Statement of Work_UPDATED 11-29-2022.docx

Hudson Valley VA Healthcare System Document and Material Shredding and Destruction

BACKGROUND:

The Department of Veterans Affairs, Hudson Valley Healthcare System – Castle Point and Montrose Campuses is seeking Firm Fixed Price Services to shred, destroy and dispose paper. This includes paper containing Personally Identifiable Information (PII) and other sensitive HIPAA related information from the Veterans Hospital Administration. The contractor must perform all services required to complete the full shredding and destruction of the materials. These services are necessary to protect and destroy sensitive information that is not permitted to be shared or distributed.

SCOPE OF WORK:

The Contractor must provide all labor, equipment, supervision, travel and transportation, and management to provide On-Site Material Shredding Services of paper items containing personal, confidential, and proprietary information in accordance with (IAW) federal, state and local laws and ordinances of the State of New York. The Contractor must provide for bi-monthly services directed by the Department of Veterans Affairs, Veterans Hospital Administration.

The Contractor must properly dispose of sensitive material/information in accordance with 36 CFR 1226.24 (b) for On-Site Material Shredding Service. All work is to be performed in accordance with (IAW) federal, state and local laws and ordinances of the State of New York.

The Contractor must perform the required services in compliance with HIPAA, NARA Code of Federal Regulations - 36 CFR 1226.24 and NIST SP 800-88 and to provide the Department of Veterans Affairs, Veterans, and employee privacy by destroying confidential information documents in accordance with:

1. Privacy Act of 1974, 5 USC 552a

1. Federal Records Act, 44 USC Chapter 31

1. NSA/CSS 02-01, Evaluated Products List for High Security Crosscut Paper Shredders

1. NSA/CSS 02-02-M, Evaluated Products List for High Security Disintegrators

1. VHA Directive 6300, Records, and Information Management

1. Contractor Rules of Behavior / See Appendix C

1. 36 CFR 1220.14 Subpart A, General Provisions, General Definitions

1. 36 CFR 1226.24, Destruction of Temporary Records (formerly 1228.58)

1. 44 USC 3302 § 1228.58 Destruction of Temporary Records

1. VA Directive and Handbook 0710, Personnel Suitability and Security Program

The Department of Veterans Affairs adheres to the Privacy Act of 1974 that was established to ensure that government agencies protect the privacy of individuals and businesses about information held by them.

Contractor must execute the terms of this contract in a manner that will safeguard the confidentiality of all Materials and information exposed to at any of the facilities Contractor must perform all work in accordance with the guidelines of Federal, State, and local ordinances. All safety practices prescribed by these agencies must be followed. When applicable, Material Safety Data Sheets (MSDS) are required to be submitted to the Veterans Hospital Administration COR and/or PO.

Contractor must provide one (1) vehicle capable of shredding all types of material at time of service. Contractor must perform shredding and destruction of paper items containing personal, confidential, and proprietary information with state-of-the-art, high capacity, high speed mobile shredding trucks. All shredding must be crosscut, performed with hands-free shred and be on-site at the Department of Veterans Affairs facility/location. The Contractor must utilize high speed mobile shredding trucks, which must have a camera for viewing the material being shred/destroyed, of which must be witnessed by the Privacy Officer (PO) or his/her representative. Contractor vehicles used to perform this contract must be locked and the keys removed when not in use. Vehicle(s) must be identified and parked in a predetermined location agreeable to both Veterans Hospital Administration and the Contractor.

Contractor must provide locking containers in the appropriate size(s) for the collection of the Materials intended for shredding; Containers must be locked and the material unable to be retrieved once it is placed in the container unless it is unlocked by Representative of the Department of Veterans Affairs or by the Contractor. Contractor must maintain and service the containers on a regular basis.

Contractor must place collection containers in the Loading Dock at Building 12, Montrose, NY, and Loading Dock at Building 17, Castle Point.

Contractor must do the first shred on site to the size of the refuse small enough that there is reasonable assurance in proportion to the data confidentiality that the data cannot be reconstructed. The final action must be the blending of the shredded material into a paper mash (pulping) product that can be used for recycling into new paper products.

All shredding must be accomplished on the government facility. Under no circumstances must confidential information leave the government facility prior to shredding.

All sensitive information must be made unrecognizable via shredding. At no time must contractor leave containers filled with confidential information left unattended, i.e., hallways. Contractor must be present at all times and if a concern arises, he/she must contact the Contracting Officer Representative (COR). It is the responsibility of the Contractor to ensure the contractor vehicle and shred mechanisms are operational and do not impede the requirements outlined herein.

SERVICE/COLLECTION SCHEDULE:

Each Monday of the scheduled week. If all areas cannot be serviced that Monday, contractor must complete work the next business day, Tuesday. If a Monday falls on a federal holiday, contractor must provide services the following workday - Tuesday.

REMOVAL:

Contractor must be required to report to the designated DVA facility, when contacted quarterly to shred/destroy confidential information, no later than 36 hours after notification by the DVA representative. The removal must be between 8 a.m., and 2 p.m., except on Saturdays, Sundays, and federal holidays. The government must not sort paper, remove paper clips, staples, rubber bands or any other fasteners from restricted information. After materials are completely shredded/made unrecognizable, 100% of the paper must be recycled.

ESTIMATED WEIGHTS:

Estimated weights of the government materials are based on the best available Government information which is 96 lbs. -120 lbs. The Government does not guarantee these estimated weights.

Estimated monthly Bins: 40 at Montrose Estimated monthly Bins: 15 at Castle Point

REPORTING/RECIEPTS:

Upon completion of any Shredding Service and within ten (10) business days after such service, the Contractor must provide a written report of the services rendered to the Contracting Officer’s Representative (COR).

At a minimum the report must consist of the following information:

· Service location.

· Service date(s).

· Name of Government COR at service location.

· Destruction Certificate Document number

· Date of Destruction Certification.

· Amount of shredded material (number of containers picked up and/or pounds shredded).

Any violation observed or encountered must be reported IMMEDIATELY to the Contracting Officer’s Representative (COR), advising the Department of Veterans Affairs of the violation.

At the time of each removal the Privacy Officer must require the contractor or his authorized representative to sign a receipt. The receipt must include the following information:

1. Signatures of contractor representative and the Privacy Officer.

2. Number of containers, estimated weight, and type of materials; and

3. Date of removal.

Along with receipts, the Contractor must furnish to the Privacy Officer a certificate and/or record of destruction that all confidential materials collected were properly destroyed in accordance with all applicable laws and regulations (such as Sarbanes-Oxley, HIPAA, NAID, and the FACTA Disposal Rule). The Privacy Officer must furnish the Contractor one copy of the receipt and forward one copy to the COR.

CONTRACTOR IDENITIFATION:

Prior to commencement of work on this contractor personnel who are related to this Statement of Work must have a background check completed.

Contractor employees must have their name and company’s logo visible on their uniforms. Contractor personnel involved in the actual handling and shredding of Materials must wear a contractor-provided, clearly readable identification badge that at a minimum state, the name of the employee and the company.

Contractor must report to the Police Station of the VHA Hudson Valley Health Care Service, Offices located in building 15 at Montrose and building 8 at Castle Point Campus to sign-in using name, date, and time reported; collect "Visitor Badge(s) “ and receive appropriate instructions prior to accomplishing the collection and destruction of sensitive information via cross-shredding.

Contractor may be accompanied by a VA employee to ensure that all consoles are properly collected, sensitive information is being properly handled, and disposed of in accordance with all federal, state, and local regulations. Under no circumstances must the contractor engage in arguments, etc. with DVA, visitors, volunteers, etc.

Upon completion of work, Contractor must report to PO or his/her designated representative, return "Visitor Badge(s)", and sign-out using name, date, and time departed.

PRIVACY REQUIREMENTS:

Prior to award of contract the Contractor must provide a signed Business Associate Agreement regarding Veteran Privacy. The background investigation must be repeated throughout the term of the contract so that all investigations are current (less than five years old.)

CERTIFICATIONS:

Contractor must be National Association for Information Destruction certified to perform the Shredding Services work; Contractor must furnish a copy of its up-to-date and current certification to the Department of Purchasing and Contracting and to the COR upon request and prior to the start of the contract.

PERIOD OF PERFORMANCE:

The base period of performance will be from January 1, 2023, to December 31, 2023, with provision of four (4) Option Years.

PLACE OF PERFORMANCE:

Department of Veterans Affairs Hudson Valley Healthcare System – Castle Point Campus 41 Castle Point Road Castle Point, NY 12511

Department of Veterans Affairs Hudson Valley Healthcare System – Montrose Campus 2094 Albany Post Road Montrose, NY 10548

WORKING HOURS:

All work must be completed between the hours of 8:00 AM ET – 2:00 PM ET excluding weekends and federal holidays.

Federal Holidays observed by the Federal Government are:

- New Year’s Day

And any other holiday designated by the President of the United States.

VHA Supplemental Contract Requirements for Combatting COVID-19

1. Contractor employees who work in or travel to VHA locations must comply with the following:

1. Documentation requirements:

0. If fully vaccinated, contractors shall show proof of vaccination.

0. NOTE: Acceptable proof of vaccination includes a signed record of immunization from a health care provider or pharmacy, a copy of the COVID-19 Vaccination Record Card (CDC Form MLS-319813_r, published on September 3, 2020), or a copy of medical records documenting the vaccination.

0. If unvaccinated, contractors shall show negative COVID-19 test results dated within three calendar days prior to desired entry date. Test must be approved by the Food and Drug Administration (FDA) for emergency use or full approval. This includes tests available by a doctor’s order or an FDA approved over-the-counter test that includes an affiliated telehealth service.

0. Documentation cited in this section shall be digitally or physically maintained on each contractor employee while in a VA facility and is subject to inspection prior to entry to VA facilities and after entry for spot inspections by Contracting Officer Representatives (CORs) or other hospital personnel.

0. Documentation will not be collected by the VA; contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

1. Contractor employees are subject to daily screening for COVID-19 and may be denied entry to VA facilities if they fail to pass screening protocols. As part of the screening process contractors may be asked screening questions found on the COVID-19 Screening Tool. Check regularly for updates.

1. Contractor employees who work away from VA locations, but who will have direct contact with VA patients shall self-screen utilizing the COVID-19 Screening Tool, in advance, each day that they will have direct patient contact and in accordance with their person or persons who coordinate COVID-19 workplace safety efforts at covered contractor workplaces. Contractors shall, at all times, adhere to and ensure compliance with federal laws designed to protect contractor employee health information and personally identifiable information.

1. Contractor must immediately notify their COR or Contracting Officer if contract performance is jeopardized due to contractor employees being denied entry into VA Facilities.

1. For indefinite delivery contracts: Contractor agrees to comply with VHA Supplemental Contract Requirements for any task or delivery orders issued prior to this modification when performance has already commenced.