Sol_Doc_75F40125R00037_Attachment 14 - Task Order Statement of Work.pdf

Access to Outpatient Longitudinal Data IDIQ 75F40125R00037

Attachment 14

ACCESS TO OUTPATIENT LONGITUDINAL DATA IDIQ

TASK ORDER #1

STATEMENT OF WORK

1. PURPOSE

Access to outpatient prescription and patient level data will complement and strengthen the utility of FDA’s Adverse Event Reporting System (FAERS) currently in place by providing estimates of the numbers of patients exposed to drugs and the numbers of prescriptions dispensed nationwide in the outpatient setting. These data provide a denominator, or context, for understanding adverse event reports; for modeling drug risk based on usage patterns; and for calculating patient-based reporting rates for drugs used in the outpatient setting.

Access to these data also increases the FDA’s ability to perform regulatory impact studies; in particular, those studies that assess the impact of risk management plans and labeling changes on prescribing habits and usage patterns for prescription drugs. Finally, direct access to these data in real time enhances and accelerates the pace of FDA's regulatory decision-making process.

2. OBJECTIVES

The objective of this Task Order is to obtain direct access to commercially available longitudinal outpatient prescription data and obtain support in regulatory drug utilization activities.

3. SCOPE OF WORK

The Contractor shall provide the required personnel, materials, services, facilities, and otherwise do all things required for or incidental to the performance of the work as described below.

3.1. TASK AREA 1: DATA ACCESS

The Contractor shall:

a. Provide continuous automated access to nationally-based, outpatient prescription-level data.

The data shall include historical prescription information at a national and sub-national level.

b. Provide patient-level data describing outpatient prescription drug use in individuals longitudinally. The prescription claims data and medical claims data shall provide immediate automated access with the ability to provide counts of current and historical aggregate national and sub-national drug utilization information. The longitudinal data shall include information at the medical claim and prescription claim levels with the ability of characterizing concomitant drug use and characterizing duration of drug exposure. The medical claims data shall provide immediate automated access with the ability to provide counts of current and historical aggregate national and sub-national drug utilization information.

c. Provide a description of the Contractor’s data acquisition process for the prescription claims and medical claims data. All data flow and management procedures shall be described, including data acquisition, cleaning, and editing procedures, data de-identification procedures, specification and description of all coding systems used for diagnoses, procedures and drugs, including versions (e.g. ICD-9, ICD-10), methods for coding data, percentage of missing or incomplete information and the method of coding missing data, availability of raw/sample numbers as well as projected numbers, and the frequency with which data are updated and methods for updates. For each health care setting, the Contractor shall estimate the proportion captured in the data source out of the entire market and provide this estimation to FDA, updated at least semi-annually. A current and complete updated data dictionary and database description shall be provided annually and as changes are made.

d. Provide the total number of years of data available overall and the number of years available online and accessible in real-time to FDA personnel. The contractor shall have a minimum total of 10 years of data (minimum of five years of data available online and at a minimum an additional five years of historical data that is no longer online), and propose methods to obtain historical data in a timely manner. FDA’s preference is that historical datasets be available on demand and without intervention from the Contractor.

The Data shall include:

e. Prescription-level data currently existing, commercially available, HIPAA-compliant product that shall provide immediate automated access.

f. Prescription-level data with the ability of analyzing current and historical aggregate national and sub-national dispensed prescription information at a minimum of monthly-level, with the ability to aggregate data by time periods specified by the user. Patient-level data shall provide the ability to analyze unique patients utilizing drug products in an outpatient setting, with the capability of stratifying by patient age and sex. Data shall have the capability of customizing patient age bands as needed. Patient-level data shall link to prescription-level data, allowing for the assessment of new versus continuing use of drugs at the molecule level and at the drug class level.

g. Patient-level data describing outpatient prescription drug use in individuals longitudinally.

The prescription claims data and medical claims data shall provide immediate automated access with the ability to provide counts of current and historical aggregate national and sub-national drug utilization information. The longitudinal data shall include information at the medical claim and prescription claim levels with the ability of characterizing concomitant drug use and characterizing duration of drug exposure. The medical claims data shall provide immediate automated access with the ability to provide counts of current and historical aggregate national and sub-national drug utilization information.

h. The size and characteristics of the population of patients or covered lives from which the prescription- and patient-level data are derived shall be provided to FDA, since these can affect the quality and usefulness of the data provided and the validity of national projections from the data. Characteristics shall minimally include: number of individual patients or covered lives per calendar quarter; number and percent of patients or covered lives with at least two years of continuous activity; number and percent of patients or covered lives with corresponding enrollment information; availability of enrollment/eligibility/participant inclusion information for use in data analyses; number and percentage of active patients or covered lives in populations of special interest to FDA (including children [ages ≤ 17 years], females of child-bearing age, and elderly [ages ≥ 65 years]); turnover or churn rate for participation in the data resource; the method by which patient age is obtained; geographic diversity; patient demographics; coverage or inclusion policies relevant to pharmaceutical products under health care plans providing the majority of the data; and availability of medical claims data. The number and percent of the total population for whom clinical/medical data or data capturing the administration of drug or biologic products in the outpatient setting by healthcare professionals are available and detailed information describing how this information is linked to the pharmacy data is required. These longitudinal data shall follow uniquely identifiable individuals (using encrypted patient identifiers) and physicians over time either across or within ambulatory health care plans. Patient age and sex shall be provided. Information on race/ethnicity shall be accompanied by documentation of the origin of this information, if available.

i. Prescription data with the therapeutic class of drug and biologic products (including biosimilars and interchangeable biosimilars), molecule(s), active ingredient(s) (e.g., single-ingredient or combination), molecular salt (if applicable), product name (U.S. proprietary and non-proprietary), original prescribed product, substitution allowability, strength, National Drug Code (NDC), company name (manufacturer or corporation), dosage form, strength, all dates dispensed, quantity dispensed, dispensed days’ supply, prescriber specialty, and method of payment. The Contractor shall provide the ability to obtain all data elements within a single dataset extract. The Contractor shall provide a history of dataset adjustments and corrections over the past 3 years.

j. Medical claims with the start date and end date of the medical event, the type of medical claim (e.g., inpatient claim, outpatient facility claim), medical specialty of the practitioner(s) involved, and the following data elements as dictated by the type of medical claim:

International Classification of Diseases (ICD) diagnosis code(s), admitting diagnosis code, discharge diagnosis code(s), version indicator (e.g. ICD-9, ICD-10), and procedure code(s) (e.g.

CPT, HCPCS) with source indicator. Current data shall include patient-level demographic information as well as a link to a patient's current and historical prescription drug use.

k. Direct access to weekly data with the capability of providing current and historical national-level and sub-national level counts of prescriptions and unique patients over time, delivered weekly with no more than an eight (8) day lag.

l. Direct access to monthly data with the capability of providing current and historical national-level and sub-national level counts of prescriptions and unique patients over time, delivered monthly with no more than a thirty (30) day lag.

m. Capability to provide data in weekly, monthly, quarterly and annual outputs.

n. Ability to use both the prescription-based outpatient data and patient-based outpatient data to estimate drug utilization patterns in the total U.S. outpatient population, or in a national sub-population of interest (e.g., children [≤ 17 years], females of child-bearing age, elderly [≥ 65 years]). This shall require the use of projection or other appropriate methodologies which shall be valid, reliable, and robust with regard to drug utilization specifically. The methods of national level estimation (projection or other methodology) shall be fully disclosed.

o. Claims-level data, such as prescriptions or medical claims, including a de-identified patient ID for linking patients across claims and a de-identified health care practitioner ID for linking practitioners across claims. The FDA has no interest in knowing the identity of any patient, provider, or health plan included in the data. It shall be solely the Contractor’s responsibility to de-identify the data for FDA use, but the methods used to de-identify the data shall be described.

3.1.1. TECHNICAL REQUIREMENTS AND CAPABILITIES FOR DIRECT ACCESS TO DATA

RESOURCES

The Contractor shall:

a. Provide outpatient prescription longitudinal patient-level data that is currently existing and commercially available. Access to the data shall be immediate, unlimited, direct, desktop and in real-time. Direct access shall include all upgrades, enhancements, and modifications to software and data.

b. Provide access through an existing interface and this interface shall be user-friendly, transparent and flexible enough to meet the FDA’s needs. Minimally, the interface shall provide both predefined (e.g., canned) and custom reports.

c. Provide full disclosure of data collection construction, coding, and configuration that are required to allow FDA staff to appropriately interpret findings and understand the construction and application of the projection or other appropriate methodology.

d. Provide access to the data resources shall be accessible via a secure Internet or network-based method permitting simultaneous, multi-user access through a user-friendly data query tool(s).

e. Provide the FDA the ability to immediately, directly download data in an automated fashion—without any intervention needed from the Contractor—in the following formats: Microsoft Excel, comma- or tab-separated file, and text delimited file. The Contractor shall provide the ability to directly download data in both a hierarchical format as well as a flat file (a file where a record contains each user-selected data field). For downloading datasets larger than 100 megabytes, the Contractor shall provide a manner which is compatible with FDA security procedures. The data query tool shall allow the user to download information regarding the user-selected specifications for each query, such as time selected, drugs selected, dosage form selected, and the date that the query was run.

f. Provide FDA with a fourteen (14) calendar day trial subscription. The Contractor shall provide a live virtual web-based training session that lasts a maximum of two (2) hours at the start of the trial subscription period. The trial subscription shall include direct access, documentation, and technical support for a maximum of seven FDA users. The FDA will not pay for this subscription as access will be used solely to assess whether the contractor meets the data requirements, and not for any analyses, public disclosure, or regulatory decision making.

g. Specify any additional software and/or hardware (name and version) necessary to access the data. Any software installed on FDA computers for the purposes of accessing the data shall not use key-logging and/or network capturing functionality to transmit any data from the FDA system. Exceptions are for login information specific to the data vendor and dataset, and procedures for querying the Contractor’s data sets, such as SQL (Structured Query Language).

h. Conform to Section 508 standards. The data vendor shall participate in the FDA secure electronic mail system to protect any sensitive data which may be transmitted electronically between the data vendor and the FDA. The FDA utilizes the virtual private network (VPN) to establish a trusted, encrypted TCP/IP tunnel for accessing data from a remote location. The VPN shall be a firewall-to-firewall encrypted tunnel utilizing commercially available software and industry standard Internet Protocol Security (IPSEC) protocols.

i. Notify the FDA in the event of changes to the Contractor’s business or agreements with their data suppliers within five (5) business days of the Contractor becoming aware of such changes. This notification shall include details of the impact of these changes on data quality, data quantity, and overall data characteristics.

3.1.2. ONSITE OR LIVE VIRTUAL TRAINING PROGRAMS AND TRAINING MATERIALS

The Contractor shall provide training for users of the data, as well as training for FDA personnel who shall support use of the data (e.g., technical users). The Contractor shall provide a minimum of two onsite or live virtual training sessions per year as required by the FDA. Live or web-based training of FDA personnel shall be offered for any modifications, enhancements, or upgrades to the data source.

The Contractor shall provide course outlines for all levels of training offered live virtually or on site at FDA (Silver Spring, MD) and options for additional “on-demand” sessions either in person or via web-based methods. The training shall be initiated within thirty (30) calendar days of award and continue throughout the duration of the contract.

3.1.3. ONSITE OR LIVE VIRTUAL KICK-OFF AND ANNUAL MEETINGS

The Contractor shall participate in a kick-off meeting within two weeks of contract award and shall conduct an annual meeting live virtually or on-site (at the FDA’s discretion), at the FDA White Oak Campus in Silver Spring, MD. The purpose of the annual meeting is to discuss scientific issues of https://gbc-word-edit.officeapps.live.com/we/wordeditorframe.aspx?ui=en-US&rs=en-US&actnavid=eyJjIjo3MTgyMjk5OTR9&wopisrc=https%3A%2F%2Ffda.sharepoint.com%2Fsites%2FCDER-OSE-IO-RSS-AcquisitionCollaboration-Team%2F_vti_bin%2Fwopi.ashx%2Ffiles%2Fbbd4382ab3c44957a741678697aa92a4&wdenableroaming=1&mscc=1&hid=3BAE5FA1-B04D-6000-D4FC-2C4DE6EA0329.0&uih=sharepointcom&wdlcid=en-US&jsapi=1&jsapiver=v2&corrid=7ef1e423-5a8f-7e48-2df4-864049fc3dcc&usid=7ef1e423-5a8f-7e48-2df4-864049fc3dcc&newsession=1&sftc=1&uihit=docaspx&muv=1&cac=1&sams=1&mtf=1&sfp=1&sdp=1&hch=1&hwfh=1&dchat=1&sc=%7B%22pmo%22%3A%22https%3A%2F%2Ffda.sharepoint.com%22%2C%22pmshare%22%3Atrue%7D&ctp=LeastProtected&rct=Normal&wdorigin=Outlook-Body.Sharing.DirectLink&wdhostclicktime=1730481150696&instantedit=1&wopicomplete=1&wdredirectionreason=Unified_SingleFlush#firewall_VPN interest to the Agency and relevant work that the contractor has performed, as well as discussing FDA satisfaction with all deliverables.

3.1.4. TECHNICAL SUPPORT

The Contractor shall provide a support package comprised of written documentation that includes technical, analytical, and clinical support throughout the length of the contract. The support package shall include any modifications, enhancements, or upgrades to the data source.

The Contractor shall provide ongoing technical, analytical, and clinical support by phone or by e-mail during business hours (9:00 am to 5:00 pm, ET), Monday through Friday, excluding Federal holidays (available at www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/), throughout the length of the contract. This support shall be in accordance with the service levels established in the contract.

The Contractor shall have dedicated client support personnel to serve as a liaison between the FDA and the Contractor to ensure effective communication and access to needed resources.

3.1.5. MONTHLY PROGRESS REPORTS

The Contractor shall provide Monthly Reports by 20th of each month for the previous month data detailing use of the resource by individual FDA users and type of use clearances, third party agreements, number of ad-hoc programming hours used and project title.

a. The Monthly Report shall include the number and type of data queries by individual FDA user.

b. Clearance Requests shall include type of data submitted, project title, FDA requestor, date of request, and approval date.

c. Third Party Agreement Requests shall include third party collaborator, project title, FDA principal investigator, date of request, approval date, and expiration date.

d. Ad-hoc Dataset Requests shall include the number of technical support programming hours used, project title, FDA requestor, date of request, and date received.

e. Notifications of any circumstances resulting in loss or lack of data streams, or any data enhancements or data errors that would impact access to data from the data resource(s).

f. The report shall include a status update on each task worked on and deliverables submitted, any problems encountered, and suggestions for addressing problems each period.

g. If the tasks are cost reimbursable in nature, an accounting of applicable staff who worked on the tasks as well as any deviations from the original projection of hours planned vs.

actually incurred shall be required.

3.1.6. DISCLOSURE CLEARANCE FOR AGGREGATED DATA

As part of its regulatory activities, FDA requires disclosure of scientific and technical articles, study results, presentations, public health advisories, and similar works involving aggregated data to entities outside the Agency including the general public. For activities that require disclosure of aggregated data, the Contractor shall accept and adhere to FDA Data Disclosure Clearance http://www.opm.gov/policy-data-oversight/pay-leave/federal-holidays/

Procedures and Form unless a different Data Disclosure Clearance Procedure process proposed by the Offeror is approved in advance by FDA. FDA shall continue to require the ability to release aggregated data through the FDA Data Disclosure Clearance process for data obtained during the contract period of performance. After Option Period IV, FDA will not require data access service, but will require the services of processing clearance requests. After Option Period IV, the FDA will notify the Contractor of the aggregated data release for projects initiated prior to the end of the contract and accept the Contractor’s requested revisions for a maximum of one year but will not require formal approval for release.

3.1.7. CLEARANCE FOR THIRD PARTY COLLABORATIONS

As part of its regulatory activities, FDA engages in collaborative research projects with third parties outside of FDA that are initiated by and conducted for the benefit of FDA. These collaborations shall require FDA to have the ability to share project aggregated or raw data with third parties for collaborative research projects. For these collaborations that require sharing of aggregated or raw data, the Contractor shall accept and adhere to the Data Disclosure Clearance Procedures and form unless a different Data Disclosure Clearance Procedure process proposed by the Offeror is approved in advance by the FDA. These Procedures include terms and conditions for third party collaborations.

3.2. TASK AREA 2: AD HOC ANALYSES: CUSTOM REPORTING AND PRODUCT CUSTOMIZATION

The Contractor may need to provide additional hours of ad-hoc data analyses, custom queries, or raw data preparation not available through the data tools and in increments.

3.2.1. CUSTOM PROGRAMMING AND ANALYTICAL SUPPORT

The Contractor shall provide additional analytical and programming support, to enable FDA personnel to obtain prescriptions, patients, claims and any other utilization metrics not available through the online data tools. The FDA estimates a potential need of up to two hundred (200) ad-hoc hours annually. The Contractor may need to provide additional hours of ad-hoc data analyses, custom queries, or raw data preparation not available through the data tools and in increments to be determined.

3.3. TASK AREA 3: AD-HOC TECHNICAL SERVICES

The Contractor shall provide additional quantities of Services including, but not limited to:

a. Validation Studies – Studies that are conducted to establish soundness or validity of a particular method used, for example to validate indications for treatment in the database using the claims data.

b. Projection Methodology Studies – Developing methods that shall allow projecting the number of prescriptions or patients based on the sample data.

c. Concomitant Drug Use Analysis – Analyses on the concomitant use of two or more drugs from the same or different therapeutic classes indicated to treat the same or different diagnosis.

d. Feasibility Studies – Studies that are conducted as initial pilot studies to determine if the scope of a study is practical, achievable, and likely to involve a large enough population size to determine a significant association or non-significance association between exposure and outcome.

e. Customized Analysis – Analyses of data that endeavor to answer a specific question that require additional tools beyond the current interface tool that is provided by the database.

f. Tool Enhancement – Expanding the tool capabilities beyond the current offering to improve data access and analysis.

g. Ability to access other outpatient data and tools that allows more granular perspective such as by geography (e.g., County, State, Metropolitan Statistical Area), and time (e.g., weekly) within the vendor’s data suite.

h. Ability to link/access additional data sources including electronic medical records within the vendor’s data suite to provide a comprehensive view of the drugs being analyzed.

4. SECTION 508 ACCESSIBILITY STANDARDS

The following list of Section 508 accessibility standards of the Access Board EIT Accessibility Standards are applicable to this acquisition:

• Must meet WCAG 2.0 A and AA

• E101.2 Equivalent Facilitation (Appendix A, Application and Scoping Requirements)

• E203 Access to Functionality (Appendix A, Application and Scoping Requirements)

• E204 Functional Performance Criteria (Appendix A, Application and Scoping Requirements)

• E205 Electronic Content (Appendix A, Application and Scoping Requirements)

• E208 Support Documentation and Services (Appendix A, Application and Scoping Requirements)

• Chapter 6 Support Documentation and Services (Appendix C, Functional Performance Criteria and

Technical Requirements)

• 302 Functional Performance Criteria (Appendix C, Functional Performance Criteria and Technical

Requirements)

• Electronic content must be accessible to HHS acceptance criteria.

• Accessibility checklists for various formats are available at the HHS site. Materials that are final items must be compliant with Section 508 at time of delivery, except upon approval of the Contracting Officer or Representative.

• E207 Software (Appendix A, Application and Scoping Requirements)

• Chapter 5 Software (Appendix C, Functional Performance Criteria and Technical Requirements)

5. INSPECTION AND ACCEPTANCE

The Contracting Officer’s Representative (COR) shall, in accordance with FAR 52.212-4, perform inspection and acceptance of all the services. Inspection and acceptance shall be performed at the location identified in individual task orders. Acceptance shall be communicated within thirty (30) calendar days of receipt in writing.

5.1. QUALITY ASSURANCE SURVEILLANCE PLAN

The Contractor shall provide a Quality Assurance Surveillance Plan (QASP) detailing the procedures and guidelines to ensure the required performance standards or services levels, specified in the performance evaluation plan, are met throughout the life of this contract. The QASP shall describe the systematic methods used to monitor performance, identify required documentation, and allocate https://www.levelaccess.com/wcag-a-and-wcag-aa-conformance/ https://www.access-board.gov/ict/#E101.2 https://www.access-board.gov/ict/#E203-functionality https://www.access-board.gov/ict/#E204-functional-performance-criteria https://www.access-board.gov/ict/#E205-content https://www.access-board.gov/ict/#E208-documentation-Services https://www.access-board.gov/ict/#chapter-6-support-documentation-and-services https://www.access-board.gov/ict/#302-functional-performance-criteria https://www.hhs.gov/web/section-508/accessibility-checklists/index.html https://www.access-board.gov/ict/#E207-software https://www.access-board.gov/ict/#chapter-5-software resources. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion.

5.2. PERFORMANCE EVALUATION PLAN

Performance shall be evaluated to determine whether it meets the threshold of the agreement. When the performance threshold is not met, the FDA COR shall notify the Contract Specialist/Officer. The Contractor shall reply to all performance inquiries listed below with a resolution within fifteen (15) business days of receipt. Failure to meet the Acceptable Quality Level shall be captured as non-performance and provided to the Contracting Officer (CO) for action.

Required Service Standard Acceptable Quality

Level (AQL) Method of Surveillance The Contractor shall provide Disclosure Clearance and Third Party Agreement Service

The turnaround time for urgent clearance requests is 24 hours (one

(1) business day); 48 hours (two (2) business days) for standard clearance requests; and 72 hours for third-party agreements

Standard shall be fully met at 100%

COR and FDA staff shall maintain a clearance tracking log with turnaround times

The Contractor shall provide unlimited Direct Access to Data Resource and Services

The Contractor shall notify the FDA 48 hours in advance of any circumstances resulting in loss of access to the data source due to planned downtime

The Contractor shall notify the FDA within 30 minutes (Monday-Friday, 9:00 AM – 5:00 PM Eastern Time) from the onset of unplanned downtime with an estimate of time to restoration of access

Standard shall be fully met at 100%

COR and FDA staff shall monitor database access, notification and restoration times

The Contractor shall provide ad-hoc analyses:

custom reporting and product customization

The Contractor shall provide the FDA ad-hoc data results within fifteen (15) business days from receipt of request from FDA, or a mutually agreed upon delivery timeline for more complex analyses

Standard shall be fully met at 100%

COR and FDA staff shall monitor turnaround times of ad-hoc requests from the Contractor’s Monthly Report

The Contractor shall provide a resolution plan and shall include a timeline for resolving any circumstances resulting in loss of, or lack of, access to data or any data errors/loss from the database(s)

Within five (5) business days of Contractor’s knowledge of the loss or lack of access to data or any data errors/loss from the database(s) and shall be documented in the Monthly Report

Standard shall be fully met at 100%

COR and FDA staff review of data quality (i.e., variance in data runs)

Required Service Standard Acceptable Quality

Level (AQL) Method of Surveillance The Contractor shall guarantee timely access to outpatient prescription- and patient-level analytical datasets

The mutually agreed upon dataset parameters (max. size, data elements) and turnaround time to be negotiated at the time of award

Standards shall be fully met for access to all prescription-and patient-analytical datasets

COR and FDA staff review of dataset quality and turnaround times

5.3. ADVANCED UNDERSTANDING

Notwithstanding any of the above requirements, under certain circumstances, the Government may be required to share data or information it obtains under this contract with Congress, with a Federal court, or with another governmental body of competent jurisdiction. If it intends to share data or information obtained under this contract with Congress, with a Federal court, or with another governmental body of competent jurisdiction, the Government shall take appropriate measures within its control to ensure that the information shall be shared in a manner intended to protect the information from public disclosure. The Contractor shall ensure the protection of the information and data they receive under this contract from unauthorized use or disclosure and shall treat the information as confidential or otherwise privileged.

6. DELIVERABLES OR PERFORMANCE

Be advised that FDA does not accept documents which contain the use of macros. When submitting documents via email, DO NOT include .exe, .mso, or any other executable file types that could potentially trigger email security protections (i.e. email blocks, quarantine). Document submissions required throughout the award period(s) shall not have macro enabled functionality and any document delivered having that functionality will be deemed delinquent, if not corrected prior to the due date.

Note: the following deliverables are based on a twelve-month period.

Item No. Description of Supplies/Service Quantity Unit Delivery Date 1 Unlimited Access to National level

Outpatient Prescription Data/Services (80 users)

Unlimited 12 Months Initiated at time of award

On-site or Virtual Kick Off or Annual Meeting

One (1) Annually Initiated within two (2) weeks of award

On-site or Virtual training programs and training materials

Two (2) Lot Initiated within thirty (30) calendar days of award

Disclosure Clearance and Third Party Agreement Services

Unlimited 12 months As needed

Monthly Reports Twelve (12) Monthly Monthly (by the 20th of each month)

Acceptable Projection or Other Appropriate Methodology

One (1) Lot At time of award

Item No. Description of Supplies/Service Quantity Unit Delivery Date

Current and complete Data Dictionary and Database Description, including updates

One (1) Lot At time of award/Annually

Technical Support: to include Notification of and Access to Upgrades and/or New Releases of the Data and Software

Unlimited 12 Months At time of award

Unlimited Access to National level counts of unique patients (100 users)

Unlimited 12 Months Initiated at time of award

3 Unlimited Access to patient level dataset extracts (25 users)

Unlimited 12 Months

Initiated at time of award

4 Unlimited Access to outpatient Medical Claims (25 users)

Unlimited 12 Months

Initiated at time of award

5 Unlimited Access to Subnational Data (State, County, Zip, Metropolitan Statistical Area (MDSA), Core-Based Statistical Area (CBSA) (100 users)

Unlimited 12 Months Initiated at time of award

6 Unlimited Access to Electronic Medical Records (EMR) (10 users)

Unlimited 12 Months As needed

7 Ad hoc Analyses: custom reporting and product customization.

Up to two hundred

(200) hours

Lot As needed

6.1. CONTRACTOR TRAINING - HHS MANDATORY CONTRACTOR TRAINING

The U.S. Department of Health and Human Services (HHS) mandates that all prime contractors and sub-contractors that are performing work under a government contract regardless of having direct access to the agency’s network are required to complete annually the HHS mandated contractor training courses within three (3) business days after contract award; and any other newly mandated training as required by the FDA within ten (10) business after training notification as follows:

• FDA Information Security Awareness – contractors without direct access to the FDA network, may use the HHS publicly available training site:

https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/

• Training completed at this site is no tracked, therefore keep the HHS training certificates for your records and provided as a separate deliverable to the CO and/or COR.

• Regular users should complete the following:

Cybersecurity Awareness Training – Module 1 Cybersecurity Awareness Training – Module 2 Rules of Behavior Overview – Module 3

• If there is a system administrator on the contract, the contractors shall complete the HHS https://www.hhs.gov/sites/default/files/hhs-etc/rbt-it-training/index.html and provide certificates to the CO and/or COR.

• FDA Records Management – contractors without access to the FDA network but are on an FDA contract and who are creating records on behalf of FDA shall complete the .pdf version of the FDA annual Records Management training and the certificate of completion, and provide the deliverables to the CO and/or COR. (See Attachment 13) https://www.hhs.gov/about/agencies/asa/ocio/cybersecurity/security-awareness-training/ https://www.hhs.gov/sites/default/files/hhs-etc/cybersecurity-awareness-training-m1/index.html https://www.hhs.gov/sites/default/files/hhs-etc/cybersecurity-awareness-training-m2/index.html https://www.hhs.gov/sites/default/files/hhs-etc/rules-of-behavior-m3/index.html https://www.hhs.gov/sites/default/files/hhs-etc/rbt-it-training/index.html

• Emergency Preparedness – the Administration for Strategic Preparedness and Response (ASPR) requires contractors without FDA Network access to complete the mandatory training via the following link: Emergency Preparedness Training

• The Contractor PM shall provide to the FDA COR/PM a training completion report via email within five (5) business days before the required FDA Training deadline. The report shall consist of all active contractor employee’s names per the Roster, name of the training and documenting training certification.

Deliverables – HHS Mandatory Contractor Training

Section Deliverables Section 6: HSS Mandated Contractor Training

• Complete mandatory training within three (3) business days after contract award

• Other mandated training as required by the FDA within ten (10) business after training notification or as notified throughout contract period of performance

• Documentation of training completion submitted to the COR/PM

7. PERIOD OF PERFORMANCE

The period of performance will be one (1) nine-month Base Period with four (4) twelve-month Option Periods, anticipated as follows:

Base Period (9 months): August 22, 2025 through May 21, 2026 Option Period I (12 months): May 22, 2026 through May 21, 2027 Option Period II (12 months): May 22, 2027 through May 21, 2028 Option Period III (12 months): May 22, 2028 through May 21, 2029 Option Period IV (12 months): May 22, 2029 through May 21, 2030

8. PLACE OF PERFORMANCE

The place of performance shall shall be at the Contractor’s site.

9. TASK ORDER (TO) ADMINISTRATION DATA

9.1. ORDER TYPE

This is anticipated to be a hybrid Firm-Fixed Price (FFP) (for Task Area 1) and Labor-Hour (LH) (for Task Areas 2 and 3) task order.

9.2. GOVERNMENT POINTS OF CONTACT

Unless otherwise specified, submit TO deliverables to all Government points of contact listed below.

9.2.1. TO CONTRACTING OFFICER (CO):

James Jenrette James.Jenretteiii@fda.hhs.gov 301-837-7549 https://humancapital.learning.hhs.gov/mandatorytraining.asp mailto:James.Jenretteiii@fda.hhs.gov

9.2.2. TO CONTRACT SPECIALIST (CS):

Noah Wills Noah.Wills@fda.hhs.gov 240-402-5220

9.2.3. TO CONTRACTING OFFICER’S REPRESENTATIVE (COR):

To be determined at award

9.2.4. TO ALTERNATE COR:

To be determined at award

9.3. GOVERNMENT FURNISHED PROPERTY

Government furnished property is not anticipated.

9.4. INVOICING

The FDA invoicing procedures shall be in accordance with HHSAR 352.232-71, Electronic Submission of Payment Requests, and as follows:

FDA Electronic Invoicing and Payment Requirements - Invoice Processing Platform (IPP) (JAN 2022)

a. All Invoice submissions for goods and or services must be made electronically through the U.S.

Department of Treasury's Invoice Processing Platform System (IPP). http://www.ipp.gov/vendors/index.htm

b. Invoice Submission for Payment means any request for contract financing payment or invoice payment by the Contractor. To constitute a proper invoice, the payment request must comply with the requirements identified in FAR 32.905(b), "Content of Invoices" and the applicable Payment clause included in this contract, or the clause 52.212-4 Contract Terms and Conditions - Commercial Items included in commercial items contracts. The IPP website address is: https://www.ipp.gov c.

1. The Agency will enroll the Contractors new to IPP. The Contractor must follow the IPP registration email instructions for enrollment to register the Collector Account for submitting invoice requests for payment. The Contractor Government Business Point of Contact (as listed in SAM) will receive Registration email from the Federal Reserve Bank of St. Louis (FRBSTL) within 3 - 5 business days of the contract award for new contracts or date of modification for existing contracts.

2. Registration emails are sent via email from ipp.noreply@mail.eroc.twai.gov. Contractor assistance with enrollment can be obtained by contacting the IPP Production Helpdesk via email to IPPCustomerSupport@fiscal.treasury.gov or phone (866) 973-3131.

3. The Contractor POC will receive two emails from IPP Customer Support, the first email contains the initial administrative IPP User ID. The second email, sent within 24 hours of mailto:Noah.Wills@fda.hhs.gov http://www.ipp.gov/vendors/index.htm https://www.ipp.gov/ receipt of the first email, contains a temporary password. You must log in with the temporary password within 30 days.

4. If your company is already registered to use IPP, you will not be required to re-register.

5. If the Contractor is unable to comply with the requirement to use IPP for submitting invoices for payment as authorized by HHSAR 332.7002, a written request must be submitted to the Contracting Officer to explain the circumstances that require the authorization of alternate payment procedures.

d. Invoices that include time and materials or labor hours Line Items must include supporting documentation to (1) substantiate the number of labor hours invoiced for each labor category, and

(2) substantiate material costs incurred (when applicable).

e. Invoices that include cost-reimbursement Line Items must be submitted in a format showing expenditures for that month, as well as contract cumulative amounts. At a minimum the following cost information shall be included, in addition to supporting documentation to substantiate costs incurred.

• Direct Labor - include all persons, listing the person's name, title, number of hours worked, hourly rate, the total cost per person and a total amount for this category;

• Indirect Costs (i.e., Fringe Benefits, Overhead, General and Administrative, Other Indirects)- show rate, base and total amount;

• Consultants (if applicable) - include the name, number of days or hours worked, daily or hourly rate, and a total amount per consultant;

• Travel - include for each airplane or train trip taken the name of the traveler, date of travel, destination, the transportation costs including ground transportation shown separately and the per diem costs. Other travel costs shall also be listed;

• Subcontractors (if applicable) - include, for each subcontractor, the same data as required for the prime Contractor;

• Other Direct Costs - include a listing of all other direct charges to the contract, i.e., office supplies, telephone, duplication, postage; and

• Fee - amount as allowable in accordance with the Schedule and FAR 52.216-8 if applicable.

f. Contractor is required to attach an invoice log addendum to each invoice which shall include, at a minimum, the following information for contract administration and reconciliation purposes:

(a) list of all invoices submitted to date under the subject award, including the following:

(1) invoice number, amount, & date submitted

(2) corresponding payment amount & date received

(b) total amount of all payments received to date under the subject contract or order

(c) and, for definitized contracts or orders only, total estimated amounts yet to be invoiced for the current, active period of performance.

g. Payment of invoices will be made based upon acceptance by the Government of the entire task or the tangible product deliverable(s) invoiced. Payments shall be based on the Government certifying that satisfactory services were provided, and the Contractor has certified that labor charges are accurate.

h. If the services are rejected for failure to conform to the technical requirements of the task order, or any other contractually legitimate reason, the Contractor shall not be paid, or shall be paid an amount negotiated by the CO.

i. Payment to the Contractor will not be made for temporary work stoppage due to circumstances beyond the control of U.S. Food and Drug Administration such as acts of God, inclement weather, power outages, and results thereof, or temporary closings of facilities at which Contractor personnel are performing. This may, however, be justification for excusable delays.

j. The Contractor agrees that the submission of an invoice to the Government for payment is a certification that the services for which the Government is being billed, have been delivered in accordance with the hours shown on the invoices, and the services are of the quality required for timely and successful completion of the effort.

k. Questions regarding invoice payments that cannot be resolved by the IPP Helpdesk should be directed to the FDA Employee Resource and Information Center (ERIC) Helpdesk at 301-827-ERIC (3742) or toll-free 866-807-ERIC (3742); or, by email at ERIC@fda.hhs.gov. Refer to the Call-in menu options and follow the phone prompts to dial the option that corresponds to the service that's needed. All ERIC Service Now Tickets will either be responded to or resolved within 48 hours (2 business days) of being received. When emailing, please be sure to include the contract number, invoice number and date of invoice, as well as your name, phone number, and a detailed description of the issue.

9.5. AVAILABILITY OF FUNDS

The Government’s obligation for performance of this contract is contingent upon the availability of appropriated funds from which payment for contract purposes can be made. No legal liability on the part of the Government for any payment may arise for performance under this contract until funds are made available to the Contracting Officer for performance and until the Contractor receives notice of availability, to be confirmed in writing by the Contracting Officer.

10. SPECIAL CONTRACT REQUIREMENTS

10.1. INTERNET PROTOCOL

All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6).

10.2. SECURITY REQUIREMENTS

1. Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or modification

(hereafter "contract"), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) will operate a federal system and information technology containing data that supports the FDA mission. In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of "information technology" (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with FDA policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity; and

Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of FDA and information systems that store, process, and/or transmit FDA information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories.

Based on information provided by the System/Data Owner, ISSO, privacy representative, or other POC, the impact level for each Security Objective (Confidentiality, Integrity, and Availability) and the Overall Impact Level, which is the highest watermark of the three factors of the information or information system are the following:

Confidentiality: [X] Low [ ] Moderate [ ] High

Integrity: [X] Low [ ] Moderate [ ] High

Availability: [X] Low [ ] Moderate [ ] High

Overall Impact Level: [X] Low [ ] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of FDA regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s). This includes http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf http://csrc.nist.gov/publications/nistpubs/800-60-rev1/SP800-60_Vol2-Rev1.pdf notifying the FDA Cybersecurity and Infrastructure Operations Coordination Center (CIOCC) within one (1) hour of discovery/detection in the event of a cybersecurity or privacy incident.

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the FDA Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain the FDA Information Security Program security requirements, outlined in the FDA Information Security and Privacy Protection (IS2P) policy, by contacting the CO/COR or emailing your ISSO.

c. Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

d. Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable FDA privacy policies and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally

Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following: Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. Based on information provided by the ISSO, System/Data Owner, or other security or privacy representative, it has been determined that this solicitation/contract involves:

[X] No PII [ ] PII

iii. The Contractor must support the agency with conducting a Privacy Threshold

Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not a full Privacy Impact Assessment (PIA) needs to be completed.

If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information after completion of the PTA and in accordance with HHS and FDA policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002. The PTA/PIA must be completed and approved prior to active use and/or collection or processing of PII and is a prerequisite to agency issuance of an authorization to operate (ATO).

The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

e. Controlled Unclassified Information (CUI). Executive Order 13556 defines CUI as "information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls,…