Section C - Draft Performance Work Statement (PWS).pdf

Food and Drug Administration

Section C

Office of The Commissioner (OC)

FDA Sentinel 3.0 Data Broker Services

DRAFT Performance Work Statement (PWS)

March 02, 2026

Table Of Contents Background

Purpose

Scope

1 REQUIREMENTS

1.1 TASK AREA 1 – DATA BROKER SERVICES

1.2 TASK AREA 2 – REQUIRED DATA SERVICES (TIERS 1 – 6)

1.3 TASK AREA 3 – ADDITIONAL DATASET ACQUISITION AND ACCESS SERVICES (OPTIONAL)

2 PERFORMANCE CONSTRAINTS

3 GOVERNMENT-FURNISHED PROPERTY, EQUIPMENT, INFORMATION (GFP/GFE/GFI)

4 SECURITY AND PRIVACY

5 ACCESS TO NON-PUBLIC INFORMATION

6 PLACE OF PERFORMANCE

7 PERIOD OF PERFORMANCE .......................................................... Error! Bookmark not defined.4

8 CONTRACTOR PERFORMANCE EVALUATIONS

9 OWNERSHIP OF WORK PRODUCTS

MONTHLY PROGRESS AND FINANCIAL REPORTING FOR LABOR-HOUR TASK ORDERS

11 ATTACHMENT LIST OF APPLICABLE DOCUMENTS

12 GLOSSARY OF ABBREVIATIONS, ACRONYMS AND DEFINITIONS

Background The Food and Drug Administration Amendments Act of 2007 (FDAAA) directed the U.S.

Food and Drug Administration (FDA) to strengthen its postmarket safety surveillance capabilities by establishing an active risk identification and analysis system capable of monitoring the safety of FDA-regulated medical products across a population of at least 100 million individuals. FDAAA further requires FDA to determine whether available postmarket surveillance data and analytic capabilities are sufficient to assess safety concerns prior to requiring additional postmarket studies or clinical trials.

In response, FDA established the Sentinel Initiative—an agency-wide effort to leverage real-world healthcare data and advanced analytic methods to support regulatory decision-making. Since 2009, Sentinel has evolved through multiple phases, including Mini-Sentinel and Sentinel System versions 1.0 and 2.0, expanding FDA’s ability to access healthcare data, conduct active surveillance, and respond to emerging public health needs.

FDA Centers have developed complementary postmarket surveillance approaches aligned with their regulated products and statutory responsibilities. CDER implemented the Sentinel System and its Active Risk Identification and Analysis (ARIA) capability. CBER advanced biologics surveillance through the Biologics Effectiveness and Safety (BEST) Initiative. CDRH invested in medical device surveillance capabilities, including collaborations such as the National Evaluation System for Health Technology (NEST), with a continued focus on improving device identification in healthcare data (including Unique Device Identifier (UDI) capture).

Building on these efforts, FDA is transitioning to Sentinel 3.0—a modernized, enterprise approach intended to improve scalability, timeliness, and responsiveness across FDA’s postmarket safety surveillance activities. Sentinel 3.0 is structured as coordinated components that include (1) data access and acquisition, (2) a Government-developed data platform for ingestion and analytics enablement, and (3) scientific services to support study execution. This Performance Work Statement (PWS) addresses the data access and acquisition component only.

Purpose The Government is transitioning Sentinel to a real-time surveillance platform. The goal of this Sentinel 3.0 Data Broker Services is to continue meeting or exceeding legislative requirements, promote program efficiency, and provide governed, scalable access to the data assets needed to support Sentinel 3.0 platform operations and study execution— while maintaining flexibility to address emerging safety issues and rapidly changing public health needs.

The Sentinel 3.0 Initiative fulfills the Food and Drug Administration Amendments Act (FDAAA) of 2007 (Sec 905) requirement for an active postmarket risk identification and analysis system. FDAAA requires that FDA access disparate data sources to link and analyze safety data to cover at least 100 million U.S. patients. CDER, CBER, and CDRH developed various approaches to conduct complementary postmarket safety surveillance activities utilizing population-based data sources tailored to the regulated products under the purview of each center. The FDA is consolidating postmarket safety surveillance activities utilizing population-based data sources conducted through the Sentinel 3.0 System, CBER Biologics Effectiveness and Safety (BEST) Initiative, and CDRH under the new Sentinel 3.0. The proposed new system will provide a collaborative, central framework for active surveillance activities for CDER, CBER and CDRH.

The Sentinel 3.0 Data Broker Services Contractor shall serve as the Data Broker, responsible for acquiring, licensing, governing, and providing FDA with access to healthcare data assets required to support the Sentinel 3.0 program and related postmarket safety surveillance activities.

The Contractor shall provide FDA with governed access to commercial healthcare claims data, Healthcare Insurance Claims–EHR linked data, EHR and registry data, Centers for Medicare & Medicaid Services (CMS) data, and outpatient prescription data, consistent with Tiers 1–6 defined in this PWS.

Any access or use granted to external HHS partners shall be subject to applicable data use agreements (DUAs), Memorandum of Understanding (MOU), or FDA governance procedures to ensure protection of data integrity, confidentiality, and compliance with program objectives.

The Sentinel 3.0 program will include the following components:

1. Data Broker Services (Tiers 1–6): Provides FDA with governed access to diverse healthcare data sources, including commercial and CMS claims data, outpatient prescription data (subscription with user interface), claims aggregator data, Healthcare Insurance Claims–EHR linked data, specialty EHR data, disease and product registries, registry networks, and Health Information Exchange (HIE) data.

Under the Data Broker Services model, the Contractor serves as the single accountable entity responsible for identifying, acquiring, licensing, managing, and governing access to all data assets, including coordinating with third-party data providers as needed. Data sources capable of linkage to Immunization Information Systems (IIS) and medical device utilization data (including Unique Device Identifier (UDI) information) are particularly valuable to FDA operations.

2. FDA Data Platform: A Government-developed platform that will provide repository, interoperability, and analytic enablement services for Sentinel 3.0 data. The platform also incorporates AI-enabled data repository services and informatics tools that facilitate data analysis through standardized terminologies and clinical-to-operational translations capabilities.

3. Studies-As-A-Service: Provide scientific services including data analytics support for complex pharmacoepidemiology and pharmacovigilance studies, as well as advanced AI-based analytics capabilities.

The FDA Data Platform is a Government-developed, cloud-based data and analytics environment that provides a highly secure, centralized foundation for ingesting, managing, and analyzing data in support of FDA’s public health mission. The platform operates within a Federal Information Security Management Act (FISMA) High Authority to Operate (ATO) environment and is production-ready, scalable, and designed to support enterprise-wide regulatory and analytical needs.

The FDA Data Platform is capable of ingesting and managing the data types described in this PWS, including structured and semi-structured healthcare data such as commercial healthcare insurance claims, claims–EHR linked data, registry data, Centers for Medicare & Medicaid Services (CMS) data, and outpatient prescription data, in accordance with FDA standards for data security, privacy, and interoperability. This description is provided for situational awareness only and does not create additional requirements for the Data Broker Services Contractor beyond those explicitly stated in this PWS.

A single Data Broker Services Contractor will be responsible for acquiring, licensing, governing, and providing FDA access to healthcare data required to support Sentinel 3.0 post-market safety surveillance activities. This includes managing access to data across Tiers 1–6, whether through proprietary data assets, third-party data sources, or a combination thereof, while retaining full contractual, legal, and compliance responsibility for all data delivered under this PWS.

Table 1: Sentinel 3.0 Scope

Tier(s) Grouped Tier(s) Topic Area(s) Tier 1

Data Broker Services

Commercial Healthcare Insurance Claims Data

Tier 2 Commercial Healthcare Insurance Claims Data from Third- Party Aggregator(s) (access to medical records is not required)

Tier 3 Healthcare Insurance Claims-EHR Linked Data

Tier 4

EHR Data (including oncology, pediatrics, geriatrics, inpatient settings of care), Registry or Registry Network Data (product or disease-based registries), and Health Information Exchange (HIE) Data

Tier 5 Centers for Medicare and Medicaid Services (CMS) Data

Tier 6 Outpatient Prescription Data (subscription with user interfaces and raw data)

Scope Sentinel 3.0 will be led by the FDA Office of the Commissioner. A key element of the Sentinel 3.0 operational framework is the establishment of a flexible and cost-effective data acquisition solution that provides FDA with access to high-quality, fit-for-purpose healthcare data across multiple domains.

Under the Data Broker Services model, the Contractor shall provide FDA with access to all data made available through the FDA Data Platform in support of Sentinel 3.0. The Contractor shall be issued task orders to provide broker-managed data acquisition and access services consistent with the Tier(s) specified in each task order.

The Contractor may subcontract with or otherwise broker access to third-party data providers within the scope of the awarded Tier(s). The Contractor shall retain full contractual, legal, and compliance responsibility for all brokered data assets, including management of data use agreements (DUAs), data governance, privacy protections, and delivery of data to the FDA Data Platform.

The Contractor shall coordinate with FDA and other Sentinel 3.0 support contractors, including the Studies-As-A-Service contractor, as required to support study design, data access, and analytic execution.

The following is a high-level description of key functions of Sentinel 3.0 components to manage a typical request for Sentinel 3.0 services (e.g., scientific consultations, requests for data to address regulatory questions).

• The FDA will receive requests for Sentinel 3.0 services (e.g., scientific questions, requests for information, or consultation) from FDA staff. These requests will be triaged and as appropriate, initiated as new projects and tracked through the Sentinel 3.0 governance process. In collaboration with the Studies-As-A-Service component, the Government will define an overall approach to address each request, including identifying data needs and determining when engagement of the Data Broker Services Contractor is required.

• FDA staff, the Studies-As-A-Service component, and the Data Broker Services Contractor shall collaborate to identify the most appropriate data resources and analytic approaches to address the scientific question. This collaboration includes development of the study protocol and methods, including the Statistical Analysis Plan (SAP) and any required programming or data specifications.

• The Data Broker Services Contractor shall be responsible for acquiring, preparing, and providing access to the required data assets in accordance with the approved protocol, including performing applicable data quality checks and delivering data or study-specific outputs in a timely manner.

• The FDA Data Platform provides a secure environment through which the Data Broker Services Contractor, the Studies-As-A-Service component, and FDA staff may exchange data and analytic outputs. Data made available through the platform may include broker-managed licensed datasets or study-specific datasets generated in response to approved surveillance or analytic requests.

• The Studies-As-A-Service component is responsible for conducting secondary quality review of analytic outputs, integrating results across datasets when applicable, and supporting interpretation and synthesis of findings for FDA regulatory decision-making.

1 REQUIREMENTS

Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform the following:

1.1 TASK AREA 1 – DATA BROKER SERVICES

The Government requires primary and continuous Data Broker for the Sentinel 3.0 Program, responsible for acquiring, licensing, governing, and providing FDA access to healthcare data across all applicable Task Areas, including but not limited to Tiers 1–6.

The Contractor may fulfill these requirements through a combination of proprietary data assets and third-party data sources, provided that the Contractor retains full contractual, legal, and compliance responsibility for all data delivered under this PWS.

This task area encompasses the assessment, acquisition, and preparation of diverse healthcare datasets to support the FDA Sentinel 3.0 Program. The Contractor shall be responsible for identifying, evaluating, and procuring commercial claims, Healthcare Insurance Claims-EHR Linked Data (EHR), specialty datasets, registry data, outpatient prescription data, or Centers for Medicare & Medicaid Services (CMS) claims data. It is important that the Contractor have access to medical charts at the patient level for review, abstraction, and adjudication. The Contractor shall ensure that all acquired datasets are compatible with the Sentinel 3.0 FDA data platform and can be linked across sources using privacy-preserving record linkage (PPRL) methods.

The Contractor shall work in close coordination with the Government and other Sentinel

3.0 support contractors (e.g., platform operations and Studies-As-A-Service) to ensure that data assets are delivered in formats and structures consistent with FDA Sentinel 3.0 standards for ingestion, normalization, and integration. All data acquisition activities shall comply with applicable federal laws, regulations, and data use agreements.

1.2 TASK AREA 2 – REQUIRED DATA SERVICES (TIERS 1 – 6)

1.1. The Contractor shall establish and operate an enterprise-level Executive Leadership

Team to oversee all aspects of Data Acquisition operations.

1.2. The Contractor shall establish and maintain business partnerships and DUAs to ascertain electronic healthcare data of tens of millions patient lives.

1.3. Under this single-award Data Broker Services model, the Contractor shall be capable of fulfilling requirements across any or all Tiers 1–6 through proprietary assets and/or brokered licensing arrangements.

1.3.1. Tier 1 - Commercial Claims Data – Direct Sources: The Contractor shall assess and acquire commercial healthcare insurance claims data covering approximately tens of millions patient lives including both open and closed claims from direct payer sources. The Contractor shall evaluate candidate data sources based on FDA Sentinel 3.0 criteria, negotiate acquisition terms, and ensure datasets are delivered in formats that support ingestion into the FDA Sentinel 3.0 platform. For CBER studies, the Contractor should have DUAs with state/local Immunization Information Systems (IIS) to enhance vaccine exposure information through claims/IIS data linkages.

1.3.2. Tier 2 - Commercial Claims Data – Aggregators: The Contractor shall assess and acquire commercial healthcare insurance claims data covering approximately 100 million patient lives from qualified third-party data aggregators. This shall include validation of the aggregator’s sourcing methodology, data coverage, refresh rates, and alignment with Sentinel 3.0 data quality standards.

1.3.3. Tier 3 - Healthcare Insurance Claims-EHR Linked Data: The Contractor shall assess and acquire EHR data covering approximately tens of millions of patients’ lives from diverse care settings, including ambulatory, inpatient, and specialty care environments. Candidate datasets shall be evaluated for completeness, representativeness, and compatibility with Sentinel 3.0 data models.

1.3.4. Tier 4 - EHR, Registry and HIE Data: The Contractor shall assess and acquire EHR datasets (including oncology, pediatrics, geriatrics, inpatient care), product- or disease-specific registries, registry networks, HIE data as needed to support Sentinel 3.0 scientific and regulatory priorities.

1.3.5. Tier 5 - CMS Data: The Contractor shall establish and manage information access (IA) and DUAs with CMS for the acquisition of Medicare and/or Medicaid claims data. The Contractor shall ensure that all CMS-sourced datasets are received, stored, and used in accordance with CMS requirements and applicable privacy regulations. The Contractor shall ensure that claims data acquired directly from CMS can be linked to commercial data sources within FDA Sentinel 3.0 using PPRL methods. The Contractor shall validate linkage quality and document methodologies for FDA review.

1.3.6. Tier 6 – Outpatient Prescription Drug Use Data: Provide patient-level data describing outpatient prescription drug use (including retail, specialty, and outpatient clinics) in individuals longitudinally. The point-of-sale near real-time pharmacy transaction data shall provide immediate automated access with the ability to provide counts of current and historical aggregate national and sub-national drug utilization information. The longitudinal data shall include information at the prescription claim levels with the ability of characterizing concomitant drug use and characterizing duration of drug exposure The data shall capture all pharmacy transaction types including cash payments and coupons.

1.3.6.1. Provide de-identified, cleaned, ready-to-go, data that can be ingested into the FDA Data platform consisting of nationally based, outpatient prescription-level data that currently exist, commercially available, HIPAA-compliant format. The data shall include historical prescription information at a national and subnational level.

1.3.6.2. Provide a description of the Contractor’s data acquisition process for all data in all Tiers. All data flow and management procedures shall be described, including data acquisition, cleaning, and editing procedures, data deidentification procedures, specification, and description of all coding systems used for diagnoses, procedures, and drugs, including versions (e.g. ICD-9, ICD-10), methods for coding data, percentage of missing or incomplete information and the method of coding missing data, availability of raw/sample numbers as well as projected numbers, and the frequency with which data are updated and methods for updates. For each health care setting, the Contractor shall estimate the proportion captured in the data source out of the entire market and provide this estimation to FDA, updated at least semi-annually. A current and complete updated data dictionary and database description shall be provided annually and as changes are made.

1.3.6.3. The Contractor shall maintain access throughout the period of performance to the applicable data resources (e.g., Commercial Healthcare Insurance Claims, Claims–EHR Linked Data, Registry Data, CMS Data, Outpatient Prescription Data) for the awarded Tier(s) as described by the Contractor in its submitted Data Characteristics Table (Attachment A). The Data Characteristics Table shall serve as a binding representation of the Contractor’s proposed data assets for the awarded Tier(s), including but not limited to data provenance, population coverage, refresh frequency, linkage capabilities, historical depth, and applicable limitations. The

Contractor shall notify the Government in advance of any material changes to the data resources described in the Data Characteristics Table and shall obtain Government approval prior to substituting or materially modifying any data asset relied upon to meet Task Area 1 requirements.

1.3.6.4. Provide the total number of years of data available overall and the number of years available and accessible in real-time to FDA personnel. A minimum total of ten (10) years of data (minimum of five (5) years of data available online and at a minimum an additional five (5) years of historical data that is no longer online) and propose methods to obtain historical data in a timely manner. FDA’s preference is that historical datasets be available on demand and without intervention from the Contractor.

1.3.6.5. Provide prescription-level data with the ability of analyzing current and historical aggregate national and sub-national dispensed prescription information at a minimum of monthly level, with the ability to aggregate data by time periods specified by the user. Patient level data shall provide the ability to analyze unique patients utilizing drug products in an outpatient setting, with the capability of stratifying by patient age and sex. Data shall have the capability of customizing patient age bands as needed. Patient-level data shall link to prescription-level data, allowing for the assessment of new versus continuing use of drugs at the molecule level and at the drug class level.

1.3.6.6. Provide the size and characteristics of the population of patients or covered lives from which the prescription-and patient-level data are derived, since these can affect the quality and usefulness of the data provided and the validity of national projections from the data. Characteristics shall minimally include: number of individual patients or covered lives per calendar quarter; number and percent of patients or covered lives with at least two years of continuous activity; number and percent of patients or covered lives with corresponding enrollment information;

availability of enrollment/eligibility/participant inclusion information for use in data analyses; number and percentage of active patients or covered lives in populations of special interest to FDA (including children [ages ≤ 17 years], females of child-bearing age, and elderly [ages ≥ 65 years]); turnover or churn rate for participation in the data resource; the method by which patient age is obtained; geographic diversity; patient demographics; coverage or inclusion policies relevant to pharmaceutical products under health care plans providing the majority of the data; and availability of medical claims data. The number and percent of the total population for whom clinical/medical data or data capturing the administration of drug or biologic products in the outpatient setting by healthcare professionals are available and detailed information describing how this information is linked to the pharmacy data is required. These longitudinal data shall follow uniquely identifiable individuals (using encrypted patient identifiers) and healthcare providers over time either across or within ambulatory health care plans. Patient age and sex shall be provided. Information on race/ethnicity shall be accompanied by documentation of the origin of this information, if available.

1.3.6.7. Provide prescription data with the therapeutic class of drug and biologic products (including biosimilars and interchangeable biosimilars), molecule(s), active ingredient(s) (e.g., single-ingredient or combination), molecular salt (if applicable), product name (U.S. proprietary and non-proprietary), original prescribed product, substitution allowability, strength, National Drug Code (NDC), company name (manufacturer or corporation), dosage form, strength, all dates dispensed, quantity dispensed, dispensed days’ supply, prescriber specialty, and method of payment. The Contractor shall provide the ability to obtain all data elements within a single dataset extract. The Contractor shall provide a history of dataset adjustments and corrections over the past 3 years.

1.3.6.8. Capability to provide medical device identification, including unique device identification (UDI) at the patient-level and device-level data and to append data provided historically and future with medical device identification, including UDI data.

1.3.6.9. Provide direct access to weekly data with the capability of providing current and historical national-level and sub-national level counts of prescriptions and unique patients over time, delivered weekly with no more than an eight calendar (8) day lag.

1.3.6.10. Provide direct access to monthly data with the capability of providing current and historical national-level and sub-national level counts of prescriptions and unique patients over time, delivered monthly with no more than a thirty (30) calendar day lag.

1.3.6.11. Capability to provide data in weekly, monthly, quarterly, and annual outputs.

1.3.6.12. Ability to use both the prescription-based outpatient data and patient-based outpatient data to estimate drug utilization patterns in the total U.S. outpatient population, or in a national sub-population of interest (e.g., children [≤ 17 years], females of child-bearing age, elderly [≥ 65 years]). This shall require the use of projection or other appropriate methodologies which shall be valid, reliable, and robust regarding drug utilization specifically. The methods of national level estimation (projection or other methodology) shall be fully disclosed.

1.3.6.13. Provide claims-level data, such as prescriptions or medical claims including a de-identified patient ID for linking patients across claims and a de-identified health care practitioner ID for linking practitioners across claims. The FDA has no interest in knowing the identity of any patient, provider, or health plan included in the data. It shall be solely the Contractor’s responsibility to de-identify the data for FDA use, but the methods used to de-identify the data shall be described.

1.3.6.14. Provide mother-infant linked records. In order to evaluate the effect of exposures in pregnancy on outcomes in infants, it is necessary to link mothers/deliveries with infants.

1.3.6.15. Provide access through an existing interface and this interface shall be user-friendly, transparent, and flexible enough to meet the FDA’s needs. Minimally, the interface shall provide both predefined (e.g., canned) and custom reports.

1.3.6.16. Provide the FDA (or work with the FDA data platform to confirm) the ability to immediately, directly download data in an automated fashion—without any intervention needed from the Contractor in the following formats: Microsoft Excel, SAS, R, comma-or tab-separated file, and text delimited file.

1.3.6.17. The Contractor may need to provide additional data analyses, custom queries, or raw data preparation not available through the data tools and in increments to be determined at the Task Order level.

1.4. Prior to acquisition, the Contractor shall evaluate all candidate datasets using standardized FDA Sentinel 3.0 criteria, including but not limited to:

• Uniqueness of individuals

• Data type and structure

• Unique device identification (UDI)

• Clinical coding systems used

• Diagnosis and procedure coverage

• Refresh rate and historical depth

• Population representativeness

• Linkage potential

• Price and licensing terms

The Contractor shall provide FDA with documented evaluation results and recommendations for acquisition.

1.5. The Contractor shall develop templated, reproducible DUAs that allow permissible use across Sentinel 3.0 program activities. These DUAs shall include standardized terms to streamline FDA tracking, renewals, and compliance monitoring.

1.6. The Contractor shall gather the data - defining a clear objective, identity reliable data sources, ensure data accuracy and privacy, and establish a method for collection.

The Contractor shall harmonize the data aligning and standardizing data from multiple sources to ensure accuracy, and usability across the business usages.

1.7. The Contractor shall develop and maintain a data onboarding roadmap that documents dataset prioritization schemes and supports FDA decision-making for data acquisition, providing transparency to stakeholders on the process for making datasets available. The roadmap must include an on-demand dashboard accessible to designated FDA personnel, displaying current dataset status in the ingestion process, projected availability dates, timelines, estimated scope and level of effort, notable roadblocks, and onboarding costs. The Contractor shall provide the capability to subset or assemble analytic cohorts across multiple data sources. All cohort definitions shall include documented provenance, reproducible query parameters, and metadata sufficient for regulatory and scientific transparency.

1.3 TASK AREA 3 – ADDITIONAL DATASET ACQUISITION AND ACCESS SERVICES

(OPTIONAL)

This Task Area is optional and may be exercised at the sole discretion of the Government.

Under this Task Area, the Contractor shall, when authorized by the Government through a Task Order, identify, acquire, license, and provide access to additional healthcare datasets or data access services that augment or complement the Tier 1–6 datasets defined under Task Area 2.

These services are intended to provide the Government with flexibility to obtain supplemental, emerging, or specialized data assets needed to address evolving regulatory, scientific, or public health questions that are not fully supported by the core Tier 1–6 data holdings.

This Task Area does not replace or modify the Contractor’s responsibilities for delivering Tier 1–6 data under the Data Broker model. All activities under this Task Area shall be explicitly scoped, approved, and governed through Government-issued Task Orders.

The Government may authorize optional data acquisitions under this Task Area by issuing Task Orders at its discretion. The Government may issue up to five (5) separate Task Orders per year not to exceed $25,000,000 over the period of performance of this IDIQ. Each exercised option increment shall specify, at a minimum, the supplemental dataset(s) or data access service(s) authorized, the scope and intended use of the data, and the applicable period of performance.

The Government is not obligated to exercise this Task Area or any associated optional CLINs. No work under this Task Area shall commence unless and until the Government exercises the applicable option increment in writing and provides funding authorization.

The Contractor shall be capable of:

1.8. Identifying and evaluating additional data assets or data access services, including but not limited to:

• Supplemental commercial datasets

• Specialty or niche datasets

• Registry or network-based datasets

• Time-sensitive or emerging data sources

1.9. Procuring, licensing, and managing access to approved supplemental datasets in accordance with applicable data use agreements, privacy protections, and federal requirements.

1.10. Providing access to such datasets through appropriate delivery or access mechanisms, which may include:

• Direct data delivery for ingestion into the FDA Data Platform

• API-based access

• Federated or query-based access models

The specific access method shall be determined by the Government at the Task Order level based on the use case, data characteristics, and governance requirements.

1.11. Supporting use cases such as:

• Augmenting Tier 1–6 datasets for targeted analyses

• Rapid-response or time-sensitive regulatory inquiries

• Exploratory analyses to assess feasibility or signal detection

• Pilot or proof-of-concept evaluations of new data sources

All data acquired or accessed under this Task Area shall comply with FDA Sentinel 3.0 data standards, security and privacy requirements, and applicable governance controls.

2 CONTRACT CONSTRAINTS

The following constraints are applicable to this contract:

1. Organizational Conflict of Interest (OCI)

An organizational conflict of interest may arise when the Contractor’s relationships with data providers, subcontractors, or affiliates could bias performance under this contract (e.g., steering FDA toward certain datasets, limiting access to alternatives, or using nonpublic information for competitive advantage). The Contractor shall identify, disclose, and mitigate potential OCIs in accordance with FAR Subpart 9.5 and the requirements of this contract.

FDA’s mitigation strategy to avoid potential organizational conflicts of interest shall require all Offerors submitting proposals, as prime Contractors or as a sub- Contractor must conduct an in-depth assessment for the potential of an organizational conflicts of interest.

2. Advance Understanding

Notwithstanding any of the above provisions, under certain circumstances, the Government may be required to share data or information it obtains under this contract with Congress, with a federal court, or with another governmental body of competent jurisdiction. If the Government intends to share data or information obtained under this contract with Congress, with a federal court, or with another governmental body of competent jurisdiction, the Government will take appropriate measures within its control to ensure that the information will be shared in a manner intended to protect the information from public disclosure contract shall not constrain the FDA from releasing study results for regulatory issues of public health importance prior to formal publication or presentation in a scientific forum.

Under these circumstances, FDA will, to the extent practicable, work with the Contractor to avoid jeopardizing timely publication of results.

3. Confidential or Otherwise Privileged Information

The Contractor shall assure the protection of confidential or otherwise privileged information disclosed by the FDA from unauthorized use or disclosure and must treat the information as confidential or otherwise privileged.

Confidential or otherwise privileged information disclosed shall not be used by the Contractor to solicit or in any other way encourage pharmaceutical or medical device industry funding/financial sponsorship of research projects to be performed by the Contractor. In the event that an outside party such as a drug or biologics NDA or BLA sponsor, or a medical device PMA, 510k or other sponsor, independently requests that the Contractor conduct research on a safety issue that FDA has previously discussed with the Contractor but FDA has not requested the Contractor perform the research on that issue, the Contractor may conduct such research only if both of the following conditions are satisfied: (1) the Contractor shall not divulge confidential and privileged information previously disclosed by the FDA; and (2) the Contractor shall recuse itself from all subsequent conversations with FDA about the safety of the involved drug, medical device or biologic product(s). In conjunction with the above, the Contractor shall provide a Conflict-of-Interest Plan as outlined in FDA Clause 1337 Conflict of interest (see FDA 1337, Conflict of Interest).

4. Clearance for Publication

No information furnished to or generated by the Contractor in the performance of this contract shall be released to the public until it has been reviewed by the FDA COR for accuracy of factual data and interpretation. The FDA shall have 30 calendar days after receipt of the manuscript or other written draft of the material to be released, to review, comment, and return to the Contractor.

5. IT Compliance Requirements The Contractor shall be responsible for knowledge of and compliance with all applicable federal information technology and information management laws, regulations, policies, and standards at the government-wide, HHS and FDA levels.

At the government-wide level, these include Office of Management and Budget (OMB), National Institute of Standards and Technology (NIST), and General Accounting Office (GAO). These can be primarily found at or through the Federal CIO Council website at: http://www.cio.gov/. HHS documents are found at:

http://www.hhs.gov/oirm/

The computer programs, data management systems, databases, and other resources used or developed through this contract shall comply with data standards and procedures established by DHHS and FDA (per http://www.fda.gov/ForIndustry/DataStandards/default.htm) .

6. Section 508 Compliance The Contractor shall be familiar with Section 508 requirements as described at http://www.section508.gov/ in order to ensure that the deliverables generated as part of this contract shall be compliant with Section 508. The complete text of Section 508 Final Provisions can be accessed at https://www.access-board.gov/ict/ and https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-compliance-accessibility-information-communications-technology.html.

3 GOVERNMENT-FURNISHED PROPERTY, EQUIPMENT,

INFORMATION (GFP/GFE/GFI)

The Government furnished property (GFP) (materials, equipment, and/or information) may be provided in conjunction with required performance under individual task orders as determined by mutual agreement between FDA and the Contractor.

For some Sentinel 3.0 Contractors, the FDA may provide Government-Furnished Property (GFP)/Government-Furnished Equipment ((GFE)/Government-Furnished Information (GFI) such as laptops and the associated PIV card badges, security badges, computer monitors, http://www.cio.gov/ http://www.hhs.gov/oirm/ http://www.fda.gov/ForIndustry/DataStandards/default.htm https://www.access-board.gov/ict/ https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-compliance-accessibility-information-communications-technology.html https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-compliance-accessibility-information-communications-technology.html https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-policy-section-508-compliance-accessibility-information-communications-technology.html

SOPs/Work Guides, for the performance of work under this contract/task order. Laptops shall not be used for any other work outside this contract/task order.

The Contractor shall be liable for loss or damage to GFP/GFE beyond fair wear and tear in accordance with the Government Furnished Property clause of the contract.

The Contractor shall maintain an up-to-date full inventory list of GFP/GFE/GFI in the Contractor Roster in accordance with government regulations on a monthly basis to the COR/Program Manager (PM) via an excel spreadsheet in SharePoint. At a minimum, the list shall include all GFP/GFE/GFI, the Contractor employee’s name, email address, and labor category position, property number.

4 SECURITY AND PRIVACY

Security and Privacy Requirements

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification (hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources. b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must: i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information.

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information. Note to the Requiring Activity Representative: Complete the following section using the information obtained from the Information Security and Privacy Certification Checklist.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [] Low [x] Moderate [ ] High

Integrity: [] Low [x] Moderate [ ] High

Availability: [] Low [x] Moderate [ ] High

Overall Impact Level: [] Low [x] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or Contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one

(1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO. etc. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed. ed.

Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

Note to the Requiring Activity Representative: Complete this section using the information obtained from the Information Security and Privacy Certification Checklist. This information may be included after award in the event it is not yet available at the time of acquisition.

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[] No PII [x] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R.

2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately.

ii. Disclosed to authorized personnel on a Need-To-Know basis.

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to FDA control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificates from the NIST CMVP.

g. Government Furnished Equipment (GFE) for Foreign Travel. FDA personnel are prohibited from taking GFE when participating in personal, unofficial travel to foreign countries. FDA personnel are strictly prohibited from teleworking using GFE in foreign countries. FDA personnel must also request loaner GFE from the FDA Foreign Travel

h. Confidentiality and Nondisclosure of Information. Any information provided to the Contractor (and/or any subcontractor) by FDA or collected by the Contractor on behalf of FDA must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the

Contractor. Each Contractor employee or any of its subcontractors to whom any FDA records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein. The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FDA policies. Will be subject to the HHS and FDA sanction policies and/or governed by the following laws and regulations: ii. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records); iii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information); and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

i. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

j. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115- 232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The Contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

k. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.