Sources Sought 75N9302022R00012.pdf

SOURCES SOUGHT NOTICE

Clinical Research Data Management and Systems Support Solicitation # 75N93022R00012

Sources Sought Reference Number:_HHS-NIH-NIAID-SS-AMOB-20012__________

Type of Requirement

New Requirement Follow-on (Contract No.: HHSN272201800005C) Other (specify):________________

Place of Performance

Place of performance is unknown at this time Place of performance is known. Address or general location:

Recompetition (if applicable)

Systex, Inc.

15245 Shady Grove Rd.

Suite 405 Rockville, Maryland 20850-3222

Contracting Office Address

Department of Health and Human Services, National Institutes of Health, National Institute of Allergy and Infectious Diseases, Office of Acquisitions, 5601 Fishers Lane, MSC 9821, Bethesda, MD, 20892-9821

Sources Sought Notice Information

Introduction

This is a Small Business Sources Sought notice. This is NOT a solicitation for proposals, proposal abstracts, or quotations. The purpose of this notice is to obtain information regarding: (1) the availability and capability of qualified small business sources; (2) whether they are small businesses; HUBZone small businesses; service-disabled, veteran-owned small businesses; 8(a) small businesses; veteran-owned small businesses; woman-owned small businesses; or small disadvantaged businesses; and (3) their size classification relative to the North American Industry Classification System (NAICS) code for the proposed acquisition. Your responses to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible.

An organization that is not considered a small business under the applicable NAICS code should not submit a response to this notice. This requirement is assigned a code of 541990 in the North American Industry Classification System (NAICS), and the size standard for such requirements is $15.0 million.

Your response to the information requested will assist the Government in determining the appropriate acquisition method, including whether a set-aside is possible. An organization that is not considered a small business under the applicable NAICS code should not submit a response to this notice.

A determination by the Government not to compete this requirement as a set-aside based upon responses to this Notice is solely within the discretion of the Government.

Interested parties are expected to review this Notice and the draft Statement of Work to familiarize themselves with the requirements of this project; failure to do so will be at your firm's own risk.

Background

The Division of Clinical Research (DCR) provides operational and technical support for clinical research data management for research studies within the Clinical Center at the National Institutes of Health (NIH) and for international outbreak response initiatives as directed by Clinical Director. The Division of Clinical Research (DCR) Data Management and System Support team leverages existing systems and expertise through the operations and technical capabilities provided through this contract. The mission of DCR has become increasing focused on supporting clinical research as part of an emergency response to disease outbreak. The evolution of the mission has resulted in the creation of the Clinical Trials Research Sections (CTRS) to develop and provide operational efficiencies and data integrity for special projects and rapid response initiatives. Primarily established in response to Ebola outbreak in West Africa and the COVID-19 pandemic, CTRS has become DCR’s core resource for study design, implementation, and data management for emerging disease responses. As part of this emerging mission DCR has developed an automated approach for defining, collecting, processing, and managing the use of Case Report Form (CRF) as a data collection process. The Study Tracking & Online Reporting Management (STORM) is early in its use but shows promise as a cornerstone for DCR remote data management workflows. It is a primary goal of this contract to support the data lifecycle of these studies or special projects

Purpose and Objectives

Objectives of the proposed contract include support, enhancement, and development of Clinical Research Information Management systems across the complete research data lifecycle (definition, collection, storage, analysis, and reporting) of studies as requested by the NIAID Division of Clinical Research (DCR). The dynamic nature of DCR’s mission requires current systems be capable of not only supporting research studies within the NIAID clinics as part of the NIH Clinical Center, but also able to be deployed as part of a response to emerging disease outbreak in remote and diverse international locations. The primary focus of the contract will be the reuse of stable and proven systems and technical platforms (e.g., CRIMSON, STORM etc..) to create a core capability of systems and expertise to provide DCR with consistent clinical research data management functionality that leverages the reusability of operational data management systems across projects, deceasing complexity of initiating new studies.

The purpose of this Small Business Sources Sought Notice (SBSS) is to identify qualified small business concerns that are interested in and capable of performing the work described herein.

On behalf of NIAID, the NIH does not intend to award a contract on the basis of responses received nor otherwise pay for the preparation of any information submitted.

As a result of this SBSS Notice, the NIAID may issue a Request for Proposal (RFP). THERE IS NO SOLICITATION AVAILABLE AT THIS TIME. However, should such a requirement materialize, no basis for claims against NIAID shall arise as a result of a response to this Small Business Sources Sought Notice or the NIAID’s use of such information as either part of our evaluation process or in developing specifications for any subsequent requirement.

Technical Requirements

The Contractor shall provide services for the continued support of the CRIMSON and STORM applications and associated operational and data processing workflows. The Contractor will also serve as a key resource for NIAID DCR Deputy Director of Operations Management (DDOM) in the support of clinical research informatics within selected projects.

The activities supported by this contract focus on the implementation, operations, and maintenance of systems and data processing workflows supporting NIAID clinical research studies. Although solutions will be required to remain agile and responsive to changing needs of the clinical research community, the goal is to continue to enhance and modernize the foundational core tools set. This foundational framework and tools will include the design and implementation of systems, user support and operations, as well as core infrastructure and technology support.

Anticipated period of performance

Base Period: December 1, 2022 through November 30, 2023 Option Period 1: December 1, 2023 through November 30, 2024 Option Period 2: December 1, 2024 through November 30, 2025 Option Period 3: December 1, 2025 through November 30, 2026 Option Period 4: December 1, 2026 through November 30, 2027

Other important considerations

See the draft Statement of Work, subject to change, in Section 2: Scope, Section 3:

Objectives and Section 4: Technical Objectives for more information.

Capability statement / information sought

Respondents must provide, as part of their responses, a capability statement, to include (a) staff expertise, including their availability, experience, and formal and/or other training; (b) current in-house capability and capacity to perform the work; (c) prior completed projects of similar nature; (d) corporate experience and management capability; (e) examples of prior completed Government contracts, references, and other related information.

Information Submission Instructions:

Page Limitations:

Interested qualified small business organizations should submit a tailored Capability Statement not to exceed 15 pages, single sided pages including all attachments, resumes, charts, etc. (single spaced, 12 point font minimum) that clearly details the firm’s ability to perform the aspects of the notice described above and in the draft SOW. Statements should also include an indication of current certified small business status; this indication should be clearly marked on the first page of your capability statement, as well as the eligible small business concern's name, point of contact, address and DUNS number. Capability Statements must not include links to internet web site addresses (URLs) or otherwise direct readers to alternate sources of information. Font size must be 10 to 12 points. All proprietary information should be marked as such.

Required Business Information:

• DUNS.

• Company Name.

• Company Address.

• Company Point of Contact, Phone and Email address

• Current GSA Schedules and/or Government-wide Acquisition Contracts (GWACs) appropriate to this Sources Sought.

• Do you have a Government approved accounting system? If so, please identify the agency that approved the system.

• Type of Company (i.e., small business, 8(a), woman owned, veteran owned, etc.) as validated via the System for Award Management (SAM) located at https://www.sam.gov/SAM/pages/public/index.jsf. This indication should be clearly marked on the first page of your Capability Statement (preferable placed under the eligible small business concern’s name and address).

Number of Copies:

Please submit one (1) electronic copy of your response as follows:

All Capability Statements sent in response to this Small Business Sources Sought notice must be submitted electronically (via e-mail) to Matt Lear, Contract Specialist, at matt.lear@nih.gov and Uju Obii-Obioha, Contract Specialist, at uju.obii-obioha@nih.gov in Adobe Portable Document Format (PDF). The e-mail subject line must specify HHS-NIH- NIAID-SS-AMOB-20012 Facsimile responses will not be accepted.

Common Cut-off Date:

Electronically submitted tailored capability statements are due no later than Friday, March 25,2022 at 2:00PM Time Eastern. All responses must be received by the specified due date and time in order to be considered. No calls or facsimile transmissions will be accepted.

CAPABILITY STATEMENTS RECEIVED AFTER THIS DATE AND TIME WILL NOT BE

CONSIDERED.

https://www.sam.gov/SAM/pages/public/index.jsf mailto:matt.lear@nih.gov mailto:uju.obii-obioha@nih.gov

Disclaimer and Important Notes

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work. Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published at beta.SAM.gov. However, responses to this notice will not be considered adequate responses to a solicitation.

Confidentiality

No proprietary, classified, confidential, or sensitive information should be included in your response. The Government reserves the right to use any non-proprietary technical information in any resultant solicitation(s).

Contracting Office Address:

5601 Fishers Lane Rockville, MD 20852

Primary Point of Contact:

Matt Lear Contract Specialist Email: matt.lear@nih.gov Phone: 240-669-5109

Second Point of Contact:

Uju Obii-Obioha Contract Specialist Email: uju.obii-obioha@nih.gov Phone: 301-761-6540 mailto:alexis.hudak@nih.gov mailto:alexis.hudak@nih.gov

Page 1 Contract HHSN272201800005C

Statement of Work

(SOW)

Clinical Research Data Management and Systems Support

Page 2 Contract HHSN272201800005C

1. Background

The Division of Clinical Research (DCR) provides operational and technical support for clinical research data management for research studies within the Clinical Center at the National Institutes of Health (NIH) and for international outbreak response initiatives as directed by Clinical Director.

The Clinical Center at the National Institutes of Health (NIH) is the world’s largest hospital entirely devoted entirely to clinical research. It is a national resource that makes it possible to rapidly translate scientific observations and laboratory discoveries into new approaches for diagnosing, treating, and preventing disease. As part of the overall mission, the NIH Clinical Center provides the National Institute of Allergy and Infectious Diseases (NIAID) with clinical facilities and technology infrastructure required to support intramural clinical research. NIAID has developed the Clinical Research Information Management Systems of NIAID (CRIMSON) hosted on the Clinical Center infrastructure as a study specific documentation and workflow management tool to address many of the unique requirements of the NIAID Clinics. CRIMSON is a well-established mature clinical and scientific information system that has undergone generations of enhancements, improvements, and refinements in the past two decades. It provides mission-essential patient management, case report management, study management, adverse event reporting, study analysis and many other related activities. The formatted CRIMSON Progress Note is also an integrated element of the Clinical Center Hospital Medical Record.

The Division of Clinical Research (DCR) Data Management and System

Support team leverages existing systems and expertise through the operations and technical capabilities provided through this contract. The mission of DCR has become increasing focused on supporting clinical research as part of an emergency response to disease outbreak. The evolution of the mission has resulted in the creation of the Clinical Trials Research Sections (CTRS) to develop and provide operational efficiencies and data integrity for special projects and rapid response initiatives. Primarily established in response to Ebola outbreak in West Africa and the COVID-19 pandemic, CTRS has become DCR’s core resource for study design, implementation, and data management for emerging disease responses. As part of this emerging mission DCR has developed an automated approach for defining, collecting, processing, and managing the use of Case Report Form (CRF) as a data collection process. The Study Tracking & Online Reporting Management (STORM) is early in its use but shows promise as a cornerstone for DCR remote data management workflows. It is a primary goal of this contract to support the data lifecycle of these studies or special projects

2. Scope

The activities supported by this contract focus on the implementation, operations, and

Page 3 Contract HHSN272201800005C maintenance of systems and data processing workflows supporting NIAID clinical research studies. Although solutions will be required to remain agile and responsive to changing needs of the clinical research community, the goal is to continue to enhance and modernize the foundational core tools set. This foundational framework and tools will include the design and implementation of systems, user support and operations, as well as core infrastructure and technology support.

2.1 User Support and Operations (60%)

The deployed Clinical Research information systems within DCR may require continued support and facilitation by the selected contract resources. The breadth of operational support will be defined in the design and definition of the proposed solution and may range from staffing and running data management and processing pipelines application specific user training, help desk support and system maintenance activities.

The operational execution of data management pipelines will include the configuration and tailoring of systems to specific research protocols. In both the existing CRIMSON applications and the proposed CTRS solutions this will include working with studies teams in configuration of application user interfaces, the identification, integration, and execution of external data sources required to support operational workflows and the reporting and dissemination of data. Additionally, there will be effort in supporting data collection and processing as part of an integrated study team approach. The contract staff will serve as study data manager and augment the team in the day-to-day operational activities.

All systems and solutions provided to DCR through this contract will be supported through active end-user operational training and technical help desk support

2.2 Infrastructure and Information Technology support (20%)

The deployment and operational support of clinical research information system within DCR Clinical Research, require software, hardware and networking infrastructure that is compliant with policies and practices established by the National Institute of Standards and Technology (NIST), NIH, and NIAID. As such, the contractor will be required maintain an operational relationship with support teams housing and providing data center services e.g., the NIAID Office of Cyber Infrastructure and Computational Biology (OCICB) as well as the Division of Clinical Research Informatics (DCRI) within the NIH Clinical Data Center.

As a tenant within these organizational data center facilities, the contractor will operate within the guidelines and practices established by that organization. This will require both a strategic and planning coordination as well as a tactical day to day communication and collaboration. This support will center on several core activities.

Availability and operational support – When established all systems, supporting hardware and network connectivity will be monitored and key objectives for performance and uptime availability will be established. Based on service level agreements (SLAs) with organizational data centers, the contractor will serve as the custodian and caretaker of DCR research information systems, leading and

Page 4 Contract HHSN272201800005C facilitating end-user systems support needs and organizational data and infrastructure resources.

Maintenance and modernization- The contractor team will work with data center teams to assure updating and patching of all infrastructure and operating systems as technology evolve. Additionally, as new hardware or networking infrastructure are introduced into the datacenter the contractor will coordinate with datacenter technical teams to assure transition and continued support of DCR clinical research information systems that may be affected

Security and Privacy - System Security and Privacy is a critical attribute of all supported systems and operational activities using those systems Core Task Areas. The current operating environment and data sensitivity (CRIMSON is currently a FISMA High) require an ongoing and proactive security and privacy auditing process. This process will at a minimum, will comply with the policies and practices required to operate on the NIH network regarding subject privacy and cybersecurity issues. The contractor will coordinate any required desk audits, privacy assessments, documentation, or reviews mandated by NIAID and Clinical Center ISSOs

2.3 Clinical Research Information System Design, Development, and Implementation (20%)

An essential part of the requested work will be leveraging custom built, open source or commercial applications to establish a core application platform to support Clinical Research operations within DCR. Using well proven system development practices the contractor will collect and analyze the operational requirements and potential solution strategies. Once approved, the proposed solution design will be developed. These solutions may include continued modification or modernization of the CRIMSON and suite of tools or systems supporting the emerging needs of DCR and special projects requires configuration and deployment of existing data collection and management tools, such as REDCap, BiobankPro, LabKey, Tableau, and/or DFdiscover. Many of these solutions may include the tailoring and use of commercial database management platforms such as PostgreSQL, MySQL, or Microsoft SQL Server.

These systems will be required to adapt and evolve as the mission and objectives of the division respond to emerging situations and technology changes. As solutions are deployed the objective will be to establish a library of tools that can be rapidly adapted for a given study or response scenario

3. Objectives

Objectives of the proposed contract include support, enhancement, and development of Clinical Research Information Management systems across the complete research data lifecycle (definition, collection, storage, analysis, and reporting) of studies as requested by the NIAID Division of Clinical Research (DCR).

The dynamic nature of DCR’s mission requires current systems be capable of not only supporting research studies within the NIAID clinics as part of the NIH Clinical

Page 5 Contract HHSN272201800005C

Center, but also able to be deployed as part of a response to emerging disease outbreak in remote and diverse international locations. The primary focus of the contract will be the reuse of stable and proven systems and technical platforms (e.g., CRIMSON, STORM etc..) to create a core capability of systems and expertise to provide DCR with consistent clinical research data management functionality that leverages the reusability of operational data management systems across projects, deceasing complexity of initiating new studies.

Three core task areas, which in addition to the overarching project management and governance strategy, comprise the functional objectives supported by this SOW. The three core objectives are:

3.1 The continued implementation and support of the CRIMSON applications within NIAID clinics and STORM system for remote data collection and processing as the backbone of the DCR Clinical Research Data Management.

Support for these objectives will require the immediate assumption of the current systems without user disruption, and continued coordination and integration with both the technical and operational environment of the NIAID Clinics and the DCR CTRS, primary tasks include.

• Expert project management, communication, and collaboration with stakeholders as identified by the CORs.

• Assurance of continued high-level performance, reliability, usability, integrity, and user support of the existing CRIMSON and STORM applications.

• Maintenance, adaptation, and optimization of core functionality supporting evolving workflows of clinical studies, regulatory requirements of existing studies.

• Maintenance, coordination, and support of the technical infrastructure required to support existing capabilities, assumption of existing MOUs and current ATOs and review all system security and privacy audits

• Continue to staff and operate data management and processing activities supported within CTRS

• It is anticipated that the resultant Contractor will need to access NIH and NIAID facilities to maintain and/or operate CRIMSON and other systems.

NIH badges will be required to access systems and onsite locations.

3.2 The ability to extend system capabilities as technical requirements and DCR operational needs change. These tasks primarily include the more complex development, modernization, and enhancement (DME) initiatives, that will require specific strategies for definition, prioritization, execution, and management.

• Define a means of review and prioritization of proposed DME activities, that include timeline and budget impact for COR approval

• Establish technology platform that leverages open source or commercial applications, that support configuration over software development

Page 6 Contract HHSN272201800005C

• Provide technical SMEs to support operational workflows that may have impact on data workflows and support informatics systems design.

• Establish technical liaisons with OCICB and DCRI to assure synergy with existing enterprise systems and coordinate integration

3.3 The maintenance and operation of data management pipelines, including data processing and integration workflows as part of system integration and data collection workflows.

• Develop, maintain, and support automated data integration interfaces

(e.g., BTRIS, CRIS. Frederick Laboratory GRIS etc..), when possible leveraging an open-source ETL engine.

• Support data cleaning and loading strategies as required, interfacing with study design teams and operational leads, again when possible leverage automated workflow engines, however when required manual data review may be required.

• Staff and support the CTRS data management team as part of the DCR emerging disease response team

These core objectives will represent the primary goal of the proposed contract, however as with any effort of this complexity the tasks and priorities may evolve through the direction of the DCR Clinical Director and DCR Deputy Director of Operations Management. A general estimate of the level effort and core workload assumptions are included in the fore mentioned fact sheet. Additionally, system security and privacy must be considered a critical attribute of all task areas and cannot be minimized, as certain systems may be required to contain PHI and PII or hold regulated data.

4. Technical Objectives

4.1. The contractor shall provide services for the continued support of the CRIMSON and STORM applications and associated operational and data processing workflows. The contractor will also serve as a key resource for NIAID DCR Deputy Director of Operations Management (DDOM) in the support of clinical research informatics within select projects. The general breadth of the services provided by the contractor are describe below.

• Oversight and Project Management –The contractor will be required to work closely with the COR and NIAID program staff to identify, prioritize and resource a project portfolio, while maintaining ongoing Clinical Research Data Management operations. The contract Program Manager will report monthly on status of the portfolio including timeline assessments and resourcing requirements.

Page 7 Contract HHSN272201800005C

• Technical Infrastructure Coordination -The contractor will be required to interface with NIAID Office of Cyber Infrastructure and Computational Biology (OCICB) server and technical teams as well as the Division of Clinical Research Informatics (DCRI) and the Clinical Data Center team to provide the technical infrastructure. In addition, the contractor will assure compliance and coordination with policies and best practices for the deployment of technology resources at the Clinical Center or within the OCICB data center, as defined by the respective data center. The COR will rely on the Program Manager and the Principal System Engineer to coordinate and communicate with these resources and to communicate the impact of changes to management. Annually a technical architecture review shall be conducted, and collaborations or partnerships reviewed. If it is anticipated that the resultant Contractor will need to access systems outside of OCICB to perform assigned tasks, contractors will need NIH badges to access systems and onsite locations.

• Privacy and Data Security Management - The contractor will provide communication and guidance between DCR operations and the NIAID and Clinical Center CIOs regarding the policies and practices required to operate on the NIH network. The contractor will provide specific attention and detail to subject privacy and cybersecurity issues. The contractor will coordinate any required desk audits, privacy assessments, documentation, or reviews mandated by NIAID and Clinical Center ISSOs.

• Maintenance and Support of DCR Clinical Data Management Systems - Maintenance and support of the CRIMSON and STORM requires diligence in o Curation and monitoring of data workflows and application functional components (to assure data and system integrity) o Tuning and optimization of hardware, software, and operational workflows (to enhance data and systems performance), o Delivering the system functionality when and where required by prescribed workflows (providing system sustainability and reliability) o Providing research community an intuitive interface for optimal use of these systems in implementing operational workflows (optimizing workflow and data efficiencies).

These activities have direct impact on the operational effectiveness of the NIAID ability to conduct clinical research and are an essential priority for the contract.

• Application Training and Operational Support - The contractor shall provide clinically trained staff to facilitate the configuration of the data management applications and data processing workflows aligned with the data management requirements details of the study plan. As a study changes the contractor, shall adapt, and modify system configuration to accommodate the

Page 8 Contract HHSN272201800005C changing workflows. In the event, specific workflow events cannot be accommodated by configuration changes, the clinical implementation will escalate for analysis and potential functional modification. This support shall include help desk team, training, and functional consultations. The clinical support team shall be conversant in the clinical operations being conducted and how the modules and functions of the application can or shall be applied.

• Data Processing Team – When requested and approved the contractor will staff and support data collection, QC, and data processing as part of the integrated study team. For both the technical and operational data processing activities for a given study, the contractor may be required to provide dedicated resources that remain part of the study team for the duration of the study. These resources would primarily be detailed as part of the CTRS team and may include international travel. The resources include, but are not limited to: data management team and/or software engineering team to operationalize the study for the duration of the study. Depending on the type of study, various systems or software tools may be needed by the Contractor.

• Development, Modernization and Enhancement of Clinical Research Data Management Systems - In addition to routine support and operations the contractor shall provide continued development, modernization, and enhancement (DME) of the existing systems. For the systems to continually adapt to the changing business requirements, technology drivers and federal regulations, DME projects will be needed. A distinction between functional enhancements to be delivered as part of the ongoing operational support and the more formal DME project process by level of effort and operational urgency shall be made. The approval and prioritization of DME projects shall be managed through a formal change control and governance process involving stakeholder input and COR oversight. The Program Manager shall define and present impact and resource requirements to key stakeholders, including the COR for prioritization and project management activities.

• Data Integration and Workflow Processing – The contractor shall provide consultative and operational services for external data integration (e.g., Health Level 7 (HL7), REDCap, FHIR) to be consumed by DCR clinical research systems or integrated with external sources at the direction of the COR. The contractor shall also serve as a resource to DCR in the use and delivery of data and use of data integration tools, providing support for the routine execution and daily management of the data processing pipeline.

• Source Code and Object Code - Unless otherwise specified herein, the Contractor shall deliver to the Government, upon the expiration date of the contract, all source code and object code developed, modified, and/or enhanced under this contract.

• The Contractor shall deliver data in accordance with FAR 52.227-14 (Rights in Data- General)

4.2 Key Personnel

Page 9 Contract HHSN272201800005C

The following personnel are considered five key personnel by the government: Program Manager, Principal Systems Engineer, Clinical Implementation Lead, System Security and Privacy Officer, and Senior Clinical Data Manager.

The contractor shall provide a Program Manager who shall be responsible for the performance of work. The name of this person as well as, the Principal System Engineer who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer as part of the technical proposal. The Program Manager or Principal System Engineer shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The Program Manager or Principal System Engineer shall be available between 8:30 – 5:00 Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. The contractor shall provide a point of contact during non-duty and holiday hours in the event emergency services are required. The Clinical Implementation Lead will serve as primary interface for clinical staff concerning CRIMSON, STORM, and the use and delivery of information systems supported in this contract within NIAID Clinics. The Senior Clinical Data Manager will manage the clinical trial databases in support of the studies. Due to the possibility of having trials conducted internationally, the individual may be required to support DCR staff during non-duty and holiday hours.

Qualifications for all key personnel are listed below:

• Program Manager – The Program Manager will require a breadth of experience in managing a complex and diverse project portfolio combining technology and clinical research, having at least 15 years’ experience in managing a clinical research informatics team. Additionally, a demonstrated knowledge of the regulatory and security requirements mandated for patient care and clinical research data is required. The Program Manager will have budget and resourcing management experience of at least 5 years of leading of a program with a budget > 2 million annually and a direct responsibility of a staff of more than 10 FTEs

• Principal System Engineer – The Principal System Engineer will lead the technical implementation and operational execution of the hardware, software and infrastructure supporting the contract objective. A strong background in design, development, deployment and support of diverse technologies is required. This expertise will be demonstrated by previous experience in deploying commercial or internally developed solutions supporting and clinical research or clinical care.

Experience must include more than 10 years of management of a software development team, direct management of server and networking resources and oversight of data integration or data warehousing operations

• Clinical Implementation Lead – The Clinical Implementation Lead will be a health care professional with at least 5 years’ experience in the facilitating the deployment and adoption of information systems in clinical care or clinical research. This experience will include requirements documentation and coordination with technical resources as well as direct supervision of help desk or training staff. The role includes oversight of the CRIMSON Help Desk and presenting CRIMSON to both users and interested parties.

• System Security and Privacy Officer: SSPA will provide expertise and consultation on regulations and best practices in cybersecurity, Federal Information Security

Page 10 Contract HHSN272201800005C

Management Act (FISMA), and Privacy Act as well as other common guidance in cybersecurity and privacy. The designated contractor will obtain within 60 days and maintain a certification equivalent to DoD 8140 Information Assurance Level 1 certification during the period of the contract. Such certification must include a thorough grounding in the Federal Information Security Management Act

(FISMA).

• Senior Clinical Data Manager: The Senior Clinical Data Manager will provide operational and strategic support to DCR in the design, execution, and maintenance of the clinical data management systems, and practices and policies used in the conduct of Clinical Research both nationally and internationally. A minimum of 10 years of experience in Clinical Data Management and 5 years of experience in Clinical Database Programming are required. The expectation is that the incumbent will be well capable of representing the operational role and activities of DCR and require little to no supervision on a day-to-day basis; as such, a deep mastery of the clinical research data process and resulting data workflows is required.

5 Specific Task Objectives

5.2 Project Management, Communication and Collaboration

• The contractor shall follow the work process flow, methodology, procedures, deliverables, and best practices that facilitates both program and goal comprehension. The contractor shall submit a method or model for this task in the Technical Proposal.

• The contractor shall develop and document an assumption plan 14 days after award, subject to the approval of the COR, to assure minimal disruption during a transition period.

• The contractor shall submit a detailed project management plan as part of the technical proposal. The plan shall include:

o A communication and collaboration plan detailing the roles and responsibilities to communicate project strategies, milestones, planning, changes, and project documents review.

o A high-level plan for an Intranet for user communication, application manuals, and help documentation available to CRIMSON users and stakeholders. Current tools available include SharePoint and Tableau.

o A high-level plan for an Intranet to post a library of confidential information such as architecture, infrastructure, application, and security documentation for use of the contractor, COR, Information Systems Security Officer, and Contracts Office.

o A proposal for a reporting strategy including content, structure, and frequency for status and progress reports. Note that reporting requirements occur in other tasks of this SOW. Acceptance is subject to COR approval.

o A proposal for a strategy for periodic evaluation of all-user feedback and sentiment subject to COR approval but no less frequently than twice per year. Available tools include SharePoint and Survey Monkey.

o A proposal for a strategy for per-event “how did we do” application support feedback subject to COR approval.

Page 11 Contract HHSN272201800005C

• Collaboration with COR to establish a change management plan to assure NIAID Program review and appropriate prioritization and weighting of projects, enhancements, and changes.

• The contractor shall attend user and governance meetings as requested by

COR.

• The contractor shall document the technical architecture, including proposed additions or alterations, including the impact on production capabilities 90 days after award, subject to acceptance by the COR.

• The contractor shall assess and document networking, hardware, and software capabilities 90 days after award. The contractor shall also produce a gap analysis of required capabilities if deficiencies are found.

B. System Maintenance

• The contractor shall provide support for the selection, procurement, implementation, and oversight of hardware and software resources as needed for the configuration, development, and maintenance of CRIMSON and

STORM.

• The contractor shall assure that NIAID Property representatives inventory any covered equipment purchased by the contractor as evidenced by a NIH Property Tag secured to the equipment.

• The contractor shall collect and report no less frequently than quarterly (as part of periodic reporting) metrics related to performance testing that are not limited to but shall include load and stress tests.

• The contractor shall support HL-7 and other normalized vocabularies for health care and research that apply to structured sources including laboratory results, diagnostic imaging, electrophysiological studies (e.g., EEG, ECG), and structured clinical observations (e.g., progress notes, problem lists, and medication coding,).

• The contractor shall support import/export and transformation of health care and research data.

• The contractor shall establish a code integrity plan that conforms to industry norms 45 days after award that assures the quality of new code before it is deployed.

• The contractor shall establish a data integrity-testing plan for assuring the accuracy and consistency of data over the entire data lifecycle 60 days after award.

• The contractor shall deliver failure-free performance that does not exceed 8 hours of unplanned failure per year. It is noted that the product depends on collateral systems over which the contractor has limited or no control and outages in those systems are excluded from this metric but must be reported in periodic reports.

C. Technical, Operations and Application Support

• The contractor shall provide all new and continuing technical support for the installation and maintenance of the CRIMSON application on approximately 250 computers. The contractor shall work with NIH, Clinical Center, and NIAID technology and security staff to assure access, hardware, and network

Page 12 Contract HHSN272201800005C performance in support of CRIMSON.

• The contractor shall provide new and continuing technical support for the continued enhancement and deployment of the LabKey platform and the STORM application, to support deployment in remote and technically underserved locations.

• The contractor shall provide operational support for data management and clinical documentation of clinical studies external to the NIH Clinical Center.

The functionality will include but not limited to; protocol design and development, CRF creation, clinical research database development, data processing, report development and coordination with regulatory, safety and study monitoring team or related activities.

• The contractor shall provide operational data management support in remote locations as part of emerging disease outbreak response.

• The contractor shall begin to provide technical and application support for software and infrastructure problems within one hour of notification or outage during duty hours (currently 0700-1530, Monday-Friday) and within four hours during non-duty hours. Technical support must be documented to industry standards and reported.

• The contractor shall coordinate data transmission and integration from studies or clinical partners outside the clinical center, to include clinical studies in remote or technically underserved areas.

• The contractor shall integrate NIH single sign-on and other collateral controls as needed to facilitate both user experience and appropriate security in access and use of both CRIMSON and STORM.

• The contractor shall provide live problem-based application support to users during normal operating hours of the NIH Clinical Center within one hour of request. In this case “live” may be defined as “desk side” or virtual with screen sharing as appropriate. All help requests and resolutions must be documented.

• The contractor shall prepare materials for presentation, training, and user support and provide a library of those materials on the user Intranet.

• The contract shall provide training and support materials to new users and conduct user briefings on substantial system changes. Trainings and briefings must also be documented.

a. The contractor’s trainers shall offer user seminars at minimum twice yearly to identify training gaps and review training objectives. These offerings may be part of a regular meeting.

b. The contractor shall provide expert staff to collaborate with investigators to create and maintain operational workflows and software configuration for clinical studies.

c. The contractor shall provide a clinical studies expert with a minimum three years of experience in the design, implementation, and closing of human studies.

d. The contractor’s expert in clinical studies must design tools and templates to assist Investigators in the design of studies and to assure rapid and efficient system configuration.

Page 13 Contract HHSN272201800005C

e. The contractor shall work with users to assure logical and intuitive interfaces, capable of adoption in 90% of cases without extensive training. Evidence of this effort must be included in periodic reports.

D. Development, Modernization and Enhancement

• Development, modernization, and enhancements of operational capabilities will be periodically required for systems to adapt to new business requirements, technology drivers, and regulatory changes. We make a distinction between functional enhancements to be delivered as part of the ongoing operational support and the more formal DME project process by level of effort and operational urgency. The approval and prioritization of DME projects shall be managed through a formal change control and governance process involving stakeholder input and COR oversight.

• For each DME project approved, the contractor shall establish an activity, schedule, and resource plan to monitor resource utilization and milestone delivery.

• The contractor shall submit their process for DME request review, analysis and prioritization tailored to the requirements and portfolio management strategy of the contract, no later than 30 days post award and reviewed annually.

• The contractor shall support data integration using XML, SOAP, Web Services, HL7 interfaces, DICOM, and similar integration services.

• The contractor shall support terminology standardization and the use of controlled vocabularies to include but not limited to ICD-9, MedDRA, and

CDISC SDTM

E. Support for Programs and Projects of the NIAID Director for Special Projects

• The contractor shall provide consultation for and facilitation of data transformation, curation, and management associated with projects and programs coordinated by the DCR Deputy Director for Operations and Management and the Chief, Biostatistics Research Branch, DCR. Requests for support will be documented and subject to COR review

• The contractor shall provide support for analytical staff including mathematicians, biostatisticians, and clinical investigators to facilitate the analysis of DCR clinical research data.

• The contractor shall serve as a DCR resource or SME in the broader area of NIAID data collection, storage, transformation, and delivery.

F. Security and Confidentiality

• The contractor shall maintain access control lists (ACLs) for supported DCR Clinical Data Research applications. ACLs and similar controls shall be reviewed no less frequently than quarterly. Changes to ACLs shall be documented in periodic reporting.

• The contractor shall inform CORs, and NIAID and CC ISSOs of a breach or exfiltration of CRIMSON data within 60 minutes of suspicion.

• The contractor shall conduct periodic “desk exercises” to include security and

Page 14 Contract HHSN272201800005C confidentiality vulnerabilities and mitigations. NIAID COR and ISSOs shall be invited. These desk exercises may be at the contractor’s, COR, or ISSO’s discretion but shall be at least once per year.

• The contractor shall provide consultation and support for information security and privacy protection to include newly deployed systems supporting special project efforts

The contractor shall maintain existing system(s) at the current assessed FISMA level(s) and prepare documentation for security assessment(s) to preserve ATO according to the NIH and NIAID cyber security guidance.