Section C_Web Based Resp Tool DRAFT.pdf

SECTION C - DESCRIPTION/SPECIFICATIONS/STATEMENT OF WORK

TITLE: WEB-BASED RESPIRATOR MEDICAL QUESTIONNAIRE AND EVALUATION

TOOL

C.1 BACKGROUND

Federal Occupational Health (FOH), a component of the Program Support Center (PSC) within the U.S. Department of Health and Human Services (HHS), has provided occupational health programs for federal employees for more than 80 years. FOH operates under the principles of the Health Promotion for Government Employees Act, Pub. L. No. 79-658, 60 Stat. 903 (1946), as amended and codified at 5 U.S.1. § 7901, which authorizes the head of an agency to establish a health service program to promote and maintain the physical fitness and emotional well-being of federal employees; 42 U.S.1. 231; and the Service and Supply Fund Charter.

The mission of Federal Occupational Health (FOH) is to improve the health, safety, and productivity of federal employees. In keeping with this mission, FOH Clinical Health Services (CHS) offers a full range of occupational health services to other federal agencies and their employees throughout the United States, U.S. Territories, and internationally. FOH provides defined health services as well as consultation to federal customer agencies exclusively through Interagency Agreements (IAAs). FOH is the largest provider of occupational health services in the federal government, serving more than 360 federal agencies and reaching 1.8 million federal employees. Agreements are negotiated with federal departments and federal agencies’ national headquarters, and/or with their regional/local components for products ranging from a standard package of Occupational Health and Safety (OHS) program components to an array of services, including expert consultation tailored to a particular federal agency’s OHS needs, wellness and health promotion, behavioral health services and organizational development related issues. FOH maintains sole responsibility for consulting with federal agencies. The Contractor shall facilitate delivery of FOH services specified in this Performance Work Statement (PWS).

To fulfill its mission, FOH designs and provides a suite of occupational health services for federal agencies and their employees. FOH enters into agreements with customer organizations and directly delivers either occupational health services or contracts with qualified organizations to provide such services. When FOH uses a contractor, FOH monitors the contract and provides technical oversight.

FOH is committed to an integrated approach to improving the health and productivity of the federal workforce, which helps address both direct and indirect cost drivers affecting the Federal Government. To that end, FOH provides programs and services that support a wellness-focused culture of health rather than a treatment-focused culture of sickness.

By offering flexible, cost competitive solutions, FOH sets the standard for a culture of health and safety across the federal workforce. The quality of services and strength of program effectiveness depends heavily on the expertise and experience of a Contractor-managed web-based respirator medical questionnaire and evaluation clearance tool.

C.2 PURPOSE

The Contractor shall furnish all of the necessary personnel, materials, services, facilities, (except as otherwise specified), and otherwise do all the things necessary for or incident to the performance of the work as set forth in each task order.

The purpose of this contract is to acquire a nationwide Contractor-Owned/Contractor-Operated (COCO), web-based respirator medical questionnaire and evaluation clearance program tool to support Program Support Center (PSC), Federal Occupational Health (FOH) under the Department of Health and Human Services (HHS). This web-based respiratory medical clearance and evaluation program will continue to provide a rapid cost-effective method to perform respiratory medical clearances, and a convenient method to evaluate geographically diverse Federal employees.

According to the U.S. Department of Labor (DOL), Occupational Safety and Health Administration (OSHA), the primary means to control occupational diseases caused by breathing contaminated air is through the use of feasible engineering controls, such as enclosures, confinement of operations, ventilation, or substitution of less toxic materials. Respirators protect workers against insufficient oxygen environments, harmful dusts, fogs, smokes, mists, gases, vapors, and sprays. These hazards may cause cancer, lung impairment, other diseases, or death.

Compliance with the OSHA Respiratory Protection Standard could avert hundreds of deaths and thousands of illnesses annually. When effective engineering controls are not feasible, or while they are being instituted, appropriate respirators shall be used pursuant to OSHA Respiratory Protection Standard, 29 CFR 1910.134(c)(1). Pre-requisite medical evaluations for respirator use must be conducted pursuant to 29 CFR 1910.134 (e) and subparts which specify “the minimum requirements for (the) medical evaluation that employers must implement to determine the employee's ability to use a respirator.” This medical evaluation is used to determine the employee's ability to use a respirator must be conducted “before the employee is fit tested or required to use the respirator in the workplace.”

The purpose of a web-based respirator medical questionnaire and evaluation clearance tool is to determine if employees can tolerate the physiological burden associated with respirator use, including the following:

Burden imposed by the respirator itself (e.g., its weight and breathing resistance during both normal operation and under conditions of filter, canister, or cartridge overload);

Musculoskeletal stress limitations on auditory, visual, and olfactory sensations Isolation from the workplace environment

Certain jobs and workplace conditions in which a respirator is used can also impose a physiological burden on the user, therefore, the respirator medical questionnaire and evaluation clearance tool must also consider the following factors:

Type and weight of the respirator to be worn Duration and frequency of respirator use Expected physical work effort

Use of protective clothing and equipment to be worn Temperature and humidity extremes that may be encountered

The respirator medical questionnaire and evaluation clearance tool is designed to identify general medical conditions that place employees who use respirators at risk of serious medical consequences. Medical conditions known to compromise an employee's ability to tolerate respirator-, job-, and workplace-related physiological stress include the following:

Cardiovascular and respiratory diseases (e.g., a history of high blood pressure, angina, heart attack, cardiac arrhythmias, etc.)

Reduced pulmonary function caused by other factors (e.g., smoking or prior exposure to respiratory hazards) Neurological or musculoskeletal disorders (e.g., ringing in the ears, epilepsy, lower back pain, etc.)

Impaired sensory function (e.g., perforated ear drums, reduced or absent ability to smell, etc.)

Psychological disorders (e.g., claustrophobia, severe anxiety, etc.)

In any workplace where respirators are necessary to protect the health of the employee, or whenever respirators are required by the employer, the employer shall establish and implement a written respiratory protection program with worksite-specific procedures. In accordance with the OSHA’s Respiratory Protection Standard, cited above, Federal agencies must comply with this requirement to medically evaluate employees before they use a respirator to ensure that they are physically capable of using a respirator without adverse medical effects. Numerous federal agencies have implemented mandatory respirator protection programs.

C.3 DEFINITIONS

Contracting Officer’s Representative (COR) An individual within FOH appointed by the Contracting Officer to manage and monitor this contract from a technical standpoint.

CONUS

Locations within the continental United States.

Federal Occupational Health (FOH) A service component within the Department of Health and Human Services offering a comprehensive program to improve the health, safety and productivity of the Federal workforce.

FOH’s governing organization is the Program Support Center (PSC), within the Assistant Secretary of Administration (ASA).

FOH Customer Agency A federal agency who has entered into an inter-agency agreement with FOH to receive services.

Occupational Health Centers (OHCs)

FOH managed Health Clinics located throughout the United States, offering occupational health and wellness services to Federal government employees.

OCONUS

Locations outside of the continental United States (e.g., Guam, Hawaii, Alaska, Puerto Rico, etc.)

C.4 SCOPE

C.4.1 Web-based Respirator Tool Requirements

The web-based respirator medical questionnaire and evaluation clearance tool shall meet OSHA requirements for respiratory medical clearance and shall contain the following elements:

Authorized to use, and currently using the OSHA Respirator Medical Evaluation Questionnaire (Attachment J.1) as a base for the web-based clearance.

Ascertain and consider work conditions under which the respirator(s) will be worn as part of the evaluation.

A single evaluation shall apply to multiple respirator types of any brand/make, including negative and positive pressure respirators.

All “Yes” medical responses shall generate appropriate follow-up questions within the questionnaire.

All questionnaires shall be evaluated utilizing the same objective criteria.

Examinees shall be cleared for multiple respirators and sets of work conditions with a single evaluation.

Respirator evaluation recertification via the medical questionnaire and evaluation clearance tool is based on FOH and/or customer agency program policies. Each participating customer agency must have the capability to set their recertification times based on the American National Standards Institute (ANSI) age recommendations (ANSI/AIHA Z88.6-2006) or on a fixed interval (e.g., annually, biennially, etc.), with approval from the FOH Medical Director or designee as specified in writing.

The average questionnaire should not take more than 20 minutes to complete.

As part of registration, the system must collect the employee’s first and last legal name, date of birth, and last 4 of their Social Security Number. An alternate four-digit ID/PIN number may be provided in lieu of a Social Security Number if approved by FOH. The system must also collect a valid federal government work email (i.e., ending in .gov or .mil only). Each customer employee must be provided a unique user account. The solution shall support secure authentication using SAML 2.0 or OpenID and shall implement multi-factor authentication (MFA) in accordance with Section C.5.7. Users shall be permitted to access only their authorized account and associated records based on their assigned identity and role.

The web-based tool shall allow the customer employee/user to enter their information into the questionnaire.

The web-based tool shall apply algorithmic logic to identify survey questionnaire responses that are either cleared or referred for further evaluation, based on a formulaic review of the survey responses.

Each customer employee shall be notified of their clearance status (i.e., cleared or not cleared/referred) to wear a respirator upon completion of the questionnaire.

Any customer employee immediately cleared shall have the ability to print their clearance letter and/or have it sent to their e-mail address.

Users shall have the ability to login to the system to reprint and/or resend their clearance letter for up to 90 days post-completion.

If the Federal employee is cleared by a qualified physician, the web-based tool shall have a mechanism to classify the federal employee as “complete/compliant”. Qualified physicians must:

o Must be a qualified medical or osteopathic physician and possess a current license to practice medicine.

o Must be board-certified in occupational medicine, preventive medicine, or board certified in a primary care specialty (internal medicine or family medicine) with at least five (3) years’ experience in occupational medicine. Minimum of two

(2) years of experience in an occupational clinic setting that conducts respirator medical clearances preferably.

o Must possess expert understanding of federal safety and health regulations, experience in occupational health related to clearance and surveillance case reviews for various jobs including law enforcement and other safety sensitive jobs.

Users not immediately cleared shall be referred to a Contractor-employed qualified physician (see definition in section above) to perform an additional review. Referred users shall receive notice via email within one (1) business day indicating whether additional physician review of their questionnaire has resulted in clearance or referral for further evaluation. All documents, referrals for further evaluation, and notifications from cases that are reviewed by a Contractor-employed physician must be physically or electronically signed and dated post-review and provided to FOH in a mutually agreed upon manner. This signature is required whether review has resulted in clearance or referral for further evaluation.

Users referred for further evaluation shall be capable of receiving automated emails customized and approved by FOH. Additional details on the content of these automated emails shall be provided upon award. For example, the user may receive an email notification to login and print a packet of information they are to take to the medical provider where their face-to-face evaluation is to be performed. This packet shall include details on the specific medical concern(s) and clear instructions regarding the next steps in the clearance process.

The web-based tool shall allow users “referred for further evaluation” to electronically submit additional follow-up documentation. Based on the additional documentation submitted, a Contractor-employed qualified physician shall perform secondary review of the questionnaire and documentation. Within one (1) business day the user shall receive notice via email indicating their clearance status (e.g., cleared, cleared with restrictions, or not cleared). The web-based tool will update the user's status and have a mechanism to classify the user as “complete/compliant”. The system shall allow follow-up documentation supplied by medical providers to be attached to the employee’s record for review. All cases referred to a Contractor-employed physician must be physically or electronically signed and dated post-review. This signature is required regardless of the updated clearance status. The Contractor shall ensure proper handling of any medical information.

The web-based tool shall allow FOH designated representatives to query, run reports, and view cases requiring follow-up with FOH.

The web-based tool shall allow FOH designated representatives to enter/view additional follow-up information/documentation for secondary review. The web-based tool shall allow approved FOH medical practitioners access to user questionnaires and follow-up information/documentation, and enter a clearance status (e.g., cleared, cleared with restrictions, or not cleared). Within one (1) business day, the web-based tool shall notify the user of their clearance (cleared, cleared with restrictions, or not cleared) via email, update the user’s status, and contain a mechanism to classify the federal employee as “complete/compliant”. FOH board certified physicians performing secondary reviews may be assigned to one or more FOH customer agencies and assignments are subject to change.

Customer employees that follow-up at an FOH Occupational Health Center (OHC) are provided copies of their follow-up assessment reports. The web-based tool shall allow the customer employee to upload this documentation. Based on the additional follow-up documentation submitted, a Contractor-employed physician board certified in occupational medicine will perform secondary review of the questionnaire and documentation. Within one (1) business day the web-based tool will notify the user of their clearance status (e.g., cleared, cleared with restrictions, or not cleared) via email, update the user's status, and contain a mechanism to classify the federal employee as “complete/compliant”. The system shall allow follow-up documentation supplied by medical providers to be attached to the employee’s record for review. All cases referred to a Contractor-employed physician must be physically or electronically signed and dated post-review. This signature is required regardless of the updated clearance status.

The Contractor shall ensure proper handling of any medical information.

FOH practitioners shall be provided a unique user account permitting access to assigned customer agency user questionnaires. User authentication shall comply with the authentication requirements identified in Section C.5.7. The COR shall provide the Contractor with the assignments upon award, and updates as they occur.

C.4.2 Administrative Requirements FOH customer agencies shall have the ability to assign administrators that are capable of viewing the clearance status of employees under their purview. This representative shall not be permitted to view any user evaluation details other than the overall compliance status. FOH customer agencies may have more than one assigned administrator, including but not limited to an overall agency administrator and additional administrators overseeing agency sub-units and/or regions.

All requests for administrative and practitioner rights must be requested using an FOH-provided form and approved by the COR. The access request form will be provided to the Contractor upon award.

C.4.3 Web Address and Email The solution shall support secure authentication and identity management in accordance with Section C.5.7. The solution shall support SAML 2.0 or OpenID and provide secure account management and recovery capabilities consistent with applicable federal cybersecurity requirements and the proposed authentication architecture.

The contractor’s product must be customizable for FOH customer agencies. This customization may include URL page additions specific to FOH customer agencies and/or color and logo branding requirements. The contractor shall provide a demo website to support FOH customer managers and others as they review and/or market the program. All website updates must be approved by the COR prior to implementation.

The website shall be available 24 hours a day, 7 days a week, with a minimal downtime (less than 15 minutes) during core business hours of 6:00am Eastern Time (ET) to 11:00pm (ET), and no more than 1 hour during non-business hours as described in section C.4.5. The contractor shall deliver the services within the periods specified in this contract. The Contractor must respond via telephone or email within 24 hours of an FOH COR or FOH website administrators call for technical assistance and problem resolution.

Approved Contractor staff may be provided an FOH email address to be used for communication related to this contract.

C.4.4 FOH Policy The quality of services provided by the Contractor shall be guided by national standards. These standards include, but are not limited to: TJC standards http://jointcommission.org; the American Medical Association (AMA) standards http://www.ama-assn.org; the American Association of Occupational Health Nurses (AAOHN) standards http://www.aaohn.org; the American College of Occupational and Environmental Medicine (ACOEM) standards http://www.acoem.org/, other standards recognized by relevant national medical specialty boards, established principles and ethics of related professions; and the standards of care in the state or locality where the services are provided.

FOH maintains a robust Quality, Safety, and Risk Management (QSRM) program in an effort to provide and maintain a safe, functional, supportive, and effective environment for customers.

The Contractor is expected to proactively support a culture of safety, participation in safety event reporting, data collection and performance improvement activities, staff surveys, and improving customer safety through communication and engagement with FOH.

C.4.5 Terms of Operation Web-based Respirator Medical Questionnaire and Evaluation Clearance Tool:

The contractor shall maintain a centralized service center with data systems available as follows: 1) Required Availability: Monday – Friday 6:00 AM Eastern Time (ET) to 11:00 PM ET, 2) Non-Critical Availability – All other times.

The contractor shall perform all scheduled system maintenance and system updates outside of required availability time periods.

http://jointcommission.org/ http://www.ama-assn.org/ http://www.aaohn.org/ http://www.acoem.org/

The contractor shall obtain written consent from the COR for any maintenance action that will affect system availability during critical hours of operation.

Best efforts should be made to keep the system operational twenty-four (24) hours per day, seven (7) days per week, and three-hundred and sixty-five (365) days per year.

Actions to perform routine maintenance or update the system shall not be more than one

(1) hour per instance.

In the event maintenance is performed, and part or all of the system is unavailable for use, a notice of temporary unavailability must be posted on the impacted website and/or webpages. This message shall explain the outage and when the system is expected to be available for use.

In the event technical assistance or problem resolution is required for the web-based system, the Contractor shall respond to the request via email or telephone within twenty-four (24) hours.

The system design should ensure that there is never a service outage for more than four

(4) hours. In the event of a catastrophic event at the hosting facility, the system should have a four (4) hour stop loss on potential data loss and be able to return to service within two (2) business days or less. Failure to return to full service within two (2) business days may result in a disincentive of $250 per business day until full service is restored.

The IT Contingency Plan shall be completed and define provisions for continuity of the contractor’s IT services and overall operations. The plan shall be structured to ensure that system services are available as defined above.

The web-based system shall have response times that are sufficiently fast to support routine access and utilization of the system when accessing through broadband or other high-speed internet services.

C.4.6 Privacy Breach

Contractor-owned Contractor-operated system privacy breaches shall be reported to the COR within two (2) hours of discovery. In the event of a privacy breach, the Contractor shall provide the COR with a thorough report of the overall impact, including a breakdown of agencies and individuals affected by the breach. This report shall include details on the breadth of compromised data and shall be updated daily until resolved.

C.4.7 Endpoint Detection and Response (EDR) / Anti-Virus Software

As part of the requirements outlined in Executive Order 14028, Improving the Nation’s Cybersecurity (issued May 12, 2021), federal agencies are mandated to implement Endpoint Detection and Response (EDR) software. This directive supports proactive cybersecurity measures including incident detection, active threat hunting, containment, remediation, and response across government infrastructure. Importantly, the EDR solution must be vetted and approved by the Cybersecurity and Infrastructure Security Agency (CISA). The contractor’s application must have a CISA-approved EDR solution in place. Addressing this gap is essential to ensuring compliance and enhancing our cybersecurity posture.

C.5 INFORMATION SECURITY AND/OR PHYSICAL

ACCESS SECURITY REQUIREMENTS

Important Note to Contractor: In the event of a discrepancy between the following language and included HHSAR clauses, the HHSAR clauses take precedence.

C.5.1 Baseline Security Requirements

C.5.1.1 Applicability The requirements herein apply whether the entire contract or order (hereafter “contract”), or portion thereof, includes either or both of the following:

a) Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

b) Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the HHS mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology: (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

C.5.1.2 Safeguarding Information and Information Systems All government information and information systems must be protected in accordance with HHS/FOH policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/FOH and information systems that store, process, and/or transmit HHS information in accordance with FIPS 199 and National Institute of

Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories. Based on information provided by the ISSO, CISO, OpDiv SOP, or other representative, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [X] Low [ ] Moderate [ ] High Integrity: [ ] Low [X] Moderate [ ] High Availability: [X] Low [ ] Moderate [ ] High Overall Impact Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/FOH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/FOH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/FOH security and/or privacy officials.

b. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

c. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800- 53, and applicable HHS/FOH privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, HHS uses a privacy analysis process to assess the risks associated with HHS's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how HHS collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002.

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

d. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information." The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 3 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term "handling" refers to "…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information." 81 Fed. Reg. 63323. The requirements below apply only to nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations applicable baseline if handled by a Contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS control, destroyed when no longer needed, or held until otherwise directed. Information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

e. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

f. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS and FOH policies. Unauthorized disclosure of information will be subject to the HHS/FOH sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

g. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-21-07, Completing the Transition to Internet Protocol Version 6 (1Pv6) available at https://www.whitehouse.gov/wp-https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf content/uploads/2020/11/M-21-07.pdf

h. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115-232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR 52.204.25. The contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

i. Government Websites. All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS at all times to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP.

For internal-facing websites, HTTPS is not required, but it is highly recommended.

Consult the HHS Policy for Internet and Email Security for additional information.

j. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents provided by FOH to comply with contract deliverables as appropriate.

k. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Standard for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet HHS and OpDiv-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the

Cryptographic Module Validation Program to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR upon request.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

v. Use the Key Management system on the HHS personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys http://csrc.nist.gov/publications/. Encryption keys must be provided to the COR upon request and at the conclusion of the contract.

vi. Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract must complete FOH non-disclosure agreement. Contractors (and/or subcontractors) must submit a copy of each signed and witnessed NDA to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

2. Training Requirements

a. Mandatory Training for All Contractor Staff. All Contractor (and/or any subcontractor) employees assigned to work on this contract must complete the applicable HHS/FOH Contractor Information Security Awareness, Privacy, and Records Management training (provided upon contract award) before performing any work under this contract. Thereafter, the employees must complete FOH Information Security Awareness, Privacy, and Records Management training at least annually, during the life of this contract. All provided training must be compliant with HHS training policies.

b. Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

c. Training Records. The Contractor (and/or any subcontractor) must maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records must be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

3. Rules of Behavior

a. The Contractor (and/or any subcontractor) must ensure that all employees performing on the contract comply with the HHS Information Technology General Rules of Behavior, HHS Rules of Behavior for Privileged Users, and any FOH policies as applicable.

b. All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, http://csrc.nist.gov/publications/ and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual FOH Information Security Awareness Training. If the training is provided by the contractor, the signed Rules of Behavior must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

4. Incident Response

a. The Contractor (and/or any subcontractor) must respond to all alerts/Indicators of

Compromise (IOCs) provided by HHS Computer Security Incident Response Center (CSIRC)/FOH IRT teams within 24 hours, whether the response is positive or negative. In accordance with FISMA and OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information (PII), an incident is "an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies" and a privacy breach is "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose." For additional information on the HHS breach response process, please see the HHS Policy and Plan for Preparing for and Responding to a Breach of Personally Identifiable Information (PII)."

b. In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) must:

i. Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract, with encryption solution that is validated with current FIPS 140 validation certificate from the NIST

CMVP.

ii. NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor must send FOH approved notifications to affected individuals for approval.

iii. Report all suspected and confirmed information security and privacy incidents and breaches to the OpDiv Incident Response Team (IRT), COR, CO, OpDiv SOP (or his or her designee), and other stakeholders, including breaches involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, no later than one (1) hour, and consistent with the applicable FOH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor must:

Cooperate and exchange any information, as determined by the

Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

Not include any sensitive information in the subject or body of any reporting e-mail; and

Encrypt sensitive information in attachments to email, media, etc.

iv. Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information, and HHS/FOH and FOH privacy breach response policies when handling PII breaches.

v. Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

5. Position Sensitivity Designations

All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

6. Homeland Security Presidential Directive (HSPD)-12

The Contractor (and/or any subcontractor) and its employees must comply with Homeland Security Presidential Directive (HSPD)-12, Policy for a Common Identification Standard for Federal Employees and Contractors; OMB M-05-24; OMB M-19-17; FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors; HHS HSPD-12 policy; and Executive Order 13467, Part 1 §1.2.

7. Roster

The Contractor (and/or any subcontractor) must submit a roster by name, position, e-mail address, phone number and responsibility, of all staff working under this acquisition where the Contractor will develop, have the ability to access, or host and/or maintain a government information system(s). The roster must be submitted to the COR and/or CO within five (5) business days of the effective date of this contract. Any revisions to the roster as a result of staffing changes must be submitted within three (3) business days of the change. The COR will notify the Contractor of the appropriate level of investigation required for each staff member.

If the employee is filling a new position, the Contractor must provide a position description and the Government will determine the appropriate suitability level.

8. Contract Initiation and Expiration

a. General Security Requirements. The Contractor (and/or any subcontractor) must comply with information security and privacy requirements, Enterprise Performance Life Cycle (EPLC) processes, HHS Enterprise Architecture requirements to ensure information is appropriately protected from initiation to expiration of the contract. All information systems development or enhancement tasks supported by the contractor must follow the HHS EPLC framework and methodology and in accordance with the HHS Contract Closeout Guide (2012).

b. System Documentation. Contractors (and/or any subcontractors) must follow and adhere to HHS System Development Life Cycle requirements, at a minimum, for system development and provide system documentation at designated intervals (specifically, at the expiration of the contract) within the EPLC that require artifact review and approval.

c. Sanitization of Government Files and Information. As part of contract closeout and at expiration of the contract, the Contractor (and/or any subcontractor) must provide all required documentation to the COR to certify that, at the government's direction, all electronic and paper records are appropriately disposed of and all devices and media are sanitized in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

d. Notification. The Contractor (and/or any subcontractor) must notify the CO and/or

COR and system ISSO within FOH before an employee stops working under this contract.

e. Contractor Responsibilities upon Physical Completion of the Contract. The contractor (and/or any subcontractors) must return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor must provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or FOH policies.

f. The Contractor (and/or any subcontractor) must perform and document the actions identified in the FOH Contractor Employee Separation Checklist when an employee terminates work under this contract within three (3) days of the employee's exit from the contract. All documentation must be available to the COR upon request

9. Records Management and Retention

a. The Contractor (and/or any subcontractor) must maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS Policy for Records Management and FOH policies and must not dispose of any records unless authorized by HHS/FOH.

b. In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, he/she must document and report the incident in accordance with HHS/FOH policies.

10. High Value Asset (HVA)

If a system is identified as HVA, the contractor must comply with the HHS Policy for the High Value Asset (HVA) Program and the DHS HVA Control Overlay in addition to the above requirements.

a) Protect government information and information systems in order to ensure:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information

b) Provide security for any Contractor systems, and information contained therein, connected to an HHS network or operated by the Contractor on behalf of HHS regardless of location.

In addition, if new or unanticipated threats or hazards are discovered by either the agency or contractor, if existing safeguards have ceased to function, the discover shall immediately, within one (1) hour or less; bring the situation to the attention of the other party.

c) Adapt and implement the policies, procedures, controls, and standards required by the

HHS Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract.