Attachment_A_-_Statement_of_Work_03.17.2017.doc

ATTACHMENT A

ATTACHMENT A

Statement of Work for

U.S. Immigration and Customs Enforcement Medical, and Drug Testing Services for One-Stop Hiring Events for Homeland Security Investigations March 17, 2017 Statement of Work Medical and Drug Testing Services

1) Introduction

a) The primary mission of the U.S. Department of Homeland Security (DHS) is to lead the unified national effort to secure the country and preserve our freedoms. While the Department was created to secure our country against those who seek to disrupt the American way of life, our charter also includes preparation for and response to all hazards and disasters. U.S. Immigration and Customs Enforcement (ICE) is responsible for the protection of the security of the American people and homeland by vigilantly enforcing the nation's immigration and custom laws.

b) This Statement of Work (SOW) encompasses the pre-employment medical and drug screening services for Immigration and Customs Enforcement, Homeland Security Investigations (HSI) Criminal Investigator (CI) applicants at three individual one-stop hiring events being held at the following locations, New York, NY; Las Vegas, NV; and San Antonio, TX. The pre-employment medical services will include the applicant’s medical screening, performance assessment, and drug testing in accordance with U.S. Department of Health and Human Services (HHS) regulations. The contractor will capture the information and results utilizing their proprietary web-based software.

2) Authority

a) The following authorities affect the services the contractor shall deliver under this SOW. To process pre-employment medical and drug testing in an expedited process to support the onboarding of 500 vacant entry level Criminal Investigator positions through multiple one-stop processing events.

b) Reduce the pre-employment process by conducting three separate one-stop events nationwide in the following cities, New York, NY; Las Vegas, NV; and San Antonio, TX during the months of April and May 2017. It is anticipated that the results from each one-stop should be available within 7-14 business days after evaluations are completed, which would allow applicants to complete all pre-employment process requirements to Enter on Duty (EOD) on or before 30 September 2017.

3) Pre-Employment Medical Services

a) Description

i) Federal agencies are responsible for ensuring that their employees are fully qualified to safely and efficiently perform the essential duties of their respective positions. In law enforcement and other safety sensitive areas, this mandate takes on extraordinary significance in that certain positions require the employee to engage in activities that are strenuous, hazardous, and carry a high degree of responsibility to the public. These areas are generally, weapon carrying positions. Due to this and in accordance with 5 CFR 339, Federal agencies have the authority to require:

ii) Applicants undergo a pre-employment medical examination and provide specific documentation related to their medical histories; and

iii) Employees demonstrate their continued medical suitability for the position based on previously established medical guidelines, physical requirements, and critical tasks specific to each position.

4) Pre-employment Medical Examinations

a) With the task order and this guidance set forth in this SOW, the contractor will conduct approximately 600 medical and drug screenings to fill 500 vacant entry level Criminal Investigative position by establishing a one-stop processing center in each of the following cities; New York, NY; San Antonio, TX; and Las Vegas, NV during the month of April and May 2017.

5) Pre-Employment Examination Process

a) Medical examinations performed under the auspices of the SOW must be consistent with established medical guidelines for weapon-carrying positions. Specifically, the medical screening must include a thorough assessment of the applicant’s medical history and must determine the following:

i) The applicant’s current and forecasted future medical suitability for fulfilling the duties of the advertised positions;

ii) Whether the individual has a history of a particular medical problem in which recurrence cannot be medically ruled out;

iii) The etiology of any disease or condition;

iv) The level/degree of stability of an existing or past disease/condition;

v) The level/degree of severity of conditions identified, and

vi) The existence and extent of any current concern that is not identified in history, but which may be present during the exam.

b) Forms to be used in the recording of the medical history and examination’s physical findings have been developed by the Office of Personnel Management (OPM) and will be utilized for examination purposes. OHC will send a fillable electronic medical history and examination form to each applicant prior to each one-stop. OHC will provide the contractor with a blank medical history and examination form. The contractor will be responsible to provide a hard copy form to any applicant on site who did not to fill out a form and bring to the one-stop.

c) These forms also serve as guidelines as to what information is salient to the exam process and include guidelines for the measurement of:

i) Vital Signs

ii) Height/Weight

iii) Vision

iv) Corrected and uncorrected visual acuity (near and distant)

v) Peripheral vision

vi) Visual depth perception

vii) Color vision per Ishihara Color Vision Test or in the alternative Farnsworth D-15

viii) Pure tone audiometry (500; 1,000; 2,000; 3,000; 4,000; 6,000; 8,000 frequencies)

(1) Contractor will be provided a testing room at the venue to conduct the hearing test in lieu of a testing booth. If the contractor discovers the room is not suitable for the hearing test, immediately contact an OHC employee on-site with your concerns.

i) A PPD tuberculosis skin test will be used in order to obtain results on site.

(1) The Primary Reviewing Physician must sign all positive tuberculosis skin test results form. Contractor will inform all applicants who have a positive tuberculosis skin test to schedule a follow-up appointment with their personal physician and have a chest x-ray exam completed with results sent to:

Entry Level Hiring Unit (PEC) Dallas Service Center

Immigration and Customs Enforcement (ICE)

7701Stemmons Freeway

Dallas, TX 75247

d) An EKG will be conducted on-site. Upon interpretation and review of the twelve lead EKG test, the Primary Reviewing Physician must sign or otherwise initial the EKG.

6) A medical conclusion/recommendation process for Pre-Employment Medical Services.

a) After performing an assessment of the applicant’s medical history and a comprehensive systematic examination, the examining physician shall complete a summary of the findings in order to establish the applicant’s health status and the stability of the condition(s) identified.

b) The examining physician shall refrain from making any recommendation verbally or in writing to the individual regarding the individual’s medical suitability for the position. Rather, the examining physician shall forward the exam/history data to the Contractor’s Primary Reviewing Physicians.

c) The Contractor’s Primary Reviewing Physicians shall possess an understanding of the stressors and responsibilities of the Criminal Investigator position and shall be thoroughly knowledgeable of the medically established guidelines for the position. Upon review of the information obtained from the applicant pre-employment medical examination, the Contractor’s Primary Reviewing Physicians shall determine whether the individual meets the medical requirements of the position.

d) Contractor’s Primary Reviewing Physicians shall be responsible for:

i) Reviewing all medical history and examination records and ensuring their completeness.

ii) Ensuring that the information obtained from the medical examination, the medical findings, conclusions, and recommendations are consistent with generally accepted professional guidelines.

iii) Ensuring that the examination procedures and methods for reporting the information are uniform.

iv) Provide an opinion as to the applicant’s medical suitability for the position including a description of current health status, stability of condition, and the rationale for the decision. This recommendation shall be typed in narrative form and shall indicate exactly what documentation was reviewed prior to reaching the decision. The individual typed suitability document will be signed by the reviewing doctor and submitted to agency within (7-14) working days from the date of the one-stop exam by uploading into proprietary electronic system. If the results of the medical exam do not clearly support the applicant’s suitability for the position, the Primary Reviewing Physician’s opinion shall specify what additional medical documentation is needed to clarify the status of a particular medical condition(s).

7) Scope of Work/Type of Task Order

a) The guidance set forth in this SOW is to conduct approximately 600 medical and drug screenings to assist in filling up to 500 vacant entry level criminal investigator position within HSI by conducting one-stop hiring event at processing center in New York, NY; San Antonio, TX, and Las Vegas, NV during the month of April and May 2017. The processing center will be hosted at a hotel setting.

b) This task order will be awarded at one fixed price for up to 600 applicants, cumulative, the three locations listed above. All costs will be included in the fixed price to include on-site labor, equipment, supplies, shipping, drug test collections, drug test lab analysis, TB Bloodwork Lab Analysis and any other direct costs incurred by the contractor.

8) TASKS & DELIVERABLES

New York, NY

San Antonio, TX

Las Vegas, NV

a) The Contractor will need to be able to render services during the timeframes identified above to conduct one-stop event during the following dates and times: Dates provided above and are subject to change to a later time frame but not sooner. Exact venues will be provided as soon as possible after contract is awarded.

b) Each day there will be approximately 40-50 applicants processed through an individual one-stop location.

c) OHC-Dallas will inform each applicant the date and time they will be expected to attend a one-stop after the applicant selects a one-stop location. OHC will not schedule more than 55 applicants each day. The last applicant will be scheduled to arrive no later than 2:00 pm local time.

d) There will not be an exact flow to the process. Staff may have the applicant start the process and/or move the applicant during the process to one of the three main stations (medical, security or interview) in order to maintain an efficient flow.

e) This task order will be awarded at one fixed price for up to 600 applicants, cumulative, for the three locations listed above. All costs will be included in the fixed price to include, on-site labor, equipment, supplies, shipping, drug test collections, drug test lab analysis, TB bloodwork lab analysis and any other direct costs incurred by the contractor. Furnish all personnel and any additional equipment needed for screening during each event to include but not limited to pipes, drapes, clipboards, computers, printers, etc. Internet may not be available at the venue therefore contractor may need to be provide their own.

f) Perform administrative, medical and drug services in accordance with (IAW) all contract requirement(s) set forth in this statement of work (SOW) and contract task order SOW.

g) Input test results into proprietary system as follows:

i) Blood test will be used for the PPD test

ii) Drug results within 2 business days of actual test Within eight (8) working days input results and or needed follow-up items that an applicant may need into proprietary electronic system. Upload the individual typed suitability document signed by the reviewing doctor within (7-14) into proprietary electronic system.

Pre-Employment Medical Test

Drug Testing Services

h) PDF or Microsoft Word file are acceptable electronic deliverables; however that is not the case for spreadsheets. For purposes of the timelines specified in this SOW are defined as if the request is made before noon the first working day is the day of the request and if the request is made after noon the first working day will be the next working day.

9) Drug Testing Services

a) Background

i) The primary objective of a urine drug screening program is to establish and maintain a Drug Free Federal Workplace in accordance with Executive Order 12564 and Public Law 100-71. The work shall be performed in accordance with all applicable policies procedures and rules set for the by HHS rules outlined in the “urine specimen collection handbook for Federal Workplace Drug Testing Programs” at http://workplace.samhsa.gov/DrugTesting/SpecimenCollection/UrnSpcmnHndbk10012004.htm. The contractor shall update processes, as necessary, according to the HHS rules outlined in the above referenced handbook, and stay abreast of HHS requirement changes, and modify processes to accommodate HHS requirement modifications.

ii) The contractor shall, administer on-site for collection and coordinate this determination with the contractor who will collect urine specimens from applicants listed at one of the one-stop locations. ICE will furnish a facility at each event location (New York, NY; Las Vegas, NV; and San Antonio, TX).

b) The Collector

i) The collector will be a certified individual who instructs and assists a donor at a collection site, receives and makes an initial inspection of the urine specimen provided by the donor, and initiates and completes the custody and control form (CCF) in accordance with the HHS DFWP Mandatory Guidelines. The collector is vital to the success of a drug-testing program and is the one individual with whom all donors will have direct face to face contact. If the collector does not ensure the integrity of the specimen and adhere to the collection process, the specimen may not be considered a valid piece of evidence. For the on-site collections, the contractor shall be expected to provide a collection team consisting of one male and one female collector. A contractor can choose of whom the specimen is collected by such as but not limited to Lab Corp. Contractor will provide the on-site OHC staff, a time the last collection should be taken so OHC can ensure all applicants successfully completed a urinalysis test each day.

ii) The contractor must contact and OHC on-site staff to resolve problems concerning:

(1) Applicants who are unable to provide a specimen while at the collection facility

(2) Permission to conduct direct observation collections for applicants or employees suspected of adulterating specimens

c) Collection Supplies

i) The contractor shall be responsible for providing all supplies necessary to conduct proper collections at the designated sites.

d) Applicant Identification

i) Applicant or employee identification will be through a government issued picture identification badge or driver’s license. The Contractor shall confirm the identity of the applicant for drug screening. If the applicant is unable to provide a specimen upon request a medical staff will not allow applicant to leave the screening area until a specimen is provided.

e) Specimen Suitability

i) In accordance with the Mandatory Guidelines if the applicant is unable to provide a specimen of at least 30 ml (45ml preferred) but does provide enough specimens to activate the temperature strip, the collector must first determine if the specimen is within the acceptable temperature range.

ii) If the specimen was of insufficient quantity and within the acceptable temperature range, the collector will dispose of the original specimen and collection container but retain the CCF. The collector notes the time of the first attempt on the CCF, and informs the individual of when the two-hour period begins and ends. The individual is required to remain at the test site until a second specimen is provided. The individual may be given a reasonable amount of liquid to drink for this purpose not to exceed 40 ounces within a three hour period per regulations. If the specimen is less than 30ml and the temperature is outside the acceptable range, the collector shall immediately contact the OHC-Dallas authorized officials to discuss the appropriate action to be taken.

iii) If the individual is unable to provide a second specimen within 3 hours, the collector must contact the OHC-Dallas staff for instructions.

iv) Specimen will be prepared for immediate shipment; it must be appropriately secured and refrigerated during temporary storage.

f) Collection Control

i) In order to ensure that the urine sample is properly identified, strict chain of custody procedures as outlined in the Mandatory Guidelines shall be applied.

ii) While performing any part of the chain of custody procedures, the contractor shall ensure that the specimen and custody documents are always under the total control of the collector. If the collector must leave the workstation, the specimen and custody form must be secured in a tamper-proof container. Collectors shall work with only one donor at a time.

iii) Only the proper laboratory chain of custody forms shall be utilized for the purpose of maintaining control and accountability from initial collection to final disposition of all specimens. The forms shall identify the specimens through use of pre-printed applicant/ employee identification information that matches label items and a sequential number assigned to each urine specimen obtained. With each transfer of possession, the chain of custody form must be signed, dated, and time stamped by the individual releasing the specimen. By signing and dating the CCF, the donor certifies that the urine in the bottle came from his/her body at the time of collection. Refusal to sign the CCF shall be noted on the CCF by the collector. The collector shall complete the CCF for the collection process. The applicant shall not be released until the specimen is sealed in the transmittal package. The contractor shall ensure that the number of person handling the specimens does not exceed two (2) consisting of the collector and one other contractor employee.

iv) After collection of urine specimens, the contractor shall arrange shipment the specimens to a designated HHS-certified contract Drug Testing Laboratory (DTL) of their choice. The specimen shall be placed in appropriate containers (specimen boxes or padded mailers) that are securely sealed to eliminate the possibility of tampering. Collectors shall prepare packages in accordance with specific written DTL instructions. The Contractor shall ensure that all specimens are delivered to the DTL, within 24 hours of collection, by next day delivery service to include weekend shipment.

g) Response to Agency

i) A final report of either a pass or a fail for each applicant seen at all one-stops will be provided to the agency30 days after the last one-stop.

ii) Upon being notified by the OHC-Dallas of drug collection problems, due to failure to comply with the SOW, the contractor shall research the problems and report to the OHC-Dallas, in writing, the corrective actions taken within two working days after the notification.

10) TRAVEL

a) Travel shall be incorporated into the fixed price of this requirement.

11) GOVERNMENT FURNISHED PROPERTY/ EQUIPMENT

a) ICE will furnish a facility at each event location (New York, NY; Las Vegas, NV and San Antonio, TX) and have available the following equipment for use.

12) SECURITY PROCEDURES

a) Contract employees assigned to the contract will not need access to sensitive DHS information or recurring access to DHS facilities therefore they are not be subject to security suitability screening.

13) PERSONNEL REQUIREMENTS

a) Medical Review Officer (MRO)

The HHS Mandatory Guidelines for Federal Workplace Drug Testing Programs (Mandatory Guidelines) define an MRO as a licensed physician holding either a Doctor of Medicine (M.D.) or Doctor of Osteopathy (D.O.) degree who has:

· Knowledge regarding the pharmacology and toxicology of illicit drugs;

· Training in the collection procedures used to collect federal agency specimens; the interpretation of test results reported by laboratories; chain of custody, reporting, and recordkeeping requirements for federal agency specimens; the HHS Mandatory Guidelines for Federal Workplace Drug Testing Programs; and procedures for interpretation, review, and reporting of results as specified by the federal agency or agencies for which the individual may serve as MRO; and

· Satisfactorily passed an examination administered by an HHS-approved organization (i.e., a nationally recognized entity that certifies MROs or a subspecialty board for physicians performing a review of federal employee drug test results). HHS publishes an annual list of approved organizations in the Federal Register.

b) Reviewing Physician(s) must a licensed physician with documented experience in performing reviews of medical examinations in order to determine whether the applicant meets the Agency’s Medical Standards.

c) Program Manager (PM) must have at least five (5) years of managing programs of the same size, complexity, and scope of this Performance Work Statement. The Program Manager should be a Subject Matter Expert (SME) in the Medical Services Industry. The contractor shall provide a Program Manager that shall act as the central point of contact with the Government. The Program Manager shall be responsible for all issue resolution, program management, and other administrative support including providing comprehensive support for the contract. The Program Manager shall be a single point of contact for these events

The Program Manager shall be available to the COR(s) via telephone between the hours of 7:00am-9:00pm (local event time) and shall respond to a request for discussion or resolution of technical problems within two hours of notification.

14) General Requirements

a) Hours of Operation

i) Contractor will be expected to have medical stations set-up and ready for applicant processing by 7:00 AM local time each morning.

ii) Each event is scheduled to end by 8:00 PM local time. This time may vary by no more than one hour, depending on the length of time an individual process may take.

iii) OHC-Dallas will not schedule an applicant to arrive after 2:00 pm local time in order to allow enough time for the last applicant to be fully processed.

iv) The Contractor, Primary Reviewing Physicians, and physicians of specialty shall be available throughout each one-stop hiring event as identified in this SOW.

v) The Program Manager shall be available to the COR(s) via telephone between the hours of 7:00am-8:00pm (local event time), and shall respond to a request for discussion or resolution of technical problems within two hours of notification.

b) Contractor’s Responsibilities

i) The contractor shall make personnel available, whenever requested in writing by the OHC-Dallas to provide testimony and documentation as required in support of administrative or judicial court actions.

ii) In providing these services, the contractor shall abide by the language in the Americans with Disabilities Act, the Civil Rights Act, the Pregnancy Discrimination Act, the Rehabilitation Act, the Code of Federal Regulations, and any other applicable law that may affect decisions made by the Government.

iii) The contractor’s responsibilities shall include, but not limited to, providing all labor, materials, and equipment necessary for the applicant medical examination services and for the collection and transportation of all specimens.

iv) Provide service for approximately 700 pre-employment medical and drug screening exams at three separate locations over a period of four weeks.

v) Provide all labor materials and equipment necessary for the applicant’s medical service and performance assessments to include collection and transportation of all specimens.

vi) The contractor shall pay all fees and postage relating to information submitted to the Government, including forms, reports, shipping to collectors, etc.

c) Contractor Quality Assurance Plan

i) The contractor is responsible for the quality and timeliness of all services and products under this SOW. The contractor shall monitor pending exams/tests and follow up with facilities to ensure the completion of services within required timeframes.

d) Timeframes:

i) Prior to the one-stop events, ICE will send an electronic file of all pre-employment applicants attending each one stop by date and location. Applicant’s location is subject to change and additional applicants may be added. ICE will attempt to provide accurate information as obtained.

ii) OHC will advise the applicant that medical records related to current or past medical conditions should be copied and brought by the applicant to the one-stop to be provided to the examining physician. Records should include any Veterans Affairs Disability Rating Decision letters and any form of disability compensation that the applicant may be receiving. Inform applicant to bring any document related to Lasik eye surgery.

iii) The reviewing physician shall provide a written medical opinion of the applicant’s suitability for the government position to ICE within eight (8) working days from the date the applicant attended the one-stop. If the results of the medical examination do not clearly support the applicant’s suitability for the position, the Primary Reviewing Physician’s opinion shall specify what additional documentation is needed. Contractor’s medical staff will relay to the applicant what additional document is needed and should obtain them through their personal physician and send to the address below.

Entry Level Hiring Unit

Dallas Service Center

Immigration and Customs Enforcement (ICE) 7701 N. Stemmons Freeway Dallas, TX 75247

iv) The drug screening personnel must provide the chain of custody to OHC at the end of each day; sent electronically to in an Excel file to OHC-Dallas.

e) Electronic Files

i) The contractor shall send OHC electronic files containing information on their medical and drug testing activity that took place within the previous 24 hours on a daily basis. The file shall be sorted by the type of test.

f) Contractor’s Data and Reporting Requirements

i) The OHC-Dallas requires the contractor to have a web-based protected site, in compliance with the Privacy Act at 5 U.S.C. 552a.

g) Release of Information

i) All records are subject to the Privacy Act, 5 U.S.C. 552a. The information and records shall be maintained and used with the highest regard for applicant privacy. Applicants/employees may review the information obtained from the physical/medical exam. However, they shall not be allowed to have unsupervised access to their medical records. Individuals may obtain a copy of their medical examination results by sending an original notarized letter authorizing release of the information, to which the information is to be released, along with the address of where the information is to be mailed.

ii) For requests concerning pre-employment examinations, the Release of Information Authorization and request should be addressed to

Entry Level Hiring Unit

Dallas Service Center

Immigration and Customs Enforcement (ICE)

7701 N. Stemmons Freeway

Dallas, TX 75247

iii) For requests concerning Fitness for Duty examinations, the Release of Information Authorization and request should be addressed to

Medical Officer

Office of Human Capital

U.S. Immigration and Customs Enforcement

800 K Street, NW

Washington, D.C. 20536

h) Billing

i) An invoice may be submitted to the COR at the completion of each event. Final invoice may be submitted to the COR after receipt of all deliverables.

ii) The invoices shall have the designated task order number.

i) Final Report

i) The contractor shall provide a final report to include all services performed during all one-stop events, within five (7-14) calendar days following the close of the last event. This report should include a summary of all work performed during all one-stop events.

Name of applicant

Last 4 of the Social Security Number

Type of exam

Cost of services performed

Date service requested

Date results sent to ICE

Privacy Act Information: In accordance with FAR 52.224-1, PRIVACY ACT NOTIFICATION (APR 1984), and FAR 52.224-2, PRIVACY ACT (APR 1984), this contract requires Contractor personnel to have access to information protected by the Privacy Act of 1974. The agency advises that the relevant system of records notices (SORN) applicable to this Privacy Act information is as follows:

OPM / GOVT 001-010 – OPM Government-Wide SORNs covering personnel records

These SORNs may be updated at any time. The most current DHS versions are publicly available at www.dhs.gov/privacy. SORNs of other agencies may be accessed through the agencies’ websites or by searching FDsys, the Federal Digital System of the Government Publishing Office, available at http://www.gpo.gov/fdsys/.

Deliverables are the Property of the U.S. Government: The Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable without the expressed permission of the Contracting Officer or Contracting Officer’s Representative. The Contractor shall certify in writing the destruction or return of all Government data at the conclusion of the contract or at a time otherwise specified in the contract. The Agency owns the rights to all data/records produced as part of this contract.

Contractor Shall Not Create or Maintain Unauthorized Records: The Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and/or Government records. The Contractor shall not create or maintain any records containing any Government Agency data that are not specifically tied to or authorized by the contract.

Agency Owns Rights to Electronic Information: The Government Agency owns the rights to all electronic information (electronic data, electronic information systems or electronic databases) and all supporting documentation created as part of this contract. The Contractor must deliver sufficient technical documentation with all data deliverables to permit the Agency to use the data.

Comply with All Records Management Policies: The Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format, mode of transmission, or state of completion.

Disposition of Documents without Prior Written Consent: No disposition of documents will be allowed without the prior written consent of the Contracting Officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the Agency records schedules.

SAFEGUARDING OF SENSITIVE INFORMATION (MAR 2015)

(a) Applicability. This clause applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall insert the substance of this clause in all subcontracts.

(b) Definitions. As used in this clause—

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, such as name, social security number, or biometric records, either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual, such as date and place of birth, or mother’s maiden name. The definition of PII is not anchored to any single category of information or technology. Rather, it requires a case-by-case assessment of the specific risk that an individual can be identified. In performing this assessment, it is important for an agency to recognize that non-personally identifiable information can become personally identifiable information whenever additional information is made publicly available—in any medium and from any source—that, combined with other available information, could be used to identify an individual.

PII is a subset of sensitive information. Examples of PII include, but are not limited to: name, date of birth, mailing address, telephone number, Social Security number (SSN), email address, zip code, account numbers, certificate/license numbers, vehicle identifiers including license plates, uniform resource locators (URLs), static Internet protocol addresses, biometric identifiers such as fingerprint, voiceprint, iris scan, photographic facial images, or any other unique identifying number or characteristic, and any information where it is reasonably foreseeable that the information will be linked with other information to identify the individual.

“Sensitive Information” is defined in HSAR clause 3052.204-71, Contractor Employee Access, as any information, which if lost, misused, disclosed, or, without authorization is accessed, or modified, could adversely affect the national or homeland security interest, the conduct of Federal programs, or the privacy to which individuals are entitled under section 552a of Title 5, United States Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept secret in the interest of national defense, homeland security or foreign policy. This definition includes the following categories of information:

(1) Protected Critical Infrastructure Information (PCII) as set out in the Critical Infrastructure Information Act of 2002 (Title II, Subtitle B, of the Homeland Security Act, Public Law 107-296, 196 Stat. 2135), as amended, the implementing regulations thereto (Title 6, Code of Federal Regulations, Part 29) as amended, the applicable PCII Procedures Manual, as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the PCII Program Manager or his/her designee);

(2) Sensitive Security Information (SSI), as defined in Title 49, Code of Federal Regulations, Part 1520, as amended, “Policies and Procedures of Safeguarding and Control of SSI,” as amended, and any supplementary guidance officially communicated by an authorized official of the Department of Homeland Security (including the Assistant Secretary for the Transportation Security Administration or his/her designee);

(3) Information designated as “For Official Use Only,” which is unclassified information of a sensitive nature and the unauthorized disclosure of which could adversely impact a person’s privacy or welfare, the conduct of Federal programs, or other programs or operations essential to the national or homeland security interest; and

(4) Any information that is designated “sensitive” or subject to other controls, safeguards or protections in accordance with subsequently adopted homeland security information handling procedures.

“Sensitive Information Incident” is an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information.

“Sensitive Personally Identifiable Information (SPII)” is a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Some forms of PII are sensitive as stand-alone elements. Examples of such PII include: Social Security numbers (SSN), driver’s license or state identification number, Alien Registration Numbers (A-number), financial account number, and biometric identifiers such as fingerprint, voiceprint, or iris scan. Additional examples include any groupings of information that contain an individual’s name or other unique identifier plus one or more of the following elements:

(1) Truncated SSN (such as last 4 digits)

(2) Date of birth (month, day, and year)

(3) Citizenship or immigration status

(4) Ethnic or religious affiliation

(5) Sexual orientation

(6) Criminal History

(7) Medical Information

(8) System authentication information such as mother’s maiden name, account passwords or personal identification numbers (PIN)

Other PII may be “sensitive” depending on its context, such as a list of employees and their performance ratings or an unlisted home address or phone number. In contrast, a business card or public telephone directory of agency employees contains PII but is not sensitive.

(c) Authorities. The Contractor shall follow all current versions of Government policies and guidance accessible at http://www.dhs.gov/dhs-security-and-training-requirements-contractors, or available upon request from the Contracting Officer, including but not limited to:

(1) DHS Management Directive 11042.1 Safeguarding Sensitive But Unclassified (for Official

Use Only) Information

(2) DHS Sensitive Systems Policy Directive 4300A

(3) DHS 4300A Sensitive Systems Handbook and Attachments

(4) DHS Security Authorization Process Guide

(5) DHS Handbook for Safeguarding Sensitive Personally Identifiable Information

(6) DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel

Suitability and Security Program

(7) DHS Information Security Performance Plan (current fiscal year)

(8) DHS Privacy Incident Handling Guidance

(9) Federal Information Processing Standard (FIPS) 140-2 Security Requirements for

Cryptographic Modules accessible at http://csrc.nist.gov/groups/STM/cmvp/standards.html

(10) National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Controls for Federal Information Systems and Organizations accessible at http://csrc.nist.gov/publications/PubsSPs.html

(11) NIST Special Publication 800-88 Guidelines for Media Sanitization accessible at http://csrc.nist.gov/publications/PubsSPs.html

(d) Handling of Sensitive Information. Contractor compliance with this clause, as well as the policies and procedures described below, is required.

(1) Department of Homeland Security (DHS) policies and procedures on Contractor personnel security requirements are set forth in various Management Directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how Contractors must handle sensitive but unclassified information. DHS uses the term “FOR OFFICIAL USE ONLY” to identify sensitive but unclassified information that is not otherwise categorized by statute or regulation. Examples of sensitive information that are categorized by statute or regulation are PCII, SSI, etc. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook provide the policies and procedures on security for Information Technology (IT) resources. The DHS Handbook for Safeguarding Sensitive Personally Identifiable Information provides guidelines to help safeguard SPII in both paper and electronic form. DHS Instruction Handbook 121-01-007 Department of Homeland Security Personnel Suitability and Security Program establishes procedures, program responsibilities, minimum standards, and reporting protocols for the DHS Personnel Suitability and Security Program.

(2) The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

(3) All Contractor employees with access to sensitive information shall execute DHS Form 11000-6, Department of Homeland Security Non-Disclosure Agreement (NDA), as a condition of access to such information. The Contractor shall maintain signed copies of the NDA for all employees as a record of compliance. The Contractor shall provide copies of the signed NDA to the Contracting Officer’s Representative (COR) no later than two (2) days after execution of the form.

(4) The Contractor’s invoicing, billing, and other recordkeeping systems maintained to support financial or other administrative functions shall not maintain SPII. It is acceptable to maintain in these systems the names, titles and contact information for the COR or other Government personnel associated with the administration of the contract, as needed.

(e) Sensitive Information Incident Reporting Requirements.

(5) All known or suspected sensitive information incidents shall be reported to the Headquarters or Component Security Operations Center (SOC) within one hour of discovery in accordance with 4300A Sensitive Systems Handbook Incident Response and Reporting requirements. When notifying the Headquarters or Component SOC, the Contractor shall also notify the Contracting Officer, COR, Headquarters or Component Privacy Officer, and US-CERT using the contact information identified in the contract. If the incident is reported by phone or the Contracting Officer’s email address is not immediately available, the Contractor shall contact the Contracting Officer immediately after reporting the incident to the Headquarters or Component SOC. The Contractor shall not include any sensitive information in the subject or body of any e-mail. To transmit sensitive information, the Contractor shall use FIPS 140-2 Security Requirements for Cryptographic Modules compliant encryption methods to protect sensitive information in attachments to email. Passwords shall not be communicated in the same email as the attachment. A sensitive information incident shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information, or has otherwise failed to meet the requirements of the contract.

(f) If a sensitive information incident involves PII or SPII, in addition to the reporting requirements in 4300A Sensitive Systems Handbook Incident Response and Reporting, Contractors shall also provide as many of the following data elements that are available at the time the incident is reported, with any remaining data elements provided within 24 hours of submission of the initial incident report:

(i) Data Universal Numbering System (DUNS);

(ii) Contract numbers affected unless all contracts by the company are affected;

(iii) Facility CAGE code if the location of the event is different than the prime contractor location;

(iv) Point of contact (POC) if different than the POC recorded in the System for Award Management (address, position, telephone, email);

(v) Contracting Officer POC (address, telephone, email);

(vi) Contract clearance level;

(vii) Name of subcontractor and CAGE code if this was an incident on a subcontractor network;

(viii) Government programs, platforms or systems involved;

(ix) Location(s) of incident;

(x) Date and time the incident was discovered;

(xi) Server names where sensitive information resided at the time of the incident, both at the Contractor and subcontractor level;

(xii) Description of the Government PII and/or SPII contained within the system;

(xiii) Number of people potentially affected and the estimate or actual number of records exposed and/or contained within the system; and

(xiv) Any additional information relevant to the incident.

(g) Sensitive Information Incident Response Requirements.

(1)All determinations related to sensitive information incidents, including response activities, notifications to affected individuals and/or Federal agencies, and related services (e.g., credit monitoring) will be made in writing by the Contracting Officer in consultation with the Headquarters or Component CIO and Headquarters or Component Privacy Office.

(2) The Contractor shall provide full access and cooperation for all activities determined by the Government to be required to ensure an effective incident response, including providing all requested images, log files, and event information to facilitate rapid resolution of sensitive information incidents.

Incident response activities determined to be required by the Government may include, but are not limited to, the following:

(xv) Inspections,

(xvi) Investigations,

(xvii) Forensic reviews, and

(xviii) Data analyses and processing.