COVID-19 Privacy Preserving Record Linkage (PPRL)   2

The Centers for Disease Control and Prevention awarded contract number 7D30123C17043 to HealthVerity, Inc., 1818 Market St Lbby 6, Philadelphia, PA 19103, on 19 July 2023 in the amount of $18,851,501.00.

This notice makes available a Justification and Approval for Other than Full and Open Competition (J&A) that applies to this contract. This contract was issued under the authority of FAR 6.302-1, Only one responsible source and no other supplies or services will satisfy agency requirements.

This contract provides for a configurable, non-developmental end-to-end PPRL Software as a Service (SaaS) solution that comprises three components:

1. Locally installed hashing/de-ID engine
2. Key Manager
3. A linkage agent

The linkage must act as an honest broker service (HBS) that permits de-identified linkage of individual patient records across systems, organizations, and settings over time. This PPRL solution will support U.S. Government and STLT PH owners by promoting public health monitoring and situational awareness into the status of the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) vaccination, testing and epi surveillance effort across the country. The SaaS must be able to provide record linkage for up to 100 data owners consisting of STLTs, Federal Government agencies, and commercia health data owners. The period of performance for this service is for one base year and two option years starting 19 July 2023 and ultimately concluding 18 July 2026.

In accordance with the attached J&A, currently there are over 325 million vaccine records representing 152 million unique individuals which have had HealthVerity PPRL-IDs attached to them. These PPRL-IDs are used to match and link historically received de-identified data from jurisdictions with new de-identified data reported on a routine basis. These PPRL IDs are unique and proprietary to HealthVerity's provided solution. Only HealthVerity has the ability to continue to generate the same PPRL ID using the hashed tokens for an individual so CDC can continue to link historical records with prospective data.

Should another vendor provide these services, not only would a new PPRL engine needs to be deployed at all existing sites currently using HealthVerity, but all the historically reported vaccine records (325 million data points captured and de-identified over 2 years) would be rendered useless and require full scale re-processing, an insurmountable burden to multiple parties with risk related to data site participation and approvals (i.e., legal, privacy, security). Therefore, this alternative approach is not feasible.

The attached J&A is being made available within 14 days of contract award in accordance with FAR 6.305(a) and will remain active for 30 days in accordance with FAR 6.305(d)(3).