FINAL STATEMENT OF WORK 9.8.22.docx

?.## STATEMENT OF WORK

1. REQUIREMENT

Collection and destruction of sensitive documents from the VA New York Harbor Healthcare System (VA NYHHS) along with any associated off sites as listed at the following locations:

Serviced Weekly:

Manhattan Campus 423 E 23 Street New York, NY 10010

Brooklyn Campus 800 Poly Place Brooklyn, NY 11209

Serviced Bi-weekly

St. Albans Community Living Center 179-00 Linden Blvd Jamaica, NY 11425

Serviced Monthly:

Staten Island Community Based Outpatient Clinic (CBOC) 1150 South Ave, 3rd Floor – Suite 301 Staten Island, NY 10314

Harlem Community Based Outpatient Clinic (CBOC) 55 West 125th Street 11th Floor, Room 1101 New York, NY 10027-4544

2. SCOPE

Description of Services: Contractor shall ensure that document information/material is secure from the point of pick-up to the point of destruction; ALL documents must be destroyed beyond recognition before leaving the VA grounds. The Contractor shall be required to make pick-ups as required of large volumes of documents generated for destruction, i.e. boxes of documents needing destruction on an as needed basis. Contractor shall use the checklist of consoles for each site; visiting each location to empty the contents into a totter to then transport for destruction. Contractor shall check off all that have been serviced. The day(s) of pick-up shall be agreed upon by the Contracting Officer’s Representative (COR) and the Contractor. A schedule of service dates shall be provided to the COR on the first day of the contract. The COR representative for each medical center shall provide a listing of console locations to be serviced. This checklist shall be kept current by both the COR and vendor.

Technicians servicing this contract are required to pass background checks performed by the Government at the Contractor’s cost along with TMS training BEFORE commencement of providing service under this contract.

Training certificates must be provided to COR representative at each medical center location. Technicians will take the required training (Privacy and HIPAA: TMS code 10203 and Privacy and Information Security: TMS code 10176) on an annual basis in the TMS system.

Each VA NYHHS facility shall have the opportunity to increase and/or decrease the number of totters utilized as needed.

· Contractor shall provide secured/locked totters as needed. Consoles will not be needed; VA NY Harbor Healthcare System owns their own shred consoles.

· Contractor shall work with COR representatives in keeping the listing of totters current.

· If totters are removed from the facility the contractor shall fill out “Totters removed” form below with how many totes are leaving the facility at each site. This form shall be left with the COR representative or designee at end of day’s service.

· Contractor shall provide servicing totters per instructions of COR.

· Contractor must be able to destroy materials regularly placed in consoles and totters of the following mixed type:

· Paper of any color, envelopes, labels

· Paper clips, staples, binding left on disposed paper

Contractor shall destroy materials regularly placed in consoles and totters in the manner prescribed in VA Handbook 6500; Risk Management Framework for VA Information Systems – tier 3: VA Information Security Program; and VA Directive 6371, Destruction of Temporary Paper Records.

Final Destruction is the process through which temporary paper records are pulped, macerated, shredded or otherwise destroyed to a degree that definitively ensures that they are not readable or reconstructable to any degree. An original Certificate of Interim Destruction, signed in ink, must be provided to the COR representative (or designee) after each shredding service and shall include the number of bins serviced, the total pounds shredded, sign in and out on-site service date and time. Sensitive documents picked up from the VA must go directly to the point of destruction with no other stops. The contractor must provide written notification to the COR representative should there be stops before the point of final destruction. If there are any stops, the truck and contents must be secured. A Certificate of Final Destruction must be provided to the COR representative after Final Destruction takes place. The Final Destruction Certificate must include the number of bins serviced, the total pounds, contractors name, date, time and method of final destruction.

The contactor shall destroy all material on the same day of pick up or provide written notification to the COR justifying why destruction is delayed and what the contractor has put in place to protect the material (electronic mail is acceptable). In no case shall the contractor hold any material for more than 24 hours. The contractor must have a process in place to ensure that the truck is always locked and the number of stops is limited when VA materials are on-board.

Contractor-Owned Supplies/Equipment:

The Contractor shall provide all sites covered by this contract, totters at no cost to the Government. NYH requires approximately 56 Totters (96 Gallon) dispersed between campuses as indicated in the chart. The VAMCs shall be allowed to increase or decrease the number of totters as needed. If an extra totter is needed for any reason, the contractor shall supply the totter for the time necessary and then remove it. Any additional cost incurred will be satisfied either by purchase card or contract modification. Keys to all totes placed at the VA sites shall be provided only to the COR representative.

NYH requires only Totters. Consoles are owned by the site.

Totters shall meet the following specifications:

· Totters shall accommodate 65-96 gallons or 200-300 pounds of material when full.

· Totters shall be easily mobile (have wheels)

· Totters shall be plastic in nature

· Totters shall be locked with lock and keys to be provided by Contractor to the COR or designee.

· Totters shall have a slot on top of unit approximately 2" X 17"

· Totters shall be able to accept labeling for type of material acceptable.

The schedule below is for your reference, it indicates pick up frequency and disbursement of both shred consoles (VA owned) and Totters.

Stationary (VA owned)

Mobile (Vendor owned)

Stationary (VA owned)

Street 11th FL

Stationary (VA owned)

Stationary (Vendor Owned)

Stationary (VA owned)

(Vendor owned)

Stationary (VA owned)

(Vendor owned)

Approximate Weight per month:

Brooklyn Campus - 10, 320 lbs.

St. Albans Campus – 6042 lbs.

Manhattan Campus - 3,570 lbs.

Staten Island CBOC - 210 lbs.

Harlem CBOC - 69 lbs.

REQUIREMENTS AT EACH FACILITY

Facility Contractor Badge: Contractor personnel shall get a vendor badge from the Police Office at each medical center location. Badges must be returned to the PIV Office at the end of the contract, the expiration date of the badge, or termination of Contractor employment.

Service Check List: A listing of all bins at the facility shall be provided to the technician(s) each service date. The technician must check off each bin serviced and turn in this checklist to the COR representative or designee at the end of each service date. These listings of bins are subject to change as bins are increased and/or decreased. The technician is to check off each room serviced; if a bin is not available to service, do not check off as serviced. Checklists are to be turned in to COR representatives or Administrative staff at each site.

New York Campus – Certificate of Destruction is hand delivered to Environmental Management Service (EMS) Office located in room 10046W Brooklyn Campus – Certificate of Destruction is hand delivered to EMS Office located in room 2-220 Saint Albans Campus – Certificate of Destruction is hand delivered to EMS Office room A-135 Harlem CBOC – Certificate of Destruction is delivered electronically to New York Campus Staten Island CBOC- Certificate of Destruction is delivered electronically to Brooklyn Campus

Bin Locations The location of bins to be serviced shall be identified by the COR the day the contract starts.

The “Bins Removed” form attached in section D shall be documented at time of service with how many totes are leaving the facility at each site. Leave this form with the COR representative or designee at end of service.

Work Hours: Regular business hours for the EMS offices are 7:00 AM to 3:30 PM, Monday through Friday. The Contractor shall provide a work schedule with a timeframe and preferred day of service (i.e. Tuesday October 6th, 2020 7:00 AM EST) to the COR representative or his/her designee no later than the contract commencement date for approval. Any change in dates must be verified with the COR representative 24 to 48 hours before change may take place. If the regular scheduled pickup date is a Federal holiday, pickup shall be the following day.

Documentation: The Contractor shall maintain an excel spreadsheet or other acceptable spreadsheet of pounds removed from each VA NYHHS site and provide a copy monthly to all respective COR representatives reflecting the total pounds removed that month for tracking purposes. The original, signed in ink, Final Certificate of Destruction must be given to the VA NYHHS COR representative after each service date. The Final Certificate of Destruction shall contain the following: date received, pounds removed that service date, method of disposal, certify during the witnessed shredding the date/time.

SUBMISSION REQUIREMENTS:

A) Quoter demonstrated a knowledge of 36 CFR 1228.58, Destruction of Temporary Records and outlined how it would incorporate VHA Directive 6371, servicing Veterans Affairs healthcare facilities.

B) Quoter demonstrated it has capability to continue service in the event of inclement weather or natural disaster and other emergency situations.

C) Quoter demonstrated quality assurance surveillance plan and procedures for mitigating deficiencies in security and safety of sensitive documents prior to and after the shredding destruction service is performed.

D) Quoter provided required documents with their quote.

3. QUALITY ASSURANCE SURVEILLANCE PLAN

The Contractor, and not the Government, is responsible for management and quality control actions to meet the terms of the contract. The role of the Government is quality assurance to ensure contract standards are achieved. The Contractor and the COR shall develop specific monitors covering work performance and management under this contract. A copy of these monitors shall be maintained by both parties. Monitors shall be completed no later than six (6) weeks after date of award. The Government will monitor the Contractor’s performance under this contract utilizing customer complaints, performance requirements, and random quality assurance inspections.

Quarterly Meetings with COR:

It is the COR’s responsibility to develop a monthly schedule with the vendor to discuss any issues or concerns the Government may have in regard to collecting sensitive documents from VA owned consoles, Certificates of Destruction and activities based on the surveillance plan’s requirements. This schedule will cover the times during which work is being performed or re-performed under the terms of this contract. The surveillance schedule will be monthly. The monthly schedule will be completed by the last workday of the preceding month and a copy will be submitted electronically to the Contracting Officer for information. The COR will routinely inspect containers on site and document the inspection. Unannounced inspections will be completed periodically with the facility Privacy Officer(s) and COR to ensure information within the containers are always safeguarded.

4. SECURITY REQUIREMENTS

Final Destruction: Final Destruction is the process through which temporary paper records are pulped, macerated, shredded or otherwise destroyed to a degree that definitively ensures that they are not readable or reconstructable to any degree. Final destruction performed at or away from a VA facility must be performed, where practicable, by a bonded and insured recycler or paper mill, and any intermediary processes must protect the records until final destruction is completed. Final destruction will be witnessed by the contractor employee.

Final Destruction is the process through which temporary paper records are pulped, macerated, shredded or otherwise destroyed to a degree that definitively ensures that they are not readable or reconstructable to any degree. Methods of destruction carried out by a contractor must be witnessed by a Federal employee or, if authorized by the organization that created the records, a contractor employee may act as witness, and the written attestation shall be submitted to the organization that created the records. The contractor employee may be the vendor performing the destruction as long as a final certification of destruction is provided to VA.

Certifications of destruction must be maintained in accordance with applicable VA Records Control Schedules and should only be accepted from data destruction or recycle vendors after final destruction has actually taken place.

Contracts for destruction of temporary paper records must include specific clauses to ensure that PII and other sensitive temporary records are handled in a secure manner until they undergo final destruction. At a minimum, these contracts shall require documentation that any contractor who will handle the records until final destruction is completed is bonded and insured for paper/printed media destruction and can provide reasonable physical safeguards for the data throughout the destruction process.

Records Management Clause needs to be added to any Contracts requiring the creation, use, storage, or disposition of Federal Records:

Use of Contractor's site and services may require management of Federal records. If the contractor holds Federal records, the contractor must manage Federal records in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. chapters 21, 29, 31& 33), and regulations of the National Archives and Records Administration (NARA) at 36 CFR Chapter XII Subchapter B). Managing the records includes, but is not limited to secure storage, retrievability, and proper disposition of all federal records including transfer of permanently valuable records to NARA in a format and manner acceptable to NARA at the time of transfer. The agency also remains responsible under the laws and regulations cited above for ensuring that applicable records management laws and regulations are complied with through the life and termination of the contract.

5. CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

All contractor employees will require a background investigation and must receive a favorable adjudication from the VA Office of Security and Law Enforcement prior to commencement performing contract services. This requirement is also applicable to all subcontractor personnel.

Position Sensitivity – The position sensitivity has been designated as Low Risk for Document Destruction services.

Background Investigation – The level of background investigation commensurate with the required level of access is National Agency Check with Written Inquiries (NACI/Tier 1).

Contractor Responsibilities

1. The contractor shall bear the expense of obtaining background investigations. If the Office of Personnel Management (OPM) conducts the investigation, the contractor shall reimburse VA within 30 days. If timely payment is not made within 30 days from date of bill for collection, then VA shall deduct the cost incurred from the contractors 1st month(s) invoice(s) for services rendered.

1. Training: All contractors and sub-contractor’s employees are required to complete VA’s Privacy and Information Security Awareness and Privacy and HIPAA Training courses annually on-line; TMS Course #10176 and #10203. Contractor and subcontractors employees will provide a course certificate to the COR representative when completed.

1. The contractor shall prescreen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship and are able to read, write, speak and understand the English language.

1. The contractor, when notified of an unfavorable determination by the Government, shall withdraw the employee from consideration from working under the contract.

1. Failure to comply with the contractor personnel security requirements may result in termination of the contract for default.

Government Responsibilities

a. The contracting officer will forward the names, social security numbers, and dates of birth of the contractor’s employees to the VA Law Enforcement Training Center/SIC.

b. The VA Law Enforcement Training Center/SIC will provide the necessary investigative forms to the contractor or to the contractor's employees, coordinate the background investigations, and notify the contracting officer and contractor of the results of the investigations.

c. The VA facility will pay for requested investigations in advance. A bill for collection will be sent to the contractor to reimburse the VA facility. The contractor will reimburse the VA facility within 30 days. If timely payment is not made within 30 days from date of bill for collection, then VA shall deduct the cost incurred from the contractors 1st month(s) invoice(s) for services rendered.

d. The current fees associated with NACI/Tier 1 background investigations are $297.00 each for low level investigation.

Records Management:

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain and manage all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

4. VA New York Harbor Healthcare System (NYHHS) and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of NYHHS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to NYHHS. The agency must report promptly to NARA in accordance with 36 CFR 1230.

5. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to NYHHS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph (4).

6. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and NYHHS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

7. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with NYHHS policy.

8. The Contractor shall not create or maintain any records containing any non-public NYHHS information that are not specifically tied to or authorized by the contract.

9. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

10. NYHHS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which NYHHS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through FAR 52.227-20.

11. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle Federal records are required to take VHA-provided training, as specified by the NYHHS Privacy Officer. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

D. Flow down of requirements to Subcontractors

1. The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph, in all subcontracts under this [contract vehicle], and require written subcontractor acknowledgment of same.

2. Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor.

VHA Supplemental Contract Requirements for Ensuring Adequate COVID-19 Safety Protocols for Federal Contractors

1. Contractor employees who work in or travel to VHA locations must comply with the following:

a. Documentation requirements:

1) If fully vaccinated, shall show proof of vaccination.

i. NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS-319813_r, published on September 3, 2020), or a copy of medical records documenting the vaccination.

2) If unvaccinated and granted a medical or religious exception, shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor’s order or an FDA approved over-the-counter test.

3) Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by the Contracting Officer Representative (COR) or other hospital personnel.

4) Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

2. Contractor employees are subject to daily screening for COVID-19 and may be denied entry to VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the COVID-19 Screening Tool. Check regularly for updates.

a. Contractor employees who work away from VA locations, but who will have direct contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance, each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

3. Contractor must immediately notify their COR or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities.