The Department of Health and Human Services, specifically the Centers for Medicare and Medicaid Services (CMS), is seeking qualified vendors for its Data Privacy Safeguard Program (DPSP). This procurement aims to enhance security and compliance support services related to IT and telecommunications, ensuring the protection of sensitive data within CMS operations. The services are critical for maintaining the integrity and confidentiality of health information, which is paramount in the healthcare sector. Interested parties can reach out to Ryan Kaufman at ryan.kaufman1@cms.hhs.gov or Jennifer Davis at jennifer.davis@cms.hhs.gov for further details, with the procurement process being guided by the Justification notice type.

This acquisition was conducted under the authority of the Multiple-Award Schedule Program in accordance with FAR 8.405-6(c). The DPSP manages the Data Management Plan (DMP) legacy and the Data Management Plan Self Attestation Questionnaire (DMP SAQ) process for Data Use Agreements (DUA) that are required for researchers to obtain access to CMS data. The incumbent contractor performing this work manages the DMP (SAQ) process and works with other contractor organizations to ensure that researchers have the necessary security and privacy controls in implemented in applicable computing environments. This project is currently in the middle of a transition that will include new enhanced forms and policies relating to the protection and oversight of PHI and PII data. These enhancements are driven in response to a GAO audit that found numerous shortcomings with the legacy approach. The incumbent contractor created all the enhanced documentation, policies, practices, and plan to correct the shortcoming found in the GAO audit. The incumbent has also been communicating and building relationships with stakeholders for years in preparation for the transition. If this project were to lose the incumbent before the transition is complete, CMS would lose all the institutional knowledge specific to the documentation and process, as well as the relationships that have been built in preparation for this transition. Without this, there is a major risk to the integrity of the processes and policies that have been developed, which could jeopardize the security and privacy of millions of beneficiary level data points. To minimize this risk, the incumbent needs to continue on the project until the transition is complete. The Period of Performance for services shall be June 21, 2022 - June 20, 2023.

Buyer

PSC

Original Source