36C10A18Q0124-002.pdf

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Records Center and Vault

Warehouse Labor Support Services

Date: February 5, 2018

TAC-18-44838

PWS Version Number: 1.1

Warehouse Labor Support Services TAC Number: TAC-18-44838

Contents

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

4.2 PLACE OF PERFORMANCE

4.3 TRAVEL

5.0 SPECIFIC TASKS AND DELIVERABLES

5.1 PROJECT MANAGEMENT

5.1.1 Project Management Support

5.1.2 Quality Control

5.2 REPORTING REQUIREMENTS

5.2.1 Monthly Status Report

5.2.2 Daily Report of Customer Billable Services

5.2.3 Accident Report

5.2.4 Personnel Report

5.3 RECALLS

5.3.1 Processing Recalls

5.3.2 Processing Recalls Where Folders Were Previously Checked Out

5.3.3 Processing Recalls Where File Folders Are Not Found

5.4 REFILES

5.4.1 Processing Re-files of Customer Folders

5.4.2 Adding New Files to an Existing Box

5.5 Outbound Mail Processing (non-freight deliveries)

5.5.1 Reporting Mail Processing Errors

5.6 WAREHOUSE SUPPORT

5.6.1 Conducting Facility Leak Inspections

5.6.2 Carting, Labeling, Shelving Boxes

5.6.3 General Facility Maintenance

5.6.4 Training

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 One-VA Technical Reference Model

6.1.2 Federal Identity, Credential, and Access Management (FICAM)

6.1.3 Internet Protocol Version 6 (IPV6)

6.1.4 Trusted Internet Connection (TIC)

6.1.5 Standard Computer Configuration

6.1.6 Veteran Focused Integration Process (VIP)

6.1.7 Process Asset Library (PAL)

6.2 SECURITY AND PRIVACY REQUIREMENTS

6.2.1 Position/Task Risk Designation Level(s)

6.2.2 Contractor Personnel Security Requirements

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

6.4 PERFORMANCE METRICS

6.5 FACILITY/RESOURCE PROVISIONS

6.6 GOVERNMENT FURNISHED PROPERTY

6.6.1 Contractor Return of Government Furnished Equipment (GFE)

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

ADDENDUM B – VA INFORMATION & INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE .. 24

1.0 BACKGROUND

The Department of Veterans Affairs (VA) operates a 400,000 square foot records storage facility in Neosho, Missouri, known as the Records Center and Vault (RCV).

The Center stores approximately 1.8 million 25 to 50 lb. boxes of paper and film based records that belong to the various VA agencies and stations located nation-wide.

Barcode technology is used to track the warehouse location of the individual boxes. VA stations submit work orders to the RCV to recall records to their facilities, return records to storage upon completion of the review, and to destroy records once agency retention requirements are met. Record retrievals from the Center’s 14-foot tall warehouse shelves are performed manually by using a combination of rolling ladders, narrow-aisled carts, hand jacks, conveyors, and scaffolds.

The work order volumes the RCV receives are dynamic and the labor hour requirements to process them vary based on the actual number of Veterans seeking benefits/medical care and the quantities of records becoming eligible for destruction each year. Historically, the RCV has utilized four to seven contractors to provide support for the recall, refile and return shipping duties, and to assist with general warehouse tasks to physically relocate boxes for storage, housekeeping, and destruction purposes.

The senior VA operations supervisor stationed at the Neosho facility (also the VA Program Manager (VA-PM)), is responsible for daily center operations, has oversight of all records management and support services, and ensures adequate labor is available to meet agency needs.

2.0 APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

2. 10 U.S.C. § 2224, "Defense Information Assurance Program"

3. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

4. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

5. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, http://www.va.gov/vapubs/

6. VA Handbook 0710, Personnel Security and Suitability Security Program, May 2, 2016, http://www.va.gov/vapubs

7. Office of Management and Budget (OMB) Circular A-130, “Managing Federal

Information as a Strategic Resource,” July 28, 2016

8. An Introductory Resource Guide for Implementing the Health Insurance

Portability and Accountability Act (HIPAA) Security Rule, October 2008

9. VA Directive 6500, “Managing Information Security Risk: VA Information

Security Program,” September 20, 2012

10. VA Handbook 6500, “Risk Management Framework for VA Information

Systems – Tier 3: VA Information Security Program,” March 10, 2015 http://www.va.gov/vapubs/ http://www.va.gov/vapubs

11. VA Handbook 6500.1, “Electronic Media Sanitization,” November 03, 2008

12. VA Handbook 6500.2, “Management of Breaches Involving Sensitive

Personal Information (SPI),” July 28, 2016

13. VA Handbook 6500.6, “Contract Security,” March 12, 2010

14. VA Directive 6508, “Implementation of Privacy Threshold Analysis and

Privacy Impact Assessment,” October 15, 2014

15. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and

Privacy Impact Assessment,” July 30, 2015

16. VA Directive 6300, Records and Information Management, February 26,

17. VA Handbook, 6300.1, Records Management Procedures, March 24, 2010

18. VA Memorandum “Mandatory Use of PIV Multifactor Authentication to VA

Information System” (VAIQ# 7613595), June 30, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

19. VA Memorandum “Mandatory Use of PIV Multifactor Authentication for Users with Elevated Privileges” (VAIQ# 7613597), June 30, 2015;

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

20. VA Memorandum “Use of Personal Email (VAIQ #7581492)”, April 24, 2015, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

21. VA Memorandum “Updated VA Information Security Rules of Behavior (VAIQ #7823189)”, September 15, 2017, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

3.0 SCOPE OF WORK

Contractor shall process work orders to recall records, refile records, and ship recalled records (via express mail carrier) to VA records owning stations, to relocate groups of boxes to designated areas for storage and destruction purposes, and perform facility leak and safety checks, and general housekeeping duties. These efforts require no communications with VA staff outside of the Neosho RCV location, and no riding lift equipment usage.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance shall be a 12-month base from April 1, 2018, through March 31, 2019, with four 12-month options to extend services.

Hours of Operation: The Contractor’s work schedule is Monday through Friday, from 8:00 AM to 4:30 PM CST. The 30-minute lunch period is 12:00 PM to 12:30 PM, and 15-minute breaks begin at 10:00 AM and 2:30 PM. Adjustments to scheduled start/stop times must be approved by the VA-PM.

Any work at the Government site shall not take place on Federal holidays or weekends unless directed by the Contracting Officer (CO).

https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

There are ten (10) Federal holidays set by law (USC Title 5 Section 6103) that VA follows. Under current definitions, four are set by date:

New Year's Day January 1 Independence Day July 4 Veterans Day November 11 Christmas Day December 25

If any of the above falls on a Saturday, then Friday shall be observed as a holiday.

Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Martin Luther King's Birthday Third Monday in January Washington's Birthday Third Monday in February Memorial Day Last Monday in May Labor Day First Monday in September Columbus Day Second Monday in October Thanksgiving Fourth Thursday in November

4.2 PLACE OF PERFORMANCE

All tasks under this PWS shall be performed at the VA facility located in Neosho, Missouri.

4.3 TRAVEL

No travel specific to the work requirements is anticipated. Contractor employees, however, may be required to travel to the VA Medical Center in Fayetteville, Arkansas, approximately 80 miles from the RCV, for fingerprints and badge requirements. All travel expenses related to this requirement shall be borne by the Contractor.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform time-critical RCV services as detailed below. The work environment is very labor intensive and requires long periods of walking, standing, climbing ladders to access records, and repetitive lifting of 25 to 50-lb. boxes to perform the tasks detailed below.

The Contractor shall perform pre-screening of its employees to certify that Contractor staff are eligible to work in the United States, have a stable work history and a clean background history (not wanted by any law enforcement agency, no felony convictions, no drug, theft, burglary, forgery or arson incidents), and is not a previous RCV contract employee that was either terminated or voluntarily resigned before being terminated for performance or attendance issues. All Contractor staff must be able to read, write, speak and understand the English language. Contractor shall provide the Contracting Officer (CO) and Contracting Officer’s Representative (COR) resumes for new Contractor staff to confirm candidates meet minimum requirements of the PWS.

The Working Team Lead shall possess the following minimum qualifications:

1. High school diploma or GED. Some education above high school is preferred.

2. Experience working in a structured, production-oriented environment.

3. Seven or more years of stable work history gained post high school with at least

3 of those years spent in a supervisory position.

4. Good grammatical, verbal, written communication and coordination skills.

Proficiency in Microsoft Office Suite to generate email, reports, training materials, and other documentation.

5. Knowledge of applicable safety regulations and OSHA reporting requirements.

6. Ability to lift 25 to 50 lbs. repetitively, walk and stand long periods of time, and repetitive climbing of 12-foot ladders to perform picking and filing duties.

7. Ability to perform/complete tasks accurately, efficiently and independently.

The Warehouse Support Staff shall possess the following minimum qualifications:

1. High school diploma/GED, or must pass a written skills test with a minimum score of 80% (format of basic skills test to be approved by the VA-PM.) Skills test shall demonstrate candidate can perform basic mathematics/problem solving skills without using a calculator, can place sequences of numbers in correct order, and recognizes differences in spelling of similar names and addresses.

2. Ability to lift 25 to 50 lbs. repetitively, walk long distances, perform repetitive daily climbing of 12’ ladders to access records stored on shelves.

3. Minimum 5-year stable work history gained post high school. Two of the five years spent in environments that demonstrate candidate’s ability to follow instructions, complete detailed work processes and meet daily processing deadlines.

4. Ability to perform/complete tasks accurately, efficiently and independently.

5.1 PROJECT MANAGEMENT

5.1.1 Project Management Support

The Contractor shall supply a Working Team Lead to provide supervision and training for staff members under this PWS. Working Team Lead shall manage contractor staff to ensure time-frames are met for work completion.

The Contractor’s Working Team Lead shall also provide new employee orientation training, safety training, and training on processes and procedures to perform duties for this PWS.

5.1.2 Quality Control

The Contractor shall establish a Quality Control (QC) Plan and implement a program in accordance with the QC plan to ensure accuracy and efficiency of employees performing assigned tasks under this PWS. The program shall be a system for identifying and correcting deficiencies in the quality of services before the level of performance becomes unacceptable and/or the RCV inspectors point out deficiencies. Revisions to the QC Plan shall be provided to the COR within 24 hours following modification. QC plans developed shall ensure individual employees do not QC their own work efforts.

NOTE: The records stored in the RCV are original hard copies (paper, film, fiche, etc.)

with no known backups. Contractor chain of custody must be fully documented on work orders of all actions taken during processing. This includes verifying capture of accurate identifiers and volume count of all boxes/folders/items retrieved (recalled), refiled or shipped, along with the names/dates/times of all staff in contact with the boxes/contents during all processing activities, and capture of the corresponding routing and tracking numbers utilized to ship records to requesting stations.

Deliverable:

A. Quality Control Plan

5.2 REPORTING REQUIREMENTS

The Contractor shall provide the reports outlined below in electronic form in Microsoft Word and Project formats.

5.2.1 Monthly Status Report

The Contractor Monthly Status Report is due to the Contracting Officer’s Representative (COR) NLT the 10th day of the month. The report shall include the following consolidated progress of work performed by Contractor staff during the previous month:

1. Summary of monthly performance metrics (count of actions and labor hours by customer) to process recall, refile and shipping work orders.

2. Accidents occurring during the month and remedies to prevent re-occurrence.

3. Results of monthly quality control checks performed by the Contractor.

4. Summary of bottlenecks/quality control issues and corrective action taken to resolve them. The Contractor shall also meet on a daily basis with the COR or designee (unless otherwise informed) to review/discuss previous day’s activities and any conflicts or issues arising or anticipated, implementation of new work procedures, address all facility equipment and safety concerns.

5.2.2 Daily Report of Customer Billable Services

The Contractor shall provide COR or designee copies of all employee Daily Time and Man Hour Forms that lists hours worked by customer and category of services performed. The format to capture increments of less than one hour is at the discretion of the VA (tenths, quarter man-hours, etc.).

5.2.3 Accident Report

The Contractor shall provide accident/injury reports within 24 hours of each event. The report shall include witness names to the incident, equipment involved, incident location (include bay/shelving row/shelving unit information if applicable), results of Contractor’s investigation, and the corrective action taken to prevent re-occurrence.

5.2.4 Personnel Report

The Contractor shall provide documentation to the COR of new personnel assigned within two (2) business days of starting work. This documentation shall consist of the following:

1. Written certification that new contract employees have received safety training.

2. Written certification that new contract employees are physically fit to perform assigned duties.

3. Signed Certificate of Confidentiality and Non-Disclosure.

4. Signed Contractor Rules of Behavior.

5. VA training certificates (Privacy and Security Awareness Training).

Deliverables:

A. Monthly Status Report B. Daily Report of Customer Billable Services C. Accident Report D. Personnel Report

5.3 RECALLS

The estimated volume of recall work orders for the performance period is 35,000 annually for the VA medical centers (VHA) and 50,000 annually for VA regional offices

(RMC).

Emergency recalls arriving during morning hours require picking and shipping by close of the same business day. Emergency recalls arriving in the afternoon require picking and shipping by close of the following business day. Routine recalls received during the current day and before closing time require picking and shipping before close of the following business day. Recall requests arriving during evenings/weekends/federal holidays are processed as though they were received at 8:00 AM the first business day after the evening/weekend/holiday, and the previously stated rules above apply.

RCV will deliver work orders printed on 3-part carbonless paper to the recall/refile sorter station at approximately 8:00 AM, 10:00 AM, 12:00 PM and 2:00 PM each business day.

5.3.1 Processing Recalls

The Contractor shall:

1. Process recall work orders in warehouse areas assigned by the COR to meet processing time-frames outlined in Section 5.3 of this PWS.

2. Post Contract employee room assignments on the outbound mail room bulletin board. If Contractor rotates assignments, do so on the first business day of the month.

3. Notify the COR or designee via email of all instances where either overages or shortages of work required Contractor staff to assist with processing duties in non-assigned areas.

4. Process recalls by warehouse room in ascending row/unit/shelf order, picking all recalls in each row before moving to the next.

5. Mark individual work order forms with the picker’s processing information (initials, date, time, type of service performed, the count and description of items pulled, and any folder/file number discrepancies observed). Place the original (white copy) of the work order either on the shelf (for a full box recall) or inside the box (for folder recalls) as a charge out card at the location folders were removed from the box. For VHA recalls, write the warehouse shelf location (bay/row/unit/shelf) and accession and box sequence number the files were removed onto the upper right-hand corner of each folder or envelope removed from the box. Cross out any prior accession and warehouse entries on the front of folders that don’t match the current warehouse and accession/box sequence number locators.

Secure the remaining two copies of the work order with rubber bands both length-wise and width-wise to the corresponding folder(s). For records in envelopes, staple two corners of both copies of the work order to the envelope to ensure the copy of the work order stay with the records for delivery to the requesting VA station.

6. Deliver and sort processed recall work orders for folders onto the corresponding customer (VHA/RMC) racks for express mail shipping. Deliver to the VA processing table for review all recalls requesting fax or scan services, whole box recalls, and any recall where the file name(s) and number(s) on the work orders were not an exact match to folders removed from a box. VA technicians will re-verify for all folders delivered to the exceptions table that Contractor has captured accurate first/last name identifiers and a full file number to positively identify the records in case they are lost in transit to the customer.

5.3.2 Processing Recalls Where Folders Were Previously Checked Out

Contractor shall code form as a “duplicate request” and capture from the charge out card the date files were previously removed from the box, the first/last name of previous requester, requester’s agency code and city/state location, and number and type of items pulled. If the previous and current requester names on both work orders are the same, use “same requester” for the name, and capture the date/time the previous request was processed.

5.3.3 Processing Recalls Where File Folders Are Not Found

Contractor shall code form as a “no find” and capture the last name and full file number for the first and last file in the box.

5.4 REFILES

The estimated number of refile receipts during the performance period is 25,000 annually. Contractor shall process folder refile work orders within five business days following the date that the requests were initialed/dated/stamped as received by the RCV staff. Processing information and discrepancies shall be documented on the work orders. Deliver processed work order forms and requests unable to be processed as submitted by the customer in collection bins marked for VA review. VA staff will either correct the discrepancies and return the folder refiles to Contractor for processing, or prepare a shipping work order to return the folders to the requesting station.

5.4.1 Processing Re-files of Customer Folders

Contractor shall remove rubber bands/binder clips to return previously recalled items to their original storage container. The corresponding charge-out card shall be pulled and stapled behind the matching refile work order when all files/envelopes previously recalled are returned. Where all previously recalled folder volumes are not returned, the Contractor shall document the corresponding charge out card with the processor’s initials and date/time, the actual count of folder volumes and description of items re-filed, and return the charge out card to the box and mark the refile cover sheet with “Pull Slip in Box”.

5.4.2 Adding New Files to an Existing Box

RCV occasionally receives refile work orders to add new folders to an existing box.

Contractor shall perform this service where there is room in the box to add additional files, and there are either files belonging to same Veteran already in the box, or the file range of the refile folder and the box contents match. Where neither of these conditions exist capture the last name and file number of the first and last file on the refile request and folders will be returned to the VHA station unprocessed.

5.5 OUTBOUND MAIL PROCESSING (NON-FREIGHT DELIVERIES)

Contractor shall perform activities to package, ship, and track recalled records and other miscellaneous mail bound for VHA stations. RCV estimates approximately 10,000 packages annually during the period of performance. The Contractor shall perform the duties below:

1. Process outgoing VHA mail to meet time-frames outlined in Section 5.3 above while also combining requests from the same initiator and/or station whenever possible to decrease package count and shipping costs.

2. Maintain current VHA shipping addresses in electronic mail metering equipment.

3. Electronically track total number of outgoing boxes/packages shipped daily.

4. Electronically track via Excel spreadsheet monthly totals for postage and non-freight shipping expense by station ID number.

5. Enter recall processing and shipping results into a standardized electronic template located in the Records Retrieval System (RRS) database.

6. File working copies of processed shipping documents by request submit date.

Make new folders as required and transfer files from prior years to inactive storage.

7. Order replenishment shipping supplies furnished free by express mail carriers.

8. Notify designated RCV staff two weeks before depleting office and warehouse supplies needed for shipping purposes (tape, 1-cubic foot corrugated boxes, etc.)

Utilize the express mail service with tracking capabilities designated by the VA-PM to ship all packages containing sensitive information, Personally Identifiable Information (PII) or Protected Health Information (PHI).

Ship records to ensure no packages are in transit during federal holidays or non-business days unless the customer requests emergency or overnight service in writing.

Only ship records to an alternate VA office when the requesting station provides complete contact and mailing information for the alternate in the comments section of the recall work order (recipient’s full name, VA business phone number with area code/complete mailing address).

Deliver processed recalls with notes in the remarks section for scan/fax/search services to the VA review table for processing.

Contractor shall prepare for express mail shipping whole boxes of records recalled from the warehouse and individual files secured in new packaging to authorized requesters as follows:

1. Obtain written approval from the VA-PM/COR or designee before shipping any boxes containing plastic liners or wet/damaged files.

2. Begin package processing after the 10:00 AM deadline for all previous day recalls to be completed and on the racks for shipping. Express mail carrier pickup occurs at approximately 3:00 PM daily.

3. Leave enough room in the packaging to allow opening without damage to internal contents.

4. Replace existing boxes when structural or adhesive weaknesses are observed, there is presence of sensitive information/PII/PHI on the box exterior surface, or box hand holds cannot be secured to prevent visibility/access to records.

5. Include a privacy flyer and verify a copy of the applicable work order(s)/routing slip(s) accompany boxes/packages processed for shipping.

6. Verify outgoing boxes and packages are adequately addressed, sealed, and free of visible, sensitive information before they leave the mail room.

7. Audit individual packages to confirm addresses on recall work orders and package shipping labels match.

8. Run daily shipping manifest/end of day reports from shipping vendor’s software and include with packages for express mail carrier pick-up.

5.5.1 Reporting Mail Processing Errors

The Contractor shall advise the COR or designee immediately following discovery of all outgoing mail shipping errors (i.e., shipping files to the wrong VHA station, etc.) to determine whether a reportable privacy incident has occurred. Any Contractor information provided via email to RCV containing sensitive information, PII or PHI must be encrypted.

5.6 WAREHOUSE SUPPORT

5.6.1 Conducting Facility Leak Inspections

The Contractor shall utilize ladders to perform weekly leak inspections in assigned shelving aisles. Leaks found shall be documented in writing on RCV provided forms indicating bay/row/unit location and source of the leak (panning, ceiling, sprinkler head, etc.). Leaks wetting boxes shall immediately be reported by phone to the COR or designee. Completed leak check repair forms are due to the COR or designee by end of the inspection day when leaks are found.

Deliverables:

A. Leak Check Repair Form

5.6.2 Carting, Labeling, Shelving Boxes

The Contractor shall cart, label, shelve, repair, and relocate boxes in accordance with applicable RCV processing procedures. Scenarios requiring these services include repair/relocation of boxes that receive water damage, recall of entire accessions (sets) of boxes by customer, retrieval of accessions of records approved by customer for destruction, repair/re-application of barcode labels that have fallen off of boxes, etc.

5.6.3 General Facility Maintenance

While RCV provides janitorial services, the Contractor shall ensure that facility office space, break room, bathrooms, warehouse aisles, and dock remain in an un-littered condition during each business day. Contractor shall perform general maintenance duties to include organization of supply areas, relocation of furniture to allow cleaning of facility floors, etc. Contract employees utilizing desks are responsible for dusting and maintaining their work space in an organized manner.

The Contractor shall monitor the Government Furnished Equipment (GFE) and facility to ensure they are kept in good repair, reporting all problems via email to the COR or designee. The Contractor shall comply with RCV-established maintenance programs.

The Government-provided ladders shall be maintained in shelving row aisles not designated as emergency exits and sit flush with shelving units posts installed at the facility main 10’ aisle-way when not in use. All facility equipment (ladders, carts, etc.)

shall be stored to prevent compromise to facility egress routes, designated emergency exits, or fire extinguisher access aisles.

5.6.4 Training

New employees shall be trained within 90 days of hire on VA processes required under this task order. The Contractor shall monitor performance and provide remedial training to employees unable to meet processing time-frames. Also the Contractor shall devise and implement a new employee training program to be completed by new hires before they are released to perform critical jobs by themselves without supervision (i.e., performing record shipment mailings, independent processing of recall and refile work orders, etc.) The Contractor shall notify the COR as new hires complete the training program.

6.0 GENERAL REQUIREMENTS

6.1 ENTERPRISE AND IT FRAMEWORK

6.1.1 One-VA Technical Reference Model

N/A. PWS has no IT components.

6.1.2 Federal Identity, Credential, and Access Management (FICAM)

6.1.3 Internet Protocol Version 6 (IPV6)

6.1.4 Trusted Internet Connection (TIC)

6.1.5 Standard Computer Configuration

6.1.6 Veteran Focused Integration Process (VIP)

6.1.7 Process Asset Library (PAL)

6.2 SECURITY AND PRIVACY REQUIREMENTS

It has been determined that protected health information may be disclosed or accessed and a signed Business Associate Agreement (BAA) shall be required. The Contractor shall adhere to the requirements set forth within the BAA, referenced in Section D of the contract, and shall comply with VA Directive 6066.

6.2.1 Position/Task Risk Designation Level(s)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task

Task Number Tier1 / Low Risk Tier 2 / Moderate Risk

Tier 4 / High Risk

5.1

5.2

5.3

5.4

5.5

5.6

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required

Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

6.2.2 Contractor Personnel Security Requirements

Contractor Responsibilities:

a. The Contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain the appropriate Background Investigation, and are able to read, write, speak and understand the English language.

b. Within 3 business days after award, the Contractor shall provide a roster of Contractor and Subcontractor employees to the COR to begin their background investigations in accordance with the PAL template artifact. The Contractor Staff Roster shall contain the Contractor’s Full Name, Date of Birth, Place of Birth, individual background investigation level requirement (based upon Section 6.2 Tasks), employee email address for the VA Security and Investigations Center to forward forms to be completed for background investigations, etc. The Contractor shall submit full Social Security Numbers either within the Contractor Staff Roster or under separate cover to the COR.

The Contractor Staff Roster shall be updated and provided to VA within 1 day of any changes in employee status, training certification completion status, Background Investigation level status, additions/removal of employees, etc.

throughout the Period of Performance. The Contractor Staff Roster shall remain a historical document indicating all past information and the Contractor shall indicate in the Comment field, employees no longer supporting this contract. The preferred method to send the Contractor Staff Roster or Social Security Number is by encrypted e-mail. If unable to send encrypted e-mail, other methods which comply with FIPS 140-2 are to encrypt the file, use a secure fax, or use a traceable mail service.

c. The Contractor should coordinate with the location of the nearest VA fingerprinting office through the COR. Only electronic fingerprints are authorized. The Contractor shall bring their completed Security and Investigations Center (SIC) Fingerprint request form with them (see paragraph d.4. below) when getting fingerprints taken.

d. The Contractor shall ensure the following required forms are submitted to the COR within 5 days after contract award:

1) Optional Form 306

2) Self-Certification of Continuous Service

3) VA Form 0710

4) Completed SIC Fingerprint Request Form

e. The Contractor personnel shall submit all required information related to their background investigations (completion of the investigation documents (SF85, SF85P, or SF 86) utilizing the Office of Personnel Management’s (OPM) Electronic Questionnaire for Investigations Processing (e-QIP) after receiving an email notification from the Security and Investigation Center (SIC).

f. The Contractor employee shall certify and release the e-QIP document, print and sign the signature pages, and send them encrypted to the COR for electronic submission to the SIC. These documents shall be submitted to the COR within 3 business days of receipt of the e-QIP notification email. (Note:

OPM is moving towards a “click to sign” process. If click to sign is used, the Contractor employee should notify the COR within 3 business days that documents were signed via e-QIP).

g. The Contractor shall be responsible for the actions of all personnel provided to work for VA under this contract. In the event that damages arise from work performed by Contractor provided personnel, under the auspices of this contract, the Contractor shall be responsible for all resources necessary to remedy the incident.

h. A Contractor may be granted unescorted access to VA facilities and/or access to VA Information Technology resources (network and/or protected data) with a favorably adjudicated Special Agreement Check (SAC), completed training delineated in VA Handbook 6500.6 (Appendix C, Section 9), signed “Contractor Rules of Behavior”, and with a valid, operational PIV credential for PIV-only logical access to VA’s network. A PIV card credential can be issued once your SAC has been favorably adjudicated and your background investigation has been scheduled by OPM. However, the Contractor will be responsible for the actions of the Contractor personnel they provide to perform work for VA. The investigative history for Contractor personnel working under this contract must be maintained in the database of

OPM.

i. The Contractor, when notified of an unfavorably adjudicated background investigation on a Contractor employee as determined by the Government, shall withdraw the employee from consideration in working under the contract.

j. Failure to comply with the Contractor personnel security investigative requirements may result in loss of physical and/or logical access to VA facilities and systems by Contractor and Subcontractor employees and/or termination of the contract for default.

k. Identity Credential Holders must follow all HSPD-12 policies and procedures as well as use and protect their assigned identity credentials in accordance with VA policies and procedures, displaying their badges at all times, and returning the identity credentials upon termination of their relationship with

VA.

Deliverable:

A. Contractor Staff Roster

6.3 METHOD AND DISTRIBUTION OF DELIVERABLES

The Contractor shall deliver documentation in electronic format, unless otherwise directed in Section B of the solicitation/contract. Acceptable electronic media include:

MS Word 2000/2003/2007/2010, MS Excel 2000/2003/2007/2010, MS PowerPoint 2000/2003/2007/2010, MS Project 2000/2003/2007/2010, MS Access 2000/2003/2007/2010, MS Visio 2000/2002/2003/2007/2010, AutoCAD 2002/2004/2007/2010, and Adobe Postscript Data Format (PDF).

6.4 PERFORMANCE METRICS

The table below defines the Performance Standards and Acceptable Levels of Performance associated with this effort.

Performance Objective

Performance Standard Acceptable Levels of Performance

A. VHA Package Processing Efficiency

Total boxes/packages shipped by the Contractor during a given month is divided by total hours utilized by all Contractor employees to perform shipping actions.

Maximum preparation time is 4 minutes per package

99.5% of the time measured on a monthly basis.

B. VHA Package Processing Accuracy

All packages containing Veteran PII/PI deliver successfully to customer.

100% of the time.

Each occurrence will be monitored.

C. Recall Processing Efficiency

Total recalls processed by the Contractor is divided by total hours the Contractor expended to perform the task. The maximum acceptable processing time for Veterans Health Administration (VHA) recalls is 5 minutes per request, and Records Management Center (RMC) recalls is 3 minutes per request.

99.5% of the time measured on a monthly basis

D. Recalls Processing Accuracy

Recall orders are accurately filled. 100% of the time.

Each occurrence will be monitored.

E. Refiles Processing Efficiency

Total refiles processed by Contractor is divided by total hours the Contractor expended to perform the task. The maximum acceptable processing time is 4 minutes per action.

99.5% of the time measured on a monthly basis.

F. Refiles Processing Accuracy

Refiles are returned to the requested accession and box sequence number.

100% of the time.

Each occurrence will be monitored.

The COR will utilize a Quality Assurance Surveillance Plan (QASP) throughout the life of the contract to ensure that the Contractor is performing the services required by this PWS in an acceptable level of performance. The Government reserves the right to alter or change the surveillance methods in the QASP at its own discretion. A Performance Based Service Assessment will be used by the COR in accordance with the QASP to assess Contractor performance.

6.5 FACILITY/RESOURCE PROVISIONS

The RCV is located in an underground facility. It contains office areas, a conference room, break room, mail rooms, and restrooms. There is also a two-bay loading dock accessible to two, 18-wheel freight trucks and an enclosed staging area. The only designated smoking area (includes smoking, dipping, chewing, vaping, etc.) resides outside the main cave entrance. A limited amount of employee parking is available inside the cave, with additional spaces located in the outdoors parking lot shared with other Ozark Terminal tenants. Employees will be issued parking permits. Vehicles left inside the cave without proper identification or permission from the senior RCV supervisor to remain after regularly scheduled business hours will be towed at the vehicle owner’s expense. Loitering in either parking area is prohibited.

The Government shall provide the RCV facility, including all infrastructure equipment, operating equipment (i.e., ladders, specialized carts), ADP equipment, software and technical support, telecommunications, maintenance and service contracts (i.e., security, pest control, and cleaning services), office equipment, office furniture, and supplies. All work stations (consisting of CPU, monitor, keyboard and mouse) and LAN printers will be provided for Contractor’s use where required. The workstations shall only be used as authorized. All procedural guides, reference materials, and program documentation for the project and other Government applications will also be provided on an as-needed basis.

The Contractor shall request other Government documentation deemed pertinent to the work accomplishment directly from the Government officials with whom the Contractor has contact. The Contractor shall consider the COR as the final source for needed Government documentation when the Contractor fails to secure the documents by other means. The Contractor is expected to use common knowledge and resourcefulness in securing all other reference materials, standard industry publications, and related materials that are pertinent to the work.

6.6 GOVERNMENT FURNISHED PROPERTY

6.6.1 Contractor Return of Government Furnished Equipment (GFE) Individual contractor staff shall be issued an ID badge (PIV card), parking permit, and general warehouse tools of nominal value such as a box knife, to perform duties under this PWS, herein referred to as GFE. The Contractor shall gather and return GFE (including ID badge/PIV card and parking permit) to the COR or designee when a contract employee resigns, is terminated, laid off, called to active military duty, or takes a medical or unpaid leave of absence for more than four (4) weeks. For permanently departing employees, the Contractor shall complete VA Form 3248 (200), Employee Clearance from Indebtedness, and forward to COR the last day the contract employee works

6.7 SHIPMENT OF HARDWARE OR EQUIPMENT

N/A. The Government will provide all hardware or equipment to perform tasks required of this PWS.

ADDENDUM A – ADDITIONAL VA REQUIREMENTS, CONSOLIDATED

A1.0 Cyber and Information Security Requirements for VA IT Services

The Contractor shall ensure adequate LAN/Internet, data, information, and system security in accordance with VA standard operating procedures and standard PWS language, conditions, laws, and regulations. The Contractor’s firewall and web server shall meet or exceed VA minimum requirements for security. All VA data shall be protected behind an approved firewall. Any security violations or attempted violations shall be reported to the VA Program Manager and VA Information Security Officer as soon as possible. The Contractor shall follow all applicable VA policies and procedures governing information security, especially those that pertain to certification and accreditation.

Contractor supplied equipment, PCs of all types, equipment with hard drives, etc. for contract services must meet all security requirements that apply to Government Furnished Equipment (GFE) and Government Owned Equipment (GOE). Security Requirements include: a) VA Approved Encryption Software must be installed on all laptops or mobile devices before placed into operation, b) Bluetooth equipped devices are prohibited within VA; Bluetooth must be permanently disabled or removed from the device, unless the connection uses FIPS 140-2 (or its successor) validated encryption,

c) VA approved anti-virus and firewall software, d) Equipment must meet all VA sanitization requirements and procedures before disposal. The COR, CO, the PM, and the Information Security Officer (ISO) must be notified and verify all security requirements have been adhered to.

Each documented initiative under this contract incorporates VA Handbook 6500.6, “Contract Security,” March 12, 2010 by reference as though fully set forth therein. The VA Handbook 6500.6, “Contract Security” shall also be included in every related agreement, contract or order. The VA Handbook 6500.6, Appendix C, is included in this document as Addendum B.

Training requirements: The Contractor shall complete all mandatory training courses on the current VA training site, the VA Talent Management System (TMS), and will be tracked therein. The TMS may be accessed at https://www.tms.va.gov. If you do not have a TMS profile, go to https://www.tms.va.gov and click on the “Create New User” link on the TMS to gain access.

Contractor employees shall complete a VA Systems Access Agreement if they are provided access privileges as an authorized user of the computer system of VA.

A2.0 VA Enterprise Architecture Compliance

The applications, supplies, and services furnished under this contract must comply with One-VA Enterprise Architecture (EA), available at http://www.ea.oit.va.gov/index.asp in force at the time of issuance of this contract, including the Program Management Plan and VA's rules, standards, and guidelines in the Technical Reference Model/Standards https://www.tms.va.gov/ https://www.tms.va.gov/ http://www.ea.oit.va.gov/index.asp

Profile (TRMSP). VA reserves the right to assess contract deliverables for EA compliance prior to acceptance.

A2.1. VA Internet and Intranet Standards

The Contractor shall adhere to and comply with VA Directive 6102 and VA Handbook 6102, Internet/Intranet Services, including applicable amendments and changes, if the Contractor’s work includes managing, maintaining, establishing and presenting information on VA’s Internet/Intranet Service Sites. This pertains, but is not limited to:

creating announcements; collecting information; databases to be accessed, graphics and links to external sites.

Internet/Intranet Services Directive 6102 is posted at (copy and paste the following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2

Internet/Intranet Services Handbook 6102 is posted at (copy and paste following URL to browser): http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2

A3.0 Notice of the Federal Accessibility Law Affecting All Electronic and Information Technology Procurements (Section 508)

On August 7, 1998, Section 508 of the Rehabilitation Act of 1973 was amended to require that when Federal departments or agencies develop, procure, maintain, or use Electronic and Information Technology, that they shall ensure it allows Federal employees with disabilities to have access to and use of information and data that is comparable to the access to and use of information and data by other Federal employees. Section 508 required the Architectural and Transportation Barriers Compliance Board (Access Board) to publish standards setting forth a definition of electronic and information technology and the technical and functional criteria for such technology to comply with Section 508. These standards have been developed and published with an effective date of December 21, 2000. Federal departments and agencies shall develop all Electronic and Information Technology requirements to comply with the standards found in 36 CFR 1194.

A3.1. Section 508 – Electronic and Information Technology (EIT) Standards

The Section 508 standards established by the Architectural and Transportation Barriers Compliance Board (Access Board) are incorporated into, and made part of all VA orders, solicitations and purchase orders developed to procure Electronic and Information Technology (EIT). These standards are found in their entirety at:

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards and http://www.section508.gov/content/learn/standards. A printed copy of the standards will http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=409&FType=2 http://www1.va.gov/vapubs/viewPublication.asp?Pub_ID=410&FType=2 https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards/section-508-standards http://www.section508.gov/content/learn/standards be supplied upon request. The Contractor shall comply with the technical standards as marked:

§ 1194.21 Software applications and operating systems

§ 1194.22 Web-based intranet and internet information and applications

§ 1194.23 Telecommunications products

§ 1194.24 Video and multimedia products

§ 1194.25 Self contained, closed products

§ 1194.26 Desktop and portable computers

§ 1194.31 Functional Performance Criteria

§ 1194.41 Information, Documentation, and Support

A3.2. Equivalent Facilitation

A3.3. Compatibility with Assistive Technology

A3.4. Acceptance and Acceptance Testing

A4.0 Physical Security & Safety Requirements:

The Contractor and their personnel shall follow all VA policies, standard operating procedures, applicable laws and regulations while on VA property. Violations of VA regulations and policies may result in citation and disciplinary measures for persons violating the law.

1. The Contractor and their personnel shall wear visible identification at all times while they are on the premises.

2. It is the responsibility of the Contractor to park in the appropriate designated parking areas. VA will not invalidate or make reimbursement for parking violations of the Contractor under any conditions.

3. Smoking (includes dipping, chewing, vaping, etc.) is prohibited in the entire RCV facility, anywhere within the interior cave complex, and must only occur outdoors.

4. Possession of weapons is prohibited.

5. The Contractor shall obtain all necessary licenses and/or permits required to perform the work, with the exception of software licenses that need to be procured from a Contractor or vendor in accordance with the requirements document. The Contractor shall take all reasonable precautions necessary to protect persons and property from injury or damage during the performance of this contract.

A5.0 Confidentiality and Non-Disclosure

The Contractor shall follow all VA rules and regulations regarding information security to prevent disclosure of sensitive information to unauthorized individuals or organizations.

The Contractor may have access to Protected Health Information (PHI) and Electronic Protected Health Information (EPHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”). Pursuant to the Privacy and Security Rules, the Contractor must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and EPHI.

1. The Contractor will have access to some privileged and confidential materials of VA. These printed and electronic documents are for internal use only, are not to be copied or released without permission, and remain the sole property of VA. Some of these materials are protected by the Privacy Act of 1974 (revised by PL 93-5791) and Title 38. Unauthorized disclosure of Privacy Act or Title 38 covered materials is a criminal offense.

2. The VA CO will be the sole authorized official to release in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this contract. The Contractor shall release no information. Any request for information relating to this contract presented to the Contractor shall be submitted to the VA CO for response.

3. Contractor personnel recognize that in the performance of this effort, Contractor personnel may receive or have access to sensitive…