels. The Offeror’s PII Security Plan will be evaluated by the Government for appropriateness and adequacy.

H. DATA RIGHTS

The National Institute on Aging shall have unlimited rights to and ownership of all deliverables provided, including clinical over-read reports, briefings, and all other deliverables. This includes the deliverables provided under the basic contract and any optional task deliverables exercised by the contracting officer. In addition, it includes any additional deliverables required by contract change. The definition of “unlimited rights” is contained in Federal Acquisition Regulation (FAR) 27.401, “Definitions.” FAR clause 52.227-14, “Rights in Data-General,” is hereby incorporated by reference and made a part of this contract/order.

I. SECTION 508 – ELECTRONIC AND INFORMATION TECHNOLOGY STANDARDS

Not applicable.

J. CONTRACTING OFFICER'S REPRESENTATIVE (COR)

1. The following Contracting Officer's Representative (COR) will represent the Government for the purpose of this contract:

Name: Taryn E. Mabe National Institute on Aging (NIA) Intramural Research Program (IRP) Office of the Scientific Director 251 Bayview Boulevard Room 4C023 Baltimore, Maryland 21224 Telephone Number: (410) 558-8310 Fax: (410) 558-8103 E-mail address: mabete@mail.nih.gov

2. The COR is responsible for: (1) monitoring the Contractor's technical progress, including the surveillance and assessment of performance and recommending to the Contracting Officer changes in requirements; (2) interpreting the statement of work and any other technical performance requirements; (3) performing technical evaluation as required; (4) mailto:mabete@mail.nih.gov

As of March 31, 2017 Page 11 performing technical inspections and acceptances required by this contract; and (5) assisting in the resolution of technical problems encountered during performance.

3. Alternate COR: N/A

4. The Contracting Officer is the only person with authority to act as agent of the

Government under this contract. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the statement of work; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the Contractor for any costs incurred during the performance of this contract; (5) otherwise change any terms and conditions of this contract; or (6) sign written licensing agreements. Any signed agreement shall be incorporated by reference in Section K of the contract

5. The Government may unilaterally change the COR designation for this contract.