Statement of Work.pdf

Procurement Request #:

Statement of Work- West Virginia University

Title: Supporting coal miners by characterizing their perspectives on black lung screening and low-dose computed tomography for lung health monitoring

Period of performance: 3-year period of performance beginning in FY26

SECTION 1 -- BACKGROUND

Pneumoconiosis is an umbrella term for dust-induced interstitial lung diseases, which includes coal workers' pneumoconiosis (CWP), also known as black lung disease, and silicosis. CWP is an occupational respiratory disease caused by the inhalation of coal mine dust. Silicosis is also an occupational respiratory disease caused by the inhalation of respirable crystalline silica. The presence of respirable crystalline silica in coal mine dust has been linked to the resurgence of pneumoconiosis, especially among Central Appalachian coal miners.

Pneumoconiosis is a chronic and progressive disease for which there is no cure. Despite increasing regulations following the 1969 Federal Coal Mine Safety and Health Act, the prevalence of pneumoconiosis in central Appalachian (Kentucky, Virginia, and West Virginia) coal miners has been increasing. Even after leaving the workforce, former coal miners can experience progression of pneumoconiosis. In recent years, thousands of cases of progressive massive fibrosis, the most severe form of pneumoconiosis, have been identified in central Appalachia. The health consequences of this disease can profoundly impact an individual's quality of life as the progressive nature of pneumoconiosis can limit an individual's ability to work and engage in everyday activities that require physical exertion.

The Coal Workers' Health Surveillance Program (CWHSP), administered by the National Institute for Occupational Safety and Health (NIOSH), was created by the Federal Coal Mine Health and Safety Act of 1969 to provide early detection of pneumoconiosis through chest x-rays and to prevent progression to severe lung disease. Information collected from coal workers by the CWHSP includes work history questionnaires, respiratory assessment questionnaires, blood pressure screening, lung function testing (spirometry), and chest x-rays. The assessments are conducted at no cost to the miner and occur at NIOSH-approved facilities or on NIOSH-operated mobile units.

Current federal regulations state that miners must have an initial chest x-ray screening submitted to NIOSH within 30 days of employment. A second radiographic screening is also mandatory, to be completed within 3 years following the date of the initial radiograph submitted to the CWHSP. However, participation in the program after these initial radiographs is voluntary. Annualized participation rates in the CWHSP typically vary between 25 and 40% of active miners.

In 2018, in response to a congressional request, NIOSH posted a Request for Information (RFI) to the Federal Register to learn more about the factors that prevent miners from participating in the CWHSP. Responses from stakeholders identified barriers including concerns about job security, confidentiality, inconvenient testing locations and times, confusion about the program's purpose, and a lack of support from employers.

Understanding the barriers and potential facilitators to participation in the CWHSP is essential for developing effective outreach and support systems to enhance screening uptake and, ultimately, improve health outcomes among coal workers. Previous reports and anecdotal feedback from miners and stakeholders have pointed to concerns about job security, confidentiality, accessibility, and a lack of understanding about the program's benefits. However, there has been no structured assessment of these barriers or of the specific factors affecting participation in the CWHSP to guide more effective communication strategies, information strategies and messaging tailored to this population.

Low-dose computed tomography (LDCT) has emerged as an important tool for lung cancer screening and can also detect early, subtle dust-related lung changes that may not be visible on chest x-ray. As screening technologies advance, there is growing interest in whether and how the CWHSP might be adapted to incorporate modern imaging modalities like LDCT. However, little is known about how coal miners and their support networks perceive the potential role of LDCT in routine lung health surveillance, including its perceived benefits, harms, costs, and relationship to the CWHSP. Understanding these perceptions is critical for designing outreach and communication strategies and future services that could integrate chest x-ray-based black lung screening with LDCT-based lung cancer screening and lung health monitoring.

SECTION 2 -- PURPOSE / OBJECTIVE

The purpose of this contract is to support NIOSH in improving participation in the CWHSP and enhancing communication about black lung screening and LDCT for lung health monitoring.

Over three years, the contractor will generate foundational audience insights, develop and refine communication strategies, validate optimized messages in a real-world setting, and produce an implementation-ready toolkit for use by NIOSH and its partners.

Specifically, the objectives are to:

1. Identify coal workers’ beliefs, attitudes, informational needs, and decision-making factors related to black lung screening, CWHSP participation, and perceptions of LDCT.

2. Assess awareness, experiences, and trust related to chest radiography and LDCT, including perceived benefits, risks, barriers, confidentiality concerns, and preferred communication channels.

3. Develop and refine evidence-informed communication strategies and message concepts that address priority beliefs, improve clarity and trust, and support informed participation in CWHSP and LDCT screening.

4. Test and optimize communication messages and materials through structured qualitative interviews and participant feedback.

5. Validate the performance of optimized messages in a real-world outreach setting, assessing feasibility, acceptability, engagement, and comparative effectiveness.

6. Analyze quantitative and qualitative data from field testing to understand implementation outcomes and identify actionable insights for improving outreach.

7. Integrate findings to develop a comprehensive communication toolkit, including message guidance, audience insight summaries, plain-language materials, templates, and dissemination recommendations.

8. Provide evidence-based recommendations for strengthening CWHSP communication and outreach, including strategies to increase awareness, trust, and participation among coal workers.

SECTION 3 -- SCOPE OF WORK

The contractor will carry out a multi-year mixed-methods project to support NIOSH in improving communication for black lung screening and low-dose computed tomography (LDCT) and to strengthen participation in the Coal Workers’ Health Surveillance Program (CWHSP). Work will include surveys, communication strategy development, message testing, real-world validation, and development of an implementation-ready communication toolkit.

The contractor will conduct a cross-sectional survey of active and retired coal workers in the Appalachian region to characterize beliefs, attitudes, informational needs, and decision-making factors related to black lung screening and LDCT. Activities will include survey instrument development, participant recruitment, data collection and management, and quantitative and qualitative analysis of coal worker perspectives.

The contractor will synthesize findings from the survey to develop evidence-informed communication strategies and message concepts. These messages will be refined collaboratively with NIOSH and evaluated through structured qualitative testing with coal workers and key stakeholders. Based on these results, the contractor will optimize communication materials for field implementation.

The contractor will then conduct a field test of the refined communication approach in partnership with a clinic, health system, or similar entity. This work will include targeted outreach to screening-eligible coal workers, collection of process and outcome data, comparative assessment of message performance (where feasible), and stakeholder feedback to assess feasibility, appropriateness, and acceptability.

The contractor will integrate quantitative and qualitative findings to evaluate implementation outcomes and to guide the development of a comprehensive communication toolkit. Toolkit components will include evidence-informed message guidance, audience insights, plain-language LDCT materials, visual/print templates, dissemination recommendations, and health information review protocols.

Throughout the project, the contractor will obtain necessary human subjects approvals, protect participant confidentiality, and ensure that data collection procedures and materials are accessible for rural populations. The contractor will provide NIOSH with detailed reports, analysis summaries, and dissemination-ready materials at the conclusion of each project phase.

SECTION 4 -- TASKS TO BE PERFORMED

Year 1: Characterize coal workers’ perspectives on black lung screening and LDCT

Task 1.1: Orientation, planning, and regulatory approvals

The contractor shall:

1. Meet with NIOSH following the award to discuss project expectations, review target populations, and confirm key outcomes and deliverables.

2. Develop a detailed project plan that includes:

- Recruitment strategy and target sample sizes

- Data collection timeline and milestones

- Quality assurance procedures

- Data management and security protocols

- Analytic plan overview

3. Obtain human subjects-related determinations from the contractor's institutional review board (IRB) or equivalent body.

4. In collaboration with NIOSH, determine whether Paperwork Reduction Act (PRA) clearance is required and contribute relevant information for a PRA package.

Deliverables (Task 1.1)

- Project plan summarizing recruitment approach, data collection methods, timeline, and analytic overview

- Documentation of IRB/human subjects determinations

- PRA-related documentation, if applicable

Task 1.2: Survey instrument development and pretesting

The contractor shall:

1. Develop survey measures to assess coal workers' perspectives on black lung screening and LDCT, including:

- Beliefs about susceptibility to and severity of black lung disease

- Perceived benefits of and barriers to CWHSP participation

- Awareness and perceptions of LDCT for lung health monitoring and lung cancer screening

- Trust and confidentiality concerns related to screening programs

- Health information access patterns and preferences

- Cues to action and self-efficacy related to screening behaviors

- Prior experience with lung health screening services

- Demographic and work history information

2. In collaboration with NIOSH, adapt and refine draft survey instruments.

3. Pretest survey instruments with a small sample of coal workers (< 10 individuals) to assess:

- Comprehension and clarity of questions

- Appropriateness of response options

- Length and burden

- Technical functionality (for online surveys)

4. Refine survey instruments based on pretest feedback.

5. Develop online and/or paper surveys to maximize accessibility for rural populations.

Deliverables (Task 1.2)

- Draft survey instrument

- Pretest summary report documenting feedback and refinements

- Final survey instrument(s)

Task 1.3: Participant recruitment and survey distribution

The contractor shall:

1. Recruit a minimum of 300 coal workers (150 active and 150 retired) who have worked in the Appalachian region using the following approaches:

- Outreach through established community partnerships (e.g. black lung clinics) in the region

- Coordination with CWHSP and NIOSH connections

- Engagement with coal worker organizations and unions

- Targeted print and digital outreach in coal mining communities

2. Ensure recruited participants meet eligibility criteria:

- Currently or previously employed as coal workers in Appalachia

- Former coal workers must have worked within the past 10 years

3. Distribute surveys via appropriate modalities:

- Online surveys through a secure platform

- Paper surveys with prepaid return envelopes

- Tablet-based surveys, if feasible

4. Implement strategies to maximize response rates, such as reminder mailings or follow-up contacts (as appropriate and approved by IRB).

5. Monitor recruitment progress and adjust outreach strategies as needed to achieve target sample sizes.

Deliverables (Task 1.3)

- Recruitment materials (flyers, digital advertisements, informational materials)

- Progress reports on recruitment activities and response rates (submitted monthly)

Task 1.4: Data collection and management

The contractor shall:

1. Collect survey data while protecting participant confidentiality:

- Administer secure online surveys without collecting identifying information

- Receive and securely store paper surveys at the contractor's facilities

- Ensure tablet-based surveys are administered without collecting identifying information

2. Implement data quality control procedures:

- Monitor completeness of survey responses

- Identify and address potential data entry errors

- Implement logic checks for survey data

3. Create a secure, de-identified dataset for analysis:

- Develop a data dictionary including all variables and coding schemes

- Clean and validate data

- Store data on secure, password-protected servers with restricted access and in alignment with all relevant security standards

4. Maintain detailed documentation of data collection activities.

Deliverables (Task 1.4)

- Data collection summary report documenting procedures, response rates, and any issues encountered

Task 1.5: Data analysis and reporting

The contractor shall:

1. Conduct comprehensive descriptive analyses of coal workers' perspectives on black lung screening and LDCT, including:

- Summary statistics (e.g. proportions, means, medians) for all key variables

- Frequency distributions and cross-tabulations

- Comparisons between active and retired coal workers

- Comparisons between those who have and have not participated in the CWHSP

2. Examine associations between key variables:

- Relationships between beliefs about screening and CWHSP participation

- Factors associated with awareness and perceptions of LDCT

- Trust and confidentiality concerns and their relationship to screening behaviors

- Health information access patterns and screening engagement

3. Analyze any open-ended or qualitative survey responses using validated analysis approaches to identify emergent themes, patterns, and insights.

4. Identify key beliefs, barriers, and facilitators influencing coal workers' engagement with CWHSP and their perceptions of LDCT.

5. Summarize informational needs and communication preferences among coal workers.

6. Prepare tables and data visualizations suitable for inclusion in reports and publications.

Deliverables (Task 1.5)

- De-identified dataset with analysis code/syntax for reproducibility

Task 1.6: Year 1 reporting and knowledge dissemination

The contractor shall:

1. Prepare a Year 1 report that includes:

- Executive summary of key findings

- Background and project overview

- Detailed methods section

- Comprehensive results with tables and figures as described in Task 1.5

- Discussion of implications for CWHSP outreach and LDCT communication

- Limitations and recommendations for future research

- Appendices with survey instruments and supplementary materials

2. Prepare a summary report suitable for dissemination to stakeholders and community partners.

3. Develop presentation materials (PowerPoint slides) summarizing key findings for NIOSH.

4. Participate in up to two (2) virtual meetings with NIOSH to present findings and discuss implications for future communication strategy development.

Deliverables (Task 1.6)

- Comprehensive Year 1 report

- Stakeholder summary report

- Presentation slides

- Participation in virtual meetings with NIOSH

Year 2: Develop and test messaging approaches for black lung screening and LDCT

Task 2.1: Synthesis of Year 1 findings and communication strategy planning

The contractor shall:

1. Review and synthesize findings from Year 1 to identify key communication needs, including:

- Priority beliefs influencing CWHSP participation

- Message leverage points and potential barriers

- Gaps in understanding related to black lung screening and LDCT

2. Map synthesized insights to appropriate communication theory framework(s)

3. Develop a preliminary communication strategy informed by these insights, with emphasis on:

- Balancing threat and efficacy

- Addressing identified misconceptions

- Supporting informed decision-making regarding chest x-ray screening and LDCT

Deliverables (Task 2.1)

- Draft communication strategy framework

Task 2.2: Message concept development

The contractor shall:

1. Develop initial message concepts addressing CWHSP participation and perceptions of LDCT, including variations in framing, wording/tone, and visual presentation

2. Refine message concepts in collaboration with NIOSH prior to testing.

Deliverables (Task 2.2)

- Revised message concepts following NIOSH feedback

Task 2.3: Recruit participants and conduct message concept testing

1. Recruit Appalachian coal workers and aligned stakeholders (e.g. black lung clinic staff) using purposeful criterion-based sampling (total participants = 20).

2. Conduct structured message concept testing interviews that include presentation of alternative message variants as described in Task 2.2.

3. Assess participant responses to message variants, including, but not limited to:

- Comprehension and clarity

- Perceived credibility and trust

- Emotional reactions and personal relevance

- Impact on motivation and intention to participate in screening

4. Transcribe, de-identify, and upload interviews to appropriate software for analysis.

Deliverables (Task 2.3)

- Monthly recruitment progress updates

Task 2.4: Qualitative analysis and message optimization

The contractor shall:

1. Analyze qualitative and structured preference data using appropriate thematic approaches.

2. Examine patterns across message variants to identify features most strongly associated with clarity, credibility, motivational potential, and other relevant features.

3. Identify communication approaches that best promote:

- Informed engagement with CWHSP

- Appropriate understanding of LDCT

4. Refine message strategies based on analysis.

Deliverables (Task 2.4)

- Analysis summary report

- Revised message strategy and prototype materials

Task 2.5: Year 2 reporting and knowledge dissemination

1. Prepare a summary report on Year 2 activities and findings, including an overview of methods, synthesized results, and recommendations.

2. Prioritize messaging strategies and refine prototype materials.

3. Participate in up to two (2) meetings with NIOSH to review findings and next steps.

Deliverables (Task 2.5)

- Year 2 summary report

- Refined message prototypes

- Participation in virtual meetings with NIOSH

Year 3: Validate messages in a real-world setting and develop an implementation toolkit

Task 3.1: Field test planning and coordination

The contractor shall:

1. Coordinate with an appropriate clinic, health system, or other entity to plan targeted outreach to screening-eligible coal workers in Appalachia.

2. Develop a detailed field testing plan that includes:

- Outreach modality and integration of messages refined in Year 2

- Tailored plain-language LDCT information materials

- Any comparative design elements (e.g., optimized message vs. usual communication)

- Workflow alignment and privacy-compliant procedures

3. Confirm eligibility for outreach recipients, consistent with established criteria.

4. Establish communication and process-tracking procedures with clinical partners.

Deliverables (Task 3.1)

- Field testing implementation plan

- Documentation of coordination with clinical partners

- Finalized outreach materials for deployment

Task 3.2: Implementation of targeted outreach

1. Conduct structured outreach to screening-eligible coal workers using the approved plan and refined communication materials.

2. If feasible, implement a comparative component (e.g., optimized vs. usual communication) to assess differential performance.

3. Monitor implementation to ensure fidelity to clinical workflows and privacy requirements.

Deliverables (Task 3.2)

- Outreach execution summary

Task 3.3: Participant recruitment for toolkit refinement

The contractor shall:

1. Recruit 5 coal workers and 3 relevant stakeholders.

2. Provide participants with draft toolkit components for structured review.

3. Conduct structured feedback sessions to assess feasibility, usability, clarity, and implementation relevance.

4. Document participant feedback to support toolkit optimization.

5. De-identify and upload all qualitative transcripts to appropriate analytic software.

6. Maintain documentation of data collection activities, including workflow metrics and follow-up intervals.

Deliverables (Task 3.3)

- Summary of participant feedback and recommendations

Task 3.4: Quantitative and qualitative data analysis

The contractor shall:

1. Conduct descriptive quantitative analyses of outreach-related findings.

2. Perform comparative analyses when two or more communication approaches were used.

3. Analyze qualitative interview data using a thematic approach.

4. Assess implementation outcomes including feasibility, appropriateness, and acceptability using established frameworks.

5. Integrate quantitative and qualitative findings to guide final toolkit refinement.

Deliverables (Task 3.4)

- Outreach and toolkit refinement brief report

Task 3.5: Develop implementation-ready communication toolkit

The contractor shall:

1. Synthesize findings across all project years using appropriate principles.

2. Develop a comprehensive health communication toolkit that incorporates:

- Evidence-informed message guidance

- Audience insights

- Plain-language materials

- Visual and print templates in accessible formats

- Dissemination recommendations

3. Ensure toolkit materials clearly address:

- Purpose of CWHSP screening

- Potential role of LDCT for lung health monitoring and cancer screening in this population

- Common concerns including trust, confidentiality, access, and other relevant concerns.

4. Prepare toolkit for dissemination to NIOSH, CWHSP partners, and clinical organizations.

Deliverables (Task 3.5)

- Implementation-ready communication toolkit

- Toolkit summary memo for NIOSH

Task 3.6: Final reporting including expected Program improvements

The contractor shall:

1. Describe real-world evidence generated regarding feasibility, acceptability, and early signals of effectiveness of the communication strategy.

2. Summarize anticipated improvements in CWHSP engagement and LDCT awareness across coal worker populations.

3. Identify evidence-informed approaches for addressing anticipated challenges encountered during implementation.

Deliverables (Task 3.6)

- Comprehensive report and supporting information as described above

SECTION 5 -- GOVERNMENT FURNISHED PROPERTY

None.

SECTION 6 -- PLACE OF PERFORMANCE

Contract work will be performed at the contractor's facilities and in Appalachian communities where survey recruitment and data collection occur.

SECTION 7 -- TRAVEL

Limited travel may be required for survey recruitment and data collection activities or community outreach events. All travel must be pre-approved by the Contracting Officer's Representative (COR) and will be conducted in accordance with Federal Travel Regulations.

Estimated travel requirements:

- Up to 12 trips within Appalachia

- Approximate duration of 1-3 days per trip

- Travel expenses will be identified on a separate Contract Line-Item Number (CLIN)

SECTION 8 -- DELIVERABLES / REPORTING SCHEDULE

Year 1

Deliverable Format Due Date Deliver To

Task 1.1 Project plan (recruitment approach, data collection, timeline, analysis overview)

MS Word 45 days after award

Project officer

(PO)

Task 1.1 IRB/human subjects determinations documentation

PDF

Determined in collaboration with PO

PO

Task 1.1 PRA-related documentation PDF Determined in collaboration with PO

PO

Deliverable Format Due Date Deliver To

Task 1.2 Pretest summary report MS Word 120 days after award

PO

Task 1.2 Final survey instrument MS Word or online format

135 days after award

PO

Task 1.3 Recruitment materials PDF 150 days after award

PO

Task 1.3 Recruitment progress reports MS Word or email 10th of each month during recruitment

PO

Task 1.4 Data collection summary report MS Word 300 days after award

PO

Task 1.5 De-identified dataset with code/syntax Appropriate statistical software

End of Year 1 PO

Task 1.6 Year 1 report MS Word End of Year 1 PO

Task 1.6 Brief stakeholder summary report MS Word End of Year 1 PO

Task 1.6 Presentation slides summarizing key findings

PowerPoint End of Year 1 PO

Task 1.6 Virtual presentations to NIOSH Teams, Zoom or similar

End of Year 1 PO

Year 2

Deliver To

Task 2.1 Draft communication strategy framework

MS Word 60th day of Year 2 PO

To

Task 2.2 Revised message concepts MS Word 90th day of Year 2 PO

Task 2.3 Recruitment progress updates MS Word or email

Monthly during recruitment

PO

Task 2.4 Qualitative analysis summary report MS Word 210th day of Year 2 PO

Task 2.4 Revised message strategy and prototype materials

MS Word or

PDF

240th day of Year 2 PO

Task 2.5 Year 2 report MS Word End of year 2 PO

Task 2.5 Refined prototype messages MS Word or

PDF

End of Year 2 PO

Task 2.5 Virtual meetings with NIOSH Teams, Zoom or similar

End of Year 2 PO

Year 3

Deliver To

Task 3.1 Documentation of coordination with clinical partners

Email or PDF 30th day of Year 2 PO

Task 3.1 Field testing implementation plan including outreach materials

MS Word and

PDF

45th day of Year 3 PO

Task 3.2 Outreach execution summary MS Word 60th day of Year 3 PO

Task 3.3 Summary of participant feedback MS Word 150th day of Year 3 PO

Task 3.4 Outreach and toolkit refinement summary report

MS Word 250th day of Year 3 PO

To

Task 3.5 Implementation-ready communication toolkit

MS Word, PDF or other

End of Year 3 PO

Task 3.5 Toolkit summary memo for NIOSH MS Word End of Year 3 PO

Task 3.6 Comprehensive report and supporting information

MS Word or PDF End of Year 3 PO

SECTION 9 -- REFERENCE MATERIALS

- NIOSH Coal Workers' Health Surveillance Program information:

https://www.cdc.gov/niosh/topics/cwhsp/

- NIOSH Request for Information (2018) on CWHSP participation barriers

- CDC Report to Congress on CWHSP

SECTION 10 -- MINIMUM VENDOR QUALIFICATIONS

The contractor must demonstrate:

1. Expertise in survey research methods, including instrument development, data collection, qualitative analysis, and quantitative analysis.

2. Experience conducting research with rural and/or occupational populations, particularly in Appalachian communities.

3. Established community partnerships or networks within the central Appalachian region (Kentucky, Virginia, West Virginia) that can support recruitment of coal workers.

4. Experience collaborating with established respiratory health screening programs in Appalachia.

5. Capacity to develop accessible survey materials and implement multiple data collection modalities (online, paper, in-person).

6. Access to secure data management infrastructure and expertise in protecting research participant confidentiality.

7. Statistical analysis capacity using appropriate software (SPSS, SAS, Stata, R, or equivalent).

8. Experience preparing reports and presentations suitable for federal agencies and public health stakeholders.

SECTION 11 -- ADDITIONAL REQUIREMENTS

Human Subjects Protections in Research

All study procedures involving human participants must be reviewed and approved by an Institutional Review Board (IRB) or equivalent ethics review body prior to initiation of data collection. The contractor shall maintain documentation of IRB approval and any modifications throughout the period of performance. The contractor shall adhere to all applicable federal regulations for the protection of human research participants (45 CFR 46).

Paperwork Reduction Act (PRA)

The contractor shall work with NIOSH to determine whether PRA clearance is required for survey instruments. If PRA clearance is required, the contractor shall provide all necessary supporting materials and documentation to support the clearance process, including burden estimates, justification statements, and draft instruments.

Data Security and Privacy

The contractor shall implement appropriate administrative, technical, and physical safeguards to protect the confidentiality of research participants and the security of research data. All electronic data shall be stored on secure, password-protected servers with restricted access.

Paper materials shall be maintained in locked storage at the contractor's facilities. No personally identifiable information shall be collected as part of survey data collection.

Section 508 and Accessibility Requirements

Part A – Provision

Reference HHSAR 352.239-73[8] Electronic Information and [Communication] Technology Accessibility Notice.

[(a) Any offeror responding to this solicitation must comply with established HHS Information and Communication Technology (ICT) accessibility standards. Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html.

(b) The Section 508 accessibility standards applicable to this solicitation are stated in the clause at 352.239-79 Information and Communication Technology Accessibility. In order to facilitate the Government’s determination whether proposed ICT supplies, products, platforms, information, and documentation meet applicable Section 508 accessibility standards, offerors must submit an appropriate HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an Accessibility Conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), in accordance with the completion instructions.

The purpose of the checklists and conformance reports are to assist HHS acquisition and program officials in determining whether proposed ICT supplies, products, platforms, information, and documentation conform to applicable Section 508 accessibility standards.

Checklists and ACRs evaluate—in detail—whether the ICT conforms to specific Section 508 accessibility standards and identifies remediation efforts needed to address conformance issues.

(c) If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies, products, platforms, information, documentation, or services support delivered do not conform to the described accessibility standards, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(d) In order to facilitate the Government's determination whether proposed ICT supplies meet applicable Section 508 accessibility standards, offerors must submit an Accessibility Conformance Report, in accordance with its completion instructions and tailored to the requirements in the solicitation. The purpose of the Report is to assist HHS acquisition and program officials in determining whether proposed ICT supplies conform to applicable Section 508 accessibility standards. The template allows offerors or developers to self-evaluate their supplies and document, in detail, whether they conform to a specific Section 508 accessibility standard, and any underway remediation efforts addressing conformance issues. Instructions for preparing the Template are available at https://www.section508.gov/.

(e) Additionally, offerors must provide enough information to assist the Government in determining that the ICT services conform to Section 508 accessibility standards, including any underway remediation efforts addressing conformance issues.

(f) Respondents to this solicitation must identify any inability to conform to Section 508 requirements. If an offeror claims its supplies or services meet applicable Section 508 accessibility standards, and it is later determined by the Government, i.e., after award of a contract or order, that supplies or services delivered do not conform to the described accessibility standards, remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(g) Items delivered as electronic content must be accessible to HHS acceptance criteria.

Checklist for various formats are available at http://508.hhs.gov/. Materials, other than items incidental to contract management, that are final items for delivery should be accompanied by the appropriate checklist, except upon approval of the Contracting Officer or Contracting Officer’s Representative.

Part B - Clause

352.239-74[9] Electronic, Information, and Communication Technology Accessibility.

(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all information and communication technology (ICT) supplies, products, platforms, information, documentation, and services, or support developed, acquired, maintained or delivered under this contract or order must comply with the Revised 508 Standards, which are located at 36 C.F.R. 1194.1 and Appendices A, B, and C, and are available at https://www.access-board.gov/ict/. Information about Section 508 is available at https://www.hhs.gov/web/section-508/index.html.

(b) Additional Section 508 accessibility standards applicable to this contract or order are identified as follows:

205 WCAG 2.0 Level A & AA Success Criteria

302 Functional Performance Criteria

502 Inoperability with Assistive Technology

504 Authoring Tools

602 Support Documentation

603 Support Services

If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(c) In the event of a modification(s) to this contract or order, which adds new ICT supplies or services or revises the type of, or specifications for, supplies, products, platforms, information, documentation, or services support, the Contracting Officer shall require that the Contractor submit a completed HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an Accessibility Conformance Report (ACR) (based on the Voluntary Product Accessibility Template (VPAT) see https://www.itic.org/policy/accessibility/vpat), and any other additional information necessary to assist the Government in determining that the ICT supplies or services conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies, products, platforms, information, documentation, and services support provided by the Contractor do not conform to the described accessibility standards in the contract, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(d) If this is an Indefinite-Delivery type contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the task/delivery order requests that include ICT supplies, products, platforms, information, documentation, or services support will define the specifications and accessibility standards for the order. In those cases, the Contractor shall be required to provide a completed HHS Section 508 Accessibility Conformance Checklist (see https://www.hhs.gov/web/section-508/accessibility-checklists/index.html) or an ACR (based on the VPAT see https://www.itic.org/policy/accessibility/vpat), and any other additional information necessary to assist the Government in determining that the ICT supplies, products, platforms, information, documentation, or services support conform to Section 508 accessibility standards. If it is determined by the Government that ICT supplies and services provided by the Contractor do not conform to the described accessibility standards in the provided documentation, remediation of the supplies, products, platforms, information, documentation, or services support to the level of conformance specified in the contract will be the responsibility of the Contractor at its own expense.

(e) The contractor shall identify to the Contracting Officer any perceived exception or exemption to Section 508 requirements for review by the agency Section 508 Program.

Standard Language

Section I: Procurements Requiring Information Security and/or Physical Access Security

Baseline Security Requirements

a. Applicability. The requirements herein apply whether the entire contract or order

(hereafter “contract”), or portion thereof, includes either or both of the following:

i. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information.

ii. Operate a Federal System Containing Information: A Contractor (and/or any subcontractor) employee will operate a federal system and information technology containing data that supports the CDC mission.

In addition to the Federal Acquisition Regulation (FAR) Subpart 2.1 definition of “information technology” (IT), the term as used in this section includes computers, ancillary equipment (including imaging peripherals, input, output, and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including support services), and related resources.

b. Safeguarding Information and Information Systems. All government information and information systems must be protected in accordance with HHS/CDC policies and level of risk. At a minimum, the Contractor (and/or any subcontractor) must:

i. Protect the:

• Confidentiality, which means preserving authorized restrictions on access and disclosure, based on the security terms found in this contract, including means for protecting personal privacy and proprietary information;

• Integrity, which means guarding against improper information modification or destruction, and ensuring information non-repudiation and authenticity;

and

• Availability, which means ensuring timely and reliable access to and use of information.

ii. Categorize all information owned and/or collected/managed on behalf of HHS/CDC/NIOSH and information systems that store, process, and/or transmit CDC information in accordance with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60, Volume II: Appendices to Guide for Mapping Types of Information and Information Systems to Security Categories, and based on information provided by the ISSO, CISO, or other security representative, the risk level for each Security Objective and the Overall Risk Level, which is the highest watermark of the three factors (Confidentiality, Integrity, and Availability) of the information or information system are the following:

• Confidentiality: [ ] Low [ X] Moderate [ ] High

• Integrity: [ ] Low [ X] Moderate [ ] High

• Availability: [ ] Low [ X] Moderate [ ] High

• Overall Risk Level: [ ] Low [X] Moderate [ ] High

iii. Based on the agreed-upon level of impact, implement the necessary safeguards to protect all information systems and information collected and/or managed on behalf of HHS/CDC/NIOSH regardless of location or purpose.

iv. Report any discovered or unanticipated threats or hazards by either the agency or contractor, or if existing safeguards have ceased to function immediately after discovery, within one (1) hour or less, to the government representative(s).

v. Adopt and implement all applicable policies, procedures, controls, and standards required by the HHS/CDC/NIOSH Information Security Program to ensure the confidentiality, integrity, and availability of government information and government information systems for which the Contractor is responsible under this contract or to which the Contractor may otherwise have access under this contract. Obtain all applicable security and privacy policies by contacting the CO/COR or HHS/CDC/NIOSH security and/or privacy officials.

Privacy Act. Comply with the Privacy Act requirements (when applicable), and tailor FAR and HHSAR clauses as needed.

Privacy Compliance. Comply with the E-Government Act of 2002, NIST SP 800-53, and applicable CDC Component privacy policies, and complete all the requirements below:

i. Per the Office of Management and Budget (OMB) Circular A-130, Personally Identifiable Information (PII), is "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." Examples of PII include, but are not limited to the following:

Social Security number, date and place of birth, mother's maiden name, biometric records, etc.

ii. To ensure that the public's personal information is protected in a manner commensurate with the privacy risks, CDC uses a privacy analysis process to assess the risks associated with CDC's collection and maintenance of PII and to ensure information is handled in accordance with applicable legal, regulatory, and policy requirements. PTAs analyze how information is handled in IT systems and electronic information collections and determines if the IT system or electronic information collection collects, disseminates, maintains, or disposes of PII. PIAs are used to assess the privacy risks of IT systems and electronic information collections that collect, disseminate, maintain, or dispose of PII about members of the public. PIAs also provide transparency into how CDC collects, disseminates, maintains, or disposes of the public's PII.

iii. The Contractor must support the agency with conducting a Privacy Threshold Analysis (PTA) for the information system and/or information handled under this contract to determine whether or not PII is collected, disseminated, maintained, or disposed as part of the contract. The PTA will determine if a full Privacy Impact Assessment (PIA) needs to be completed.

• If the results of the PTA show that a full PIA is needed, the Contractor must support the agency with completing a PIA for the system or information within 30 calendar days after completion of the PTA and in accordance with CDC policy and OMB M-03-22, Guidance for Implementing the Privacy Provisions of the E- Government Act of 2002.

• The Contractor must support the agency in reviewing the PIA at least every three years throughout the system development lifecycle (SDLC)/information lifecycle, or when determined by the agency that a review is required based on a major change to the system, or when new types of PII are collected that introduces new or increased privacy risks, whichever comes first.

Controlled Unclassified Information (CUI). CUI is defined as “information that laws, regulations, or Government-wide policies require to have safeguarding or dissemination controls, excluding classified information.” The Contractor (and/or any subcontractor) must comply with Executive Order 13556, Controlled Unclassified Information, (implemented at 32 CFR, part 2002) when handling CUI. 32 C.F.R. 2002.4(aa) As implemented the term “handling” refers to “…any use of CUI, including but not limited to marking, safeguarding, transporting, disseminating, re-using, and disposing of the information.” 81 Fed. Reg. 63323. All sensitive information that has been identified as CUI by a regulation or statute, handled by this solicitation/contract, must be:

i. Marked appropriately;

ii. Disclosed to authorized personnel on a Need-To-Know basis;

iii. Protected in accordance with NIST SP 800-53, Security and Privacy Controls for Federal Information Systems and Organizations applicable baseline if handled by a contractor system operated on behalf of the agency, or NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations if handled by internal Contractor system; and

iv. Returned to HHS/CDC control, destroyed when no longer needed, or held until otherwise directed. Destruction of information and/or data must be disposed of in accordance with NIST SP 800-88, Guidelines for Media Sanitization.

f. Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) must protect all government information that is or may be sensitive by securing it with a solution that is validated with current FIPS 140 validation certificate from the NIST CMVP.

g. Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by CDC or collected by the contractor on behalf of CDC must be used only for the purpose of carrying out the provisions of this contract and must not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and must ensure that all work performed by its employees and subcontractors must be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any CDC records may be made available or disclosed must be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information must be protected in accordance with HHS/CDC and [CDC] policies. Unauthorized disclosure of information will be subject to the HHS/[CDC] sanction policies and/or governed by the following laws and regulations:

i. 18 U.S.C. 641 (Criminal Code: Public Money, Property or Records);

ii. 18 U.S.C. 1905 (Criminal Code: Disclosure of Confidential Information);

and

iii. 44 U.S.C. Chapter 35, Subchapter I (Paperwork Reduction Act).

h. Internet Protocol Version 6 (IPv6). All procurements using Internet Protocol must comply with OMB Memorandum M-05-22, Transition Planning for Internet Protocol Version 6 (IPv6) available at https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf 99

i. Information and Communications Technology (ICT). ICT products and services from prohibited entities/sources must not be used/acquired in compliance with Public Law 115- 232, Section 889 Parts A and B, FAR 4.21, FAR 52.204.23, FAR 52.204.24, and FAR

52.204.25. The Contractor (and/or any subcontractor) must notify the government if they identify prohibited ICT products and/or services are used during the contract performance.

j. Government Websites All new and existing public-facing government websites must be securely configured with Hypertext Transfer Protocol Secure (HTTPS) using the most recent version of Transport Layer Security (TLS). In addition, HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to always assume HTTPS to reduce the number of insecure redirects and protect against attacks that attempt to downgrade connections to plain HTTP. Configure internal-facing websites with HTTPS. According to the CDC Web Policy, all CDC web content must reside on a CDC.gov domain and must be hosted on CDC or CDC-authorized information systems.

Consult the HHS Policy for Internet and Email Security for additional information.

k. Contract Documentation. The Contractor must use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

l. Standard for Encryption. The Contractor (and/or any subcontractor) must:

i. Comply with the HHS Policy for Encryption of Computing Devices and Information to prevent unauthorized access to government information.

https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf https://www.whitehouse.gov/wp-content/uploads/2020/11/M-21-07.pdf

ii. Encrypt all sensitive federal data and information (i.e., PII, protected health information [PHI], proprietary information, etc.) in transit (i.e., email, network connections, etc.) and at rest (i.e., servers, storage devices, mobile devices, backup media, etc.) with encryption solution that is validated with current FIPS 140 validation certificate from the NIST Cryptographic Module Validation Program

(CMVP).

iii. Secure all devices (i.e.: desktops, laptops, mobile devices, etc.) that store and process government information and ensure devices meet CDC and CDC Component-specific encryption standard requirements. Maintain a complete and current inventory of all laptop computers, desktop computers, and other mobile devices and portable media that store or process sensitive government information (including PII).

iv. Verify that the encryption solutions in use have been validated under the CMVP to confirm compliance with current FIPS 140 validation certificate from the NIST CMVP. The Contractor must provide a written copy of the validation documentation to the COR 90 calendar days from award.

v. Use the Key Management system on the CDC personal identification verification (PIV) card or establish and use a key recovery mechanism to ensure the ability for authorized personnel to encrypt/decrypt information and recover encryption keys (http://csrc.nist.gov/publications/). Encryption keys must be provided to CSPO.

m. Contractor Non-Disclosure Agreement…