NIHPMIIRBSOW2022.docx

Solicitation No. NIHODM9000012022

STATEMENT OF WORK

SUPPORT SERVICES FOR THE ALL OF US RESEARCH PROGRAM

INSTITUTIONAL REVIEW BOARD (IRB)

December 2, 2021

1.0 Background

Launched with a $215 million investment in the President’s 2016 Budget, the Precision Medicine Initiative (PMI) will pioneer a new model of patient-powered research that promises to accelerate biomedical discoveries and provide clinicians with new tools, knowledge, and therapies to select which treatments will work best for which patients. A critical part of PMI is the All of Us Research Program led by the National Institutes of Health (NIH).

This program seeks to extend precision medicine to all diseases by building a national research cohort of one million or more U.S. participants. Many factors have converged to make now the right time to begin a program of this scale and scope — Americans are engaging in improving their health and participating in health research more than ever before, electronic health records have been widely adopted, genomic analysis costs have dropped significantly, data science has become increasingly sophisticated, and health technologies have become mobile. The All of Us Research Program is a participant-engaged, data-driven enterprise supporting research at the intersection of human biology, behavior, genetics, environment, data science and computation, and much more to produce new knowledge with the goal of developing more effective ways to prolong health and treat disease. The cohort broadly reflects the diversity of the U.S. population by including participants from diverse social, racial/ethnic, and ancestral populations living in a variety of geographies, social environments, and economic circumstances, and from all age January 21, 2022groups and health statuses. Information from the cohort will be a broad, powerful resource for researchers working on a variety of important health questions.

2.0 Mandatory Requirements

Offerors should demonstrate prior experience in providing administrative and regulatory support for scheduled and occasional unscheduled, ad-hoc Institutional Review Board (IRB) meetings, including all administrative tasks involved in the preparation, conduct, and follow-up of meeting actions (including the management of expedited reviews).

Successful offeror must be fully accredited by the Association for the Accreditation of Human Research Protection Programs (AAHRPP).

3.0 Objective

NIH is seeking an organization to provide administrative, regulatory, and operational support for the single Institutional Review Board (IRB) supporting the All of Us Research Program.

It is anticipated the IRB will review approximately 100-150 submissions per year.

4.0 Statement of Work

4.1 General Requirements

The All of Us Research Program IRB serves as the IRB of record for all protocols received. This Statement of Work (SOW) sets forth the management, administrative and regulatory support needed for the All of Us Research Program IRB. Specifically:

A. Manage and provide administrative and regulatory support for scheduled and occasional unscheduled, ad-hoc meetings of the All of Us Research Program IRB, including all administrative tasks involved in the preparation, conduct, and follow-up of meeting actions (includes managing expedited review). These tasks include, but are not limited to, the following:

a. Receipt of all All of Us Research Program IRB-required documentation including maintenance of electronic regulatory files for the IRB.

b. Advise the IRB of the regulations and their regulatory role during their review of all submissions.

c. Complete meeting minutes within 7 business days of convened IRB meetings. Minutes must be compliant with the requirements of applicable regulations and should comply with guidance provided by relevant regulatory agencies.

d. Appropriately assign reviewers for each review to be conducted, including initial review, continuing review, amendment review, etc.

e. Arrange for a conference call line and all logistics needed for each regularly scheduled and ad hoc All of Us Research Program IRB meeting.

f. Coordinate, prepare and distribute agendas, submissions for review, and all background material for all meetings providing members, with sufficient time to review materials prior to IRB meetings.

g. Record attendance and completion of primary reviewer assignments per All of Us Research Program IRB member; manage member’s conflict of interest, recusal, and meeting quorum issues per the All of Us Research Program IRB SOPs prior to and during all meetings.

h. Prepare minutes of ad-hoc conference calls in which the All of Us Research Program IRB Chair participates and forward those minutes for review by the Chair and NIH designee. Minutes shall include salient points of discussion and highlight any action items. Minutes should be completed within.

i. Prepare all correspondence related to All of Us Research Program IRB review outcomes from expedited or convened review, including, but not limited to, drafting outcome letters, ensuring appropriate review and approval of the draft, and distribution of the letter to appropriate Study contacts, copying additional relevant staff per their request or All of Us Research Program IRB SOPs. Approval letters shall be distributed to Study contacts via email within three days of approval with the rest of the outcome letters distributed within seven days.

B. Serve as subject matter experts in guiding the IRB’s decision-making relative to applicable regulations governing the conduct of human subjects’ research under the All of Us Research Program.

C. Create, maintain and periodically evaluate regulatory compliant SOPs for the core functions of the All of Us Research Program IRB including, for example, SOPs pertaining to: initial review of research, review of changes in research, continuing review of research, and review of unanticipated problems and serious or continuing noncompliance.

D. Collaborate as requested with the All of Us Research Program to:

E. Support the NIH in identifying and selecting All of Us Research Program IRB members, including the following:

1. Track the tenure and categories of All of Us Research Program IRB Board members in the Member Activity Tracking Database or similar system.

2. Maintain a list of potential/future appointees.

3. Ensure that the All of Us Research Program IRB maintains membership compliant with the requirements of the Common Rule.

4. Advise the All of Us Research Program Institutional Official regarding the adequacy of the IRB membership to review the nature and scope of research submitted for its review.

5. Orient newly appointed IRB members to the IRB’s operational structure and support orientation of new members to the All of Us Research Program.

6. Support the continuing education of IRB members with timely content pertinent to the nature and scope of their reviews.

7. Maintain bio sketches and CV’s for each All of Us Research Program IRB members.

8. Manage disbursement of honorarium to IRB members at the rate of $200 per member per meeting attended and $200 per member per month for Expedited/Exempt/Other Reviews conducted outside of an IRB Meeting.

F. Purchase and hold professional liability insurance for All of Us Research Program IRB members without gaps in coverage at time of renewal.

G. Provide subject matter expertise regarding the functions, policies and procedures of the All of Us Research Program IRB in support of the All of Us Research Program’s goal of AAHRPP Accreditation.

H. Advise and propose best practices for a model for centralized All of Us Research Program IRB activities including:

· Development of processes to address local context considerations, as necessary;

· Management of Authorization/Reliance Agreements with relying sites;

· Helpdesk support for research sites, and to limited extent participant complaints; and

· Advise on potential IT solutions to support the All of Us Research Program IRB, such as utilization of an integrated software suite to support virtual IRB meetings and IRB records tracking.

I. Collaborate with and advise on other All of Us Research Program stakeholders to support the All of Us Research Program’s efforts to protect human subjects.

J. At the request of the All of Us Research Program, provide additional support for human subjects protection efforts related to researchers’ use of the All of Us Research Program’s resource when that use is deemed to constitute human subjects research subject to regulation.

4.2 Management and Reporting Requirements

The offeror shall provide one (1) electronic copy each of the following information to the Project Officer(s). The address for the Project Officer(s) shall be provided at the time of the award.

1. By the tenth (10th) calendar day of each month a brief monthly status report shall be provided. These reports shall include, but are not limited to, a description of work accomplishments during the period, including a list of all activities, the status of each task, problems encountered and any corrective action taken, planned activities for the upcoming period, any available deadlines, and any problems that are anticipated during the upcoming period.

2. Complete Meeting Report. This report shall contain a summary of all work performed as identified by the SOW. This report shall discuss in detail any problems encountered and the successful resolution of those problems in addition to any recommendations and conclusions the offeror has based upon experience and the results obtained.

4.3 Reporting Requirements

All reports required herein shall be submitted in electronic format. In addition, one (1) hardcopy of each report shall be submitted to the Contracting Officer, unless otherwise specified.

A. Technical Progress Reports. Deliveries in this Schedule, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The frequency and specific content of these reports will be determined prior to contract award.

B. Monthly Progress Reports shall contain two main sections as indicated below and should be submitted with the monthly invoice:

Financial Status Report—The following will be provided in Section 1 of the Monthly Progress Report:

a) Hours expended during the reporting period by individual

b) Cumulative hours expended throughout the reporting period by job category

c) Contract funds expended during the reporting period

d) Schedule of activities planned and estimated hours for the next reporting period and number of remaining hours to complete activities.

Progress Report—The following will be provided in Section II of the Quarterly Progress Report:

a) Descriptive information about the activities undertaken during the reporting period

b) Planned activities for future reporting periods

c) Summary of work accomplished during the previous month

d) Milestones and deliverables, if applicable

e) Any issues or problems impacting project progress along with their ultimate resolution

The Offeror shall provide a Progress Report to the Project Officer on the 15th day of each month.

4.4 Deliverables and Delivery Schedule for In-person or Virtual Non-Review All of Us Research Program IRB Meetings

A. Pre-Meeting Deliverables

a. Determine dates for biannual and ad-hoc in-person and virtual non-review All of Us Research Program IRB meetings a minimum of 6 months in advance.

b. Socialize draft meeting agenda with All of Us Research Program IRB co-chairs for review and approval in coordination with All of Us Research Program leadership.

B. On-Site Meeting Deliverables

a. Provide the necessary on-site (or virtual) meeting staff support (a minimum of 2) to capture meeting notes, support IRB members, and assist with meeting facilitation (in conjunction with AOU staff and logistical contractors).

C. Post-Meeting Deliverables

a. Plan for prompt delivery of action items (3-4 business days after meeting) and meeting summary (2-3 weeks after meeting).

b. Distribute honoraria of $200 per member per meeting if the meeting was virtual (does not apply for in-person meetings).

5.0 Period of Performance

The period of performance for this contract shall be one twelve-month base year, with four twelve-month option periods commencing on or around the base year below:

Base year: March 25, 2022 – March 24, 2023

Option year 1: March 25, 2023 – March 24, 2024

Option year 2: March 25, 2024 – March 24, 2025

Option year 3: March 25, 2025 – March 24, 2026

Option year 4: March 25, 2026 – March 24, 2027

6.0 Key Personnel - 352.237-75

In accordance with HHSAR 352.237-75 Key Personnel

Key Personnel (December 18, 2015)

The key personnel specified in this contract are considered to be essential to work performance. At least 30 days prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a request to replace the individual. The request must identify the proposed replacement and provide an explanation of how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or separates from the contractor voluntarily with less than thirty days’ notice, the Contractor shall provide the maximum notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to key personnel without the written consent of the Contracting Officer. The contract will be modified to add or delete key personnel as necessary to reflect the agreement of the parties.

(End of clause)

The following positions for this requirement are considered to be Key Personnel:

Director of IRB Operations Project Manager

7.0 Additional Requirements

Section 508

This language is applicable to Statements of Work (SOW) or Performance Work Statements (PWS) generated by the Department of Health and Human Services (HHS) that require a contractor or consultant to (1) produce content in any format that could be placed on a Department-owned or Department-funded Web site; or (2) write, create or produce any communications materials intended for public or internal use; to include reports, documents, charts, posters, presentations (such as Microsoft PowerPoint) or video material that could be placed on a Department-owned or Department-funded Web site.

Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) requires Federal agencies to purchase electronic and information technologies (EIT) that meet specific accessibility standards. This law helps to ensure that Federal employees with disabilities have access to, and use of, the information and data they need to do their jobs. Furthermore, this law ensures that members of the public with disabilities have the ability to access government information and services.

There are three regulations addressing the requirements detailed in Section 508. The Section 508 technical and functional standards are codified at 36 CFR Part 1194 and may be accessed through the Access Board’s Web site at http://www.access-board.gov. The second regulation issued to implement Section 508 is the Federal Acquisition Regulation (FAR). FAR Part 39.2 requires that agency acquisitions of Electronic and Information Technology (EIT) comply with the Access Board’s standards. The entire FAR is found at Chapter 1 of the Code of Federal Register (CFR) Title 48, located at http://www.acquisition.gov. The FAR rule implementing Section 508 can be found at http://www.section508.gov. The third applicable regulation is the HHS Acquisition Regulation (HHSAR).

Regardless of format, all Web content or communications materials produced for publication on or delivery via HHS Web sites - including text, audio or video - must conform to applicable Section 508 standards to allow Federal employees and members of the public with disabilities to access information that is comparable to information provided to persons without disabilities. All contractors (including subcontractors) or consultants responsible for preparing or posting content intended for use on an HHS-funded or HHS-managed Web site must comply with applicable Section 508 accessibility standards, and where applicable, those set forth in the referenced policy or standards documents below. Remediation of any materials that do not comply with the applicable provisions of 36 CFR Part 1194 as set forth in the SOW or PWS, shall be the responsibility of the contractor or consultant retained to produce the Web-suitable content or communications material.

The following Section 508 provisions apply to the content or communications material identified in this SOW or PWS:

· HHS Section 508 Web site: http://508.hhs.gov/

· HHS ASPA Web Communications Division Web site: http://www.hhs.gov/web/policies/index.html

· US General Services Administration (GSA) Section 508 Web site: http://www.section508.gov/index.cfm

Confidentiality

The Contractor shall guarantee strict confidentiality of the information/data that is provided by the Government during the performance of this contract. The Contractor must commit to protecting non-public Departmental information and data. The Contractor and any subcontractors performing under this contract shall not release, publish, or disclose non-public Departmental information to unauthorized personnel and shall protect such information in accordance with provisions of the following laws and any other pertinent laws and regulations governing the confidentiality of such information:

· 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records)

· 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information)

· Public Law 96-511 (Paperwork Reduction Act)

Disclosure of the information/data, in whole or in part, by Contractor can only be made after Contractor receives prior written approval from the Contracting Officer. Whenever the Contractor is uncertain with regard to the proper handling of information/data under the Contract, the Contractor shall obtain a written determination from the NIH COR.

The Contractor may not incur travel costs associated with traveling to and from NIH's facilities except as authorized in advance in writing. Allowable travel and per diem charges are governed by Pub. L. 99-234 and FAR Part 31. The Industrial Funding Fee does not apply to travel and per diem charges.

The contractor must complete a Non-Disclosure Agreement (NDA).

Privacy and Security Requirements

All personnel and activities must conform to all Federal, HHS, NIH and All of Us policies and guidelines regarding security, confidentiality and privacy. The contractor must be able to successfully complete any required security or background checks.

Government Furnished Equipment

All equipment and supplies needed to perform the outlined tasks and activities will be supplied by the offeror.

Security Categories and Levels The security level for this work is:

Privacy provisions for All of Us Research Program (AoURP)

All partners in the All of Us Research Program (AoURP) are required to adhere to the PMI Privacy and Trust Principles, which may be accessed at: https://allofus.nih.gov/about/program-overview/precision-medicine-initiative-privacy-and-trust-principles

1. The AoURP requires the contractor to work with the program office through the designated Contract Officer Representative (COR) to develop a privacy plan within six (6) months of contract award. The plan shall describe how the contractor will design and implement privacy controls and policy safeguards necessary to ensure secure data sharing, access, and use and data quality and integrity congruent with the PMI Privacy and Trust Principles and, where applicable, how they will comply with privacy requirements established in the Common Rule, the Public Health Service Act, the 21st Century Cures Act, HITECH, HIPAA, including relevant supporting regulations, and agency and program policies.

The AoURP, through the Policy Director and in coordination with the Privacy Officer and Program Officer, may require additional privacy measures not included in the PMI Privacy Trust Principles. AoURP will regularly monitor compliance with the privacy plan and any new privacy requirements as specified by the program and agreed upon by the contractor. The contractor will reach agreement with AoURP on requested terms, scope, and timing of privacy reviews

2. PII specifically obtained for the All of Us Research Program may be stored at any of the following sites: an enrollment and/or data collection site (Health Provider Organization (HPO) or Direct Volunteer sites), the Data and Research Center (DRC), or the Participant Technology Systems Center (PTSC). A privacy incident may occur in any system that collects or uses PII from these sites, due to an external or internal intruder, human error or intentional malice, or during data exchange between systems. Once the contractor identifies a suspected or confirmed privacy incident, it must be notified to the Incident Notification Board (INB) as soon as possible and no later than 24 hours, even if investigations into the incident(s) are incomplete or ongoing. Notification to the Board should use the Privacy Incident Report template and must include the following information, if available:

· Description of what happened.

· Type of PII involved in the privacy incident and to whom the PII pertains;

· Description of the controls in place that could potentially minimize the risk posed by the incident;

· Approximate number of potentially impacted individuals affected by the incident.

· Any initial remediation steps taken by the site to minimize risk;

· Actions the site has already taken in compliance with Federal and State law.

If this information is not available, the contractor should include in its notification as much information as is available to it at that time and supplement its notification as additional information becomes available. Privacy incident reports are sent to the INB by email to AllofUs_Notifications_Board@mail.nih.gov, using the Privacy Incident Report Template.

The affected contractor should also notify the INB of any deadlines it anticipates facing as part of its investigation or response to the incident, whether required by law (including HIPAA, if applicable) or policy, so that the INB may provide timely recommendations. In the event that a privacy incident also includes a security breach, the contractor may have additional notification requirements per their obligations for FISMA and the NIH ATO, including reporting to the NIH IRT.

Privacy Provisions for the All of Us Research Program

All partners in the All of Us Research Program are required to adhere to the Precision Medicine Initiative Data Security Policy Framework which may be accessed at: https://allofus.nih.gov/protecting-data-and-privacy/precision-medicine-initiative-data-security-policy-principles-and-framework-overview

Additional Conditions for Contractors with Significant Security Responsibilities

1. Compliance with AoURP Security Authorization Process - The NIH AoURP requires that the contractor comply with the AoURP Security Authorization Process for all AoURP systems under the direct management and operations of the contractor. The NIH AoURP requires the contractor to describe how it will design and implement technical and policy safeguards necessary to ensure data security, in accordance with NIST Special Publication 800-53 meeting or exceeding the FISMA Moderate baseline. All contractors will apply NIH organizationally-defined parameters unless provided a waiver by the NIH AoURP ISSO. Additionally, the contractor shall abide by the terms outlined in the Authority to Operate (ATO) requiring that the authorization will remain in effect as long as:

I) The required security status reports for the system are submitted periodically to the AOURP ISSO II) The vulnerabilities reported during the continuous monitoring process do not result in additional NIH-level risk which is deemed unacceptable III) The system has not exceeded the maximum allowable time between security assessments (one-third security controls are reviewed annually within three-year authorization period)

The NIH AoURP Information Systems Security Office will request an annual independent review of security controls, in addition to continual review and testing, to ensure overall effectiveness against evolving threats and consistent implementation as a requirement of renewal of the ATO.

All major changes to the system boundary will be evaluated using a Security Impact Analysis within the AOURP Security Authorization Process to determine if a new or additional ATO is required.

2. Risk Management – The NIH AoURP, through the program Information System Security Officer (ISSO) in coordination with the Program Officer, may require additional security measures not included in the FISMA Moderate baseline to provide advanced cybersecurity measures following a risk-based approach. The NIH AoURP and the contractor will establish data security implementation plans and timelines collaboratively. NIH AoURP will regularly monitor compliance with ongoing and new security requirements as specified by the NIH AoURP and agreed upon by the contractor. The following terms apply:

a. Adhere to NIH AoURP security policy, procedure, and developed memorandum

b. All contractors must maintain and make available to the NIH AoURP accurate security documentation and architecture diagrams

c. Apply risk reducing measures and other NIH AoURP recommendations

d. All contractor system ISSOs must maintain a record of completed trainings and signed user access agreements (Rules of Behavior)

e. All contractor systems ISSOs must coordinate and complete an annual IT Contingency Plan test methodology that commensurate with the risk profile of the system

3. Plans of Action & Milestones - A Plan of Action & Milestones (POA&M) document will be maintained by the contractor and reviewed at least monthly with the AoURP Information Systems Security Office. Additionally, the contractor must abide by the following terms:

a. POA&Ms will be categorized, and managed following NIH AOURP provided templates

b. POA&Ms will be documented as Program-level and System-level

c. POA&M corrective actions will follow the following standard

d. POA&Ms will be created based on the following criteria

e. All risk waivers will be created from POA&Ms that cannot be completed due to technology limitation, functional impact to the AoURP, or a conflict in policy between contractor and the NIH

f. All risk waivers will be documented and reviewed annually and acknowledged by the AoURP ISSO

g. The contractor will use an NIH designated site to share documents as directed by the AoURP ISSO

h. The completion of POA&Ms will be a collaborative effort requiring acknowledgement from the contractor ISSO, System Owner, and the NIH AoURP Information Security Office

i. Status of all milestones will be included in the quarterly report and thereby incorporated into the NIH award record

NIH may take action, including reduction or reallocation of funds or termination of the award, for non-compliance with security requirements and milestones as agreed upon by both the NIH and the contractor.

4. Incident Response – The NIH AoURP requires all contractors to maintain an active and evolving security program with incident response capabilities that meet NIH AoURP requirements. All contractors will use the HHS Policy and Plan for Responding to a Breach as guide for implementing incident response capabilities. The following incident reporting requirements must be followed.

a. All contractors must designate a dedicated incident response point of contact

b. All perceived and potential security and privacy incidents must be reported to the NIH AoURP ISSO within 1 hour of discovery

c. All incidents will require full transcript of incident and timeline, response action report, and final report

d. Notification of incidents will be submitted via ISAO-AllofUs-Security@mail.nih.gov and contain non-sensitive information; all follow up communication and sharing information potentially containing with sensitive information will utilize NIH Secure Email and File Transfer (SEFT) or secure method of transfer approved by the AoURP ISSO

5. Continuous Monitoring – The NIH AoURP requires all contractors to maintain a continuous monitoring program that follows NIH guidelines and aligns with NIST SP 800-137. The purpose of the continuous monitoring program is to provide visibility into organizational assets, awareness of threats and vulnerabilities, and visibility into the effectiveness of deployed security controls. The continuous monitoring program provides ongoing assurance that planned and implemented security controls are aligned with organizational risk tolerance as well as the information needed to respond to risk in a timely manner should observations indicate that the security controls are inadequate. The following requirements must be followed.

Contractor will reach agreement with AoURP on requested terms, scope, and timing of security reviews.

Dispute resolution: Any disagreements or disputes regarding data security requirements specified by AoURP will be elevated to the NIH ATO signatories, i.e., the NIH Office of Chief Information Officer and the Director of the All of Us Research Program.