R614--VISN 4 Shredding Services Contract

PERFORMANCE WORK STATEMENT VISN 4 Shredding Services SECTION 1.0 - INTRODUCTION 1.1 The Veterans Affairs Medical Centers (VAMC) in Veterans Integrated Network Services (VISN) 4 and their VA Community Clinics (VACC) campuses are looking for a qualified, experienced and dependable contractor that can provide on-site commercial destruction of private and sensitive patient information, confidential materials, and media destruction. VISN 4 consists of (9) facilities and a total of (46) subsidiary VACC campuses. The objective of this Performance Work Statement (PWS) is to describe the Contractor's technical support requirements for a contract to remove and destroy confidential documents generated at each location and will require various pick-up intervals ranging from weekly, bi-weekly, and monthly basis. The Contractor will need to provide a proper chain of custody, including electronic signatures and a certificate of destruction for every visit. The Contractor must be capable of providing

a truck to perform on-site shredding and media destruction for the following facilities and their subsidiary locations: FACILITY: ADDRESS: Altoona* 2907 Pleasant Valley Blvd. Altoona, PA 16602 Butler* 353 North Duffy Road Butler, PA 16001 Coatesville* 1400 Blackhorse Hill Road Coatesville, PA 19320 Erie* 135 E 38th Street Erie PA 16508 Lebanon* 1700 S. Lincoln Ave. Lebanon, PA 17042 Philadelphia* 3900 Woodland Ave. Philadelphia PA 19104-4551 Pittsburgh/University Drive* 4100 Aliquippa St, Pittsburgh, PA 15240 Wilkes-Barre* 1111 East End Blvd, Wilkes-Barre, PA 18711 *See below for a detailed description of all (40) VACC s locations, bin sizes, quantity of bins and frequency of pick-ups. Altoona Facility Name Address Media Bins Mini Console Standard Console 95 Gallon Totter Main Hospital Altoona 2907 Pleasant Valley Blvd. Altoona, PA 16602 1 Mini Console 0 60 1 VACC Johnstown 598 Galleria Drive, Johnstown, PA 15904 0 0 6 0 VACC DuBois 5690 Shaffer Road, DuBois, PA 15801 0 0 5 0 VACC State College 2581 Clyde Ave, State College, PA 16801 0 0 6 0    1 0 77 1 Butler Facility Name Address Media Bins Mini Console Standard Console 95 Gallon Totter Main Hospital Butler 353 North Duffy Road Butler, PA 16001 1 Mini Console 0 67 6 Main Hospital Butler 325 New Castle Road, Butler, PA 16001 0 0 26 2 VACC Armstrong County 11 Hilltop Plaza, Kittanning, PA 16201 0 0 4 0 VACC Clarion County 56 Clarion Plaza, Suite 115, Monroe Township, PA 16214 0 0 2 0 VACC Cranberry Township 900 Commonwealth Drive, Suite 900, Cranberry Township, PA 16066 0 0 2 0 VACC Lawrence County 1750 New Butler Road, New Castle, PA 16101 0 0 3 0 VACC Mercery County 295 North Kerrwood Drive, Suite 110, Hermitage, PA 16148 0 0 3 0    1 0 107 8 Coatesville Facility Name Address Media Bins Mini Console Standard Console 95 Gallon Totter Main Hospital Coatesville 1400 Blackhorse Hill Road Coatesville, PA 19320 1 Mini Console 0 112 14 VACC West Norriton 2495 General Armistead Ave. Norristown, Pa 19403 0 0 2 0 VACC Delaware County 4883 West Chester Pike, Newtown Square, PA 19073 0 0 2 0    1 0 116 14 Erie Facility Name Address Media Bins Mini Console Standard Console 95 Gallon Totter Main Hospital Erie 135 E 38th Street Erie PA 16508 1 Mini Console 72 41 0 VACC Venango 464 Allegheny Blvd, Franklin, PA 16323 0 0 3 0 VACC Crawford 16954 Conneaut Lake Rd, Meadville, PA 16335 0 0 5 0 VACC Warren 3 Farm Colony Drive., Warren, PA 16365 0 0 3 0 VACC Ashtabula 2044 Lambros Ln, Ashtabula, OH 44004 0 0 5 0    1 72 57 0 Lebanon Facility Name Address Media Bins Slim/Mini Console Standard Console 95 Gallon Totter Main Hospital Lebanon 1700 S. Lincoln Ave. Lebanon, PA 17042 12 Mini Consoles 20/10 112 10 VACC Berks 2762 Century Blvd, Wyomissing, PA 19610 0 0 7 0 VACC Lancaster 212 Willow Valley Lakes Dr, Willow Street, PA 17584 0 0 8 0 VACC York 2251 Eastern Blvd, York, PA 17402 0 0 7 0 VACC Cumberland 5070 Ritter Rd, Mechanicsburg, PA 17055 0 0 10 1    12 30 144 11 Philadelphia Facility Name Address Media Bins Mini Console Standard Console 65Gallon Main Hospital Philadelphia 3900 Woodland Ave. Philadelphia PA 19104-4551 20 Mini Console 0 140 8 CLC Philadelphia Nursing Home Care 3461 Civic Center Blvd, Philadelphia, PA 19104 0 0 10 0 VACC Gloucester County CBOC - Sewell, NJ 211 County House Rd, Sewell, NJ 08080 0 0 1 0 VACC Willow Grove CBOC - Horsham, PA 433 Caredean Dr, Horsham, PA 19044 0 0 1 0 VET CENTER VA Vet Center - Philadelphia 101 E Olney Ave, Philadelphia, PA 19120 0 0 1 0 VACC Camden, NJ CBOC 300 Broadway UNIT 103, Camden, NJ 08103 0 0 2 0 VACC Fort Dix, NJ CBOC 3000 Lincoln Dr E, Marlton, NJ 08053 0 0 4 0 OUPT Outpatient Dialysis Unit - Philadelphia 4219 Chestnut St, Philadelphia, PA 19104 0 0 2 0 VACC West Philadelphia 6232 Market Street Suite 100, Philadelphia, PA 19139 0 0 2 0  Multi Service Center - Philadelphia 213-217 North 4th St Philadelphia, PA 19213 0 0 2 0  Annex Bldg Suite 201 Philadelphia 4100 Chester Ave Suite 201 Philadelphia, PA 19104 0 0 1 1    20 0 166 9 Pittsburgh Facility Name Address Media Bins Mini Console Standard Console 95 Gallon Totter Main Hospital Pittsburgh/University Drive 4100 Allequippa St, Pittsburgh, PA 15240 1 0 6 33 Main Hospital H.J. Heinz/Aspinwall 1010 Delafield Rd, Pittsburgh, PA 15215 1 0 0 20 VACC Greentree Annex 875 Green Tree Road, Suite 3 Pittsburgh, PA 15220 0 0 0 1 VACC Bakery Square 6425 Penn Avenue, Suite 400 Pittsburgh, PA 15206 0 0 0 1 VACC Monroeville (Opening 3/30/23) 421 Mall Circle Drive, Monroeville, PA 15146 1 0 8 0    3 0 14 55 Wilkes-Barre Facility Name Address Media Bins Mini Console Standard Console 95 Gallon Totter Main Hospital Wilkes-Barre 1111 East End Blvd, Wilkes-Barre, PA 18711 1 (65 Gallon Totter) 0 0 39 VACC Sayre Outpatient Clinic 1537 Elmira St, Sayre, PA 18840 0 0 0 2 VACC Williamsport Outpatient Clinic 1705 Warren Ave # 304, Williamsport, PA 17701 0 0 0 2 VACC Allentown Outpatient Clinic 3110 Hamilton Blvd, Allentown, PA 18103 0 0 0 4    1 0 0 47 VISN 4 Totals Total Bins 41 102 681 145 Main-8 Subsidiary Locations-40 Total Bin Count: 967 SECTION 2.0 GENERAL REQUIREMENTS 2.1 This section outlines the general requirements under which the Contractor will be expected to perform. Any issues regarding the terms and conditions of this contract shall immediately be brought to the attention of the designated VA point of contact, Contracting Officer s Representative (COR)/Project Manager (PM) and Contracting Officer (CO). 2.2 Scope of Work 2.2.1 VA Medical Center staff and VACC campus staff are in the practice of putting all confidential materials (including white and mixed paper containing VA sensitive information, personally identifiable information (PII) and protected health information (PHI)) in locked consoles located throughout all of the medical center and it s VACC campuses. Types of paper that can be expected are office and computer paper of a variety of color, type, carbon, and size. Limited quantities of incidentals and media to be destroyed includes: paper clips, staples, rubber bands, plastic arm bands, folders, x ray file jackets, patient ID bracelets/wristbands (in accordance with VHA Directive 1650.06), patient ID cards, employee ID badges, CD s, VHS tapes, pharmacy ribbons, self-adhering prescription labels and other similar items can be expected. 2.2.2 The Contractor must provide secured Global Positioning System (GPS) tracked, truck/mobile unit specifically designed to shred sensitive/confidential documents and products through cross-cut shredding systems for on-site shredding and be capable of on-site media destruction. The Contractor shall transport interim destructed materials securely to their facility and ensure the materials are appropriately final destroyed, maintaining compliance with VA Directive 6371, Destruction of Temporary Paper Records, throughout the entire process. 2.2.3 Media Destruction: Types of media that can be expected are plastic arm bands, x ray file jackets, patient ID bracelets/wristbands (in accordance with VHA Directive 1650.06), patient ID cards/wristbands, employee ID badges, CD s, VHS tapes, pharmacy ribbons, self-adhering prescription labels and other similar items. If interim destruction of media is not reasonably practicable and temporary media has to be removed from VA custody for final destruction, the VA will require the contractor to sign a Certificate of Non-Paper Media Records Pickup. This must occur with the VA representative prior to departing the VA location with the acknowledgement receipt of the media. The contractor is to ensure that the information is reasonably safeguarded and securely transported to its final destruction location. The Contractor will complete final destruction of the media within 30 days of collection and must provide a Certificate of Destruction (Mentioned in section 5.5) proving that media was indeed destroyed. The Contractor is to coordinate with designated VA representative at each facility for media pickup. 2.2.4 The Contractor shall provide all labor, personnel, equipment, supervision, and other related services necessary to transport this information from the VA facilities. 2.2.5 The Contractor shall deliver and set up secure, tamper-proof, bar-coded consoles at the medical center and their VACC campuses within 10 business days after contract award and approval of the designated VA point of contact. The Contractor shall work with the facility s designated VA point of contact to coordinate bin placement to ensure a smooth transition and mitigate any lapse in service. The consoles shall have a slotted lid or front panel allowing multiple pages of paper to be discarded at one time and utilize a keyed lock to limit access. All containers will be key lock/key code and unique to each facility. The consoles shall be placed at the designated locations directed by the designated VA point of contact. 2.2.6 The Contractor shall use scanning and barcoding technology to ensure a secure chain of custody. This includes scanning each console at the time of pick up, utilizing electronic signatures that will provide date and time stamps to acknowledge service, scanning when arriving at the facility for final destruction and scanning once again at the time of destruction. 2.2.7 The Contractor shall provide a listing in electronic format, bi-annually (will be determined by designated POC after award) with the following information for each facility: Location Building number Room number Console size in gallon Poundage/amount of materials collected 2.2.8 The contractor will submit a consolidated invoice on a monthly basis. This invoice shall encompass the total amount billed, based on the total number of consoles serviced at all campuses throughout the entire month. The number of consoles picked up must match the number of consoles on the receipts of temporary records listed on paragraph 6.3 and Certificate of Destruction (COD). Due to special projects and the possible fluctuation of the quantity of bins, the monthly invoice total is expected to vary. 2.2.9 There are no current activations anticipated for VISN 4, other than what is mentioned in Attachment A. Still, the Contractor must be able to offer on-site shredding and media destruction services to any additional VACC campuses that may be activated in VISN 4 within the contract period. The Contractor may be asked to provide a quote/price for any new activation, which will be modified into the contract. 2.3 Contract Management 2.3.1 For the purpose of this contract, there is one facility designated VA point of contact located in each facility and one designee for each VACC location. The CO will issue the BPA Order(s) and the COR/Project Manager (PM) will initiate and monitor the Order(s) for all equipment and services. The designated VA point of contact will have full responsibility for day to day document destruction operations, including but not limited to invoice verification, approval and console relocations and deletions. The Contractor shall designate a Project Manager to interact with the designated VA point of contact and CO for prompt responses to any issues. 2.4 Service Frequency and Hours of Operation 2.4.1 The hours of operation for this contract shall be defined as 8:00am through 4:30pm, local time, Monday through Friday, except Federal holidays. The contractor should adhere to the frequency schedule below regarding regular servicing. The servicing can occur on any set business day (Monday through Friday) between the hours of 8:00AM and 3:30PM. 2.4.2 The Contractor and designated VA point of contact will negotiate the specific day of the week for reoccurring services once contract is awarded. This day should stay consistent, week to week and month to month, barring any unforeseen circumstances. 2.4.3 If needed, can be changed, upon agreement of both the medical center, campuses and the contractor in writing. After the schedule is established, the Contractor shall provide the designated VA point of contact a written schedule of when shredding will be picked up at each facility to include pick up days in-lieu of the holiday. 2.4.4 When a regular pick up day occurs on one of the Federal holidays listed below, the pickup day shall automatically shift to the following business day. The (11) national holidays observed by the Federal Government are: HOLIDAYS New Year s Day January 1 Martin Luther King Jr. Day Third Monday in January Presidents Day Third Monday in February Memorial Day Last Monday in May Juneteenth June 19th Independence Day July 4 Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day November 11 Thanksgiving Day Forth Thursday in November Christmas Day December 25 2.4.5 This list may also include any other day specifically declared by the President of the United States to be a national holiday. If a holiday falls on Sunday, the following Monday will be observed as the legal holiday. If a holiday falls on Saturday, the preceding Friday is observed as a legal holiday by U.S. Agencies. 2.4.6 Prior to any changes made to the pick-up schedule, the designated VA point of contact will notify the (CO) in writing of the revised schedule. A revised pick-up schedule will be provided to the contractor in writing along with the contract modification from the CO. SECTION 3 PHASE-OUT PLAN/INVOICES 3.1 Phase-out Plan Contractor shall have/provide a phase out plan. This plan shall describe the Contractor s methods and procedures to ensure smooth and uninterrupted service at expiration contract date. Contractor shall fully cooperate with the successor Contractor and the Government so as not to interfere with their work or duties. 3.2 Charges/Invoices Bid/Quote prices must include all charges. Additional fees or surcharges for fuel or other items must not be shown separately. No hidden charges allowed. SECTION 4 - SPECIFIC REQUIREMENTS 4.1 Console Descriptions and Quantities 4.1.1 Upon the award of this shredding contract, the Contractor shall provide and maintain locked, barcoded consoles to the Government and shall remain the sole property of the contractor. Bar codes should be placed inside the console door as to protect it from being tampered with and or wearing/tearing off. The Contractor is to make available the proper sized consoles required by each facility listed on Table 1 below. 4.1.2 The Contractor shall be responsible for placing and positioning all consoles in designated/required locations throughout the medical centers and at all the VACC s. 4.1.3 The sizes of bins will vary by location and can be changed out at any time through proper request, as stated in section 4.2. Equipment and installation, if needed, will be provided at no additional charges to all facilities for the life of the contract. 4.2 Quantities/Locations 4.2.1 During the course of the contract, the bin sizes, quantities, and locations are subject to change and will fluctuate as needs change at each medical center and VACC campuses. The designated VA point of contact shall notify the Contractor in writing, of location changes, bin size change, removing consoles, and adding additional consoles. The Contractor will have up to (10) business days to deliver these consoles upon receiving the request. The designated VA point of contact will maintain a spreadsheet of console locations, and the parties agree that this list will be definitive of what service is to be performed from the time the list is published until expiration of the contract period of performance or publication of a revised list. The price per event of servicing each console will remain constant. 4.2.2 The designated VA point of contact will provide a location list of consoles to be serviced, and or other materials for destruction. Contractor staff will be responsible for performing the work of placing the bins in locations throughout the medical center and VACC s. Table 1: EQUIPMENT DIMENSIONS- *Dimensions of console will vary, but shall be similar to what the facilities requires ACCESSORIES/FEATURES BAR CODED ,LOCKED OFFICE CONSOLES,FRONT LOADED, LONG CLOTH BAG OR BOX TO GO INSIDE CONSOLES Standard Size: 35"H x 17"D x 19" W 35 H x 19 D x 19 W 36 H x 16 D x 20.5 W 40 H x 19 D x 19 W 42 H x 26 D x 25 W DOUBLE-TURN LOCK. PAPER DEFLECTOR TO INCREASE SECURITY TO PREVENT ANTI-FISHING. ONE KEY SOLUTION. BAR CODED ,LOCKED OFFICE CONSOLES,FRONT LOADED, LONG CLOTH BAG OR BOX TO GO INSIDE CONSOLES Mini Size: 24 H x 16 D x 16 D 26 H x 19 5/8 D x 20 Â1⁄4 D 27 H x 16 D x 19 W 28.5 H x 19 D x 19 W 30 H x 11"D x 20"W DOUBLE-TURN LOCK. PAPER DEFLECTOR TO INCREASE SECURITY TO PREVENT ANTI-FISHING. ONE KEY SOLUTION BAR CODED, LOCKED SLIM LINE CONTAINERS, TOP LOADED Slim Jim 23 Gallon: 30" H x 13.5"D x 24.25"W REMOVABLE LIDS, EASY EMPTYING, NO BAGS NEEDED. ONE KEY SOLUTION. HOLDS UP TO 60 LBS. OF PAPER BAR CODED, LOCKED TOTES TOP LOADED 65 Gallon Totter: 46 H x 27.5 D x 24.5 W 95 Gallon Totter: 46"H x 34"D x 26"W MULTIPLE SECURITY LOCK OPTION: BARREL LOCK AND PADLOCK HASP. 10 HEAVY DUTY, WITH WHEELS FOR EASY ROLLING, QUIET CAP WHEELS ARE FULLY INSET TO ELIMINATE DAMAGE TO HALLWAYS AND DOORWAYS AND REDUCE NOISE LEVELS. KEYS THREE SETS -- SHOULD BE UNIQUE TO EACH FACILITY, ONE SET FOR PRIVACY OFFICER, ONE SET FOR VA SECURITY/POLICE AND ONE SET FOR DESIGNATED VA POINT OF CONTACT 4.3 Extra Consoles 4.3.1 Occasions may arise where a facility needs extra bins for special projects (i.e. a temporary or one-time removal of large amounts of documents). In the event a special project arises, the contractor shall have the capability to accommodate the facility (s). The firm fixed rates for all bins and consoles captured in the B.3 Price Schedule shall be used to calculate special project total. 4.3.2 The Contractor is to provide each facility and VACC s an extra 65- or 95-gallon totter in case of overflowing in the event that bins are missed, and the problem becomes a security violation. The VA staff will utilize the extra totter to remove overflowing materials until the situation is resolved as stated in 7.2.2. 4.3.3 In the event that additional services or consoles are needed, the CO is the only government staff member responsible for requesting changes with the contractor. All changes must be documented in writing. Once the designated VA point of contact requests and CO authorizes the request for additional service, the contractor will be notified of the request and at that point, can complete it within 10 business days. Any requests the contractor completes outside of the knowledge and approval from the CO will be considered unapproved. The VA will not reimburse the contractor for any unapproved requests or services. 4.4 Management of Consoles 4.4.1 The consoles shall always be kept locked to ensure the protection of the confidential materials enclosed. In the event VA staff identifies a console that is unlocked, they will need to notify the designated VA point of contact to use his/her master set of keys to lock the bin and notify the contractor. If there are reported instances of the Contractor leaving consoles unlocked after servicing, the Contractor will need to formally address this non-compliance with VA staff, and provide documentation of the remediation efforts to the designated VA point of contact, COR/PM, and CO. This is also addressed in the QASP. SECTION 5.0 - SHREDDING SPECIFICATIONS 5.1 The Contractor shall provide shredding documents and media destruction services for all secure materials that are collected in the locked consoles. The Contractor will shred/destroy paper and media material in accordance with VA Directive 6371. This directive requires that final destruction of paper records is pulped, macerated, or shredded, to a degree that ensures that they are not readable or re-constructible to any degree. 5.2 Interim Destruction 5.2.1 The interim destruction of records is proper for ensuring their security when transportation is necessary for final destruction. Interim destruction of these records shall take place at the VA facility. This destruction must be to the degree that the information contained on them is not readable and not reconstruct-able without extraordinary effort. Destroy paper using crosscut shredders which produce particles that are 1 mm x 5 mm (0.04in x 0.2 in.) in size (or smaller) or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4) security screen. 5.2.2 If interim destruction is not carried out by VA employees, it must be carried by an insured bonded contractor, subcontractor, or third party that satisfies all of the standards outlined in the VA Directive 6371 Appendix A. 5.2.3 Methods of interim destruction carried out by a contractor must be witnessed by a Federal employee or, if authorized by the organization that created the records, a contractor employee may act as witness, and the written attestation shall be submitted to the organization that created the records. The contractor employee may be the vendor performing the interim destruction as long as a certification of destruction is provided to VA. 5.3 Final Destruction 5.3.1 Although lesser destruction measures may be taken prior to the secure transport of paper records, final destruction of the records must ensure that the information on the record is not readable or reconstruct able. 5.3.2 The pulverized material will be of a screen size (max) 2-inch diameter holes. If final destruction is not carried out by VA employees, the final destruction must be witnessed by a VA employee or, if authorized by the organization that created the records, a contractor employee may serve as witness. 5.3.3 As with interim destruction, if final destruction is not carried out by VA employees it must be carried by an insured contractor, subcontractor, or third party that satisfies all of the standards outlined in the VA Directive 6371 Appendix A. 5.3.4 If the final destruction is witnessed by a contractor, it must be attested in writing, and the attestation must be submitted to the organization that created the records. 5.4 Certifications 5.4.1 Awarded contractor does not have to be National Association for Information Destruction (NAID) but will still need to establish minimum standards according to Appendix A, Implementation Procedures, in VA Directive 6371: 7. If interim destruction is reasonably practicable and is not carried out by VA employees, it must be carried out by either: A National Association for Information Destruction (NAID) certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction who has contracted to provide sufficient reasonable safeguards to protect the temporary paper records until final destruction has been completed; or A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in this Appendix. 5.5 Certificate of Destruction 5.5.1 A written documentation known as a Certificate of Destruction (COD) shall be provided by the Contractor. Certification of destruction documentation can be in the form of a letter, memo, or any format attesting to its complete destruction. The documentation should contain sufficient information to attest to the final destruction of the temporary paper records including: What temporary records were destroyed, Date when they were destroyed (i.e. shredding, pulping, incineration) What destruction method was used (address of plant) Where they were destroyed (company name) Who was responsible for their final destruction The weight (in pounds) of confidential material destroyed for that month 5.5.2 The certificate should not be provided to VA until after destruction sufficient to meet the stands of VA Directive 6371 has taken place. The certificate should clearly document that final destruction has been (past tense) completed and should identify the material in a manner that would allow VA to have a record of what data has been destroyed (e.g. (16) 36 gallon containers picked up on January 15, 2021). This shall correspond with the notification of volume picked up. 5.5.3 The certificate should be signed and dated by the prime vendor, regardless of who is actually completing final destruction: The prime contractor may only be conducting an interim process such as shredding that does not make the material unreadable and not reconstruct-able The prime contractor would still be responsible for certifying final destruction by their subcontractor or downstream vendor, who may be pulping or macerating, etc. The downstream vendor is not expected to produce a certificate SECTION 6.0 - CONTRACTOR PERFORMANCE 6.1 Performance 6.1.1 Upon arrival at each location, the Contractor shall have their service technicians check in with the designated VA point of contact prior to beginning work and check out on completion of the work. 6.1.2 If collection bins must be left in the hallway briefly while servicing, the bins must be locked and within sight distance of contract staff. Consoles are not to be left unattended outside, in hallways, or other areas. 6.1.3 The Contractor shall be responsible for the ongoing condition and aesthetic appeal/acceptance of Contractor equipment used at the VA Medical Centers and its subsidiary facilities. Contractor will not use plastic bags to collect items from consoles. 6.1.4 The Contractor shall provide sufficient labor and equipment necessary to transport collection containers form the indoor environment to an outdoor designated location. 6.1.5 The Contractor shall ensure each locked container remains locked until it arrives at the shredding location. They shall only be unlocked to transfer documents. 6.1.7 The Contractor shall make sure the confidential documents are protected from wind gusts and other atmospheric conditions. 6.1.8 The Contractor shall ensure all locations are treated the same for pickup, cut and shred size. 6.1.8 The Contractor shall not reveal, divulge, or disseminate any oral or written information obtained. 6.1.9 All sensitive documents/material, regardless of classification, is protected from unauthorized viewing and is destroyed properly by shredding and or pulverizing. 6.1.10 All shredding consoles are to be emptied at each pickup, no matter the amount of material in the consoles. 6.1.11 Contracting staff are not to make a judgment call as to whether the console should be emptied. 6.1.12 The Contractor shall be responsible for disposing by recycling all shredded material offsite at their own expense. 6.1.13 If any area is locked and not accessible, contracting staff are to make a reasonable effort to gain entrance by contacting staff in offices near the location. A reasonable attempt will be considered going to at least two offices with employees present near the locked area. If an area has continuous issues being accessed, the shredding company and Privacy Officer(s) will need to resolve the issue. 6.2 On-Site Service Receipt 6.2.1 After each service, the Contractor shall provide a consolidated summary receipt stating the number of consoles that were collected at the time of service. This serves as a documentation acknowledging the receipt of the temporary records, to the designated VA representative the COR/PM identifies at each campus. The documentation shall be provided to the designated VA representative prior to leaving the facilities. Document shall be on company letter head and include: Date of service Location of each console serviced Timestamp of each console serviced Name of the campus serviced Name of the Contractor/subcontractor/third party accepting receipt of records Comments explaining any issues Signed by both the contracted service technician and designated VA representative 6.2.2 This documentation is required per VA Directive 6371 and is critical for privacy and information security matters. If the Contractor does not provide this documentation to the designated representatives on the day of servicing before leaving the campus, the designated VA point of contact is unable to establish appropriate custody of the sensitive documents. Therefore, the Certifying Official will not be able to certify invoices for the bins serviced that day, as the facility will be noncompliant with VA Directive 6371. This is a zero-tolerance matter. The receipt of temporary records must be provided before the Contractor leaves the campus. 6.3 Accountability Spreadsheet/Checklist 6.3.1 Once the contract is awarded the designated VA point of contact and contracted service technician will combine efforts to maintain a spreadsheet/checklist verifying console locations to be serviced. The purpose of this spreadsheet/checklist is to provide issue awareness and to prevent missed consoles. The Contractor service employees are responsible for familiarizing themselves with the layout of the VA facilities and report any issues shall bins become missing. 6.3.2 Any discrepancy from the consoles listed on the spreadsheet shall be noted by the Contractor s employee on the onsite service slip stated above in section 6.3.1, and designated VA point of contact shall be notified at check out. 6.4 Incident Notification 6.4.1 The Contractor shall notify the designated VA point of contact/COR/PM immediately (within 24 hours) after discovery of any incident which may potentially be a data breach. Per the methodology specified by the Department of Health and Human Services (HHS) in guidance issued under §13402(h)(2) of the Health Information Technology for Economic and Clinical Health(HITECH) Act, the Contractor s notice shall include the identification of each individual whose unsecured protected health information has been, or is reasonably believed by the contractor to have been, accessed, acquired, or disclosed during such breach. 6.4.2 The Contractor will coordinate with the designated VA point of contact and Privacy Officers to the extent necessary to help remediate any issues related to data breaches that occur once the contractor officially maintained possession of the temporary paper records. 6.5 Contractor Vehicles 6.5.1 All contractor vehicles utilized in the performance of this contract shall maintain liability insurance (at least the minimum coverage required by the state where the vehicle is registered). The Contractor shall maintain current state vehicle registration for the duration of the contract, and for following all pertinent federal and state regulations regarding transportation and destruction of classified medical documentation. 6.5.2 All contractor employees shall possess a valid state driver s license and have a clean driving record. The Contractor and its employees shall not use personal vehicles to transport containers to and from the government and contractor site while performing under this contract. 6.5.3 The Contractor shall ensure that all contractor vehicles used in connection with this contract are kept in proper working condition. The contractor vehicles shall always be locked and properly secured while at the government site or travelling to and from contractor site(s). Vehicles used in the performance of the contract shall not be left unattended and unlocked at any time while transporting sensitive information. 6.5.4 Contractor shall allow for on-site vehicle inspection of shredded media for compliance of VA Policy. 6.6 Quality of Work 6.6.1 Service technicians will collect confidential material from locked consoles, bins and totes. Types of paper that can be expected are office and computer paper of a variety of color, type, carbon, and size. Limited quantities of incidentals such as paper clips, staples, rubber bands, plastic arm bands, folders, x ray file jackets, patient ID bracelets, patient ID cards/wristbands, pharmacy ribbons CD s , VHS tapes and self-adhering prescription labels and other similar items can be expected. VA staff will not be expected to remove all these items prior to placing in shredding consoles. 6.6.2 The confidential material gets placed into 95-gallon totes; the mobile tote, when full, is transported to shredding truck, tote is mechanically lifted and emptied, and confidential/sensitive material is destroyed (pierce and tear). Destroy paper using crosscut shredders which produce particles that are 1 mm x 5 mm (0.04in x 0.2 in.) in size (or smaller) or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4) security screen. 6.7 Contractor Supplies, Equipment, Furnishings and Keys 6.7.1 Initial orientation to the medical center and VACC s will be done by the designated VA point of contact and Privacy Officer. 6.7.2 Contractor must furnish all material, equipment and supplies for full-service shredding contract. 6.7.3 Contractor shall be responsible for placing and installing consoles, bins, and totes in the required locations. 6.7.4 The locations for receptacles are subject to change Contractor must furnish all consoles, cloth bags/box inserts, slim line containers, locked totes, and keys. 6.7.5 All receptacles shall be of excellent quality and shall be free of defects that would diminish the appearance of collection containers or render containers structurally or operationally unsound. 6.7.6 Contractor must provide suitable, barcoded, locked, covered receptacles and long cloth bags/box insert. 6.7.8 All accessed areas, equipment, furniture, items, etcetera moved during services are returned to original location and their original state. 6.7.9 Three sets of keys unique to each facility and it s VACC s to shredding consoles will be given to the designated VA point of contact to distribute to authorized VA appointed officials. 6.7.10 All supplies, equipment and keys are supplied at no cost to the VA Medical Center facilities. SECTION 7.0 - CONTRACTOR MONITORING AND ADMINISTRATION 7.1 Quality Control 7.1.1 The contractor shall develop and maintain quality programs to ensure recycling services are performed in accordance with commonly accepted commercial practices and comply with VA requirements. 7.1.2 The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. 7.1.3 At a minimum, the contractor shall develop quality control procedures addressing the areas where the Acceptable Quality Level was not met and how corrective action will be taken. 7.2 Contingency Plan 7.2.1 Contractor must provide notice in writing of their contingency plan in the event of equipment failure, truck break down, inclement weather conditions or unplanned events. Contractor must provide a written notice 24 hours prior to any planned event (i.e. Observed Holidays) with their contingency plan. Contractor shall go over service calendar to ensure that all Observed Holidays have a contingency plan if it falls on a service day. Neither planned nor unplanned events should place the burden on the facilities for accommodating full bins. 7.2.2 In the event a discrepancy arises in which VA staff advise a bin was not emptied for the week the Contractor will have 48 hours to come back and service that particular bin and will work with the designated VA point of contact to resolve the matter. If consoles are repeatedly missed or forgotten 3 or more times, the contractor will need to formally address this noncompliance with designated VA point of contact, COR/PM, and CO to provide documentation of these remediation efforts. Contractor is to come up with contingency plan for the following: ISSUE CONTRACTOR RESOLUTION SHREDDING TRUCK IS BROKEN DOWN AND UNAVAILABLE FOR SHREDDING AT VA FACILITIES/VACC BAD WEATHER/INCLEMENT WEATHER VENDOR MISSED SHRED BINS 7.3 Contracted Service Technicians 7.3.1 The Contractor shall have in their employ and/or under their control, enough qualified and competent personnel to perform shredding services in accordance with NAID regulations. Contractor is to provide uniformed personnel, trained, licensed, and bonded service technicians to perform full shredding service. 7.3.2 Background Investigation- All contracted employees will have background investigations before entering the premises for duty. The Privacy Officer(s) and Information Security Officers will be given a copy before that employee may start to work. Process in place for PO and ISO to know before new employees coming had investigations. The level of background investigation commensurate with the required level of access is National Agency Check and Inquiries (NACI) with written inquires. The contractor will be responsible for the expense of all background investigations. The website that provides information on the cost of background investigations is www.opm.gov\extra\investigate - Select Federal Investigations Notices-(FIN 01-0) The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain U.S. citizenship and are able to read, speak, and understand the English language. The contractor shall provide the screening results to the designated VA point of contact prior to award and anytime new employees are hired. No service technician will be allowed to work on this contract without providing proof of NACI security check (NCHC, National Criminal History Check) performed by the VSC Security through the VA Medical Center. Upon receipt of the NCHC, contract employees will be required to fulfill remaining security requirements for background investigations. All contracted service technicians shall report to the designated VA point of contact for coordination of badging and fingerprinting at the Personal Identity Verification (PIV) Office. The Risk or sensitivity level has been designated as Moderate with a corresponding investigation level of Tier 3. 7.3.3 Privacy Information Security Training All contractor staff must complete VA Privacy and Information Security Awareness and Rules of Behavior and Privacy and HIPAA Focused Training in Talent Management System (TMS) (https://www.tms.va.gov/) in addition to signing the National Rules of Behavior. Training will need to be done prior to the performance of the contract and annually thereafter. Contracting staff must use the Self Enrollment method to complete course numbers 10176 and 10203 before they will be allowed to work and have access to any PHI/PII. Contractor staff being delinquent will not be allowed access to the facility or VACC s to make collections. If background investigations are required, paperwork needed for that will also be completed at that time. If training requirements change, contractor staff will be 14 days to become compliant. The designated VA point of contact must ensure that all contractors are validated in the PIH domain. Proof of training completion must be verified and tracked by the designated VA point of contact. A BAA will be required. Contractor shall provide and maintain a current spreadsheet of employees performing under this contract. It is the Contractor s responsibility to know the expiration dates for all their employees and to act BEFORE it expires. The list shall include employee s name, address, phone number, security badge and Privacy Training expiration dates as to not expire while the contract is in place. The Contractor shall have service technicians report to the designated VA point of contact (2) months in advance before expiration of badge and Privacy Training to fill out necessary paperwork for renewal. The Contractor shall not send any contracting staff with expired Privacy Information Security training and or expired badge to perform pick-ups from ANY VA facility. The Contractor will inform and show proof of training completion/badge renewal to the designated VA point of contact when the training or badge has been renewed before the contracted employee is able to come on site. 7.3.4 The Contractor shall furnish all contracted service technicians, equipment, and tools necessary to perform the work defined in this contract. All equipment must comply with all applicable safety standards, including OSHA. Apart from the contractor's paper collection bins, no equipment or tools will be left on the VA Medical Center premises. 7.3.5 All contracted service technicians shall: Be capable of performing at an effective level in accordance with specifications and industry standards. Perform in a workmanlike manner and in compliance with all federal, state, and local laws and codes. Be required to provide service with a minimum of prompting or direction from the designated VA point of contact. Check-in with designated VA point of contact prior to starting and after all work/shredding service has been completed. Ensure that all contents of totes remain inside totes during transport to shredding vehicle or picked up immediately when sensitive material mistakenly falls out of totes. Ensure that no totes or sensitive material is left unattended and one person is present during shredding operations at the shredding hopper/vehicle to ensure that no sensitive material mistakenly falls out of tote or is blown away by the wind. If sensitive material falls out of tote and/or hopper technician will retrieve sensitive material immediately and shred accordingly. Be ready to interrupt their work at any time so as not to interfere with the normal functioning at any facility, including utility services, fire protection systems, passing of facility patients, personnel, equipment, and carts. Be prohibited from possessing weapons, firearms, or ammunitions on themselves or their contractor-owned or privately owned vehicle on VA property. Display VA Contractor s badges while performing requirements of contract; badges shall be worn above the waist at all time while on facility grounds and at VACC s. 7.3.6 In the event that the designated VA point of contact deems it necessary to have a contracted employee dismissed from further performance under this contract for reasons of their moral character, unethical conduct, security reasons, and violation of building rules, the contractor will bear all costs associated. 7.4 Supervision 7.4.1 In the beginning of contract and/or when a new contract employee starts the Contractor shall provide onsite supervision to inspect work, assure all safety and security precautions are met and expectations are fulfilled. 7.5 Conduct 7.5.1 The Contractor is always fully responsible for the conduct of his/her employees while performing under this shredding contract. The Contractor shall not allow any employee to perform work under the influence of alcohol, drugs, or any other incapacitating agent. VA Police have the right to deny entry to the Medical Center or remove from the facility any contractor employee for misconduct that endangers the health and/or safety of people at the facilities and VACC s. 7.4 Smoke Free Facility 7.4.1 The VA facilities is a non-smoking facility, at no time shall the Contractor or its employees smoke on VA grounds. 7.5 Non-Disclosure of Sensitive Information 7.5.1 Contractor staff/employees involved with this shredding contract will have access to some privileged and confidential material of the US Government. These printed documents are for internal use only and remain the sole property of the VAMC and VACC s. Some of the materials are protected by Privacy Act of 1974 and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials, by any contractor or subcontracted staff, is a criminal offense. The Contractor is responsible for actions of contract employees. 7.6 Inspections 7.6.1 Representatives of the Government (COR/PM, designated VA point of contact, VA Police, Safety Officer, Privacy Officer, Information Security Office, Records Manager and Associate Director) shall have the right to inspect the contractor s and/or subcontractor s facilities, vehicles, equipment and operations provided for the performance of work/shredding services under this agreement/contract. Contractor is to provide samples of the shredding particles to the designated VA point of contact or Privacy Officer as requested and will be required on a quarterly basis. 7.7 Quality Assurance 7.7.1 Government officials (designated VA point of contact, VA Police, etc.) will receive and investigate complaints from various customers located at the VA facilities and VACC s. All information received will be provided verbally and/or in writing to the contractor for appropriate action. 7.8 Substandard Work 7.8.1 The Contractor employee has the responsibility to correct any substandard work/discrepancies as requested by the COR/PM and designated VA point of contact 7.9 Reassignments 7.9.1 The Contractor shall utilize, on this shredding contract, only workers that are skilled in the tasks to which they are assigned. The VA retain the right to require the reassignment of an employee or employees as they may deem necessary. Reasons for this request may be, but are not limited to poor work performance, incompetence, carelessness, disruptive or otherwise objectionable behavior. The request for reassignment is in no way a call for dismissal. It is just a request for the individual to be reassigned away from the facilities and VACC s. 7.10 Uniforms/Identification 7.10.1 All company workers while on duty at the facilities or VACC s shall be identified by uniform shirt, blouse or smock indicating the company name or logo in print large enough to be easily read. In addition, all contracting staff assigned to provide shredding services at the facilities or VACC s shall be easily contacted using a cell phone. 7.11 Occupant Safety 7.11.1 Work shall be done in a safe manner and be of little disruption for all VA staff, patients, and visitors throughout the facilities and at all the VACC s. Engine to shredding truck is to be turned off/shut down during on-site shredding. Truck cab should always be locked when unoccupied. 7.12 Safety Plan 7.12.1 Contractor shall have a documented and comprehensive Health and Safety program to ensure all shredding activities are provided in a safe and secure manor. The Contractor shall provide a safety plan and copy of safety manual prior to starting any work/service. Occupational Safety and Health Administration (OSHA) requires all companies and corporations to have a printed safety manual. 7.13 Parking of Shredding Truck 7.13.1 It is the responsibility of the Contractor s personnel to park in the appropriate designated parking areas. Parking information shall be coordinated with the designated VA point of contact. Cab shall remain locked when unoccupied and engine turned off. (PENNDOT Regulation). 7.14 Traffic Laws 7.14.1 The contractor and its employees shall comply with all VA traffic laws. The VA does not validate or make reimbursements for parking violations under any circumstance. SECTION 8 - SECURITY CONSIDERATION 8.1 All Contractors shall comply with physical security policies. A compliant ID badge must always be worn by contracting employees while on VA premises. Contractor may not have access to the VA network. 8.2 Access to VA Information and VA Information Systems 8.2.1 A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. 8.2.2 All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. 8.3 VA Information Custodial Language 8.3.1 Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. 8.4 Security Incident Investigation 8.4.1 The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the designated VA point of contact and simultaneously, the COR/PM, designated Information Security Officer (ISO) and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. 8.4.2 In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other Compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. 8.5 ISO/PO Comments The COR is responsible for ensuring that all Contractors comply with physical security policies. A compliant ID badge must be worn by Contractors at all times while on VA premises. Contractor may not have access to the VA network. The following language is required from VA Handbook 6500.6: Appendix C: Paragraphs #2a, b, e, #3a, c, d, e, f, j, k, #6a, b, #7(all), #9(all) (SEE SECTION D) Contractor must complete VA Privacy and Information Security Awareness and Rules of Behavior and Privacy and HIPAA Focused Training courses prior to the performance of the contract and annually thereafter. Training must be completed in VA s TMS system (https://www.tms.va.gov/). Contractors must use the TMS Managed Self Enrollment method to complete the training in TMS. Proof of training completion must be verified and tracked by the COR.