SAM RFI_Visiting Scholar.pdf

REQUEST FOR INFORMATION (RFI)

Agency/Office: HHS/HRSA/OAMP Contracting Office Location: 5600 Fishers Lane, Rockville, MD 20857 Reference Number: 75R60223Q00203 Title: HRSA Visiting Scholar Program NAICS Code: 541990 (All other Professional, Scientific, and

Technical Services), Size Standard of $19.5M PSC Code: R499 (Support – Professional: Other) RFI Response Date: 9:00 AM (ET), August 29, 2023

This Request for Information (RFI) is issued by the Health Resources and Services Administration (HRSA) for the purpose of planning and market research only; questions will not be entertained in response to this notice. A solicitation is not being issued at this time. This notice does not commit HRSA to issue a solicitation, nor does it restrict HRSA to a particular acquisition approach. Any information provided to HRSA as a result of this RFI, is strictly voluntary. Responses will not be returned, nor will HRSA reimburse respondents for the costs of preparing and/or submitting responses.

While the information obtained from RFI responses may be used for planning purposes, and/or in the development of an acquisition strategy or solicitation, there is no guarantee that any solicitations will result from this notice. Respondents are responsible for appropriately marking confidential or proprietary information contained in their responses.

BACKGROUND

The mission of Health Resources and Services Administration (HRSA) Bureau of Primary Healthcare (BPHC) is to improve the health of the nation’s historically medically underserved communities by assuring access to comprehensive, culturally competent, quality primary healthcare services. BPHC supports this mission through the Health Center Program, which is comprised of health centers that receive federal award funds (“health centers”) authorized by Section 330 of the Public Health Service (PHS) Act, as well as look alikes (LALs) that do not receive federal funding under Section 330 but meet requirements for designation under the program. Populations served by the program include but are not limited to people with lower incomes, residents of public housing, people experiencing homelessness, agricultural workers, racial and ethnic minorities, geographically isolated persons, persons living with HIV/AIDS, uninsured and underinsured persons, and persons with limited English proficiency.

The dynamic healthcare environment is shaped by factors such as changes in healthcare financing and delivery, value-based purchasing, increased focus on quality and performance improvement, as well as changes in federal and state reimbursement policies impacting primary care delivery. Thus, it is essential for BPHC and its training and technical assistance partners—including health centers, Health Center Controlled Networks (HCCNs), national training and technical assistance partners (NTTAPs), and Primary Care Associations (PCAs)— to have the ability to analyze and respond to the rapidly changing healthcare environment. To support effective program management and policies BPHC conducts research and analyses on healthcare topics that include prevention, improving health outcomes, reducing health disparities, and ensuring high quality care. These activities focus on high priority issues that will inform the HRSA’s budgetary, legislative, regulatory, and planning cycles.

HRSA oversees data assets that are utilized for health services research and program evaluation, including but not limited to the Uniform Data System (UDS), Health Center Patient Survey, Area Health Resources Files, and Ryan White HIV/AIDS data set. Also of note, HRSA is undertaking a data modernization effort to transform the aggregation of UDS clinical quality measures from health center- to de-identified patient-level data known as UDS Patient-Level-Submission (UDS+). UDS+ will enable robust analyses to better understand healthcare use patterns and the impact on health outcomes by studying the dynamic interactions of patient sociodemographic and social determinants of health.

To support, strengthen and build out BPHC’s research and evaluation capacity, it is necessary to expand and diversify analytical perspectives, as well as the pool of researchers. This contract facilitates the establishment and management of a visiting scholar program that fosters research opportunities for mid-career public health professionals and community health practitioners who are from historically underserved communities and/or work with underserved populations. The program shall be open to professionals from diverse disciplines such as healthcare providers, social workers, healthcare administrators, epidemiologists, or economists from academic and healthcare practice settings, including those with experience working in health centers.

PURPOSE

The purpose of this notice is to identify interested vendors that have the expertise and capacity to establish and manage a Visiting Scholar Program that provides practical research experience for three (3) full-time equivalent (FTE) Scholars (or a combination of full and/or part time) who are from historically underserved communities and/or work with underserved populations, and/or interested in conducting research with the Health Center Program through temporary contractual scholar appointments. Additionally, the Government requires expert project management services and support for research strategy, coordination, communication, and evaluation of this program.

RESPONSES TO RFI

In response to this RFI notice and DRAFT Statement of Work (SOW), HRSA is seeking to identify interested and capable vendors (both Small and Large) that will submit quotes in response to any resultant solicitation. Most specifically, HRSA requests that interested vendors submit a Technical Capability Narrative regarding their interest and associated expertise, capabilities, and capacity necessary to meet the Government’s requirement per Attachment A - DRAFT SOW.

RFI RESPONSE DEADLINE & FORMAT

Interested vendors are encouraged to respond to this notice. However, be advised that generic statements are not sufficient. Please submit your responses by 9:00 a.m. (ET), August 29, 2023 via email to gdillon@hrsa.gov, as follows:

Format

• Microsoft Word (or PDF) document with page size 8.5 by 11 inches, with a minimum of 1” margins

• Times New Roman, font size 12 with single-spacing between lines; smaller font is acceptable for tables and graphics

• Submission shall not exceed five (5) pages; cover page is not included in the total page count

Cover Page

• RFI Notice number, title, date of issuance

• Business name, address and point of contact phone and email

• Unique Entity Identifier (UEI), PSC code, NAICS code, and Size Status

Interest and Technical Capability Narrative

• Include proposed contract-type and justification, if other than FFP;

• Provide a Technical Capability Narrative that reveals the technical expertise, capability and capacity required to meet the Governments requirement per Attachment A – DRAFT SOW;

• Confirmation of intent to submit a quote in response to any subsequent solicitation, if issued; and

• Questions for the Government in response to this RFI, which will help to inform and shape any resultant solicitation, most effectively; however, Government responses to questions will not be provided in response to this RFI notice.

Questions shall be submitted as an Appendix to the Technical Capability Narrative.

Interest and technical capability narratives are not quotes and do not address actual cost or price details and information, other than structure. Interested vendors are asked for information which proves that they have expertise and capacity to meet the requirements of this work. Interested vendors should provide enough information for HRSA to make an informed determination of their capability to perform the work.

Respondents are requested to state their capabilities and expertise in clear and concise language.

mailto:gdillon@hrsa.gov

CONFIDENTIALITY

To the maximum extent possible, please avoid submitting confidential or proprietary information. Any confidential or proprietary information submitted shall be marked as such and will be protected from disclosure except as required by law. The Government reserves the right to use any unmarked information in any resultant solicitation(s).

DISCLAIMER & IMPORTANT NOTES

This notice does not commit the Government to award a contract or constitute an obligation of Federal funds. The Government reserves the right to use information provided by respondents for purposes other than those specified in this notice. The Government may not acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. Respondents will not be notified of the results of this market research. Responses will not be returned.

Attachment A: Statement of Work (SOW)

DRAFT Statement of Work (SOW) Visiting Scholar Program

I. Introduction

Background and Need

The mission of Health Resources and Services Administration (HRSA) Bureau of Primary Healthcare (HRSA) is to improve the health of the nation’s historically medically underserved communities by assuring access to comprehensive, culturally competent, quality primary healthcare services. HRSA supports this mission through the Health Center Program, which is comprised of health centers that receive federal award funds (“health centers”) authorized by Section 330 of the Public Health Service (PHS) Act, as well as look alikes (LALs) that do not receive federal funding under Section 330 but meet requirements for designation under the program. Populations served by the program include but are not limited to people with lower incomes, residents of public housing, people experiencing homelessness, agricultural workers, racial and ethnic minorities, geographically isolated persons, persons living with HIV/AIDS, uninsured and underinsured persons, and persons with limited English proficiency.

The dynamic healthcare environment is shaped by factors such as changes in healthcare financing and delivery, value-based purchasing, increased focus on quality and performance improvement, as well as changes in federal and state reimbursement policies impacting primary care delivery. Thus, it is essential for HRSA and its training and technical assistance partners— including health centers, Health Center Controlled Networks (HCCNs), national training and technical assistance partners (NTTAPs), and Primary Care Associations (PCAs)— to have the ability to analyze and respond to the rapidly changing healthcare environment. To support effective program management and policies HRSA conducts research and analyses on healthcare topics that include prevention, improving health outcomes, reducing health disparities, and ensuring high quality care. These activities focus on high priority issues that will inform the HRSA’s budgetary, legislative, regulatory, and planning cycles.

HRSA oversees data assets that are utilized for health services research and program evaluation, including but not limited to the Uniform Data System (UDS), Health Center Patient Survey, Area Health Resources Files, and Ryan White HIV/AIDS data set. Also of note, HRSA is undertaking a data modernization effort to transform the aggregation of UDS clinical quality measures from health center- to de-identif ied patient-level data known as UDS Patient-Level- Submission (UDS+). UDS+ will enable robust analyses to better understand healthcare use patterns and the impact on health outcomes by studying the dynamic interactions of patient sociodemographic and social determinants of health.

To support, strengthen and build out HRSA’s research and evaluation capacity, it is necessary to expand and diversify analytical perspectives, as well as the pool of researchers. This contract facilitates the establishment and management of a visiting scholar program that fosters research opportunities for health care and public health professionals who are from historically underserved communities and/or work with underserved populations.

Purpose

The purpose of this requirement is to establish and manage a visiting scholar program that provides practical research experience for three (3) full-time equivalent (FTE) scholars (or a combination of full and/or part time). The Contractor shall also provide expert project management for research strategy, coordination, communication, and evaluation of this program.

II. Period of Performance/Place of Performance

The period of performance shall be a three (3) year or 36-month Base Period from September 29, 2023, to September 28, 2026. All services shall be performed at the Contractor’s primary facility.

III. Tasks

The Contractor shall provide the personnel and services for the following task areas:

Task 1 - Federal Records Management Task 2 – Program Planning and Implementation Task 3 – Contract Management and Coordination Task 4 – Contract Initiation and Expiration Task 5 – Security Requirements Task 6 – Plain Language Guidelines

Task 1 - Federal Records Management

Task 1.1 - Records and Information Regulation Guidelines

The Contractor shall:

1. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and shall be managed and scheduled for disposition only as permitted by statute or regulation.

2. Not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

Task 1.2 - Records and Information Management

The Contractor shall:

1. Manage and maintain Federal records and/or information, including electronic records and/or information, ensuing from this contract in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters.

21, 29, 31, 33); 36 CFR § 1236.20 What are appropriate record keeping systems for electronic records? & 1236.22 What are the additional requirements for managing electronic mail records?

(http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25); NARA Bulletin 2013-02, http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5&node=36:3.0.10.2.25

August 29, 2013, Guidance on a New Approach to Managing Email Records (https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html); and NARA Bulletin 2010- 05 September 08, 2010 (http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html), Guidance on Managing Records in Cloud Computing Environments.

2. Managing the records includes maintaining records to retain functionality and integrity throughout the records' full lifecycle including: (1) maintenance of links between records and metadata, and (2) categorization of records to manage retention and disposal, either through transfer of permanent records to NARA or deletion of temporary records in accordance with NARA-approved retention schedules.

Task 1.3 - Records Management Training

The Contractor shall:

1. Ensure that all employees having access to (1) Federal information or a Federal information system, or (2) personally identif iable information (PII), complete the HHS Records Management Training before performing work under this contract, and thereafter completing the annual refresher training during the life of the contract. The training is located at https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html.

2. At the end of the Records Management training, please send the "Certif icate of Completion" to the Contracting Officer Representative (COR) of the contract. The listing of completed training shall be included in the first progress report. Any revisions to this listing as a result of staffing changes shall be submitted with next required progress report.

Task 2 – Visiting Scholars Program Planning and Implementation

The Contractor shall:

Task 2.1 - Establish an application process

The Contractor shall:

1. Application Process Plan. Develop and submit a draft plan that details how the visiting scholar application process will be implemented. The plan shall include the application, selection criteria, participant recruitment approach, electronic application submission process, marketing, selection and notif ication process with implementation tasks and timelines. The Contractor shall submit the draft plan to the COR for review within ten (10) business days after the effective date of the contract (EDOC). Following COR review and feedback, the Contractor shall submit a final plan within ten (10) business days for approval.

2. Application Process Implementation. Establish and implement an electronic application process as outlined in the approved plan. The Contractor shall make the approved application publicly available as well as monitor and manage application submission according to the approach outlined in the plan.

https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.html http://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html https://humancapital.learning.hhs.gov/courses/2022recordsmanagement/01_index.html

3. Application Process Maintenance. Ensure application process implementation is maintained. The Contractor shall implement the application process to replace scholars as needed throughout the life of the contract.

Task 2.2 - Recruit participants

The Contractor shall:

1. Marketing. Promote the visiting scholar program and application process using targeted marketing strategies that have been successful for similar programs via health services research community channels such as websites, emails, newsletters, and social media. The Contractor shall also use recruitment strategies to target their membership and affiliates using their own proprietary listservs of health services research and health policy professionals. These include researchers, practitioners, healthcare providers, or policymakers from institutions within the Health Center Program, community-based organizations, grass-root agencies serving historically underserved communities and populations.

The Contractor shall also post web content to engage potential applicants in the visiting scholar program, including background information and program goals, eligibility requirements, selection criteria, information regarding the application process, submission of application materials, review criteria, and deadline information. The Contractor shall submit marketing content for COR review prior per deadlines outlined in the application process plan (Task 2.1).

2. Point of Contact. Serve as the main point of contact for inquiries from external stakeholders and applicants regarding the recruitment and application process.

Task 2.3 - Application Review, Selection, and Notification

1. Technical Assistance (TA) SMEs. Utilize TA Subject Matter Experts (SME) to review scholar applications and make selection recommendations to HRSA. The Contractor shall provide SMEs in fields that specialize in care access, quality, cost, and equity for primary care and community health in medically underserved US populations to participate in visiting scholar selection meetings.

2. Virtual Selection Meetings. Convene and facilitate virtual selection meetings to review visiting scholar applications in accordance with published selection criteria. The contractor shall schedule the virtual meetings; develop and disseminate agendas and other materials such as candidate application packets; and host using a platform with capabilities such as online voting to facilitate review and selection activities. All materials shall be shared with the COR at least ten (10) business days prior to the scheduled meeting.

3. Prioritized Applicant List. Document the recruitment process, including tracking selection recommendations and maintaining a ranked list of all candidates. The Contractor shall submit a prioritized list of applicants within five (5) business days of convening the final virtual selection meeting for COR review and final selection.

4. Applicant Notifications. Notify all applicants of the results (i.e., selected or not selected) once final selections have been made by HRSA. Notif ications via email are acceptable.

Candidates who have been selected for visiting scholar positions shall be notif ied first. Up to six candidates (3 FTEs or a combination of full and/or part time) may be selected as finalists and receive offers.

5. Scholar Rolling Replacements. In the event that a scholar is no longer available, provide backup candidates for immediate review and replacement.

Task 2.4 Professional Membership/Conference Management

1. Professional Membership Selection, Registration, and Payment. Facilitate identif ication, registration, and payment of one professional membership per scholar annually. The Contractor shall submit membership recommendations to the COR for approval prior to registration and shall allow for a minimum of fifteen (15) business days for HRSA clearance prior to registration. The recommendation shall include:

• membership name;

• rationale for how participation will benefit the scholar’s professional development; and

• copy of the membership acceptance letter or notice.

2. Professional Conference Selection, Registration, and Payment. The contractor shall facilitate identif ication, registration, and payment for each scholar to attend and/or present at two professional conferences or meetings annually. Payments will cover registration costs as well as travel and accommodations. The Contractor shall submit one (1) conference or meeting recommendation list per scholar annually to the COR for approval prior to registration and shall allow for a minimum of thirty (30) business days prior to registration. All conference and travel activities shall be reviewed and approved by the COR prior to implementation and payment. The recommendations shall include:

• conference or membership name;

• rationale for how participation will benefit the scholar’s professional development;

• if a conference, copy of conference request for abstract submission;

• copy of the conference or membership acceptance letter or notice; and

• if a conference, include the attendance date(s).

3. Abstract Submissions. Work with scholars to prepare and submit draft conference abstracts for COR review at least sixty (60) business days prior to conference deadlines.

The Contractor shall work with scholars to prepare and submit applications and approved abstracts to conference organizers.

4. Conference Materials (Presentations and Posters). Assist scholars with development of presentations, posters and other necessary materials for each professional meeting or conference for COR review. Final draft materials should be submitted for COR review at least sixty (60) business days prior to event deadlines. The Contractor shall work with scholars to prepare and submit approved presentations, posters, and other materials to conference organizers.

Task 2.5 Webinar Planning and Implementation

1. Webinar Topic Selection. Work with scholars to develop a list of 3 to 5 topics to facilitate topic selection for one (1) webinar during Year Three (3) to share research findings and scholar accomplishments. The webinar shall range from 1 to 1.5 hours in length. The Contractor shall submit the topic list ninety (90) days prior to the targeted webinar date as outlined in the annual work plan.

2. Webinar Content Development. Work with scholars to develop a content outline with learning objectives and submit to the COR within fifteen (15) business days of f inal topic selection. The Contractor shall work with scholars to submit draft slides for COR review within fifteen (15) days following outline finalization. The Contractor shall work with scholars to submit f inal slides with talking points at least f ifteen (15) business days prior to webinar date.

3. Webinar Logistics. Manage webinar logistics, including providing a webinar platform for hosting, creating the registration link, conducting dry runs prior to the webinar date, moderating, and recording the webinar. The Contractor shall submit the 508 compliant webinar recording files within fifteen (15) days after the webinar.

4. Post-Webinar Summary. Following the webinar, collect and analyze participant feedback and develop a summary of webinar metrics and participant feedback. The Contractor shall submit the summary fifteen (15) business days after the webinar.

Task 3 – Contract Management and Coordination

The Contractor shall:

Task 3.1. Project Planning

1. Post-Award Meeting. Participate in an in-person post-award meeting with the COR, within ten (10) business days after the Effective Date of the Contract (EDOC) to discuss the overarching goals and objectives of the contract, specific tasks, the schedule of performance, reporting mechanisms and formats, project management approaches, and any aspects of the project that need clarif ication.

2. Annual Work Plan. In consultation with the COR, the Contractor shall develop an Annual Work Plan for the duration of the contract that is consistent with HRSA’s priorities and HHS policies. A Draft Annual Work Plan shall be submitted to the COR within fifteen (15) business days of the EDOC. The COR will provide feedback within five (5) business days, and the Contractor shall submit the Final Annual Work Plan within fifteen (15) business days after receiving COR feedback and within fifteen (15) business days after the start of each option year, thereafter. The Annual Work Plan shall include:

a. schedule for completion of the proposed tasks, including major milestones;

b. staffing; and

c. list of deliverables for the reporting period.

3. Individual Visiting Scholar Work Plans. Work closely with each scholar to develop an individual work plan that is updated annually and as manuscript development progresses. The Contractor shall submit to the COR a draft work plan for each scholar within thirty (30) business days following onboarding of scholars, and a final workplan shall be submitted within ten (10) business days after receiving COR feedback. The Contractor shall work with each scholar to update individual work plans as manuscript development proceeds and annually. The Contractor shall submit annual updates to the COR within fifteen (15) business days of the start of Year Two (2) and Year Three (3). The work plan shall include:

a. schedule for completion of the proposed tasks, including major milestones;

b. description of how research projects and activities will align with HRSA priorities and research agenda;

c. description of how research projects and activities will contribute to the scholar’s development in at least one of the key in Learning Health System Research (see https://www.ahrq.gov/learning-health-systems/building-workforce.html); and

d. list of proposed research questions.

Each scholar is expected to develop, at a minimum, one peer-reviewed manuscript for publication submission annually, in consultation with the COR. As part of work plan reviews, the COR will approve research questions for manuscript development.

4. Visiting Scholar Orientation. Plan and facilitate one (1) to two (2) virtual orientation meetings annually to include scholars and HRSA staff that will cover topics including Health Center Program research, visiting scholar program purpose and expectations, overview of federal data sets, manuscript development and clearance process. The Contractor shall coordinate call logistics in coordination with the COR, provide the conference platform, and submit an agenda and other relevant materials for COR review no more than five (5) business days prior to scheduled orientation meetings.

Task 3.2 - Contract Management https://www.ahrq.gov/learning-health-systems/building-workforce.html

1. Staff and Project Management. Manage personnel, f inancial, and material resources to ensure that all contract requirements are met. The Contractor shall also ensure that the contract is fully staffed with visiting scholars throughout the life of the contract.

Maintain, update, and submit to the COR a roster of Contractor personnel and their respective roles on a quarterly basis. Ensure that the following Key Personnel are available upon the EDOC:

• Project Director: Meets with client, determines program objectives, develops work plans, oversees planning and implementation of the scholar recruitment and application process, manages scholar onboarding and orientation processes, facilitates professional development opportunities for scholars (e.g., professional association membership, conference presentations), and provides overall project oversight. This position requires a Bachelor’s degree and a minimum of five (5) years of experience managing research fellowship programs and at least ten (10) years of experience in managing Government contracts is required. Must have experience in individual Project Management as well as management of several related projects simultaneously.

• Research Analyst: Meets with scholars, work with scholars to develop and implement individual work plans, guide scholars in developing analyses, manuscripts, conference abstracts and posters, and assist with scholar orientation. This position requires a Master’s degree or higher in social science, economics, public health, or a related field and a minimum of five (5) years of experience generating analytics and peer reviewed manuscripts; experience working with research fellows preferred.

2. Communication with Visiting Scholars. Maintain communications with the scholars to provide support to help achieve projected research milestones as outlined in their individual work plans, including meetings, emails, and calls.

3. Communication with HRSA. Maintain communications with the COR to apprise HRSA of any issues that affect the Contractor’s ability to provide the contracted services and/or meet deadlines.

4. Meetings. The Government will provide regular opportunities for the Contractor to communicate with the COR, such as conference calls, and meetings. The Contractor shall participate in all scheduled meetings and conference calls. Contractor management practices shall include proactive consultation and communication with the COR to address any issues affecting the successful operation of the contract. Regularly scheduled meetings must include:

a. Annual Kickoff Meeting (in person): Within ten (10) business days of starting Year Two (2) and Year Three (3), the Contractor shall schedule, coordinate, and participate in an in-person kickoff meeting, held at HRSA headquarters, 5600 Fishers Lane, Rockville, Maryland 20857, to review the scope of work and deliverables. The Contractor shall provide the meeting agenda to the COR within five (5) business days prior to the meeting. The COR shall make conference room arrangements and notify building security of need for access to building.

b. Monthly Status Calls (virtual): Conduct monthly status calls with the COR to discuss project activities, challenges, action items and next steps. The Contractor shall coordinate call logistics in coordination with the COR, provide the conference platform, and submit an agenda and other relevant materials for COR review no more than five (5) business days prior to each call.

c. Weekly Research Coordination Calls. Conduct weekly calls to include scholars and HRSA to discuss research activities such as manuscript concept plan development, preliminary analyses, content outline development, drafting of full manuscripts for peer reviewed publication, and conference abstract submission and presentations. The calls shall also help facilitate HRSA input, review and clearance needed for manuscript development, abstract submission, and conference presentation deliverables. The Contractor shall coordinate call logistics in coordination with the COR, provide the conference platform, and submit an agenda and other relevant materials for COR review no more than five (5) business days prior to each call.

Task 3.3. Reporting

1. Project Tracking. Maintain a project management tool that tracks the progress of deliverables, action items, the responsible party, and due dates, including meeting notes.

The Contractor and COR will have access to the tracker and the Contractor is responsible for updating it within five (5) business days of completing an assigned activity.

2. Monthly Reports. Submit a draft monthly report within (5) business days after the end of each reporting month; the COR will provide feedback within (5) business days for inclusion in the final report, which shall be due to the COR five (5) business days after receiving feedback. If the COR does not provide feedback within five (5) business days of receiving the draft report, the draft report shall be accepted as final. This report shall include:

• summary of activities for the reporting month for each major task.;

• issues encountered or anticipated and corrective actions or proposed solutions;

• upcoming activities, with timelines and due dates, for the next reporting months;

and

• f inancial section, shown by tasks, anticipated budget by task for the year, expenses for current month, annual expenditures to date, estimated cost to complete, funds remaining and status of over/under/on track for budget.

3. Annual Reports. The Contractor shall submit a written draft report for submission to the COR thirty (30) business days prior to the completion of Year One and Year Two; the COR shall provide feedback within ten (10) business days for inclusion in the final version which shall be due five (5) business days after receiving feedback from the COR. The report shall include a summation of the work performed during, including links to published products, meetings and conferences scholars participated in and their roles, and documentation of professional membership.

4. Visiting Scholar Presentations. The Contractor shall schedule and facilitate at least one virtual presentation for each scholar annually to present their research activities and findings, and how the objectives and/or findings of these research projects inform the Health Center Program to HRSA. Presentations shall be conducted within thirty (30) business days prior to the completion of each contract year. The Contractor shall schedule and facilitate the virtual presentations. The HRSA research presentation is separate from the professional membership/conference attendance expectation.

5. Final Report. The Contractor shall submit a draft Final Report thirty (30) business days prior to the completion of Year Three (3) of the contract; the COR shall provide feedback within ten (10) business days for inclusion in the final version which shall be due five (5) business days after receiving feedback from the COR. The report shall include:

• Summation of all work performed during the life of the contract.

• Lessons learned and recommendations for future program planning and implementation.

• Evaluation of how the program has (1) furthered the visiting scholars’ research goals and to determine which areas may stand in need of improvement, and (2) improved the visiting scholars’ knowledge of the Health Center Program and competencies in Learning Health System Research (see https://www.ahrq.gov/learning-health-systems/building-workforce.html

Task 4 – Contract Initiation and Expiration

1. General Security Requirements. The Contractor (and/or any subcontractor) shall comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the Contractor shall follow the HRSA EPLC framework and methodology (https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared Documents/z_Old PMO Archives/Documents.aspx) and in accordance with the HHS Contract Closeout Guide (2012).

2. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) shall provide all required documentation to the CO and/or COR to certify that, at the government’s direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

HHS EA requirements may be located here:

https://www.hhs.gov/ocio/ea/documents/proplans.html https://www.ahrq.gov/learning-health-systems/building-workforce.html https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared%20Documents/z_Old%20PMO%20Archives/Documents.aspx https://sharepoint.hrsa.gov/oo/oit/dcppm/pmo/Shared%20Documents/z_Old%20PMO%20Archives/Documents.aspx https://www.hhs.gov/ocio/ea/documents/proplans.html

3. Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO within 10 business days before an employee stops working under this contract.

Task 5 - HHS Policy for Information Technology Procurements - Security and Privacy Language

The Contractor shall:

I. Procurements Requiring Information Security and/or Physical Access Security

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, f irmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/HRSA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

iii. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/HRSA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/HRSA security and/or privacy officials.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable HHS/OpDiv privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identif iable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identif ied as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy

Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certif icate from the

NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notif ied in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and HRSA policies. Unauthorized disclosure of information will be subject to the HHS/HRSA sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate. See Appendix A for baseline deliverables.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and

Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certif icate from the NIST

CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and HRSA-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certif icate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR.

v. Use the Key Management system on the HHS personal identif ication verif ication (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption http://csrc.nist.gov/publications/ keys must be provided to the COR upon request and at the conclusion of the contract.

2. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of

Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identif iable information or (2) an authorized user accesses or potentially accesses personally identif iable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certif icate from the NIST

CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send HRSA approved notif ications to affected individuals following specific instructions from the HHS Privacy Incident Response Team (PIRT).

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the HRSA Computer Security Incident Response Team (hrsacsirt@hrsa.gov) or 301-443-3333, COR, CO, HRSA SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable HRSA and HHS policy and procedures, NIST standards and guidelines, as well as US- CERT notif ication guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the

Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

mailto:hrsacsirt@hrsa.gov

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of

Personally Identifiable Information, and HHS and HRSA privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

3. Contract Initiation and Expiration

a…