Statement of Work - SRLM Support 9-29-2025 1.docx

Statement of Work (Procurement Sensitive) National Institutes of Health Clinical Center (CC)

Introduction The National Institutes of Health (NIH) Clinical Center is the principal biomedical research institution of the Federal Government. The CC is a major organizational component of the NIH. The mission of the CC is to: (1) provide patient care facilities and services in support of clinical research by the institutes/centers of the NIH; (2) conduct research in related areas; and (3) supervise residency and other training programs. The CC is a 200-bed research hospital, operates with a budget of over $700 million (in FY 2025), and employs over 2,000 staff, trainees, and contractors.

NIH Clinical Center requires the services of a project executive to support Surgery Radiology, and Laboratory Medicine (SRLM) Wing Project. The contractor serves as primary point of contact for the NIH Clinical Center Leadership Team during the construction, outfitting and transition for the Clinical Center Surgical, Radiology and Lab Medicine (SRLM) Project. Reports to the Clinical Center Chief Operating Officer, to ensure timely decision making, resource planning and preparation for the successful occupancy upon completion of construction.

Provides guidance, recommendations and expertise based upon knowledge and experience of similar projects and programs, to effectively liaison with associated staff of Clinical Center and NIH, Office of Research Facilities (ORF). Works with the CC leadership to develops, resources and oversees appropriate Program Management Office for the project.

Background The vision of the NIH Clinical Center is to serve as the nation’s premier research hospital for conducting clinical research to improve the health of humankind. It also serves as a national resource for clinical research by developing diagnostic and therapeutic interventions, enhancing systems to ensure the safe, efficient, and ethical conduct of clinical research, training clinical researchers, and leading the response to the nation’s public health needs.

The SRLM construction project is adding a new structure that is nine (9) levels above grade (including interstitial floors and a roof penthouse) and two (2) levels below grade on the west end of the current Clinical Research Center (CRC) on the Bethesda, MD campus. In addition to housing the SRLM programs, this project will also house laboratories for NCI (those currently housed on the first and third floors of the CRC West Labs), Interventional Radiology, and the NHLBI Catheterization Lab. While technically inaccurate, the acronym SRLM is intended to apply to all these programs.

1.0 Introduction: The NIH\CC is seeking project management and consulting services to support the outfitting and transition from current SRLM space to the new SRLM Wing ready for occupancy in Spring 2029. The project management services would evaluate and define all relevant requirements for a seamless transition to the new Wing. and develop recommendations for a successful relocation of these services. The project consultant will be responsible for conducting analysis, budget requirements, and provide recommendations to the CC CEO and COO. The consultant will work with CC staff and relevant Office of Research Facilities, Office of Research Services and other Institutes/Centers staff, as appropriate to execute the transition.

2.0 Scope of Work: The project consultant will provide services as follows:

Complete an assessment/evaluation of CC’s costs by conducting document and data reviews, interviews with key staff, and industry research as outlined below:

Document reviews include:

Review of existing design and construction documents and modifications on the SRLM projects and other associated projects to ensure coordination and support Conduct interviews/document review with key stakeholders from the Office of Research Facilities in regards to the design and construction modifications for the SRLM project Conduct a detailed analysis of the existing operating spaces identifying and documenting both requirements – reusable and new equipment requirements.

Provide a detailed report of findings and recommendations to hospital leadership.

3.0 Tasks and Deliverables: The consultant will perform the following tasks and deliverables:

Task 1: Task Order Management Evaluate the Clinical Center’s the following Proper and adequate funding must be proactively programmed, and actively managed, to ensure safe and successful CC transition to the $620M SRLM project Support a collaborative forum of CC Stakeholders, Leaders and Experts to identify, discuss, resolve and document issues and challenges associated with activating the SRLM Project, which is scheduled to be fully operational in Spring 2029.

Task 2. Support Communications Activities Routine Communications. The Clinical Center requires support for communications to its various stakeholders. Communications should include introducing the effort, engaging stakeholders to provide input and sharing information as needed.

Briefing Materials. The Clinical Center requires support to develop briefing materials for various stakeholder meetings, such as with the CC Leadership and CCGB Meeting Support. The Clinical Center also requires participation in meetings to share materials and provide information/updates about the project work.

Task 3. Provide Project Management Support The Clinical Center requires support for project management activities associated with the execution and monitoring of this effort. Support activities should include:

Provide bi-weekly (every two weeks) progress meetings and monthly status reports which tracks all tasks that have been completed, tasks in progress, and the percent complete for each task.

Provide deliverable review meetings as requested by COR and/COO.

Meeting Support. The Clinical Center also requires participation in meetings to share materials and provide information/updates about the project work.

Conduct occasional project site visits

4.0 Timeframe and Milestones: The consultant will complete the work within a period of not to exceed 3 months from the start date of the contract. The following milestones will be achieved during the contract period:

Month 1: Conduct initial meetings with CC staff and commence review to ensure all requirements are accounted for a seamless transition to the new Wing Month 2: Complete meetings with CC staff and review/reconcile outfitting requirements or space modifications for an orderly transition Month 3: Complete analysis of all transition requirements to include costs and identify potential gaps and provide recommendations NIH CC leadership, as deemed appropriate

5.0 Evaluation Criteria: The following criteria will be used to evaluate proposals received in response to this SOW:

Demonstrated experience in conducting similar work for healthcare institutions or hospitals.

Understanding of federal acquisitions regulations and compliance with them.

Quality of written and oral communication skills.

Cost competitiveness.

6.0 Contract Management: The contract will be managed by CC staff. The consultant will provide regular progress reports and attend meetings with CC staff as necessary. The consultant will be expected to comply with all NIH and CC policies and procedures, including those related to security, confidentiality, and ethics.

Contract Type This will be a Fixed Price Contract Place of Performance Ideally, the contractor shall perform the majority of the work, including interviewing staff and stakeholders, virtually. However, site visits should be utilized as appropriate.

If on-site activities occur, designated office space will not be provided to the contractors. However, contractors will have access to schedule into NIH Clinical Center conference rooms to host meetings as needed. Work which does not require face-to-face interaction with NIH staff will be completed off-site.

Period of Performance 3 months from date of award, and clearance completion.

Deliverables/Delivery Schedule

Ownership of Records The term "Records" means all working papers and such other information and materials as may have been accumulated or generated by the Contractor or Contractor agents in performing under this contract, including, but not limited to: documents, data, plans, books, computations, drawings, specifications, notes, reports, records, estimates, summaries and correspondence, kept or stored in any form, including by magnetic or electronic means.

The Contractor, upon the request of the NIH, shall promptly give to the NIH all original records, or, in the sole discretion of the NIH, copies thereof. The Contractor shall otherwise maintain all original Records, or copies thereof, for a period of ten (10) years after the termination of this Agreement. Unless the NIH designates otherwise in writing, all Records are the exclusive property of the NIH and no one else shall have any right, including, but not limited to, any copyright, trademark or other intellectual property rights, in those Records.

Security

A. Access (Physical or Logical) to Government Information: A Contractor (and/or any subcontractor) employee will have or will be given the ability to have, routine physical (entry) or logical (electronic) access to government information. Contractor personnel who need to be on-site to perform service and maintenance must be escorted and monitored at all times. An NDA must be signed if services and maintenance requires access PII/PHI or sensitive government information.

2) Protection of Sensitive Information. For security purposes, information is or may be sensitive because it requires security to protect its confidentiality, integrity, and/or availability. The Contractor (and/or any subcontractor) shall protect all government information that is or may be sensitive in accordance with OMB Memorandum M-06-16, Protection of Sensitive Agency Information by securing it with a FIPS 140-2 validated solution.

3) Confidentiality and Nondisclosure of Information. Any information provided to the contractor (and/or any subcontractor) by HHS or collected by the contractor on behalf of HHS shall be used only for the purpose of carrying out the provisions of this contract and shall not be disclosed or made known in any manner to any persons except as may be necessary in the performance of the contract. The Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its employees and subcontractors shall be under the supervision of the Contractor. Each Contractor employee or any of its subcontractors to whom any HHS records may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such employee or subcontractor can be used only for that purpose and to the extent authorized herein.

The confidentiality, integrity, and availability of such information shall be protected in accordance with HHS and NIH policies. Unauthorized disclosure of information will be subject to the HHS/NIH sanction policies and/or governed by the following laws and regulations:

4) Contract Documentation. The Contractor shall use provided templates, policies, forms and other agency documents to comply with contract deliverables as appropriate.

5) Contractor Non-Disclosure Agreement (NDA). Each Contractor (and/or any subcontractor) employee having access to non-public government information under this contract shall complete the NIH non-disclosure agreement. A copy of each signed and witnessed NDA shall be submitted to the Contracting Officer (CO) and/or CO Representative (COR) prior to performing any work under this acquisition.

Role-based Training. All Contractor (and/or any subcontractor) employees with significant security responsibilities (as determined by the program manager) must complete role-based training annually commensurate with their role and responsibilities in accordance with HHS policy and the HHS Role-Based Training (RBT) of Personnel with Significant Security Responsibilities Memorandum.

2) Training Records. The Contractor (and/or any subcontractor) shall maintain training records for all its employees working under this contract in accordance with HHS policy. A copy of the training records shall be provided to the CO and/or COR within 30 days after contract award and annually thereafter or upon request.

2) All Contractor employees performing on the contract must read and adhere to the Rules of Behavior before accessing Department data or other information, systems, and/or networks that store/process government information, initially at the beginning of the contract and at least annually thereafter, which may be done as part of annual NIH Information Security Awareness Training. If the training is provided by the contractor, the signed ROB must be provided as a separate deliverable to the CO and/or COR per defined timelines above.

D. Incident Response The Contractor (and/or any subcontractor) shall respond to all alerts/Indicators of Compromise (iocs) provided by HHS Computer Security Incident Response Center (CSIRC)/ NIH IRT teams as soon as possible, whether the response is positive or negative.

FISMA defines an incident as “an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines incidents as events involving cybersecurity and privacy threats, such as viruses, malicious user activity, loss of, unauthorized disclosure or destruction of data, and so on.

A privacy breach is a type of incident and is defined by Federal Information Security Modernization Act (FISMA) as the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for another than authorized purpose. The HHS Policy for IT Security and Privacy Incident Reporting and Response further defines a breach as “a suspected or confirmed incident involving PII.”

In the event of a suspected or confirmed incident or breach, the Contractor (and/or any subcontractor) shall:

1) Protect all sensitive information, including any PII created, stored, or transmitted in the performance of this contract so as to avoid a secondary sensitive information incident with FIPS 140-2 validated encryption.

2) NOT notify affected individuals unless so instructed by the Contracting Officer or designated representative. If so instructed by the Contracting Officer or representative, the Contractor shall send NIH approved notifications to affected individuals.

3) Report all suspected and confirmed information security and privacy incidents and breaches to the NIH Incident Response Team (IRT), COR, CO, NIH SOP (or his or her designee), and other stakeholders, including incidents involving PII, in any medium or form, including paper, oral, or electronic, as soon as possible and without unreasonable delay, as soon as possible, and consistent with the applicable NIH and HHS policy and procedures, NIST standards and guidelines, as well as US-CERT notification guidelines. The types of information required in an incident report must include at a minimum: company and point of contact information, contact information, impact classifications/threat vector, and the type of information compromised. In addition, the Contractor shall:

A. Cooperate and exchange any information, as determined by the Agency, necessary to effectively manage or mitigate a suspected or confirmed breach;

B. Not include any sensitive information in the subject or body of any reporting e-mail; and

C. Encrypt sensitive information in attachments to email, media, etc.

4) Comply with OMB M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information HHS/NIH incident response policies when handling PII breaches.

5) Provide full access and cooperate on all activities as determined by the Government to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents. This may involve disconnecting the system processing, storing, or transmitting the sensitive information from the Internet or other networks or applying additional security controls. This may also involve physical access to contractor facilities during a breach/incident investigation.

E. Position Sensitivity Designations All Contractor (and/or any subcontractor) employees must obtain a background investigation commensurate with their position sensitivity designation that complies with Parts 1400 and 731 of Title 5, Code of Federal Regulations (CFR). The following position sensitivity designation levels apply to this solicitation/contract:

F. Contract Initiation and Expiration

1) Notification. The Contractor (and/or any subcontractor) shall notify the CO and/or COR and system ISSO before an employee stops working under this contract.

2) Contractor Responsibilities Upon Physical Completion of the Contract. The contractor (and/or any subcontractors) shall return all government information and IT resources (i.e., government information in non-government-owned systems, media, and backup systems) acquired during the term of this contract to the CO and/or COR. Additionally, the Contractor shall provide a certification that all government information has been properly sanitized and purged from Contractor-owned systems, including backup systems and media used during contract performance, in accordance with HHS and/or NIH policies.

3) The Contractor (and/or any subcontractor) shall perform and document the actions identified in the NIH Contractor Employee Separation Checklist when an employee terminates work under this contract. All documentation shall be made available to the CO and/or COR upon request.

G. Records Management and Retention The Contractor (and/or any subcontractor) shall maintain all information in accordance with Executive Order 13556 -- Controlled Unclassified Information, National Archives and Records Administration (NARA) records retention policies and schedules and HHS/NIH policies and shall not dispose of any records unless authorized by HHS/NIH

In the event that a contractor (and/or any subcontractor) accidentally disposes of or destroys a record without proper authorization, it shall be documented and reported as an incident in accordance with HHS/NIH policies.

Government Furnished Equipment (GFE)/ Government Furnished Information (GFI) The awardee is expected to utilize their own equipment to document notes, reports, presentations, and other analysis, provided it meets with NIH requirements for security and privacy. The NIH will not provide GFE, including laptops, mobile devices, and desktops.

Other Pertinent Information or Special Considerations Contractor experience and expertise in conducting cost analyses and cost modeling is required. Experience and expertise in conducting cost analyses in the health care industry is required. Experience and expertise in conducting cost analyses in government industry is preferred.

The Contractor will provide three references for showing the completion of at least three jobs of similar size and scope.

Badging - The NIH Badge (NIH Legacy Badge), not to be confused with the HHS ID Badge, is an identification credential issued to individuals who are in a short-term or intermittent position that requires physical access to the NIH campus and/or facilities. The sub-contractor and sub-contractor(s) shall always wear their NIH issued ID badge prominently while on campus.

NIH ID Badge Process and the following link:

Http://www.ors.od.nih.gov/ser/dpsac/badge/Pages/default.aspx Extended Visitor Badge Program - NIH has implemented new policies and procedures for issuing Extended Visitor Badges to individuals such as Service Providers, Board Members, Constructions Workers and others who are not registered in the NIH Enterprise Directory (NED) and may need frequent physical access to NIH facilities. All position classifications at NIH, along with examples, can be viewed by clicking on the following link:

Https://orsweb.od.nih.gov/sites/dpsac/Internet%20Site%20Documents/NIH%20Badging%20Authority%20by%20Classification%20Table%20(rev.%2010-21-14).pdf Invoicing Instructions – Per procedures on Standard Form 1442 provided by the Contracting Officer.

Quality Assurance Surveillance Plan. The COR will review, for completeness, preliminary or draft products that the Contractor submits, and may return them to the Contractor for correction. Absence of comments by the COR will not relieve the Contractor of the responsibility for complying with the requirements of this work statement. Final approval and acceptance of products required herein shall be by letter of approval and acceptance by the COR. The Contractor shall not construe any letter of acknowledgment of receipt of products as a waiver of review, or as an acknowledgment that a product is in conformance with this work statement. Any approval given during preparation of a product, or approval for distribution shall not guarantee the final acceptance of the completed product.

7.0 Conclusion: The NIH Clinical Center is seeking a consultant to define all possible operating costs for the hospital. The consultant will be responsible for conducting a thorough analysis of the existing operating costs of the hospital and identifying costs not currently covered by its annual budget funding source. Proposals must be submitted in accordance with the evaluation criteria outlined in this SOW

EVALUATION CRITERIA:

To be considered, respondents must have extensive experience in health care reimbursement and clinical research environments. Successful applicants will be able to demonstrate via their proposal, proposed team members, past experience and references, and in-depth knowledge of hospital management, a familiarity with operating costs for services provided within a clinical research environment.

Evaluation Criteria will be as follows:

An overall rating of each proposal meeting the minimum requirements will be developed using weighted combination of technical and price proposals. Price proposal will be considered on the basis of total price. The business proposals will be evaluated to determine the reasonableness of the proposed price. The lowest total evaluated price will be assigned 20 points. Points for all other offers will be calculated as follows:

Lowest Total Evaluated ------------------------------------------X 20 Points = Number of points to be assigned Offeror’s Total Evaluation Price Total number of points possible will be determined as follows:

Total Evaluated Price + Total Technical Evaluation = Total Score % + % = 100 The Government intends to make a single award to the eligible, responsible offeror whose offer conforms to the solicitation, and is the most advantageous to the Government, cost and other factors considered. The Government will make an award to that offeror whose quotation provides the best overall value to the Government. The Government may also ask for oral presentations which will influence the final selection.