RFQ Attachment 1 - Statement of Work.pdf

STATEMENT OF WORK

Cross-sectional, Multistate, Commercial Laboratory Assessment of HCV Prevalence

SECTION 1 – BACKGROUND

In the United States, the national estimate of viral hepatitis C (HCV) prevalence derives mainly from the

National Health and Nutrition Examination Survey (NHANES). NHANES uses rigorous statistical sampling to derive a nationally representative sample of the noninstitutionalized civilian population.

However, the NHANES sampling frame excludes certain populations that are at high risk for HCV infection, such as people living in correctional facilities and people living unsheltered. Additionally, the two-year study cycle, the need to combine two cycles to adequately characterize prevalence, and the lag time to when data are available make it difficult to get up-to-date prevalence estimates. In this work, CDC will conduct a cross-sectional specimen survey using convenience samples collected from one or more commercial laboratories across the United States.

SECTION 2 – PURPOSE

The purpose of the contract is to procure de-duplicated patient-level data using residual/remnant/excess, de-identified blood specimens to determine U.S. HCV prevalence at a point in time among two age groups. The period of performance is twelve (12) months with no option period(s).

SECTION 3 – SCOPE OF WORK

The Contractor shall work with and report to CDC/DVH. The Contractor shall submit a draft sampling plan (additional details are outlined in Section 4 below) prior to initial data submission. The document(s) will be reviewed by CDC and modified by Contractor as necessary. Once CDC approves the documents, data will be submitted as a single submission. Thereafter, electronic datasets shall be submitted based on the specimen testing completion rate (10%, 25%, 50%, 75%, and 100%) for all required variables. The Contractor shall review the data to remove duplicates and complete information on records that are incomplete, prior to submitting the data electronically to CDC. Data submitted to

CDC shall be de-linked from identifying information. No patient identifying information shall be published or otherwise disseminated.

SECTION 4 – TASKS TO BE PERFORMED

The Contractor shall perform the following tasks…

HCV Antibody and RNA Testing

Task 1: Kickoff Meeting

The Contractor shall arrange and conduct an initial meeting (by teleconference) with the Contracting

Officer’s Representative (COR) and other relevant staff within 2 weeks of the effective date of the contract. The purpose of the meeting shall be to review and clarify the scope of work and delivery schedule for tasks, to delineate roles and responsibilities, and to establish communication protocols. Each task and deliverable shall be reviewed. The Contractor shall submit an agenda for the kickoff meeting within 1 week of the effective date of the contract.

Task 2: Residual Specimen Selection

Contractor shall submit a draft sampling plan by jurisdiction, region, or other stratification that would ensure geographic coverage across the Contractor’s service area if sufficient samples from each of the 50 states and DC cannot be selected. The sampling plan shall reflect a desired precision of ±0.1 percentage point around an assumed prevalence of 1.0% and include the method of sample size calculation. The sampling plan shall align with the anticipated analysis approach of weighting or calibration to selected strata of geographic and demographic characteristics of the US population or the population of the geographic area served by the vendor if the service area covers less than all 50 states and DC. If another analysis method is used as the basis for the sampling plan (e.g., Bayesian inference or sequential methods), that shall be clearly specified in the draft sampling plan. The final sampling plan shall be submitted 45 days after contract award.

Contractor shall identify excess, remnant, or residual blood specimens from remaining volumes of previously obtained blood specimens. From this list, the Contractor shall choose sufficient samples to achieve the target sample size within each age group: 18 to ≤49 years, 50 to ≤75 years. The sampling plan shall use additional strata or sampling units within these age groups to assure a representative selection of samples across the geographic area served by the vendor in proportion to the number of persons for whom tests were conducted in the past year or the estimated population in each geographic area, and representative selection of samples by gender. Stratification by additional characteristics associated with

HCV prevalence is desirable if information is available to do so, e.g., facility type or setting (correctional facility, homeless shelter or homeless health care [e.g., FQHC 330(h)] clinics), drug use treatment or syringe services program, military, skilled nursing facility, hospital, tribal or Indian Health Service facility, primary care office, provider type and specialty, and pregnancy status.

A table of aggregate counts of total number of persons with tests ordered within each stratification used shall be provided with the HCV test results for each data reporting period. These will be used for the purpose of weighting the sampled results, standardizing estimates to the US population or geographic area covered by the sampling plan, to inform analyses with a goal of adjusting the estimates for potential biases arising from the sampling plan, to create a combined national estimate, and to describe the limitations of the study.

Task 3: Residual Specimen Testing

The Contractor shall test clinical specimens using FDA-approved HCV antibody and HCV RNA tests.

The required sample matrix and sample volume shall be specified for each offered test name. Quantitative or qualitative assays are acceptable. Qualitative interpretations are requested for quantitative assay results, in addition to the quantitative result, in accordance with the manufacturer instructions for interpretation of quantitative assays.

Task 4: Data Report(s)

4.1 The Contractor shall create a data report that outlines the following information: unique patient ID;

age group category (18 to ≤49 years or 50 to ≤75 years)*; gender*; state of patient residence (provider state if patient residence is not available)*; information on if the specimen came from an outpatient, inpatient, or emergency department facility (if available)*; information on if the specimen came from a correctional institution (if available)*; payor type*; provider and specialist type*; pregnancy status*; the name and codes (e.g., CPT) of the original laboratory test (e.g., basic metabolic panel, lipid panel); and

ICD-10 diagnosis code(s) associated with the original laboratory test. For variables designated by “*” the

Contractor shall submit aggregate information for all samples available for selection for this study in order to establish denominators. Data submitted to CDC shall be de-linked from identifying information.

No patient identifying information shall be published or otherwise disseminated.

The Contractor shall submit a detailed description of collection, management, validation, and interpretation of data about hepatitis C testing. This shall include a detailed description of methods for extraction and management of electronic data, description of the algorithm (variables, weights, etc.)

used for patient matching and de-duplication, quality control and data validation measures, and creation of the electronic datasets to be submitted to CDC. The nature of commercial laboratory data is such that certain variables in the data contain a certain proportion of missing or invalid values. The Contractor shall report estimates of such missing or invalid values within 10 days after the contract effective date.

The Contractor shall clarify method(s) and approach as requested by the COR.

The Contractor shall provide an initial data report to the COR after completion of the first 10% of specimens tested. Subsequent interim data reports shall be submitted to the COR after 25%, 50%, and

75% of specimens have been tested.

4.2 The data report shall be submitted prior to initial data submission. The document(s) will be reviewed by CDC and modified by Contractor as necessary. Once CDC approves the document(s), data shall be submitted as a single submission upon completion of the first 10% of specimens tested. Thereafter, electronic datasets shall be submitted for all required variables after 25%, 50%, 75%, and 100% of specimens have been tested (including completion of reflex testing for HCV RNA, if indicated by HCV antibody screening test results).

The Contractor shall submit electronic data through a Secure File Transfer Protocol (SFTP) site owned by CDC or via the Enterprise Data Analytics and Visualization (EDAV) platform. Files shall be submitted as 1) a locked Excel file, 2) an unlocked Excel file, and 3) a .CSV file. After each data submission, DC/DVH will conduct data quality checks on the data. The data must meet quality standards with minimum missing or invalid data of less than 5% relative to the expected rates for each variable established at the beginning of the contract. CDC will notify the Contractor of any issues with the data and the Contractor shall correct errors in and clarify questions about the data. The contractor shall provide assistance on interpretation of the data when such interpretation is not in the provided description.

The Contractor shall review the data to remove duplicates and complete information on records that are incomplete, prior to submitting the sample-level data electronically to CDC. The Contractor shall transmit data to CDC by either a CDC-designated secure email, SFTP, or EDAV. The Contractor shall submit sample-level data for all tested specimens, a summary of the number of selected samples not tested or with invalid results, and reasons for not testing (e.g., quantity not sufficient) or invalid results

(e.g., interfering substance present in specimen).

Task 5: Progress Calls/Mid-Term Meeting

The Contractor shall coordinate with the COR for all project-related communications. The Contractor shall maintain regular communications with the COR involved with the project. The chief means of communication shall be via progress calls that shall be scheduled at each completed interval for specimen testing. Additional calls may be scheduled as needed. The Contractor shall provide an agenda and minutes for each call. All progress calls shall be scheduled and administered by the contractor. The Contractor shall respond to all emails and telephone communications from the COR within 2-3 working days.

The Contractor shall coordinate with the COR for a mid-term meeting to discuss the progress of the project. The meeting will include the COR and other relevant CDC staff, and shall be held virtually via

MS Teams, Zoom, or another platform that is accessible by all parties. The Contractor shall provide an agenda and meeting minutes.

Task 6: Final Report and Meeting

Contractor shall create and submit a final report and schedule a final report meeting with CDC to review and discuss. The final report shall be submitted at least 10 days in advance of the meeting.

SECTION 5 – GOVERNMENT FURNISHED MATERIALS

No Government material will be furnished.

SECTION 6 – INFORMATION SECURITY

1. Applicability. The requirements herein apply whether the entire contract or order (hereafter

“contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

2. Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an

HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS

Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the

HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3. Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with

Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part

2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to

“…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, shall be:

a. marked appropriately;

b. disclosed to authorized personnel on a Need-To-Know basis;

c. protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal

Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled

Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

d. returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data shall be accomplished in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The

Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency

Information by securing it with a FIPS 140-2 validated solution.

5. Confidentiality and Nondisclosure of Information. Any information provided to the contractor

(and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of

Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

6. Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

7. Standard for Encryption. The Contractor (and/or any subcontractor) shall:

a. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

b. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with FIPS 140-2 validated encryption solution.

c. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and CDC-specific encryption standard requirements.

Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information

(including PII).

d. Verify that the encryption solutions in use have been validated under the Cryptographic Module

Validation Program to confirm compliance with FIPS 140-2. The Contractor shall provide a written copy of the validation documentation to the COR.

e. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys. Encryption keys shall be provided to

CDC Office of Chief Information Security Officer (OCISO).

8. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the CDC non-disclosure agreement, as applicable. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

9. Training

Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/CDC Contractor

Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees shall complete CDC Security Awareness Training (SAT), Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with

HHS training policies.

10. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR).

11. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security

Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

a. Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility of all staff working under this acquisition where the

Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR and/or CO by the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted immediately upon change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the

Government will determine the appropriate suitability level.

SECTION 7 – DELIVERABLES/REPORTING SCHEDULE

Task Deliverable Quantity Delivery Date Deliver To

1 Kickoff Meeting Agenda

1 Agenda Within 1 week of contract effective date

COR

2 Draft Sampling Plan outlining/describing testing methods

1 Report

Within 20 days of

COR

2 Final Sampling Plan outlining/describing testing methods

Within 45 days of

COR

4.1 Report of estimates of missing or invalid

values

1 Report Within 10 days after the contract effective date

COR

4.1 Report for 10% completion of specimen

testing

Report for 25% completion of specimen

Report for 50% completion of specimen

Report for 75% completion of specimen

Within 15 business days of completion of testing the first 10% of the specimens

Within 10 business testing the first 25% of testing the first 50% of testing the first 75% of the specimens

5 Progress Call Agenda I

Progress Call Agendas II and III

1 Agenda

2 Agendas

Within 20 business testing 10% of the specimens

Within 15 business testing 25%and 75% of

Mid-term Meeting (50% completion of specimen testing) 1 Meeting Within 10-15 business days of completion of testing the first 50% of

6 Final Report for 100% completion of specimen testing

Final Meeting

1 Meeting days of completion of testing of 100% of the specimens days of submission of the final report

SECTION 8 – SPECIAL CONSIDERATIONS

Electronic and Information Technology Accessibility

(a) Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce

Investment Act of 1998 and the Architectural and Transportation Barriers Compliance Board Electronic and Information (EIT) Accessibility Standards (36 CFR part 1194), require that when Federal agencies develop, procure, maintain, or use electronic and information technology, Federal employees with disabilities have access to and use of information and data that is comparable to the access and use by

Federal employees who are not individuals with disabilities, unless an undue burden would be imposed on the agency. Section 508 also requires that individuals with disabilities, who are members of the public seeking information or services from a Federal agency, have access to and use of information and data that is comparable to that provided to the public who are not individuals with disabilities, unless an undue burden would be imposed on the agency.

(b) Accordingly, any offeror responding to this solicitation must comply with established HHS EIT accessibility standards. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of the Section 508 Final Provisions can be accessed at http://www.access-aboard.gov/sec508/standards.htm.

(c) The Section 508 accessibility standards applicable to this contract are: 1194.

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria

502 Inoperability with Assistive Technology

504 Authoring Tools

602 Support Documentation

603 Support Services

In order to facilitate the Government's determination whether proposed EIT supplies meet applicable

Section 508 accessibility standards, offerors must submit an HHS Section 508 Product Assessment

Template, in accordance with its completion instructions. The purpose of the template is to assist HHS acquisition and program officials in determining whether proposed EIT supplies conform to applicable

Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and documentation detail - whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the HHS Section 508 Evaluation Template are available under Section 508 policy on the HHS

Web site http://hhs.gov/web/508.

In order to facilitate the Government's determination whether proposed EIT services meet applicable

Section 508 accessibility standards, offerors must provide enough information to assist the Government in determining that the EIT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(d) Respondents to this solicitation must identify any exception to Section 508 requirements. If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(e) Electronic content must be accessible to HHS acceptance criteria. Checklist for various formats are available at http://508.hhs.gov/, or from the Section 508 Coordinator listed at https://www.hhs.gov/web/section-508/additional-resources/section-508-contacts/index.html. Materials that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Representative.