RFP_75N95023R00001.pdf

OMB #0990-0115

NATIONAL INSTITUTE ON DRUG ABUSE

REQUEST FOR PROPOSAL (RFP) No. 75N95023R00001

“Population Assessment of Tobacco and Health (PATH) Study”

Issued by:

Joshua T. Lazarus, Contracting Officer NIDA Section, Contracts Management Branch Red Office of Acquisition, NIDA c/o NIH Mail Center

NIDA 3WFN MSC 6023

16071 Industrial Drive – Dock 11 Gaithersburg, MD 20877

Point of Contact: Josh Lazarus, Contracting Officer E-Mail: josh.lazarus@nih.gov

DATE ISSUED: June 12, 2023

PROPOSAL DUE: August 9, 2023, 3:00 P.M. (Eastern Time)

The National Institute on Drug Abuse (NIDA) invites you to submit a proposal responding to the requirements of this RFP No. 75N95023R00001 for the “Population Assessment of Tobacco and Health (PATH) Study”.

This Request for Proposal is released under FULL AND OPEN Competition Procedures.

Please refer to Section M for mandatory criteria. Additionally, all offerors must be REGISTERED and have an ACTIVE System for Award Management "http://www.sam.gov/" (www.sam.gov) account at the time an offer/proposal is submitted to the Government. All offerors registered in the System for Award Management http://www.sam.gov/ (www.sam.gov) must be in full compliance with FAR 52.204-7 System for Award Management and FAR 52.204-13 System for Award Management Maintenance to be eligible to submit a proposal.

The Government will not accept proposals from offerors who do not meet the SAM requirement.

NIDA prepared this Request for Proposal in accordance with the Uniform Contract Format prescribed for Government Wide application by the Federal Acquisition Regulation (FAR). The Uniform Contract Format is both a Request for Proposal and a contract award document. The resulting contract will consist of Parts I, II, and III of the Uniform Contract Format.

NIDA anticipates that one (1) cost-reimbursement completion style contract will be awarded. This requirement will include the use of Options to Extend the Period of Performance and Options for Increased Quantity for additional tasks and services as described in the Statement of Work. Given the progress, scope, and objectives to collect nationally representative data for the PATH Study, NIDA anticipates one (1) 5-year base period and up to eight (8) additional 5-year option periods as necessary to achieve the requirements of this contract, for a total contract term of 13 years.

Offerors shall respond with separate technical and cost/price proposals based on the assumptions provided in Sections C and L. Please include separate pricing for each option period and option quantity.

General

Part IV of the RFP contains instructions, provisions, and evaluation factors for the submission and review of proposals. Attachment 2 is a "Proposal Intent Response Sheet." Please complete this form and return it to the below address on or before 3:00 p.m. on Monday, July 17, 2023. The balance of Parts I, II, and III contain provisions, clauses, and special requirements which will be made a part of any resultant award. Please review these sections and consider their impact on performance, capability, technical, and cost factors as you develop your proposal. Do not fill in blanks or otherwise complete portions of Parts I, II, and III which appear to require additional information. The Government will complete these items prior to contract award and, if negotiations are conducted, will tailor those items through final negotiations.

Requests for Information (RFIs)

Requests for clarification, additional information, or correction must be made in writing to the Contracting Officer. RFIs must be submitted on or before 3:00 p.m. Thursday, July 6, 2023. RFIs may be submitted by e-mail to shaun.rostad@nih.gov with the subject line “RFI – RFP 75N95023R00001.”

NOTE: Site visits will not be provided.

The Technical Proposal

Offerors shall complete and attach the “Technical Proposal Cover Sheet” for each copy of their technical proposal.

It is important that Offerors list all professional personnel and organizations named in the proposal that have any role in the proposed work. This includes staff, subcontractors, collaborating organizations, and consultants. Show organization affiliation(s) for every person named. Offerors may use extra sheets, as needed, following the format shown in the Technical Proposal Cover Sheet. NIDA will use this information to ensure that no conflicts of interest exist with the selected review committee members.

Technical Proposal are detailed in Section L.2.b.

The Business Proposal

Offerors must have an authorized organizational official sign the Business Proposal. It must contain a detailed breakdown of costs for each of the sample tasks and option quantities. For each cost category/element, provide an explanation of the basis for all costs, and provide documentation to support these costs. NIDA directs special attention to Breakdown of Proposed Estimated Costs (plus fixed fee) w/Excel Spreadsheet contained in the Business Proposal Cost Information, Attachment 13. Please submit business proposals with a spreadsheet in this format. Use of the above format will hasten review and award. A PDF copy of the spreadsheet must be included in the Business Proposal. Do not send encrypted files.

A completed Form NIH-2043, “Proposal Summary and Data Record” (see Attachment 11) must be included with the Business Proposal. Include the e-mail addresses of both the Principal Investigator and the responsible business representative on the form. Note that in addition to telephone and fax numbers, you should include the e-mail addresses of both the Principal Investigator and the responsible business representative on the form.

The Offeror must submit its Small Business Subcontracting Plan, Travel Policy, Total Compensation Plan and Annual Report with the initial Business Proposal. See Section L.2.c. for additional detail.

Submitting a Proposal

Proposals must be submitted via the electronic Contract Proposal Submission (eCPS) website (https://ecps.nih.gov) no later than August 9, 2023, 3:00 P.M. Eastern Time. Proposals submitted by facsimile, e-mail, or hard copy will not be accepted. An official authorized to bind your organization must sign the proposal.

Offerors are solely responsible for submitting proposals in a timely manner. Please note that creating an account to submit may take up to three (3) business days. Please plan accordingly. Additional instructions on submitting a proposal via eCPS can be found at https://ecps.nih.gov/home/howto and in Attachment 1.

All notices related to this solicitation will be posted on www.SAM.go (https://www.sam.gov) as well as the NIDA Contracts Home Page (https://www.drugabuse.gov/funding/funding-opportunities/nida-requests-contract-proposals-rfps). If you would like to receive e-mail notifications of updates to this solicitation, please register with

SAM.

In accordance with FAR 15.306(a)(3) and FAR 52.215-1, the Government intends to evaluate proposals and award a contract without discussions. Therefore, your initial proposal should contain the best terms from cost or price and technical standpoints. The Government does, however, reserve the right to conduct discussions if the Contracting Officer determines them to be necessary.

Disclaimers

This RFP does not commit the Government to pay the costs for the preparation and submission of a proposal. The Contracting Officer is the only individual who legally can commit the Government to the expenditure of public funds in connection with this acquisition.

Any contract award for this requirement is contingent on the availability of funds (see FAR 52.232-18, Availability of Funds – April 1984).

NIDA appreciates your interest in this RFP and looks forward to receipt of your proposal. Requests for any information concerning this RFP should be directed to Shaun Rostad, or the undersigned, at the NIDA Section, Contracts Management Branch Red. We may be reached at (301) 443-6677; collect calls will not be accepted.

Discussions with any other individual outside the NIDA Section, Contracts Management Branch Red should not occur.

Sincerely, Joshua T. Lazarus, Contracting Officer National Institutes of Health, Office of Acquisition, NIDA

- 1 -

SOLICITATION

SECTION A - SOLICITATION/CONTRACT FORM

1. Requisition or other Purchase Authority: P.L. 102-321 as amended

2. Request for Proposal (RFP) Number:

75N95023R00001

3. Issue Date:

6/12/2023

4. Set Aside:

[X] No [ ] Yes See Part IV Section L

5. Title : Population Assessment of Tobacco and Health (PATH) Study

6. ISSUED BY:

NIDA Office of Acquisitions Contracts Management Branch Red C/O NIH Mail Center

NIDA 3WFN MSC 6023

National Institutes of Health 10671 Industrial Drive – Dock 11 Gaithersburg, MD 20877 (20892 for USPS)

7. SUBMIT OFFERS TO:

See Part III, Section J, "Packaging and Delivery of the Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website, ATTACHMENT 1 of this Solicitation.

8. Proposals for furnishing the supplies and/or services in THE SCHEDULE will be received at the place specified in, and in the number of copies specified in Attachment 1, "Packaging and Delivery of the Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website," until 3:00 PM local time on August 9, 2023. Offers will be valid for 180 days unless a different period is specified by the offeror on the Attachment entitled, "Proposal Summary and Data Record, NIH 2043.

9. This solicitation requires delivery of proposals as stated in ATTACHMENT 1, "Packaging and Delivery of the Proposals for Use with the NIH electronic Contract Proposal Submission (eCPS) Website ."Proposals submitted by any other means such as facsimile, hard copy or e-mail will not be accepted. IF YOUR PROPOSAL IS NOT RECEIVED BY THE CONTRACTING OFFICER OR HIS DESIGNEE AT THE PLACE AND TIME SPECIFIED FOR THE OFFICE

OF ACQUISITIONS, THEN IT WILL BE CONSIDERED LATE AND HANDLED IN ACCORDANCE WITH

subparagraph (c)(3) of FAR Clause 52.215-1, Instructions to Offerors--Competitive Acquisition," LOCATED IN

SECTION L.1. OF THIS SOLICITATION.

Offeror must be registered in the System for Award Management (SAM) when submitting a proposal and continue to be registered until time of award, during performance, and through final payment of any contract, basic agreement, basic ordering agreement, or blanket purchasing agreement resulting from a solicitation. Offerors who are not registered in SAM should consider applying for registration immediately upon receipt of this solicitation. See FAR 52.204-7 System for Award Management (Oct 2018) and https://www.sam.gov for information on registration.

FOR INFORMATION :

Joshua Lazarus

MAIL: josh.lazarus@nih.gov

Joshua T. Lazarus Contracting Officer NIDA R&D Contracts Management Branch National Institute on Drug Abuse, NIH

RFP Number : 75N95023R00001

- 2 -

RFP TABLE OF CONTENTS

PART I - THE SCHEDULE

SECTION A - SOLICITATION/CONTRACT FORM

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

SECTION D - PACKAGING, MARKING AND SHIPPING

SECTION E - INSPECTION AND ACCEPTANCE

SECTION F - DELIVERIES OR PERFORMANCE

SECTION G - CONTRACT ADMINISTRATION DATA

SECTION H - SPECIAL CONTRACT REQUIREMENTS

PART II - CONTRACT CLAUSES

SECTION I - CONTRACT CLAUSES

PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACHMENTS

SECTION J - LIST OF ATTACHMENTS

SOLICITATION ATTACHMENTS

TECHNICAL PROPOSAL ATTACHMENTS

BUSINESS PROPOSAL ATTACHMENTS

INFORMATIONAL ATTACHMENTS

PART IV - REPRESENTATIONS AND INSTRUCTIONS

SECTION K - REPRESENTATIONS, CERTIFICATIONS AND OTHER STATEMENTS OF OFFERORS

SECTION L - INSTRUCTIONS, CONDITIONS, AND NOTICES TO OFFERORS

a. GENERAL INFORMATION

a. INSTRUCTIONS TO OFFERORS--COMPETITIVE ACQUISITION

b. NAICS CODE AND SIZE STANDARD

c. COMMITMENT OF PUBLIC FUNDS

d. PROMOTING EFFICIENT SPENDING

e. COMMUNICATIONS PRIOR TO CONTRACT AWARD

f. RELEASE OF INFORMATION

g. REFERENCE MATERIALS

h. PREPARATION COSTS

i. SERVICE OF PROTEST

j. LATE PROPOSALS AND REVISIONS

2. INSTRUCTIONS TO OFFERORS

a. GENERAL INSTRUCTIONS

1. Contract Type and General Clauses

2. Authorized Official and Submission of Proposal

3. Proposal Summary and Data Record (NIH-2043)

4. Separation of Technical and Business Proposals

5. Alternate Proposals

6. Evaluation of Proposals

7. Potential Award Without Discussions

8. Use of the Metric System of Measurement

9. Standards for Privacy of Individually Identifiable Health Information

- 3 -

10. Privacy Act - Treatment of Proposal Information

11. Selection of Offerors

12. Institutional Responsibility Regarding Investigator Conflicts of Interest

13. ROTC Access and Federal Military Recruiting on Campus

14. Certification of Filing and Payment of Taxes

15. Past Performance Information

16. Solicitation Provisions Incorporated by Reference

b. TECHNICAL PROPOSAL INSTRUCTIONS

1. Technical Discussions

2. Other Considerations

3. Technical Evaluation

4. Human Subjects

5. Obtaining and Disseminating Biomedical Research Resources

c. BUSINESS PROPOSAL INSTRUCTIONS

1. Basic Cost/Price Information

2. Proposal Cover Sheet

3. Information Other than Cost or Pricing Data

4. Requirements for Cost or Pricing Data or Information Other than Cost and Pricing Data

5. Salary Rate Limitation

6. Small Business Subcontracting Plan

7. Mentor Protege Program, HHSAR 352.219-70

8. HUBZone Small Business Concerns

9. Total Compensation Plan

10. Other Administrative Data

11. Qualifications of the Offeror

12. Subcontractors

13. Proposer's Annual Financial Report

14. Travel Costs/Travel Policy

SECTION M - EVALUATION FACTORS FOR AWARD

1. GENERAL

2. COST/PRICE EVALUATION

3. HUMAN SUBJECT EVALUATION

4. MANDATORY QUALIFICATION CRITERIA

5. EVALUATION OF OPTIONS

6. EVALUATION OF DATA SHARING PLAN

7. TECHNICAL EVALUATION FACTORS

8. EVALUATION OF ELECTRONIC AND INFORMATION TECHNOLOGY ACCESSIBILITY- SECTION

9. PAST PERFORMANCE FACTOR

10. SUBCONTRACTING PROGRAM EVALUATION CRITERIA

- 4 -

PART I - THE SCHEDULE

THE INFORMATION SET FORTH IN SECTION A - SOLICITATION/CONTRACT FORM, HEREIN CONTAINS IMPORTANT INFORMATION FOR ANY OFFEROR INTERESTED IN RESPONDING TO THIS SOLICITATION.

ANY CONTRACT RESULTING FROM THIS SOLICITATION WILL INCLUDE IN ITS SECTION A - SOLICITATION/ CONTRACT FORM, ACCOUNTING, APPROPRIATION AND GENERAL INFORMATION APPLICABLE TO THE

CONTRACT AWARD.

THE CONTRACT SCHEDULE SET FORTH IN SECTIONS B THROUGH H, HEREIN, CONTAINS CONTRACTUAL INFORMATION PERTINENT TO THIS SOLICITATION. IT IS NOT AN EXACT REPRESENTATION OF THE CONTRACT DOCUMENT THAT WILL BE AWARDED AS A RESULT OF THIS SOLICITATION. THE CONTRACT COST OR PRICE AND OTHER CONTRACTUAL PROVISIONS PERTINENT TO THE OFFEROR (i.e., those relating to the organizational structure [e.g., Non-Profit, Commercial] and specific cost authorizations unique to the Offeror's proposal and requiring Contracting Officer Prior Approval) WILL BE DISCUSSED IN THE NEGOTIATION PROCESS, IF NECISSARY, AND WILL BE INCLUDED IN THE RESULTANT CONTRACT. THE ENCLOSED CONTRACT SCHEDULE IS INTENDED TO PROVIDE THE OFFEROR WITH THE NECESSARY INFORMATION

TO UNDERSTAND THE TERMS AND CONDITIONS OF THE RESULTANT CONTRACT.

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

ARTICLE B.1. BRIEF DESCRIPTION OF SUPPLIES OR SERVICES

The National Institutes of Health (NIH), through the National Institute on Drug Abuse (NIDA) and in partnership with the Center for Tobacco Products (CTP) of the Food and Drug Administration (FDA), provides for the continuation of the Population Assessment of Tobacco and Health (PATH) Study. The Research Objectives of the PATH Study are to enhance the evidence base to inform FDA's regulatory actions under the TCA to protect the Nation's public health and reduce its burden of tobacco-related morbidity and mortality by examining tobacco product use behaviors, identifying factors that affect tobacco product use trajectories among both users and non-users, assessing health outcomes associated with tobacco product use, including biomarkers of exposure and potential harm, evaluating the impacts of TCA-regulations on those outcomes and assess all of the above among special subpopulations, as well as to conduct additional data collections in response to emerging regulatory needs as appropriate.

The purpose of this Research and Development (R&D) contract is to continue data collection and analysis for the PATH Study among new and continuing participants, including both users and non-users of tobacco products, for at least four main waves of data collection including up to two waves of replenishment, as well as for any special data collections. The schedule of data collection waves and their specific follow-up waves, as well as key tasks the Contractor shall perform, are defined within Section C "Period of Performance" of this SOW.

The contract also supports the dissemination of research findings and products generated from the PATH Study. By monitoring and assessing behaviors, attitudes, biomarkers, and health outcomes associated with tobacco products use in the United States, the PATH Study helps enhance the evidence base available to inform FDA's regulatory activities related to tobacco products. Charged with generating data to inform regulatory actions based on the Population Health Standard, weighing potential benefits and harm to current, former, and never users of tobacco products, the PATH Study provides longitudinal data on the impact of tobacco products on the health of the population as a whole, including data on the potential of tobacco products to encourage cessation among current tobacco users and the potential to prevent relapse/reuptake by former tobacco users and initiation by new tobacco users, particularly youth.

ARTICLE B.2. ESTIMATED COST PLUS FIXED FEE

a. The estimated cost of the Base Period of this contract is $ .

b. The fixed fee for the Base Period of this contract is $ . The fixed fee shall be paid in installments based on the percentage of completion of work, as determined by the Contracting Officer. Payment shall be subject to the withholding provisions of the clauses ALLOWABLE COST AND PAYMENT and FIXED FEE referenced in the General Clause Listing in Part II, ARTICLE I.1. of this contract.

- 5 -

c. The total estimated amount of the contract, represented by the sum of the estimated cost plus the fixed fee for the Base Period is $ .

d. If the Government exercises its option pursuant to the OPTION PROVISION Article in SECTION H of this contract, the Government's total estimated contract amount represented by the sum of the estimated cost plus the fixed fee will be increased as follows:

Estimated Cost ($) Fixed Fee ($) Estimated Cost Plus Fixed Fee (CPFF) ($)

Base Period Option Period 1 Option Period 2 Option Period 3 Option Period 4 Option Period 5 Option Period 6 Option Period 7 Option Period 8

ARTICLE B.3. OPTION PRICES

a. Unless the Government exercises its option pursuant to the option clause referenced in ARTICLE I.3.

ADDITIONAL CONTRACT CLAUSES, this contract consists only of the Base Period specified in the Statement of Work as defined in SECTIONS C and F, for the Cost Plus Fixed Fee (CPFF) set forth in ARTICLE B.2. of this contract.

b. Pursuant to FAR Clause 52.217-7 Option for Increased Quantity-Separately Priced Line Item set forth in ARTICLE I.3. ADDITIONAL CONTRACT CLAUSES of this contract, the Government may, by unilateral contract modification, require the Contractor to perform the Option Period(s) specified in the Statement of Work as defined in SECTIONS C and F of this contract. If the Government exercises this/these option(s), notice must be given before the expiration date of the contract. Specific information regarding the time frame for this notice is set forth in the OPTION PROVISION Article in SECTION H of this contract. The CPFF of this contract will be increased as set forth in paragraph c., below.

c. Upon the delivery and acceptance of the Option Services described in SECTION C of the contract and identified in the schedule of charges below, the Government shall pay the Contractor the unit amounts(s) set forth below:

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

Base Task 2. Transition Phase-In

Base Task 6. Data Collection Quality Control, Management, and Processing

Base Task 7. Data Files & Codebook

Base Task 8. Technical Reports

Base Task

9. Biospecimen Operations and Storage

- 6 -

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

Base Task 9.

Biospecimen Access

Base Task 10. Extra Small Data Collection Prep.

Base Task 10. Extra Small Data Collection

Base Task 10. Small Data Collection Prep.

Base Task 10. Small Data Collection

Base Task 10.

Medium Data Collection Prep.

Base Task

10. Medium Data Collection

Base Task 10.

Large Data Collection Prep.

Base Task 10.

Large Data Collection

Base Task 10.

Extra Large Data Collection Prep.

Base Task 10. Extra Large Data Collection

Base Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

1 Task 4. Preparation for Data Collection

- Replenishment

1 Task 4. Preparation for Data Collection

- Biospecimen

1 Task 6. Data Collection Quality Control, Management, and Processing

1 Task 7. Data Files & Codebook

1 Task 8. Technical Reports

- 7 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

1 Task

9. Biospecimen Data Collection Incentives and Logistics

1 Task 9.

Biospecimen Access

1 Task 10. Extra Small Data Collection Prep.

1 Task 10. Extra Small Data Collection

1 Task 10. Small Data Collection Prep.

1 Task 10. Small Data Collection

1 Task 10.

Medium Data Collection Prep.

1 Task

10. Medium Data Collection

1 Task 10.

Large Data Collection Prep.

1 Task 10.

Large Data Collection

1 Task 10.

Extra Large Data Collection Prep.

1 Task 10.

Extra Large Data Collection

1 Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

2 Task 5. Data Collection - Replenishment

2 Task 5. Data Collection - Biospecimen

2 Task 6. Data Collection Quality Control,

- 8 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

Management, and Processing

2 Task 7. Data Files & Codebook

2 Task 8. Technical Reports

2 Task

9. Biospecimen Incentive Logistics

2 Task 9.

Biospecimen Access

2 Task 10. Extra Small Data Collection Prep.

2 Task 10. Extra Small Data Collection

2 Task 10. Small Data Collection Prep.

2 Task 10. Small Data Collection

2 Task 10.

Medium Data Collection Prep.

2 Task

10. Medium Data Collection

2 Task 10.

Large Data Collection Prep.

2 Task 10.

Large Data Collection

2 Task 10.

Extra Large Data Collection Prep.

2 Task 10.

Extra Large Data Collection

2 Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

3 Task 4. Preparation for Data Collection

- Replenishment

3 Task 4. Preparation for Data Collection

- Biospecimen

- 9 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

3 Task

9. Biospecimen Data Collection Incentives and Logistics

3 Task 9.

Biospecimen Access

3 Task 10. Extra Small Data Collection Prep.

3 Task 10. Extra Small Data Collection

3 Task 10. Small Data Collection Prep.

3 Task 10. Small Data Collection

3 Task 10.

Medium Data Collection Prep.

3 Task

10. Medium Data Collection

3 Task 10.

Large Data Collection Prep.

3 Task 10.

Large Data Collection

3 Task 10.

Extra Large Data Collection Prep.

3 Task 10.

Extra Large Data Collection

3 Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

4 Task 5. Data Collection - Replenishment

4 Task 5. Data Collection - Biospecimen

4 Task 6. Data Collection Quality Control,

- 10 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

Management, and Processing

4 Task 7. Data Files & Codebook

4 Task 8. Technical Reports

4 Task

9. Biospecimen Data Collection Incentives and Logistics

4 Task 9.

Biospecimen Access

4 Task 10. Extra Small Data Collection Prep.

4 Task 10. Extra Small Data Collection

4 Task 10. Small Data Collection Prep.

4 Task 10. Small Data Collection

4 Task 10.

Medium Data Collection Prep.

4 Task

10. Medium Data Collection

4 Task 10.

Large Data Collection Prep.

4 Task 10.

Large Data Collection

4 Task 10.

Extra Large Data Collection Prep.

4 Task 10.

Extra Large Data Collection

4 Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

5 Task 4. Preparation for Data Collection

- Replenishment

- 11 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

5 Task 4. Preparation for Data Collection

- Biospecimen

5 Task

9. Biospecimen Data Collection Incentives and Logistics

5 Task 9.

Biospecimen Access

5 Task 10. Extra Small Data Collection Prep.

5 Task 10. Extra Small Data Collection

5 Task 10. Small Data Collection Prep.

5 Task 10. Small Data Collection

5 Task 10.

Medium Data Collection Prep.

5 Task

10. Medium Data Collection

5 Task 10.

Large Data Collection Prep.

5 Task 10.

Large Data Collection

5 Task 10.

Extra Large Data Collection Prep.

5 Task 10.

Extra Large Data Collection

5 Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

6 Task 5. Data Collection - Replenishment

6 Task 5. Data Collection - Biospecimen

- 12 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

6 Task 6. Data Collection Quality Control, Management, and Processing

6 Task 7. Data Files & Codebook

6 Task 8. Technical Reports

6 Task

9. Biospecimen Data Collection Incentives and Logistics

6 Task 9.

Biospecimen Access

6 Task 10. Extra Small Data Collection Prep.

6 Task 10. Extra Small Data Collection

6 Task 10. Small Data Collection Prep.

6 Task 10. Small Data Collection

6 Task 10.

Medium Data Collection Prep.

6 Task

10. Medium Data Collection

6 Task 10.

Large Data Collection Prep.

6 Task 10.

Large Data Collection

6 Task 10.

Extra Large Data Collection Prep.

6 Task 10.

Extra Large Data Collection

6 Task 11. Analytic Activities

- 13 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

7 Task 4. Preparation for Data Collection

- Replenishment

7 Task 4. Preparation for Data Collection

- Biospecimen

7 Task

9. Biospecimen Data Collection Incentives and Logistics

7 Task 9.

Biospecimen Access

7 Task 10. Extra Small Data Collection Prep.

7 Task 10. Extra Small Data Collection

7 Task 10. Small Data Collection Prep.

7 Task 10. Small Data Collection

7 Task 10.

Medium Data Collection Prep.

7 Task

10. Medium Data Collection

7 Task 10.

Large Data Collection Prep.

7 Task 10.

Large Data Collection

7 Task 10.

Extra Large Data Collection Prep.

7 Task 10.

Extra Large Data Collection

7 Task 11. Analytic Activities

Option Period Description of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

8 Task 2. Transition Phase-Out

- 14 -of Option

Quantity (Units) / Period

Unit CPFF Total CPFF of Options

8 Task 5. Data Collection - Replenishment

8 Task 5. Data Collection - Biospecimen

8 Task

9. Biospecimen Data Collection Incentives and Logistics

8 Task 9.

Biospecimen Access

8 Task 10. Extra Small Data Collection Prep.

8 Task 10. Extra Small Data Collection

8 Task 10. Small Data Collection Prep.

8 Task 10. Small Data Collection

8 Task 10.

Medium Data Collection Prep.

8 Task

10. Medium Data Collection

8 Task 10.

Large Data Collection Prep.

8 Task 10.

Large Data Collection

8 Task 10.

Extra Large Data Collection Prep.

8 Task 10.

Extra Large Data Collection

8 Task 11. Analytic Activities

ARTICLE B.4. PROVISIONS APPLICABLE TO DIRECT COSTS

This article will prohibit or restrict the use of contract funds, unless otherwise approved by the Contracting Officer. The following is a list of items that may be included in the resultant contract as applicable: 1) Conferences & Meetings; 2) Food for Meals, Light Refreshments & Beverages; 3) Promotional Items; 4) Acquisition, by purchase or lease, of any interest in real property; 5) Special rearrangement or alteration of facilities; 6) Purchase or lease of any item of general

- 15 -purpose office furniture or office equipment regardless of dollar value; 7) Travel Costs including Foreign Travel; 8) Consultant Costs; 9) Subcontract Costs; 10) Patient Care Costs; 11) Accountable Government Property; 12) Printing costs; and 13) Research Funding.

ARTICLE B.5. ADVANCE UNDERSTANDINGS

Specific elements of cost, which normally require prior written approval of the Contracting Officer before incurrence of the cost (e.g., foreign travel, consultant fees, subcontracts) will be included in this Article if the Contracting Officer has granted his/her approval prior to contract award.

[Remainder of Page is Left Intentionally Blank]

- 16 -

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

ARTICLE C.1. STATEMENT OF WORK

a. Independently and not as an agent of the Government, the Contractor shall be required to furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the Statement of Work, attached hereto and made a part of this Solicitation (See SECTION J - List of Attachments).

b. The applicable Privacy Act System of Records Number will be specified and shall be used in any design, development, or operation work to be performed under the resultant contract. Disposition of records shall be in accordance with SECTION C of the contract, and by direction of the Contracting Officer's Representative (COR).

ARTICLE C.2. REPORTING REQUIREMENTS

All reports required herein shall be submitted in electronic format as specified in Section F.

All electronic reports submitted shall be compliant with Section 508 of the Rehabilitation Act of 1973. Additional information about testing documents for Section 508 compliance, including guidance and specific checklists, by application, can be found at: http://www.hhs.gov/web/508/index.html and at: https://www.section508.gov/create/ documents, "Create Accessible Documents."

a. Technical Progress Reports

1. In addition to the required reports set forth elsewhere in Section F and the Statement of Work, the preparation and submission of regularly recurring Technical Progress Reports will be required in any contract resulting from this solicitation. These reports will require descriptive information about the activities undertaken during the reporting period and will require information about planned activities for future reporting periods. The frequency and specific content of these reports will be determined prior to contract award. Note: The Contractor shall include the applicable PubMed Central or NIH Manuscript Submission reference number when citing publications that arise from its NIH funded research.

2. Summary of Salient Results

The Contractor will be required to prepare and submit, with the final report, a summary (not to exceed 200 words) of salient results achieved during the performance of the contract. This report will be required on or before the expiration date of the contract.

3. Annual Technical Progress Report for Clinical Research Study Populations

The Contractor shall submit information about the inclusion of women and members of minority groups and their subpopulations (when appropriate) for each study being performed under this contract. The Contractor shall submit this information in the format indicated in the attachment entitled, "Cumulative Inclusion Enrollment Report," which is set forth in SECTION J of this contract.

The Contractor also shall use this format, modified to indicate that it is a final report, for reporting purposes in the contract period final report. If the clinical study(s) involves US and non-US sites, the US sites and non-US sites should be reported on separate Cumulative Inclusion Enrollment Reports.

The Contractor shall submit the report in accordance with the DELIVERIES Article in SECTION F of this contract.

- 17 -

In addition, the NIH Policy and Guidelines on the Inclusion of Women and Minorities as Subjects in Clinical Research, Amended, October, 2001 applies. If this contract is for Phase III clinical trials, see II.B of these guidelines. The Guidelines may be found at the following website: http://grants.nih.gov/ grants/funding/women_min/women_min.htm.

For NIH-defined Phase III Clinical Trials: Include a description of the plans for valid analysis in the study design and outcomes. This includes designing the study in a manner that potential differences, as appropriate, by sex/gender and/or racial/ethnic groups in the clinical trial protocol could be conducted. Also, provide a description of any analyses by sex/gender, race, and/or ethnicity, as appropriate, in the annual progress report and the final report. If the analysis reveals no subset differences, a brief statement to that effect, indicating the subsets analyzed, will suffice. The Government strongly encourages inclusion of the results of subset analysis in all publication submissions. In the final report, the Contractor shall include all final analyses of the data on sex/ gender, race and/or ethnicity.

b. Other Reports/Deliverables

1. Reporting of Financial Conflict of Interest (FCOI)

All reports and documentation required by 45 CFR Part 94, Responsible Prospective Contractors including, but not limited to, the New FCOI Report, Annual FCOI Report, Revised FCOI Report, and the Mitigation Report, shall be submitted to the Contracting Officer in Electronic format. Thereafter, reports shall be due in accordance with the regulatory compliance requirements in 45 CFR Part 94.

45 CFR Part 94 is available at: https://www.ecfr.gov/current/title-45/part-94. See Part 94.5, Responsibilities of Institutions regarding Investigator financial conflicts of interest for complete information on reporting requirements.

(Reference subparagraph g. of the INSTITUTIONAL RESPONSIBILITY REGARDING INVESTIGATOR FINANCIAL CONFLICTS OF INTEREST Article in SECTION H of this contract.)

2. Source Code and Object Code

Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract, all source code and object code developed, modified, and/or enhanced under this contract.

3. HHS Security and Privacy Language for Information and IT Procurements

The Contractor shall submit the following reports as required by the INFORMATION AND PHYSICAL ACCESS SECURITY Article in SECTION H of this contract. Note: Each report listed below includes a reference to the appropriate subparagraph of this article.

A. Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

- 18 -

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/NIH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

1. Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

2. Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity;

and

3. Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/NIH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

1. Confidentiality: [ ] Low [X] Moderate [ ] High

2. Integrity: [ ] Low [X] Moderate [ ] High

3. Availability: [X] Low [ ] Moderate [ ] High

4. Overall Impact Level: [X] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/NIH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/NIH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this

- 19 -contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/NIH security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/NIH privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

1. If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 90 calendar days after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

2. The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/ information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

f. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records

- 20 -and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

g. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6) available at https://www.whitehouse.gov/wp-content/ uploads/2020/11/M-21-07.pdf

h. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

i. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. For internal-facing websites, HTTPS is not required, but it is highly recommended. Consult the HHS Policy for Internet and Email Security for additional information.

j. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents. NIH will specify which documents/forms will be provided to comply with contract deliverables as appropriate.

k. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and NIH-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current

- 21 -

FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR within 15 calendar days of the validation.

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

l. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete the NIH non-disclosure agreement. https:// ocio.nih.gov/aboutus/publicinfosecurity/acquisition/Documents/Nondisclosure.pdf, as applicable. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

3. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/NIH IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII).

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or

- 22 -representative, the Contractor must send NIH approved notifications to affected individuals in accordance with https://wiki.ocio.nih.gov/wiki/index.php/US- CERT_Federal_Incident_Notification_Guidelines.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT) via email at IRT@mail.nih.gov, COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable OpDiv and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

1. Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

2. Not include any sensitive information in the subject or body of any reporting e-mail; and

3.