Posting SOW.pdf

Statement of Work

Provider training to increase vaccine confidence in Indigenous communities

1.1 Mission

The mission of the Indian Health Service (IHS) is to raise the physical, mental, social, and spiritual health of American Indians and Alaska Natives to the highest level.

1.2 Background

The IHS is a federal agency within the Department of Health and Human Services responsible for providing comprehensive health services to American Indians and Alaska Natives (AI/AN).

As the principal federal health care provider and health advocate for AI/AN people, the IHS mission is to raise AI/AN health status to the highest possible level.

Ensuring high levels of immunization protection is critical in AI/AN communities considering disparities in infectious disease. For example, influenza and pneumonia rates are nearly twice as high in AI/AN populations than in all-U.S. populations. Recognizing the importance of continually strengthening immunization programs, the IHS Health Promotion Disease Prevention and Public Health programs promotes building the capacity of tribes and communities by increasing vaccine confidence through the sharing of effective solutions and assisting health care professionals to promote vaccine uptake.

Unfortunately, the COVID-19 pandemic has created significant backsliding in immunization coverage in AI/AN communities. As of 2022, fewer AI/AN children were protected against diseases such as diphtheria, influenza, pneumococcus, and rotavirus, when compared to non- Hispanic White children. Reasons for incomplete vaccination series for children across the U.S.

included changes in or the loss of insurance coverage, fear of exposure to COVID-19 while visiting a provider’s office, and virtual schooling. Studies suggest barriers to vaccination are often structural. In response, the IHS has developed policies (e.g., E3 Strategy) and public health approaches to increase effective health messaging and partnerships with tribal health organizations, academic institutions, state health departments, and tribal epidemiology centers.

To address other service barriers, solutions may focus on changes to provider practices.

Evidence-based communication techniques such as the presumptive approach, personalized messaging, and motivational interviewing (MI) have been shown to support providers in facilitating health behavior change around immunization decision-making.

1.3 Purpose

The IHS proposes to increase the number of trained health care professionals who will reduce the risk of infectious diseases in communities by encouraging the uptake of vaccination. This will be fostered by partnering with the Johns Hopkins Center for Indigenous Health (JHCIH and referred to as “contractor”) on a comprehensive health worker training package that is community-driven, culturally grounded, will be tailored to community needs to reverse the alarming drop in vaccine coverage. Program will encourage and train health care professionals to engage with patients to improve the immunization rates of children and adults. This partnership with the contractor will

DEPARTMENT OF HEALTH & HUMAN SERVICES Public Health Service

Indian Health Service Rockville MD 20857 address an imminent crisis of under-immunized children and adults vulnerable to infectious disease outbreaks in the post-pandemic era.

2 General Requirements This section describes the general requirements. The following sub-sections provide details of various considerations for this effort. The following schedule of tasks and deliverables outline the requirements necessary to organize, develop, facilitate, manage, and evaluate comprehensive training.

2.1 Non-Personal Services

The Government shall neither supervise contractor employees nor control the method by which the contractor performs the required tasks. Under no circumstances shall the Government assign tasks to, or prepare work schedules for, individual contractor employees. It shall be the responsibility of the contractor to manage its employees and to guard against any actions that are considered personal services, or give the perception of personal services. If the contractor believes that any actions constitute, or are perceived to constitute personal services, the contractor is responsible for immediately notifying the Contracting Officer (CO).

2.2 Business Relations

The contractor shall successfully integrate and coordinate all activities needed to execute the requirement. The contractor shall manage the timeliness, completeness, and quality of problem identification. The contractor shall promptly identify issues, establish corrective action plans, and effectively manage any subcontractors. The contractor shall ensure customer satisfaction and ensure all contractor personnel display professional and ethical behavior.

2.3 Contract Administration and Management

The following subsections specify requirements for contract, management, and personnel administration.

2.4 Contract Management

The contractor shall establish clear organizational lines of authority and responsibility to ensure effective management of the resources assigned to contract/agreement. The contractor must maintain continuity between the support operations, the contractor's corporate offices and the

IHS.

2.5 Contract Administration

The contractor shall establish processes and assign appropriate resources to effectively administer this contract/agreement. The contractor shall respond to Government requests for contractual actions in a timely fashion. The contractor shall have a single point of contact between the Government and Contractor personnel assigned to support this contract/agreement.

The contractor shall assign work effort and maintaining proper and accurate time keeping records of personnel assigned to work under this contract/agreement.

The contractor will meet with the Contracting Officer Representative (COR) and IHS officials within 10 (ten) days of the contract/agreement award to review the Statement of Work (SOW), discuss timelines and deliverables, and to begin initial planning. The contractor and COR will hold a kick-off meeting at the beginning of each option year if exercised to revisit and make adjustments (if necessary) to the comprehensive action plan, quality assurance plan, communications plan, evaluation plan, and project plan, to discuss ongoing tasks in the PWS, and new deliverables for the optional year.

2.6 Personnel Administration

The contractor will provide the following management and support as required. The contractor shall maintain the currency of their employees by providing initial and refresher training as required to meet the SOW requirements. The contractor shall provide necessary infrastructure to support contract/agreement tasks. The contractor will provide administrative support to employees in a timely fashion (e.g., time keeping, leave processing, pay, emergency needs).

2.7 Subcontract Management

The contractor will be responsible for any subcontract management necessary to integrate work performed on this requirement and will be responsible and accountable for subcontractor performance on this requirement. The prime contractor will manage work distribution to ensure there are no Organizational Conflict of Interest (OCI) considerations. Contractors may add subcontractors to their team after notification to the CO or Contracting Officer Representative

(COR).

2.8 Contractor Personnel, Disciplines, and Specialties

The contractor will accomplish the assigned work by employing and utilizing qualified personnel with appropriate combinations of education, training, and experience.

2.9 Location and Hours of Work

Accomplishment of the results contained in this SOW requires work at various contractor/subcontractor locations in the continental United States. Normal workdays are Monday through Friday except US Federal Holidays. Federal Workers typically work eight (8) hours per day, 40 hours per week. Flextime workers start not earlier than 0600 and not later than 0900. Core hours of work are from 0900 to 1500 daily. Contractor/Subcontractor employees are expected to be available to IHS staff during core hours.

2.10 Travel / Temporary Duty (TDY)

Contractor travel is required under this contract/agreement. Costs for travel to any facility for any work completed under this PWS shall be at no additional cost to the government. Any travel for training participants is not covered under this contract/agreement.

3. Performance Requirements The Contractor will be the primary coordinator and facilitator for the program and will serve as coordinator and advisor for review and revisions to the training/curriculum/project. The contractor shall possess appropriate academic training, knowledge and working relationship with key AI/AN health facilities, and experience with tailored curriculum development and health training for professionals working in AI/AN communities. The specific needs for contract support of the program are listed below. Details of this need will be provided in the Task and Deliverables section.

4. Objectives and Tasks:

Objective1 : Create an Inter-Regional Community of Practice (CoP) for Vaccine Communication

Task 1. Meet and electronically communicate with IHS team to discuss potential topics in curriculum content.

Task 1.2 Conduct a focus group discussion with IHS immunization service coordinators nationally exploring determinants affecting immunization uptake and strategies to increase coverage

Task 1.3 Form Vaccine Communication Community of Practice across three participating facilities that serve AI/AN patients and initiate quarterly meetings.

Task 1.4 Conduct a webinar sharing a presentation of the focus group discussion.

Task 1.5 Compile best practices related to vaccine communication.

Objective 2: Design, Pilot and Host the Training Package.

Tasks 2.Design multimedia learning resource package for health professionals on vaccine communication with AI/AN community members.

Task 2.1 Produce visuals/job tools for health care professionals, including SOPs and communication tips.

Task 2.2 Partner with three health facilities to pilot the training package, working with implementation champions representing various health worker cadres.

Task 2.3 Maintain a record of activities and meeting/discussion attendees and debrief on health worker learning.

Objective 3: Evaluate the Health worker training package (year 2 option).

Task 3 Administer pre- and post-training surveys and interviews to health care professionals who participated in training to measure how training affected provider knowledge, confidence, and practice.

Task 3.1 Report on pre- and post-training outcomes at three facilities, lessons learned from implementation, training reach, provider self-efficacy, and maintenance of provider communication strategies.

Objective 4: Disseminate training package within AI/AN-Serving Health Networks (year 2 option).

Task 4 Disseminate the training package into communities where training took place.

Task 4.1 Disseminate knowledge on vaccination uptake strategies and evidence-based provider practice in unique community contexts, including to Indigenous professional networks (e.g., AAIP, Indian Health Service, VacciNative).

The period of performance for this contract/agreement is 12 months from date of award with an additional 12-month option period. All training must be completed within the stated performance period.

5.1 Reporting

The contractor shall follow the reporting plan submitted as part of the proposal and keep the Government fully informed of status throughout the contract/agreement period. It is essential that interruptions or work in progress delays are minimized so that the mission is not negatively impacted. The contractor shall provide quarterly reports, which will include:

• Key findings from discussions with IHS immunization service coordinators and focus group meetings

• Participant database/listing of training participants, including:

o Number of participants (successful and unsuccessful) o Participant professional category (facility, title, department) o Contract staff names and credentials

• Updates on deliverable

• Pre- and post-training findings from participants (additional year 2 option)

Formats and content for Annual Reports will be discussed in the start-up meeting with the contractor, COR, and Shawnell Damon (IHS team).

6 Storage and Disposition of Materials Disposition of any national training and marketing materials will be determined in the Start-Up meeting. Storage should be available as soon as national materials are generated. A disposition schedule will be discussed with the COR during the Start-Up meeting.

7 Deliverables The contractor shall provide deliverables as described below and in subsequent requests within the scope of this contract/agreement. The CO must be notified of any issues or questions regarding scope before any action is taken. The format and delivery schedule for deliverables shall be discussed during the kick-off meeting and at other times during the performance period as needed.

8 Outputs/Deliverables Table

Deliverables Frequency, Date, or Timeframe

Medium and Format Submit to

Contract kick-off/start-up meeting Once, within 15 working days after contract/agreement execution

Teleconference, IHS will schedule and provide the teleconference information

N/A

Comprehensive action plan on activities, participant identification/recruitment, and development of training package

As needed, revised as project progresses

Teleconference meetings, webinar setting

IHS

COR

1. Create Interregional CoP for Vaccine Communication

Monthly during Year 1 Teleconference meetings, webinar setting

IHS

COR

2. Conduct a Focus Group and establish a Community of Practice, Focus Group, Advisory Group

Once Teleconference meetings, webinar setting

IHS

COR

Deliverables Frequency, Date, or Timeframe

Medium and Format Submit to

3. Develop, pilot, and host Health Worker Trainings Package

Monthly beginning 2025 during Year 1, potential to carry into optional Year 2

Teleconference meetings, webinar setting

IHS

COR

4. Design Toolkit for health professionals on vaccine communication with AI/AN community

Monthly beginning 2025 during Year 1, potential to carry into optional Year 2

Teleconference meetings, webinar setting

IHS

COR

5. Evaluate Health Worker Training Package

Available for optional Year 2, monthly

Teleconference meetings, webinar setting

IHS

COR

6. Disseminate Training Package within AI/AN Health Networks

Available for optional Year 2, monthly

IHS

COR

Annual Report Within 30 days after the conclusion of the base/option year

Annual report must be submitted electronically by email.

IHS

COR

Quarterly Report Within 2 weeks after the conclusion of the quarter period

Quarterly report must be submitted electronically by email.

IHS

COR

9 Security Requirements

1) Applicability. The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements.

3) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

See the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

4) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

5) Contractor Non-Disclosure Agreement (NDA). If applicable, each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the HRSA non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

10 Training Requirements (https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html)

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/IHS Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete HHS/IHS Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. The training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

11 Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, the IHS Information Technology Rules of Behavior (included in the IHS Information Security and Privacy Awareness Training), and any applicable system-level rules of behavior.

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/index.html

2) All Contractor employees performing on the contract must read and adhere to the Rules of

Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual IHS Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable.

12 Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the IHS Security Operations Center (SOC), COR, CO, IHS SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable IHS and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, HHS, and IHS incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

13 Position Sensitivity Designations

When applicable all Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

The requiring activity representative, in conjunction with Personnel Security, shall use the OPM Position Sensitivity Designation automated tool (https://www.opm.gov/investigations/) to determine the sensitivity designation for background investigations. After making those determinations, include all applicable position sensitivity designations.

14 Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR, with a copy to the Contracting Officer, within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

https://www.opm.gov/investigations/ https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12

15 Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the IHS information security requirement and processes, in accordance with the HHS Contract Closeout Directive (2018).

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 10 days before an employee stops working under this contract.

5) Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or IHS policies.

Payment Schedule: for Base Period

The Contractor shall submit an invoice based on the completion and acceptance of the below listed items. TBD at time of award.

HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html