RFQ Health Centers PMO_ 75R60221Q00072.pdf

February 23, 2021

Dear Sir/Madam:

You are invited to submit a quote in accordance with the requirements of Request for Quotation (RFQ) 75R60221Q00072 under Federal Acquisition Regulation (FAR) Part 12, Acquisition of Commercial Items and Subpart 13.5 - Simplified Procedures for Certain Commercial Items.

The purpose of this contract is to develop a framework for and to carry out project management and project planning for the implementation of Health Center COVID-19 Vaccine Program for participating HRSA-supported health centers and their clinical services delivery sites. The period of performance will be a 12-month base period. The NAICS Code is 541611 – Administrative Management and General Management Consulting Services with a size standard of $16.5M and the Product Service Code is R408. It is anticipated that this will be a firm fixed-price contract.

QUESTIONS

Offerors may submit questions requesting clarification of this requirement via email (ctaylor@hrsa.gov). Any clarifying information issued by the Government will be provided to all prospective Offerors. All questions must be submitted via email (ctaylor@hrsa.gov) by Thursday, February 25, 2021 at 2:00 p.m. (EST). Questions received after the due date and time will not be considered. No Exceptions.

ELECTRONIC SUBMISSION

Your RFQ response shall be prepared in accordance with Section entitled "Instructions, Conditions, and Notices to Offerors”. This RFQ does not commit the Government to pay any costs for the preparation and submission of a proposal nor does it commit the Government to make an award. It is also brought to your attention that the Contracting Officer is the only individual who can legally commit the Government to expenditure of public funds in connection with this proposed acquisition. Quotes must be received via email (ctaylor@hrsa.gov) by March 4, 2021 at 4:00 p.m. (EST).

Your technical quote must provide a contact name and number, your company name and complete address, including street, city, county, state, zip code, e-mail address, Tax Identification Number (TIN), and Dun & Bradstreet Number (DUNS). The TIN must match the name of the Offeror to whom the payments will be made. Please note that FAR 52.204-7 System for Award Management (Oct 2018) applies to this acquisition.

Requests for additional information concerning this RFQ should only be referred to Carolyn C.

Taylor at ctaylor@hrsa.gov.

DEPARTMENT OF HEALTH & HUMAN SERVICES Public Health Service

Health Resources and Services Administration Office of Acquisitions Management and Policy 5600 Fishers Lane, Room 14W26B Rockville, MD 20857 mailto:ctaylor@hrsa.gov.

2 | P a g e

Sincerely yours, Carolyn C. Taylor Contract Specialist

Attachments Attachment A – SF-1449 Attachment B – Statement of Work

3 | P a g e

INSTRUCTIONS, CONDITIONS AND NOTICES TO OFFERORS

NOTE: The Government reserves the right to reject any quote that does not comply with these quote preparation/submission instructions.

General: Offerors must comply with the detailed instructions for the format and content of the quote. Quotes that do not comply with the detailed instructions for the format and content of the quote may be considered non-responsive and may render the Offeror ineligible for award.

In view of the fact that this procurement is conducted under FAR Part 12 and Subpart 13.5 procedures, the Contracting Officer will not conduct FAR Part 15 discussions. The Government intends to make an award without discussions. However, the Contracting Officer may determine the need to request additional information or clarifications from certain Offerors regarding their quotations. In doing so, the Contracting Officer might not necessarily inform Offerors of problems with their quotations or areas where their quotations do not meet RFQ requirements. Nor shall the fact that the Contracting Officer has sought such additional information from one (or more) Offerors obligate the Government to have similar communications or any communications whatsoever with any other Offerors. Furthermore, the Contracting Officer might decide NOT to request additional information or clarifications of the Offerors. Therefore an Offeror’s quote, as submitted, must be complete and in compliance with the RFQ requirements.

To facilitate the evaluations, your quote shall be submitted in two (2) separate and clearly labeled parts titled as follows:

Volume Title

I Technical Quote II Price Quote

Electronic Submission: Quotes must be received via email (ctaylor@hrsa.gov) by March 4, 2021 at 4:00 p.m. (EST) in order to be considered. Failure to submit a complete quote prior to the solicitation closing date and time will render the quote late and unacceptable.

Quote Format: Offerors shall submit quotes in accordance with the following guidelines.

• All filenames shall include the Offeror’s company name and title/subject of content.

• All documents requested herein shall be compatible with Microsoft Office formats or Adobe

PDF.

Definitions. As used in this provision –

Quote expiration date:

Quotes in response to this solicitation shall be valid for a minimum of 180 calendar days.

4 | P a g e

Amendments to Solicitations If this solicitation is amended, all terms and conditions that are not amended remain unchanged.

Offerors shall acknowledge receipt of any amendment to this solicitation by the date and time specified in the amendment(s).

Submission, Modification, Revision, and Withdrawal of Quotes

1. Quotes and revisions of quotes shall be submitted via email to

2. Offerors shall submit quotes in response to this solicitation in English and in U.S. dollars.

3. Quotes may be withdrawn at any time before award. Withdrawals are effective upon receipt of notice by the Contracting Officer.

Page Limits and Format The Technical Quote shall be single spaced and shall be printable on 8.5 x 11 inch paper containing text no smaller than 11 point for text and 9 point for graphics (including call out boxes and tables).

Each page shall be numbered and each volume shall be tabbed to correspond to the table of contents (Note: The Government will accept a blank page as a tab between sections, which will not count the blank page as part of the page limit). Offerors may include 11 x 17 inch foldouts only to display graphics, flow charts, organizational charts, or drawings. The technical quote shall not exceed 10 single-spaced pages, excluding cover pages, table of contents and resumes. Pages submitted over the 15-page limit will not be read or evaluated. The clarity, relevance, and conciseness of the quote is important, not the length.

A. TECHNICAL QUOTE

Factor 1: Technical

1. Ability to ramp up quickly (50 points)

The Offeror shall demonstrate its ability to ramp up within 3-4 days of effective date of contract, including:

• Demonstrate ability and methodology to conduct a comprehensive program management assessment of Health Center COVID-19 Vaccine Program implementation and understanding of the National Strategy for the COVID-19 Response and Pandemic Preparedness and CDC’s COVID19 Vaccination Program and its national operations with respect to the issues pertaining to equitable allocation of COVID-19 vaccine in the U.S. under 3 days.

• Demonstrate ability to provide a project management plan and recommendations for setting up a program management office under 3-5 days.

• Demonstrate ability and methodology to provide program management implementation services under expedited timeliness.

• Demonstrate ability and methodology to provide staffing and command center structure for a program management office within 2 weeks

2. Corporate Capabilities (40 points)

The Offeror’s proposal shall be evaluated on the demonstrated technical ability and subject matter expertise to conduct the various types of activities in the PWS, particularly with experience with COVID-19 activities and rapid response efforts.

https://www.hrsa.gov/coronavirus/health-center-program#:%7E:text=To%20ensure%20our%20nation's%20underserved,allocate%20a%20limited%20supply%20of https://www.whitehouse.gov/wp-content/uploads/2021/01/National-Strategy-for-the-COVID-19-Response-and-Pandemic-Preparedness.pdf https://www.whitehouse.gov/wp-content/uploads/2021/01/National-Strategy-for-the-COVID-19-Response-and-Pandemic-Preparedness.pdf

5 | P a g e

The Offeror’s technical quote shall be evaluated on their demonstrated ability to organize, manage resources and personnel, and discuss relevant technical and substantive experience including:

• Evidence of successful experience setting up the framework for a project management office under expedited timelines.

• Experience carrying out project management and governance structure, program integrity and risk strategy, and strategic communication services through diverse staffing expertise, accessibility of staff members, and adequate staffing levels.

• Approach to operation execution and scale up incremental effort as more vaccine becomes available for the Health Center COVID-19 Vaccine Program and how it will be carried out in coordination with the jurisdictions and health centers.

Communication and Coordination:

• Describe in detail the Offeror’s approach in ensuring comprehensive and timely communication with internal (e.g. HRSA staff) and external stakeholders (e.g.

HRSA supported health centers, State Primary Care Association, HHS Offices, CDC, 64 jurisdictions).

• Demonstrate the Offeror’s understanding of the challenges experienced by the safety net primary care programs and proposed solutions and alternatives in addressing potential problems in carrying out Health Center COVID-19 Vaccine Program.

Technical Assistance:

• Demonstrate ability to provide technical assistance and facilitate online peer learning i.e. HRSA Salesforce Community utilizing adult learning model to support Program participants with implementation of this dynamic program.

• Describe in detail the process of implementing rapid cycle strategy for continuous quality improvement of technical assistance, impact, and methods that effectively respond to program participant feedback

Data Analytic Support

• Demonstrate subject matter expertise and experience with both quantitative and qualitative statistics to support Health Center COVID-19 Vaccine Program implementation.

• Demonstrate knowledge of the COVID-19 related data, clinical, and resource issues and possible solutions associated development, implementation, and administration of the Health Center COVID-19 Vaccine Program.

• Demonstrated experience with COVID-19 activities and rapid response efforts strategic approach to support the implementation of the Health Center

6 | P a g e

COVID-19 Vaccine Program that will be carried out in coordination with the 64 jurisdictions and health centers. Past experience relative to the requirement of this project:

Project management and organizational experience Execution and operations Provide quantitative and qualitative analytic services Provide technical assistance including facilitation of peer learning and dissemination of promising practices Expertise in management and understanding of challenges experienced by the safety net primary care programs during public health emergencies.

3. Personnel (10 points) The Offeror shall propose labor categories and the qualifications and experience required to successfully perform the tasks. The Offeror shall identify proposed subcontractors, experts, and/or consultants and describe their specific roles and reporting relationships. In addition, key personnel shall be identified and resumes of all proposed key personnel shall be submitted. Resumes shall be no more than three (2) pages.

The Government will evaluate:

• The proposed organizational structure for conducting tasks in the PWS, detailing the managers and professionals proposed to complete each task.

• Proposed key personnel’s qualification with respect to educational and professional experience to be employed to meet the needs of this contract.

• Proposed key personnel’s knowledge of and experience working with COVID-19 public health emergency and HRSA funded program.

• Key senior personnel must possesses technical knowledge and has seven (7) or more years of experience in each of the following areas:

Project and program management;

Program integrity, monitoring and risk management;

Strategic communication outreach and stakeholder engagement; and Data analytics including qualitative analysis and quantitative statistics.

B. PRICE QUOTE

Factor 2: Price The Offeror shall submit a price quote, fully supported by cost and pricing data, in sufficient detail to allow for cost analysis that will be utilized to establish the reasonableness of the proposed costs.

The Offeror's price quote shall consist of the following sections:

1. Standard Form 1449, Solicitation/Contract/Order for Commercial Items

2. Supporting Documentation: The contractor shall furnish a price breakdown in support of the

Performance Work Statement (PWS) and deliverables.

C. AWARD CRITERIA

1. The Government will make an award to the responsible Offeror whose offer represents the best value in terms of technical capability and price. All non-price factors (i.e., technical approach and past performance) are significantly more important than price.

7 | P a g e

2. Best Value Determination: Determining the best value of the solicitation includes the following factors:

Factor A: Technical Factor B: Past Performance Factor C: Price

3. Each of the three (3) factors will be evaluated on a stand-alone basis. Factor A will be evaluated using points, Factor B will be evaluated based on confidence level, and Factor C will be evaluated on a total price basis.

4. The Technical Factor is more important than the Price Factor. The Price Factor is more important than the Past Performance Factor. The Technical Factor and Past Performance Factor when combined are significantly more important than the Price Factor.

5. Selection of Offeror(s):

a. Each quote will be evaluated utilizing point scores and written critiques.

b. The Government reserves the right to make an award without further discussion of the RFQ received. Therefore, it is important that the RFQ be submitted initially on the most favorable terms from both the technical and price standpoints.

c. The Government reserves the right to make a single award, or no award. In addition, the RFQ may be amended or cancelled if determined to be in the best interest of the Government.

6. Evaluation Criteria Weights:

The evaluation will be based on the demonstrated capabilities of the prospective Offeror in relation to the needs of the project as set forth in the PWS. The following criteria are those that will be applied in the evaluation of your technical quote.

The quote will be evaluated using the following criteria and weights.

Evaluation Criteria Weights/Points Ability to Ramp Up Quickly 50 Corporate Capabilities 40 Personnel 10 Total 100

8 | P a g e

ATTACHMENT A – SF1449

This page is left blank intentionally.

9 | P a g e

ATTACHMENT B

PERFORMANCE WORK STATEMENT

1. BACKGROUND

On January 9, 2020, the World Health Organization announced that there were 59 cases of coronavirus-related pneumonia. Just one year later, the United States has experienced over 24 million confirmed COVID-19 cases and over 400,000 COVID-19 deaths. America has just 4% of the world’s population, but 25% of the world’s COVID-19 cases and 20% of all COVID-19 deaths. The United States continues to experience the darkest days of the pandemic, with record numbers of cases, hospitalizations and deaths. Over 77,000 Americans lost their lives to COVID-19 in December, and across the nation businesses are closing and hospitals are full.

Immunization with a safe and effective COVID-19 vaccine is a critical component of the United States strategy to reduce COVID-19-related illnesses, hospitalizations, and deaths and to help restore societal functioning. The goal of the U.S. government is to have enough COVID-19 vaccine for all people in the United States who wish to be vaccinated. Early in the COVID-19 Vaccination Program, there may be a limited supply of COVID-19 vaccine, and vaccination efforts may focus on those critical to the response, providing direct care, and maintaining societal function, as well as those at highest risk for developing severe illness from

COVID-19.

To ensure our nation's underserved communities and those disproportionately affected by COVID-19 are equitably vaccinated against COVID-19 under the White House National Strategy for the COVID-19 Response and Pandemic Preparedness, the Health Resources and Services Administration (HRSA) and the Centers for Disease Control and Prevention (CDC) would collaboratively launch the Health Center COVID-19 Vaccine Program to directly allocate a limited supply of COVID-19 vaccine to selected HRSA-funded health centers starting in February.

This will be an incremental effort as more vaccine becomes available and will be carried out in coordination with the jurisdictions and health centers to advance primary care and public health integration. This program complements existing jurisdictional efforts to ensure equitable and effective access by providing an additional vaccine supply directly to all HRSA-supported health centers that specialize in caring for disproportionately affected populations.

HRSA-supported health centers are community-based and patient-directed organizations that deliver affordable, accessible, quality, and cost-effective primary health care to medically underserved communities and disproportionately affected populations, including high-need urban, rural, and frontier communities across the United States.

10 | P a g e

Nationwide, over 1,400 HRSA-supported health centers operate more than 14,000 sites, providing primary and preventive care on a sliding fee scale to over 30 million patients each year. Over 91% of health center patients are individuals or families living at or below 200% of the Federal Poverty Guidelines and nearly 63% are racial/ethnic minorities. Health centers across the nation are playing vital roles in supporting local community responses to the COVID-19 public health emergency.

HHS/HRSA will be administering the Health Center COVID-19 Vaccine Program to distribute a limited supply of COVID-19 vaccine to HRSA-supported health centers through direct federal allocation program. HHS is seeking to procure professional services to establish project management across the portfolio of Health Center COVID- 19 Vaccine Program activities. These services will help to enhance strategic planning and data-driven decision-making. In addition, these services will enable improved risk management and a more efficient response to rapidly emerging issues.

2. PURPOSE/GENERAL DESCRIPTION

The purpose of this contract is to develop a framework for and to carry out project management and project planning for the implementation of Health Center COVID-19 Vaccine Program for participating HRSA-supported health centers and their clinical services delivery sites.

In meeting the objectives of the contract, HRSA is addressing core responsibilities for the implementation of Health Center COVID-19 Vaccine Program, a large scale, and rapidly deployed public health response project. The scope of this activity include:

1. Project Management

2. Program Management Support

3. Program Integrity, Monitoring and Risk Management Support

4. Strategic Communication Outreach and Coordination of Stakeholder

Engagement/Information Management

5. Reporting and Data Analytics Support

6. Technical assistance

3. PROBLEM STATEMENT

HRSA is in need of immediate assistance in scaling up its capacity to implement, manage and monitor the Health Center COVID-19 Vaccine Program as well as assistance in establishing the internal controls and procedures necessary to ensure efficient and comprehensive management of the COVID-19 vaccination administration

11 | P a g e within the Health Centers.

4. PERIOD OF PERFORMANCE/PLACE OF PERFORMANCE

The period of performance is a 12-month base period plus one (1) 12- month option period. The Contractor shall perform the work under this contract off-site, primarily at the contractor’s facilities.

5. TASKS

The Contractor shall perform the following tasks.

TASK 1 PROJECT MANAGEMENT

The contractor shall:

1.1 Single Point of Contact

Provide a single point of contact for the management of all aspects of this contract to the Contracting Officer’s Representative (COR). The point of contact shall be responsible for ensuring that the services and deliverables required by HRSA are provided in accordance with the contract.

1.2 Kickoff Meeting

• Meet with the COR and other HRSA representatives within two (2) business days of the effective date of the contract (EDOC) activities for this project. One (1) day prior to the kickoff meeting, the contractor shall provide an agenda for the meeting.

• At the kickoff meeting, provide an updated project management plan and timeline, updated roster of key personnel, a roster of all personnel and roles, signed Non- Disclosure Agreements, and proposed communication schedule/plan.

• Submit detailed minutes of the meeting to the COR within one week.

The objectives of the kickoff meeting are to:

12 | P a g e

1. Initiate the communication process between HRSA and the contractor by introducing key project participants and identifying their roles.

2. Ensure the contractor understands the expectations of key stakeholders regarding the scope of work and the effort described in this contract, including task requirements and objectives.

3. Discuss critical aspects of the Project Management Plan (PMP) and deliverables.

4. Review communication ground rules.

5. Define a roadmap to a successful project.

1.3 Weekly Conference Calls

Chair weekly conference calls with the COR and HRSA representatives, providing an agenda with action items and any corrections within 24 hours of the meeting during the first three (3) months of the period of performance.

1.4 Ad Hoc Conference Calls

Chair and conduct up 250 ad hoc meetings with the COR and HRSA representatives to be scheduled at the request of the COR throughout the 12-month period of performance.

1.5 Weekly Status Report

Submit a weekly progress reports and project updates to the COR for the first three months after the effective date of the contract.

1.6 Draft Final Report

Develop final report that encompasses the project accomplishments, programmatic goals, national impact, barriers, recommendations for preparation and plan of action of future humanitarian and public health crises. A draft of final report will be submitted to COR and HRSA program staff for review forty-five (45) days prior to the end of contract period.

1.7 Final Report

Within ten (10) days of receiving feedback from COR, the contractor shall submit a final report to the COR for approval that incorporates COR and HRSA program staff comments and feedback.

13 | P a g e

1.8 Project Management Documents

Develop and submit the following project management documents to the COR:

• Integrated Project Management Project Management Plan

• Business requirements documents with visual business workflows for the overall process

TASK 2 HEALTH CENTER COVID-19 VACCINE PROGRAM MANAGEMENT

2.1 Program Management Assessment, Plan, and Recommendations

• Conduct a rapid assessment of HRSA’s program management and oversight needs in support of the Health Center COVID-19 Vaccine Program building upon HRSA’s existing structures/infrastructure carrying out activities pertaining to the Health Center COVID-19 Vaccine Program.

• Based on the assessment, formulate recommendations regarding overall program management and submit to COR and HRSA staff for review and approval.

2.2. Program Management Plan

• Provide a Program Management Plan reflecting HRSA-approved recommendations for overall Program Management to include the following items:

1. Provide tools, workflows, templates and reporting frameworks to support

HRSA’s processes, management and oversight of the Health Center COVID- 19 Vaccine Program.

2. Identify any inter-dependencies, sequencing, milestones, risk/issues and performance measures for Health Center COVID-19 Vaccine Program activities.

3. Identify and provide recommendations throughout the implementation and planning process.

2.3. Program Management Plan Execution and Support Services

For up to 40 weeks from the effective date of the contract, the contractor shall:

• Execute program management implementation plans for organizational processes and systems to scale up and to improve the efficiency and effectiveness of Health Center COVID-19 Vaccine Program strategy and operations.

14 | P a g e

• Communicate progress on process and results on a regular basis, including any quick wins during this period.

• Support and resolve ongoing program implementation issues and escalations as they arise.

Upon achievement of national COVID-19 vaccine coverage, the contractor shall:

• Carry out the winding down process of the Health Center COVID-19 Vaccine Program.

• Facilitate public health and primary care integration and partnership transition planning between HRSA supported health centers and public health departments in states and jurisdictions for efficient and sustainable immunization infrastructure to support primary care and public health integration in future achievement of national immunization coverage targets and low incidence of vaccine-preventable disease.

TASK 3 PROGRAM INTEGRITY AND RISK MANAGEMENT

• Develop a strategy in support of HRSA carrying out program integrity, monitoring and risk management activities pertaining to the implementation of the Health Center COVID-19 Vaccine Program within 6-8 weeks from EDOC.

• Develop a program integrity strategic plan for the Health Center COVID-19 Vaccine

Program consistent with requirements of the CDC COVID-19 Vaccination Program, Vaccine Administration, Provider Requirements, federal and jurisdiction reporting requirements for Health Center COVID-19 Vaccine Program participants in accordance with HRSA Health Center Program Conditions of Participation.

• Conduct monitoring and risk management for the Health Center COVID-19 Vaccine

Program consistent with requirements of the CDC COVID-19 Vaccination Program, Vaccine Administration, Provider Requirements, federal and jurisdiction reporting requirements for Health Center COVID-19 Vaccine Program participants in accordance with HRSA Health Center Program Conditions of Participation.

TASK 4 STRATEGIC COMMUNICATION OUTREACH AND COORDINATION

OF STAKEHOLDER ENGAGEMENT/ INFORMATION

MANAGEMENT

15 | P a g e

4.1 Draft Health Center COVID-19 Vaccine Program Communications and Outreach Plan

Develop a proactive and reactive Health Center COVID-19 Vaccine Program-level communications and outreach plan. The plan development will be guided by and implemented in close coordination with the HHS, CDC, senior health officials, and state, local, and territorial health departments. It shall inform all staff and key stakeholders on requirements for participation in the Health Center COVID-19 Vaccine Program as well as progress and impact of the Health Center COVID-19 Vaccine Program in support of HRSA’s proactive and reactive communication to internal and external stakeholders.

4.2 Recommendations of Communications Strategy

Provide recommendations on a communications strategy to ensure consistent messaging, especially as the Health Center COVID-19 Vaccine Program evolves.

4.3 Strategic Communication Outreach Support Services

Provide response to external inquiries in high-stress/visibility situations by including development of response templates, mechanisms for tracking and analyzing inquiries to inform a response strategy. Provide fact sheet and FAQ for program participants. Prepare and provide senior leadership brief materials to support HRSA’s response to external inquiries.

TASK 5 REPORTING AND DATA ANALYTICS SUPPORT

5.1 Program Analytic and Data Visualization Services

• Provide quantitative and qualitative analytical services in support of the Health Center COVID-19 Vaccine Program through analysis of participants’ readiness assessments, weekly Health Center COVID-19 Survey, and performance outcome data to inform internal operational management and to disseminate to external audiences on a weekly basis.

• Develop a user-friendly data dashboard for the purposes of accessing data and evaluating the impact of the Health Center COVID-19 Vaccine Program. This dashboard will enable users to explore and download associated datasets and generate descriptive summary statistics on the impact of the program.

5.2 Vaccine Analytic Services

• Provide and prepare weekly vaccine ordering and inventory analysis for CDC’s Vaccine Tracking System (VTrckS) and Vaccine Provider Ordering Portal (VPoP) for all Health

16 | P a g e

Center COVID-19 Vaccine Program participants.

• Provide weekly program evaluation analysis that incorporating data and information from Tiberius. Tiberius was developed by operation warp speed and is the collaborative effort led by the Department of Health and Human Services and the Defense Department to develop, manufacture and deliver safe and effective COVID-19 vaccines to Americans. It contains multitude of sources including the U.S. Census, Vaccine Tracking System and commercial logistics companies. Tiberius provides visibility of each effort within Operation Warp Speed from manufacturing and allocation of vaccine to granular planning of vaccine administration sites to the provider level across the jurisdictions of 64 U.S.

states, territories and large metropolitan cities.

5.3 Ad hoc Analytics

Provide 50 ad hoc analytics in support of the Health Center COVID-19 Vaccine Program reporting and program evaluation. These ad hoc reports shall take no more than 48 hours to develop as they are often used to support time-sensitive inquiries and/or briefings. These reports shall include statistical visualizations to help convey key messages informed by large quantities of data (e.g., box and whisker plots, histograms, etc.)

5.4 Final Analytic Dataset

Provide final analytic file and data dictionary containing information for Health Center COVID-19 Vaccine Program implementation related activities for participating HRSA supported health centers.

• This analytical file shall be validated and viable for statistical analyses and may require the need for statistical imputation. A Restricted Use File (RUF) shall be developed with no redactions for internal use. A Public Use File (PUF) shall be made available either through the HRSA Freedom of Information Act (FOIA) Reading Room or on a BPHC stand-alone webpage for public use. The public use file will maximize efforts to protect patient confidentiality and proprietary information of health centers.

TASK 6 TECHNICAL ASSISTANCE

All 1400 HRSA supported health centers are eligible for this voluntary program.

The contractor shall:

6.1 Technical Assistance

Provide training and technical assistance and facilitate peer learning to all participants of the Health Center COVID-19 Vaccine Program.

17 | P a g e

6.2 Technical Assistance and Performance Improvement Support

• Provide around the clock technical assistance including group and one-on-one supports for health centers based upon Health Center COVID-19 Vaccine Program participants identified needs informed by weekly Health Center COVID-19 Surveys and participant inquiries in areas such as reporting, vaccination administration, vaccine confidence, patient engagement and education.

• Facilitate online peer learning utilizing adult learning model to support Program participants

6.3 Continuous Quality Improvement of Technical Assistance

• Provide data-informed, rapid cycle, continuous quality improvement of technical assistance delivery. The technical assistance shall respond to program participant feedback efficiently through weekly improvements to process and effectively in improving program participants’ ability to carry out vaccine administration.

• Troubleshoot issues in readiness, jurisdiction coordination, COVID-19 Vaccine Ordering Process and reporting, and operational aspect of the vaccine administration process.

TASK 7 FEDERAL RECORDS MANAGEMENT

7.1 Records Management

• The contractor shall manage and maintain Federal records, including electronic records, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters. 21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate recordkeeping systems for electronic records?

& 1236.22 What are the additional requirements for managing electronic mail records? (http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010-05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010- 05.html), Guidance on Managing Records in Cloud Computing Environments.

• Managing the records includes, maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

7.2 Records Management Training

The contractor (and/or subcontractor) shall ensure that all employees having access to (1) http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25 https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html

18 | P a g e

Federal information or a Federal information system, or (2) personally identifiable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher course during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2020recordsmanagement/01_index.html.

At the end of the Records Management training, the “Congratulations" slide is considered your certificate of completion. Please send the completion certificates to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

TASK 8 SECURITY REQUIREMENTS

1) Applicability. The requirements herein apply whether the entire contract or order

(hereafter “contract”), or portion thereof, includes either or both of the following:

a. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

2) Safeguarding Information and Information Systems. In accordance with the Federal

Information Processing Standards Publication (FIPS)199, Standards for Security Categorization of Federal Information and Information Systems, the Contractor (and/or any subcontractor) shall:

a. Protect government information and information systems in order to ensure:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

• Availability, which means ensuring timely and reliable access to and use of information.

b. Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location. In addition, if new or unanticipated threats or hazards are https://humancapital.learning.hhs.gov/courses/2020recordsmanagement/01_index.html

19 | P a g e discovered by either the agency or contractor, or if existing safeguards have ceased to function, the discoverer shall immediately, within one (1) hour or less, bring the situation to the attention of the other party.

c. Adopt and implement the policies, procedures, controls, and standards required by the HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the HHS Information Security Program security requirements, outlined in the HHS Information Security and Privacy Policy (IS2P), by contacting the CO/COR or emailing fisma@hhs.gov.

d. Comply with the Privacy Act requirements and tailor FAR clauses as needed.

3) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

See the HHS Standard for the Definition of Sensitive Information, for additional information in defining and protecting sensitive information.

4) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor officer or employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

a. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

b. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

c. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

5) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this

20 | P a g e contract shall complete the HRSA non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Training

1) Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract shall complete the applicable HHS/HRSA Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract.

Thereafter, the employees shall complete HHS/HRSA Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training shall be compliant with HHS training policies.

2) Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

3) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy.

The training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

Rules of Behavior

1) The Contractor (and/or any subcontractor) shall ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, the HRSA Information Technology Rules of Behavior (included in the HRSA Information Security and Privacy Awareness Training), and any applicable system-level rules of behavior.

2) All Contractor employees performing on the contract must read and adhere to the Rules of

Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual HRSA Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable.

Incident Response

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

21 | P a g e

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII”.

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor), the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send notifications to affected individuals as expeditiously as practicable, without unreasonable delay, and in accordance with applicable law.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Security Operations Center (SOC), COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contract information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

a. cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

b. not include any sensitive information in the subject or body of any reporting e-mail; and

c. encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable

Information, HHS, and HRSA incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls.

22 | P a g e

Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract is a non-sensitive T2 moderate risk background investigation will be processed for the contractors working this project.

Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees shall comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

For additional information, see HSPD-12 policy at: https://www.dhs.gov/homeland-security-presidential-directive-12)

Roster. The Contractor (and/or any subcontractor) shall submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster shall be submitted to the COR, with a copy to the Contracting Officer, within 14 days of the effective date of this contract. Any revisions to the roster as a result of staffing changes shall be submitted within 14 days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor shall provide a position description and the Government will determine the appropriate suitability level.

Contract Initiation and Expiration

1) General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor shall follow the HRSA EPLC framework and methodology (https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared Documents/z_Old PMO Archives/Documents.aspx) and in accordance with the HHS Contract Closeout Guide (2012).

2) System Documentation. Contractors (and/or any subcontractors) must follow and adhere to NIST SP 800-64, Security Considerations in the System Development Life Cycle, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html https://www.dhs.gov/homeland-security-presidential-directive-12 https://www.dhs.gov/homeland-security-presidential-directive-12 https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared%20Documents/z_Old%20PMO%20Archives/Documents.aspx https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared%20Documents/z_Old%20PMO%20Archives/Documents.aspx

23 | P a g e

3) Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

4) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 10 days before an employee stops working under this contract.

5) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e.,…