Inactive

National Cancer Institute (NCI) Division of Cancer Control and Population Sciences (DCCPS), Surveillance Research Program (SRP), plans to procure on a sole source basis a purchase order from HealthVer... National Cancer Institute (NCI) Division of Cancer Control and Population Sciences (DCCPS), Surveillance Research Program (SRP), plans to procure on a sole source basis a purchase order from HealthVerity, Inc.; 1818 Market Street, Lobby 6, Philadelphia, PA 19103-3602 to acquire Commercial-Off-The-Shelf (COTS) software and project management services to create a data platform for the NCI’s National Childhood Cancer Registry (NCCR), a component of the larger Childhood Cancer Data Initiative (CCDI) and its federated data ecosystem. This project will support the NCI in planning, acquiring, developing, documenting, implementing, updating, and supporting childhood cancer research by applying commercially available information technology (IT) solutions in an NCI-approved environment. This requirement and resulting IT and applications will assist researchers and the NCI to meet data sharing and scientific objectives in surveillance and public health analysis and cancer research, with an ultimate goal of improving treatments, quality of life, and survivorship of every child with cancer. The response close date of this notice for this requirement is in accordance with FAR 5.203(a)(1). This acquisition will be processed under FAR Part 12 – Acquisition for Commercial Items and in accordance with simplified acquisition procedures as stated in FAR Part 13.106-1(b)(2) and is exempt from the requirements of FAR Part 6. The North American Industry Classification System code is 518210 and the business size standard is $35.0M. Only one (1) award will be made as a result of this solicitation. This will be awarded as a firm fixed price type purchase order with one (1) base period, and one (1) term option period. If the Government exercises its option pursuant to the OPTION PROVISION Article FAR 52.217-9 in the contract, the Period of Performance will be increased by a maximum of twelve (12) months. It has been determined there are no opportunities to acquire green products or services for this procurement. The DCCPS is one (1) of the six (6) Divisions of the National Cancer Institute. It generates new knowledge and seeks to ensure that the products of cancer control research are effectively applied in all segments of the population. Childhood cancer patients comprise a special and understudied population of cancer patients. Approximately 16,000 childhood cancer patients are diagnosed in the United States annually, compared with the 1.7 million new cancer cases diagnosed each year. Due to their rare nature, it has been challenging to collect substantial and vital information on a large scale to study and understand the needs for this unique population of cancer patients. The SRP provides national leadership in the science of cancer surveillance as well as analytical tools and methodological expertise in collecting, analyzing, interpreting, and disseminating reliable population-based cancer statistics. This surveillance infrastructure benefits the public, policymakers, and scientists in understanding changes in cancer incidence and outcomes in all segments of the U.S. population over time. A well-designed data platform supports the inclusion of disparate data sources to enable linkage and basic cohort discovery across multiple sources. This requirement shall support NCI by providing Commercial-Off-The-Shelf (COTS) solutions to create a data platform that will hold de-identified registry data, securely link patients using privacy-preserving methods to external data sources, provide secure governance workflow components to manage data access and approvals, allow users to conduct cohort discovery and use other features to understand data availability, connect to other data resources in the childhood cancer data ecosystem, and support analytical tools. These activities must be accomplished within two years to satisfy CCDI timelines and serve as an analytic resource for future CCDI priorities. The Contractor shall deploy their software to an NCI-approved cloud-based environment. The NCI under the CCDI is focusing on building data infrastructures to support research that focuses on childhood cancer patients. These patients have experienced complexities in their care and outcomes that are significantly different than for adults. These include long term sequelae of treatment, high risk for second primary cancers, and psycho-social challenges. Further because they are so young and often mobile, it is especially challenging to track these patients from a surveillance perspective. This Programmatic CCDI related requirement complements, enhances, and supports efforts aligned with the ongoing Childhood Cancer Survivorship, Treatment, Access, and Research (STAR) Act of 2018 (Public Law No. 115-180) that was enacted to maximize discovery, and accelerate development and availability, of promising childhood cancer treatments. The NCI launched the Childhood Cancer Data Initiative (CCDI) in 2019 to collect, analyze, and share data to address the burden of cancer in children, adolescents, and young adults. The NCI Board of Scientific Advisors affirmed CCDI priorities for this 10-year initiative in a June 2020 report.[1] The NCCR is a critical component of the CCDI. Currently, cancer registries in the United States hold structured information on every cancer case, including childhood cancers, within their respective catchment areas. The NCCR consists of population-based cancer data from 18 Surveillance, Epidemiology and End Result (SEER) registries across the US (California (Greater Bay, Greater California, Los Angeles), Connecticut, Georgia, Hawaii, Idaho, Illinois, Iowa, Kentucky, Louisiana, Massachusetts, New Jersey, New Mexico, New York, Seattle, Texas, Utah) and 5 Centers for Disease Control (CDC) National Program of Cancer Registries (NPCR) (Florida, Michigan, Ohio, Pennsylvania, Tennessee, Wisconsin) for children diagnosed under age 20 since 1995, with the goal to expand to all 50 states, capture all patients with cancer diagnosed before age 40, and provide annual updates. The initial participation of 23 registries covers 66% of the US population. Registries report data in SEER[2] and North American Association of Central Cancer Registries (NAACCR)[3] formats. For childhood cancer patients and survivors, data on late effects, recurrence, subsequent primary cancers, and follow-up are critically important to capture at a national level to ensure data completeness. Patients frequently travel for care and survivors mature and leave their original state of residence at the time of initial diagnosis and treatment. Additionally, childhood cancer survivors experience a wide sequalae of long-term outcomes as a direct result of their cancer and cancer treatment and require proactive health screenings over their lifetimes. The NCCR can enhance registry data by incorporating data on genomic and tumor characterization, claims, social determinants of health, longitudinal treatment and outcomes, pharmacy and claims information, and comorbidities. The NCCR will bring together key information on every childhood cancer patient regardless of where or when they receive care and will support research about childhood cancer patients and survivors. Access to external healthcare data will help improve scientific opportunities, enable cancer surveillance to rapidly adapt to emerging issues in pediatric oncology care, and support research that will improve the health and wellbeing of childhood cancer survivors. The implementation of an NCCR data platform activity is in in close alignment with the NCI’s CCDI and a high priority for the NCI. SRP has made significant progress in securing registry data submissions in the NCCR’s first two years and creating public-facing analytic tools (https://nccrexplorer.ccdi.cancer.gov/) and statistical reports (https://nccrexplorer.ccdi.cancer.gov/about/nccr.html) using de-identified registry data in 2021. The next major step for the NCCR is to supplement registry data with external data sources and integrate with the wider cancer data ecosystem in a modern data platform. The NCCR Data Platform will hold de-identified registry data, securely link patients using privacy-preserving methods to external data sources, provide secure governance workflow components to manage data access and approvals, allow users to conduct cohort discovery and use other features to understand data availability, connect to other data resources in the childhood cancer data ecosystem, and support analytical tools. These data are rapidly needed to support NCI’s CCDI analytic projects, NIH data sharing priorities, and to support future planning efforts for CCDI priorities. Contractor shall perform the following: TECHNICAL REQUIREMENTS: Independently and not as an agent of the Government, the Contractor shall furnish all the necessary services, qualified personnel, material, equipment, and facilities, not otherwise provided by the Government, as needed to perform task assignments at the direction of the NCI COR in the Tasks specified below. Section 3. Task 1: Software Development Section 3. Task 1.1 COTS The Contractor shall provide a COTS software solution that consists of several components, working together to achieve the needed functionality of the NCCR data platform. The NCCR data platform and its components shall run in an isolated network space (such as a Virtual Private Cloud or similar) approved by NCI and communicate with external systems using modern technologies, such as secure application programming interface (API) calls, over secured network channels. The Contractor shall perform technology-related activities, to include but not limited to the following: Data storage and backup systems, processing systems, user interfaces, and connectivity between all components using modern technology approaches; Technology components and connectivity that are clearly and fully documented, and designed to follow industry best practices for information architecture; Technology components and connectivity that meet industry standards for availability, such as API availability at least 99.999% of the time, overall system availability of at least 99.999% per month or downtime of 5.26 minutes annually; A dashboard reporting Service Level Agreements (SLAs) and availability information for the system and all its components on a continuous basis. System or subsystem failures or partial failures shall be reported to the dashboard within 5 minutes of the incident; A system that continuously maintains a FISMA-moderate security rating; Authentication to the NCCR data platform that complies with HHS, NIH, and NCI requirements and standards, such as following OpenID Connect 1.0 and OAuth 2.0. and supports, in a federated way, interoperability and API–based integration with NIH Identity Provider (IdP) services such as Login.gov, NIH iTrust or NIH Researcher Auth Service (RAS)5 or similar NIH authentication service following SAML and OIDC authentication protocols. Logging and storing all user (including all non-human user) actions in an audit trail. Storage of audit trail data shall follow best industry practices, such as storing audit trail data in a separate data storage system independent from the NCCR data platform with an immutable ledger, enabling access to audit trails by security users and not to any other type of users, including system administrators; Apply PPRL technologies using Personally Identifiable Information (PII) to source registry systems when this has not already been done for NCCR registries; User interfaces that follow best practices in user-centered design; Users shall be able to save and share reports or complex queries for future use; Usage and utilization metrics shall be available for approved users, along with the ability to generate usage reports based on these metrics; Industry standards for performing secure, automatic backups for system datasets, including all metadata and user data. The NCCR data platform shall maintain metadata information about availability of that data source and useable by the data platforms systems and interfaces; Industry standards for preventing data loss, such as maintaining Recovery Point Objectives (RPOs) of 30 minutes and Recovery Time Objectives (RTOs) of 1 hour. Snapshots of the datasets shall be taken monthly and maintained for archival purposes in tiered, cost-effective storage options with a minimum durability of 99.9999999%; The COTS solution shall offer dynamic, faceted, and granular search features in the interface to build queries that join datasets on the population of interest and form the basis for a data access request in the governance workflow. Search results of cohort discovery shall visualize the intersection of de-identified patients across multiple, disparate data sources and basic statistics about the cohort, underlying data structures, and data sources. Search functionality shall offer flexible and discrete searching of underlying data structures such as disease and drug codes (e.g., ICD-9, ICD-10, ICD-O, NDC, CPT), genomic information, geographic characteristics, patient demographics and other characteristics, and support querying data structures across multiple disparate datasets. The interface shall rapidly update results of datasets that meet various combinations of search queries, clearly document search criteria, and save search criteria for re-use or sharing with other users, and allow filtering on patient-level and dataset-level parameters; To link and search datasets in a unified fashion, the NCCR data platform shall contain de-identification and patient matching technology that can be applied to existing data sets or user defined datasets. The software component shall allow normalization of data through de-identification (removing any Personal Identifiable Information (PII) that might be contained in the original dataset) and highly accurate matching of the data concerning a single individual across multiple, disparate datasets; Support analysis of data and datasets in the interface, in complex user-generated or system reports, and by making datasets available to users in 3rd party COTS analytic tools such as Jupyter Notebooks, SAS, etc. Section 3. Task 1.2 Governance The Contract shall provide a COTS' governance features that ensure appropriate security controls and allow users to maximize the use of external data source enabled by the COTS solution. The Contractor shall describe the types of limitations placed on data use from the original data providers that would affect the NCCR Data Platform and its users, including limitations placed on data use, appropriate storage or querying of data (e.g., storage in the NIH-approved environment or federated queries), data management or linking, or other governance issues. Key governance features shall include: Data access requests: Technology supporting data governance workflows and approvals shall clearly document datasets and cohorts in a request and route access requests to the appropriate approvers for their review within the platform interface. Users shall be required to complete information for various levels of access requests depending on the granularity or sensitivity of data being requested up to and including IRB approval. All user actions associated with governance and access approvals shall be auditable, traceable, and reportable, including user-specific queries to formulate cohorts of interest. Receive data: Once a data access request is approved, the data shall be available to the appropriate user for further analysis in the COTS platform or in 3rd party analytic tools. Save and share data queries, datasets, and reports: Approved users shall be able to share and create projects for future use and with other authenticated users to allow for collaboration in the platform. Users involved in a collaborative project shall also be approved in the initial or subsequent data access requests by dataset owners through the governance workflow. Registries contributing data may also require reports on what users or projects accessed their data. Section 3. Task 1.3 Project Management The Contractor shall provide project management services to plan, implement, operate, and maintain services, applications, software, systems, and infrastructures to support adapting commercial software to an NCI-approved, cloud-based environment. The Contractor shall apply expert level knowledge and best practices of project management to ensure effective and efficient management of activities within the project’s cost, schedule, and quality goals. The Contractor shall conduct a project kick-off meeting and provide for COR approval, a meeting agenda three days in advance of the meeting. The Contractor shall participate in monthly project and contract meetings and provide bi-weekly status and progress briefings to report on their performance and progress toward successful completion of this SOW. The Contractor shall support the development, maintenance, and document control of project plans, roadmaps, protocol documents, spreadsheets, financial statements, and contract deliverable documents. The Contractor shall keep all documents organized in a secured, collaborative workspace and allow access to be granted to the Contractor, NCI, NIH, HHS, and 3rd party partners designated by the NCI. The Contractor shall perform project management activities, to include but not limited to the following: Identify and implement project management tools and artifacts to support project needs and make these tools available to NCI and appropriate 3rd parties involved in the NCCR, including: Define, document, distribute, and manage milestone reviews, project schedules, team tasks, team members from the staffing plan linked to tasks, risks, issues, and assumptions; Monitor and report on progress of implementation of the solution and tasks associated with adapting the commercial solution to NCI use cases and the NCI-approved environment; Financial management of the contract, including cost tracking as the project progresses; Prepare program and project assessment and evaluation activities such as metrics for success and processes for go-no-go decisions to demonstrate progress and adherence to project schedule; Provide consulting and training support to government project and task managers to help ensure successful, on time, and within budget project completion; Coordinate among teams and with different NCCR components; and, Conduct project close out and transition in a smooth and orderly fashion, if needed. Section 3. Task 2: Software Deployment The Contractor shall provide information technology services to implement commercial software in a manner that ensures compliance with applicable HHS, NIH, and NCI policy requirements. The Contractor shall design, configure, test, deploy, operate, and secure an NCI-approved cloud environment suitable for hosting all software components necessary to run the NCCR Data Platform in an efficient, cost-effective, and secure way. At a minimum, this cloud environment should be a private cloud hosting a single-tenant environment where the hardware, storage and network are dedicated to exclusively holding NCCR data. The Contractor shall provide staff with experience in industry standard technologies and processes: Agile (e.g., Kanban and Scrum), Cloud Infrastructure and Security, DevOps, serverless computing, Cloud Managed Services, FISMA/FedRAMP Compliance, AWS S3, AWS CloudFront, AWS Shield, AWS API Gateway, and other AWS services. The appropriate and applicable security documentation shall be written, updated, and submitted for signature by the NCI, NIH, or HHS security departments as appropriate and FedRAMP/FISMA Moderate Compliance shall be maintained at all times. Any revisions requested by the NCI, NIH, or HHS security departments shall be the Contractor’s responsibility to remediate. All code deployed shall be monitored by the Contractor to ensure proper system utilization and load handling. The code shall be demonstrated as compliant through use of a 3rd party online code evaluator of the contractor’s choice. The Contractor shall ensure and be able to demonstrate that all code is tested using best practices such as automated unit testing, integration tests, interface tests, smoke tests, load testing, and behavior-driven development (BDD) tests. The Contractor shall deploy all code using modern cloud-based tools and techniques, such as Infrastructure-as-code, configuration management, continuous deployment, etc. The Contractor shall be responsible for configuring and updating the cloud environment and the tools as appropriate to fulfill this requirement. The Contractor shall follow software and systems development principles and best practices for software and system development maintenance, and IT governance in accordance with Government regulations. The Contractor shall perform deployment-related activities, to include but not limited to the following: Environment setup; Securing FISMA Authority to Operate and FedRAMP authorization of all components, if needed; Authentication and Authorization of users including connecting with NIH authentication services; Reporting and monitoring for software components and infrastructure, including availability reports; Technical skills and expertise to assist SRP to maintain and update the NCCR data platform and its’ associated websites; Developing training resources to administer and use the software; Develop and test Standard Operating Procedures (SOPs) for the maintenance and software updates to data platform components and underlying infrastructure; Support for the planning, management, tracking, and reporting on deployment of information systems at NCI (leased and/or supported sites), as well as in the cloud; Database management services including planning, evaluation, risk and issue analysis and management support; Cloud Operations, Cloud General Security System, and Cybersecurity services: use of industry standards for implementing security controls, continuous threat monitoring for the production cloud environment, cybersecurity incident response according to the guidelines and security standards mandated by the NCI, NIH or HHS. Analysis and reporting services of the data platform including utilization, effectiveness, acceptance, performance, risks, issues, etc.; Ensuring that any new websites or web applications incorporate appropriate code to support web analytics per Federal reporting requirements; Maintaining sites including updating technologies and links as required; Additional solution updates required by the NCI to satisfy requirements for the NCCR Data Platform interface, governance, search features, analytics, data stores, data processing, connectivity, public-facing information, and interoperability. Development of these updates shall follow best practices in software design and project management through requirements analysis, information architecture review, and iterative development in conjunction with NCI and NCCR collaborators and stakeholders; Prepare technical and business requirements analysis, map requirements to functionality, and conduct prioritization of commercial software requirements for implementation at the NCI, including data governance policy and processes; Work with the NCI, NCCR Data Platform end users, and 3rd party partners to document and implement infrastructure and interface enhancements; Provide engineering deployment in an Infrastructure as Code model (e.g., YAML, JSON) to ensure consistent, reliable, and reproducible methods to configure the cloud environment. Set up all cloud services needed for the platform to run, including services for required to obtain and maintain Authority To Operate (ATO) (e.g., logs set to expire and moved to long term cold storage); Public-facing informational websites with aggregate statistics about the NCCR Data Platform shall follow the NCI’s Digital Standards[4] for websites; Ensuring all digital assets align with NCI branding and identity and NIH Identity guidelines.[5] Section 3. Task 3: Data Linkages Section 3. Task 3.1 Registry Data Ingestion The Contractor shall work with NCI and appropriate 3rd parties to extract, transform, and load de-identified registry data into the NCCR Data Platform. The Contractor shall provide infrastructure and services necessary to ingest, parse, and make registry data available in the COTS platform’s interfaces, data stores, and other features. To facilitate consistent and reliable searching and analysis, registry data shall be indexed and aligned to a common data model appropriate to the underlying data structure as part of data ingestion practices. Section 3. Task 3.2 Data Ingestion and Linking with External Data Sources The Contractor shall leverage their existing COTS software to bring external data sources into the NCCR Data Platform and support governance workflows to allow access to those datasets. Data provided shall be relevant to the US childhood cancer population represented in the NCCR, such as Medicaid claims or data from healthcare institutions that deliver care to children with cancer (e.g., inpatient and outpatient data, pharmacy benefits managers, laboratory results, and imaging). The Contractor shall describe external data sources they will bring to the NCCR Data Platform, including the data types and formats, estimates of coverage of the population of interest (i.e., children that develop cancer and geographic representativeness), and examples of original data sources. Datasets shall be clearly documented as part of data ingestion practices and made available to users such as description of the data source and data supplier, key data source statistics, an epidemiological profile of available data with statistics on gender, age, regional and state coverage, and a data dictionary with column names, data descriptions, field types, and fill rates for each data element. To facilitate consistent and reliable searching and analysis, all datasets shall be aligned to the COTS solution’s common data models appropriate to the underlying data structure as part of data ingestion practices. The Contractor shall leverage their existing COTS solutions to provide multiple methods of linking unique patients across datasets, including working with 3rd party entities that hold registry data, to support accurate cohort discovery and other queries, and to make these data available for analysis in the NCCR Data Platform. Section 3. Task 3.3 External Data Repository Releases The Contractor shall work with NCI and non-NCI entities to enable patient matching, searching, and data availability estimates of data in the NCCR Data Platform linked to external data repositories. This includes NIH and NCI data repositories such as the Cancer Research Data Commons[6] and data resources external to the NCI in the wider childhood cancer data ecosystem. The Contractor shall participate in use of NCI’s participant index solution and other NCI solutions to match patients and enable data sharing and interoperability, however, release of NCCR data will be restricted to the Contractor’s solution and 3rd party analytics resources approved for use through the NCCR Data Platform. The Contractor shall ingest or federate data, as appropriate, and ensure all components and services need to ensure interoperability are deployed, for example, by deploying APIs to enable querying, retrieval of results, governance, and analysis in the NCI-approved environment. The Contractor shall describe how the NCCR Data Platform will be interoperable with external data repositories at NCI or outside NCI, including their data normalization and harmonization processes. Section 3. Task 4: Operations and Maintenance The Contractor shall provide services for the operations and maintenance of infrastructure services, applications, software, and systems required for the NCCR Data Platform, public-facing Internet sites, and data transfer or exchange processes. These operations and maintenance activities vary over time depending on the needs of the NCCR Data Platform and will be conducted in collaboration with a variety of 3rd party partners and NCI personnel. Section 3. Task 5: Transition Planning and Support The Contractor shall work with SRP and other NCI support contractors to ensure that working relationships are cordial, professional, that incoming managers and staff fully absorb methodologies, experiences, and lessons learned to ensure all work, management, and reporting tasks and efforts are conducted rapidly and smoothly. The Contractor shall ensure that proposed key personnel are available to begin work upon contract award and that all staff required to implement the Contractor’s proposed technical approach are available and onboard within 30 days of award. In the final year of the Contract, and prior to completion of this Delivery Order’s period of performance, the Contractor shall develop and deliver a draft and final Transition-Out Plan not later than 90 and 30 days prior to contract expiration. The purpose of the Transition-Out Plan is to ensure an orderly and successful transition of contract functions. This Transition-Out Plan shall include processes, procedures, and activities the Contractor shall use to adequately educate and train personnel on operations and maintenance of the NCCR Data Platform and smoothly and effectively transition work activities to the new Contractor or NCI personnel. When tasked, the Contractor shall implement the Transition-Out Plan and assist the NCI to transition knowledge, processes, tasks, activities, etc. to the follow-on contractor or NCI personnel. The plan shall detail transition-out activities to assure continuity of operations and the execution of a smooth and timely transition. Transition-out activities shall be coordinated through the COR and/or other designated federal staff on a weekly basis. In the event that maintenance and operations of the NCCR Data Platform are assumed by an entity other than the incumbent, the incumbent Contractor shall cooperate to the extent required to ensure an orderly changeover. Section 4. Government Responsibilities: The NCI COR to provide the necessary information to the Contractor in order for them to complete Sections 3 and 5 of this Statement of Work. Section 5. Reporting Requirements and Deliverables: (for the Base Period and to Term Option Period 1 (if exercised), as noted) All written deliverable products shall be submitted electronically in draft format for review, comment and approval by the COR. Final copies of approved drafts shall be delivered to the COR within five (5) business days after receipt of the COR’s comments. The delivery schedule of products is outlined in the delivery schedule table below. Other written and technical deliverables shall be submitted according to the schedules identified in the approved Program Management Plan developed under this SOW. The Contractor shall deliver the following: 1. Program Management Plan: The Contractor shall prepare draft and final versions of a Project Management Plan specifying the tasks, sub tasks, and approaches to be used to provide the services and products specified including the deliverable documents, analyses, and reports necessary to fulfill the requirements of this SOW. This Plan shall be delivered in draft not later than one week following the award of the Contract. 2. Bi-Weekly Status and Progress Report Briefings: The Contractor shall prepare and submit a Bi-Weekly status report in collaborative project management tools and in an export appropriate for forwarding to NIH executive management containing accomplishments for the current reporting period, goals for the next reporting period, current risks and issues, and upcoming project milestones. 3. Monthly Contract Status and Progress Summary Report: The Contractor shall prepare and submit Monthly Contract Status and Pr...