Statement of Work.pdf

NIH Clinical Center, National Institutes of Health

Office of Clinical Research Training and Medical Education

Statement of Work for Graduate Medical Education Information Management System Background Information

The Office of Clinical Research Training and Medical Education (OCRTME) at the National Institutes of Health Clinical Center, National Institutes of Health (NIH), administers a number of programs and initiatives to recruit and develop participants for clinical research training on the NIH campus in Bethesda, MD. The NIH Clinical Center is the accredited graduate medical education (GME) sponsoring institution at the National Institutes of Health, with OCRTME having responsibility for the administrative support and oversight of Accreditation Council for Graduate Medical Education (ACGME)-accredited graduate medical education programs designed to train physicians, recruited through a competitive nation-wide search process, currently in a total of 20 nationally recognized medical/surgical specialties.

These graduate medical education programs, under NIH Clinical Center sponsorship, provide prescribed structured, standardized clinical and research training experiences to these physicians that permits their certification as specialists in a recognized medical or surgical field by the American Board of Medical Specialties (ABMS), a national organization that has established a process for verifying the competence of individual physicians in such recognized medical or surgical specialty fields.

GME Sponsoring institutions nationally, including the NIH Clinical Center, are expected to achieve and maintain accreditation by the ACGME in order to permit training program graduates to be certified by the ABMS. Accreditation of both individual graduate medical education programs, and the NIH Clinical Center as a sponsor of graduate medical education on the by the ACGME is essential for the NIH Clinical Center and the NIH to meet its mission of training highly competent (i.e., ABMS certified) and qualified physician-scientists and clinician-investigators in recognized specialty fields of medicine or surgery.

Site visits of individual training programs by accrediting organizations occur at fixed intervals, typically 10 years, and the entire institution also under goes a separate accreditation site visit approximately once every decade. At these visits, documented evidence for a systematic evaluation process of the trainees by the training program, in particular a focus on the six areas of general competency mandated by the ACGME, including specialty specific milestones, is required in addition to other documented aspects of training provided by the programs, including supervision and the didactic and clinical experience offered. Documentation of evaluation of the teaching effectiveness of faculty members and documented evidence of the educational effectiveness of the training program itself are also essentials of the accreditation process relevant to the NIH Clinical Center.

Since July 1, 2013, the evaluation and training tracking process for all accredited GME programs nationally has become dependent on electronic data collection and transmission to the ACGME and other accrediting organizations. Accordingly, all accredited training programs at the NIH must have available to them a flexible and multifunctional information management system that permits these programs, under the administrative oversight of the OCRTME, to collect, analyze and report information about trainee competency and training program outcomes, as required by the ACGME or other accrediting organizations.

Purpose and Objectives for the Procurement

The purpose of this procurement is to obtain a secure, multifunctional, flexible, and end-user friendly, electronic information management system designed to effectively and efficiently permit documentation, evaluation and tracking of training that occurs in NIH GME training programs.

Objectives include:

• Maintain and ensure continuity of data that relate to the assessment of trainee competence and the evaluation of graduate medical education training program outcomes at the NIH and that are overseen by the NIH Clinical Center's Office of Clinical Research Training and Medical Education.

• Evaluate the Graduate Medical Education (GME) programs at the NIH, both those that are accredited by the Accreditation Council for Graduate Medical Education and those that are not, which will allow for the prospective and cumulative collection of data from the GME programs, their participants, and their alumni, that are required to meet existing and evolving national accreditation and NIH institutional standards:

• Provide a user friendly and multifaceted mechanism for NIH graduate medical education training programs to evaluate the effects of clinical and research training curricula on their program participants' outcomes and career trajectories in clinical practice, academia and/or clinical research;

• Collect, manage and retrieve information required for the clinical competency assessment of trainees, as well as for the assessment of the teaching effectiveness of training program faculty who teach and supervise trainees while at the NIH Clinical Center and at all extramural affiliated training sites; and

• Manage information required for logistical support of graduate medical education training programs at the NIH including, but not limited to, compliance reports, assignment and call schedules, rotation diagrams, patient logs and duty hour reports.

• The information management system selected must permit data collection, prospective data tracking and administrative staff monitoring of nationally accepted or training program selected/determined measures of academic achievement, clinical competence, research productivity, as well as the documentation of program- specific clinical experience, exposures and outcomes, for trainees who are currently in, or have previously participated in, the medical education or clinical research training programs at the NIH. The information management system must also provide the technological flexibility to permit collection of demographic, professional achievement, and standardized or customized program-specific clinical performance information about the current participants and the alumni of the GME training programs to determine if the training received fulfilled expected outcomes reflecting clinical competency (e.g. training milestones or success on medical/surgical certification examinations), research competency (e.g., grant awards) or academic achievement (e.g., faculty appointments).

In addition, the system must permit both prospective and cumulative collection of outcome information reflecting indicators of success in academia or clinical research, as well as productivity within a chosen biomedical field/area of endeavor.

Contractor Requirements

The Contractor shall:

• Create and host the NIH graduate medical education information management system and securely maintain NIH graduate medical education training program data on the Contractor's website and server.

o Ensure role-based security administrative access, email notification and reminders capability, and custom alerts for each training program survey tool and real-time reporting in gathering information in support of ACGME requirements o Ensure components of the information management system include but not be limited to evaluation management (of the program, the teaching faculty and clinical fellows/residents or students, as applicable); procedure tracking; de identified diagnosis tracking; duty hour tracking; conference attendance tracking; milestone assessment and tracking; shared document management; schedule management; journal article title delivery; portfolio component; standardized/ customized trainee, faculty and program-specific performance evaluation templates; duty and on-call assignment schedules;

rotation block rotation diagrams; scope of clinical experience logs; and graduate/alumni outcome survey templates.

• Provide administrative access for OCRTME staff to the information management system and sufficient training to permit optimal utilization of the operational features of the information management system. Such training will be interactive and provided through webinar sessions.

• Allow OCRTME full accessibility to the NIH system at all times by designated OCRTME staff members and persons authorized by OCRTME, except for scheduled down-time for maintenance during non-business hours (Central Time).

• Provide an electronic copy of the standard system User Manual and the standard system Administrator Manual.

• As applicable and upon request, transfer all prior data referent to NIH medical education and training programs held by previous vendors/contractors seamlessly to the incumbent contractor.

• Provide, at a minimum, 30 licenses for system use with the ability to procure additional licenses if needed.

• Provide customer training o The contractor shall ensure that full implementation of the system is in effect and that all programs, including ACGME accredited program directors and support staff, in addition to staff members of the Office of Clinical Research Training and Medical Education, are thoroughly trained at least annually on the use of the system annually by September 1 of each calendar year.

o The contractor shall work with the OCRTME and NIH GME programs and/or clinical research training programs ad hoc via conference calls, webinars to address ongoing learning needs, and provide training on application/use of newly available system operational features.

o If necessary, additional face-to-face meetings shall be scheduled between the contractor and OCRTME to address issues of interest or problem areas.

• Provide maintenance services to include necessary system upgrades, repair of system errors and malfunctions, on-line system user help application including access to a Frequently Asked Questions (FAQ) section, assistance with existing evaluation templates and creating new evaluation templates/forms, access upon request to sample evaluation templates/forms and questions, a web-based feedback mechanism to request feature enhancements.

• Provide the ability for additional services to be purchased at the discretion of OCRTME.

• Provide Information Technology (IT) Support and Ensure IT security and privacy compliance o Contractor support shall be available to NIH and OCRTME staff Monday-Friday, 10 am - 6 pm EST o The information management system meets U.S. Government, DHHS, NIH Clinical

Center, FISMA, Section 508 Accessibility, Joint Commission, all pertinent NIH IT security and privacy policies and requirements, and Federal certification requirements, if system is cloud based. See additional information security requirements attachment.

o NIH program and alumni participants have individualized password-protected information system access consistent with the NIH information security and the NIH Password Policy. See Information Security Requirements attachments.

o The information management system database will be secure and held only in US data centers as verified by the NIH Information Systems Security Officer (ISSO).

o All data collected and maintained within the information management system is subject to the provisions of the Privacy Act of 1974. See additional information security requirements attachment.

o Data input processes will expressly prohibit entry birth date or social security number for any participant.

o Ensure all upgrades and/or modifications to the database are done in accordance with the Information Technology Security requirements as identified in the IT Security requirements attachment, and ensuring that all data is stored outside the NIH only in US data centers.

• Ensure deliverables are submitted to the identified OCRTME contact within the requested time frame. Provide customized reports will be created and available upon request to include a variety of combinations of the fields identified in the Government provided data

• Ensure problems are identified, addressed, and resolved to the satisfaction of the identified OCRTME contact.

• Contractor representative shall provide a complete response to all NIH requests and inquiries within 48 hours of NIH submission of request or inquiry by authorized information management system users.

• Conduct Fiscal Responsibility and Financial Accountability o Invoices shall be submitted annually in accordance with the invoice instructions as provided by the Contracting Officer and have an itemized component to match the price listings on the contract.

o All upgrades and/or modifications to the information management system that will incur a charge to the OCRTME must be prior-approved by the OCRTME.

• Ensure continuity of operations o All data associated with this requirement is the property of the U.S. Government and is available to the U.S. Government upon request and at the time of termination of this requirement in a format specified by OCRTME which may include spreadsheet or other analytic and display template.

• Assure confidentiality of information: For the purposes of this section, the Company is identified as the Contractor and the Client is identified as the NIH, an agency of the U.S. Government o Contractor will submit a copy of the services agreement confidentiality agreement.

Period of Performance

The period of performance will a base year and 4 option years with the base year commencing on August 7, 2022 and option years as follows:

August 7, 2023 to August 6, 2024 August 7, 2024 to August 6, 2025 August 7, 2025 to August 6, 2026 August 7, 2026 to August 6, 2027

Government Responsibilities

The U.S. Government will furnish the following information:

• Names and emails of NIH personnel requiring administrative access

• Names and emails of NIH personnel requiring participant access

• Data to be imported into the information management system, to include customized evaluation questions and responses from each training program.

• Reporting Requirements and Deliverables

Scheduled Deliverables

The contractor shall be responsible for the items in the following table of scheduled deliverables. This list of reporting requirements and deliverables is subject to the decision of the NIH Information System Security Officer's approval/disapproval of the Contractor's Information Security Plan.

Deliverable Date Due To Whom

1. Invoice submission (see invoice submission instructions) Annually OCRMTE Contact

2. NIH Computer Security Awareness Training Certificates for all personnel involved in this requirement

Prior to commencement of requirement

Contracting Officer’s Representative

3. List of all Contractor Staff who have completed the additional training as required by the CC ISSO

Prior to commencement of requirement

Contracting Officer’s Representative

4. Notification of Contracting Officer, Project Officer, and the Security Investigation Reviewer of new or departing employees.

Notification shall include: name, position title, and suitability determination level held by or pending for the individual

Within five working days before anew employee assumes a position that requires a suitability determination or when an employee stops working under this acquisition

Contracting Officer, Contracting Officer’s Representative and Security Investigation Reviewer

5. Contractor Employee Separation Checklist Upon separation of individual

Contracting Officer’s Representative

6. Commitment to Protect Non-Public Information - Contractor Employee Agreement Non-Disclosure Agreement

Prior to performing any work under this acquisition

Contracting Officer’s Representative

7. Information Security Assessment using NIST SP 800-53, Recommended Security Controls for Federal Information Systems

Submit with proposal and yearly after award

Contracting Officer

8. Information System Security Plan (ISSP)

Submit with proposal

Contracting Officer

9. Information System Security Plan (Final) Within 90 calendar days after award

Contracting Officer’s Representative

10. Updated ISSP Every three years or when modifications have been made to its internal system.

Contracting Officer’s Representative

11. Notification of Data Breach:

http:/irm.cit.nih.gov/security/PII_Spillage_Report.doc

Within one hour of discovering the incident

NIH Incident Response Team: IRT@mail.nih.gov

Contracting Officer’s Representative

12. Vulnerability Scanning Requirements: Vulnerability Scans identified on the SANS Top-20

On the first day of each month

Contracting Officer’s mailto:IRT@mail.nih.gov

13. Certification that installed applications are fully functional and operate correctly as intended on systems using the Federal Desktop Core Configuration (FDCC)

Prior to award

14. HHS Section 508 Product Assessment (see attachment section)

Prior to award and Annual Report

Program Management and Control Requirements

The contractor shall develop the following internal management and control systems:

• Risk assessment and Risk management plan as it pertains to the completion of this requirement.

• Information security risk identification and risk management plan to cm1trol access to confidential information.

Government program management and quality assurance:

The Government will utilize the attached Quality Assurance Surveillance Plan to evaluate the contractor's performance as well as the standard contractor evaluation tool also attached to this requirement and will evaluate the following requirements:

• Information Technology Support

• Information Security

• Program Evaluation

• Problem Identification and Resolution

• Fiscal Responsibility and Financial Accountability

• Continuity of Operations

• Confidentiality of information

• Track and report to the contracting officer all reported unsatisfactory work or responses by the Contractor Representative.

• Inspection and Acceptance Requirements

Inspection and acceptance will be performed by: the OCRTME staff and the specific GME training program administrative staff.

Criteria for acceptance will include access to and functionality of the information system as per the requirements of the specific programs.

Attachments

Contractor shall adhere to all requirements in the following documents:

• Information Security Requirements

• Section 508 Communication Contract Requirements

• Privacy Requirements

• Quality Assurance Surveillance Plan

• Additional Requirements: Contractor Performance Matrix