36C25023Q0035 0002.docx

Amendment to a Previous Combined Solicitation

Amendment to a Previous Combined Solicitation

GENERAL INFORMATION

CONTRACTING OFFICE ADDRESS

Department of Veterans Affairs Network Contracting Office - NCO 10 3140 Governor’s Place Blvd. Suite 210 Kettering OH 45409-1337

POINT OF CONTACT*

Contract Specialist Josh Kovar Joshua.Kovar@VA.gov

All Questions Shall Be emailed to POC above.

PLACE OF PERFORMANCE

Multiple Medical Centers and CBOCs

See PWS for full listing

POSTAL CODE

COUNTRY

ADDITIONAL INFORMATION

AGENCY’S URL

URL DESCRIPTION

AGENCY CONTACT’S EMAIL ADDRESS

EMAIL DESCRIPTION

DESCRIPTION

The purpose of this email is to answer questions from industry, update the PWS, Update Price/Cost Schedule CLIN/SLINs, and to issue a new pricing sheet that will be utilized for quote responses.

Questions and Answers:

1. Some of the frequency of pickups vary from location to location (i.e. 2X month or bi-weekly) would it be possible to adjust "monthly" to "Every 4 weeks" and "2X Month" to "bi-weekly"?

The Government changed the frequency to every 4 weeks and bi-weekly to allow for ease of invoicing. If any instances of monthly pickup exist in the PWS or CLIN/SLINS they shall be considered as every 4 weeks and bi-weekly.

2. On page 112 of the solicitation there are 2 separate addresses for Bloomington. 1 is Bloomington CBOC and the other is the Mental Health Facility. There are no container counts for either facility and unless I've overlooked it, I don't believe it is listed in any of the CLINs or SLINs.

The Government removed the instances of these 2 locations (Bloomington CBOC and Bloomington Mental Health) from the PWS.

3. On the pricing spreadsheet in Battle Creek's Grand Rapids CBOC (frequency = Bimonthly), it shows a quantity of 26. Is that correct or should it be 6 The CLIN is now correct, changed to Bi-Weekly service

4. In the pricing schedule document, I see on line-item 0015 - BATTLE CREEK VA MEDICAL CENTER - MEDIA SHREDDING SERVICES: Main Campus, they are in need of the Location and Bin Size for a Quarterly pickup. Has the location and bin size been determined for this line item?

The CLIN, 0015 has been updated along with all the option years, 1015, 2015, 3015 to include QTY 1 (23-Gallon SlimJim) bin. The location is still being isolated and shall be forthcoming.

5. Can you please confirm that NORTHEAST OHIO VHS - CBOCs - DOCUMENT DESTRUCTION SERVICES do not begin until Option year 2?

They do not start in OY2, they start in OY1, but previously referenced OY2 due to an unseen error with the contract writing system. Northeast Ohio VA Healthcare System Facilities AND CBOCs do not start until OY-1, on 1/1/25: CLINS 1019AG, 1020, 1021, 1022 – See note below regarding CLIN restructuring.

6. Can you provide the incumbent information? Contract Number? Vendor?

36C25023C0013 – The Rapid Group LLC 36C25023C0014 – Dunlap Government Solutions 36C25022P1136 – Chermat Holdings LLC 36C25020C0052 – Gateway Recycling End of Questions and Answers Additional Changes to the CLINS/SLINS not specifically addressed in the QA portion of this document.

To ease vendor input and Government evaluations the following CLINS/SLINS have been restructured. (X is the OY POP.)

CLIN X019 – Facility Purging CLIN 1020, 2020, 3020 – NE Ohio VA main Facility CLIN 1021, 2021, 3021 – NE Ohio CBOCs CLIN 1022. 2022, 3022 – Media Destruction – NE Ohio.

X0011 – Kettering Contracting Offices has been changed to (every 4 weeks of service).

Please see below for updated PWS and Location information.

Please see updated Excel attachment: Price-Cost Schedule_Q0035-v2.xls.

Submission of your response shall be received not later than 12/29/2022 at 1:30PM via email to Joshua.Kovar@VA.gov. (Please see note below regarding email attachment limitations) Late submissions shall be treated in accordance with the solicitation provision at FAR 52.212-1(f).

Any questions or concerns regarding this solicitation should be forwarded in writing via e-mail to the Point of Contact listed below.

Point of Contact Josh Kovar Joshua.Kovar@va.gov

All questions SHALL be submitted no later than 12/20/2022 by 13:30 (1:30 PM EST) via email. Phone queries will not be entertained. Questions received after the Q/A deadline may not be answered.

*VA has a maximum allowable incoming email size limitation including attachments of seven megabytes. Offerors submitting responses via email which exceed seven megabytes shall split their response into multiple email messages so as to not exceed the maximum allowable email size limitation. The VA is not responsible for late responses due to undelivered e-mails that exceed seven megabytes

Performance Work Statement Document Destruction (Shredding) and Media Destruction Services

1. GENERAL: This is a non-personnel services contract to provide Document and Media Destruction services. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

A. Description of Services / Introduction: The contractor shall provide all personnel, equipment, tools, materials, vehicles, supervision, and other items and services necessary to perform collection, and shredding of paper /and non-paper media materials at Veterans Integrated Service Network (VISN)10 facilities including:

· Battle Creek VA Medical Center

· Chillicothe VA Medical Center

· Cincinnati VA Medical Center

· Chalmers P. Wylie VA Ambulatory Care Center

· Dayton VA Medical Center

· VAMC Outpatient Clinics and Community Based Outreach Centers (CBOCs)

· VA Off-Site Administrative Offices

· VA Northeast Ohio Healthcare System

Complete list of all facilities to be serviced is available in Appendix B

The Contractor shall be certified by (NAID) National Association for Information Destruction. The contractor shall perform to the standards in the contract as well as all local, state, and federal regulations. Paper materials will be defined as any type of paper used in an office environment, such as copy paper, brochure paper, newspaper, coated stock, slick magazine-type paper, envelopes, computer paper, any type of note paper, manila folders, and hanging folders. Contractor will not require cardboard inserts, staples, paper clips, binder clips, rubber bands, or plastic covers to be removed from material placed in collection units.

Shredding of non-paper media includes CDs, VHS or cassette tapes, PIV badges, government credit cards. Non-Paper media shall be picked up from not more than two areas within the medical facilities (ISO and/or Privacy office). Pickups are not anticipated to be necessary more than once a quarter at any of the sites.

COMPETENCY OF PERSONNEL CONDUCTING SHREDDING:

The Contractor and any/all subcontractors (if applicable) shall be National Association for Information Destruction (NAID) certified. Certification shall be continued/renewed during the entirety of the contract period of performance.

B. COLLECTION SITES: Each site will appoint a Technical Contract Officer's Representative, (T-COR) to address local issues and communicate with the contractor as needed. The local Technical CORs will include the VISN COR in all communication between the local facility and the contractor. The Contractor shall collect all materials from the Contractor supplied lock boxes (consoles) or designated Contractor secured holding area. All consoles will be emptied as scheduled regardless of the volume of paper that they hold. Locations to be collected from and bin quantities are listed in Appendix 1. List is subject to change based on revised usage or needs.

C. CONTAINERS: The Contractor will supply secure collection containers (consoles) that are aesthetically pleasing and fit for use in public areas. Standard Containers will have a capacity of no more than 32 gallons. They will be lockable and tamper-resistant/evident. All containers will be numbered, and a list of the container location(s) shall be provided to the COR and Contracting Office. The Contractor will supply keys for the containers to the local COR's, ISO, and other staff as required and confirmed by the Contracting Officer. Contractor shall ensure that all bins/cabinets are labelled with contact information for facility personnel to contact should an issue arise with the bin/cabinets that is construction or lock related. Also, the vendor shall allow VA staff to affix instructional signage on the bins.

D. MAINTENANCE: The contractor will be responsible for the routine maintenance and repair of all contractor-owned equipment at no cost to the government.

E. PERSONNEL: All contractor staff will be uniformed as appropriate and will always display photo ID badges. Contractor staff will check in with designated Facility point of contact upon arrival at the facility.

F. COLLECTIONS: All collections and destruction will be conducted during normal business hours (M-F 0800-1630) unless prior written approval from facility management is obtained. The contractor shall service each collection point and remove all material and shred within 24 hours of collection in accordance with the following schedule. Any variation from this requirement must be approved in writing from Facility Management:

1. VA Medical Centers and Ambulatory Care Centers - See Schedule in Addendum A

2. Community Based Outpatient Clinics – See Schedule in Addendum A

3. Off-Site Admin Offices (Network Contracting Offices) – See Schedule in Addendum A

4. Other VA Supported facilities – See schedule in Addendum A

Collection schedules at Community Based Outpatient Clinics may be altered to accommodate need. The contractor will communicate any anticipated changes to collection dates and/or times to the COR and CBOC Officer in charge at least one (1) week prior to the service date.

If any location cannot be serviced for any reason including locked doors or buildings, it is the contractor’s responsibility to reach out to the applicable site COR immediately. Additional remediation efforts shall be sent to the Privacy officer, site COR, and the contracting officer/specialist. A spreadsheet of POC’s shall be provided with a list of locations upon contract award. Updates to contact information, bin locations, or additional bins shall be sent as soon as possible to all parties.

The Government reserves the right to add or remove any additional Medical Centers, CBOC’s or other facilities to the contract as they become available. Furthermore, the Government reserves the right to increase or decrease frequencies of collections to allow for fluctuations of client demand that are otherwise unknown at time of solicitation. The total contract value may increase up to 15% of the base award.

G. UNSCHEDULED COLLECTIONS: The contracting officer may require the contractor to make unscheduled collection or purge, disposals, and relocation of containers for special events or other occasions. The contractor will respond within 48 hours of the request. If additional cost will be incurred, the contractor will provide an estimate of anticipated expense prior to providing service. Additionally, the contractor will respond to requests for additional equipment, equipment moves, etc. within one business day.

All purges will be quoted in 300 “Banker Box” increments in the price cost schedule. Vendor will accept GCPC – Government Purchase Credit card for all purges under the maximum allowable threshold. If the maximum allowable threshold is eclipsed, then the ACO shall issue a separate purchase order on a case-by-case basis.

H. INCLEMENT WEATHER SCHEDULE: The contractor shall collect during periods of inclement weather. In cases of severe weather, the contracting officer or COR may authorize exceptions. When exceptions are granted, the contractor shall make up all missed collections within 24 hours after the severe weather has terminated, unless the contracting officer or COR authorizes additional time.

I. ROUTE PARAMETERS: The contractor shall communicate with local facilities to establish routes to the facilities as well as identifying any access requirements and/or restrictions within the facilities.

J. POINTS OF COLLECTION: The contractor shall position containers for customer ease in depositing materials. This may require repositioning of containers from time to time. The contractor shall also position containers to minimize interference with foot traffic within areas being serviced. Containers will be placed in accordance with applicable safety and security regulations.

K. CAPACITY: Proposed capacity of containers is such to maximize the use of available space. The government reserves the right to change any collection station or change the number of collection stations if it does not impact resources needed by the Contractor to fulfill the requirement of this PWS. The contractor shall comply with the request to move collection station during next collection date. If movement is required to alleviate a health or safety issue the government will move container and notify contractor of the new location. The government may also reduce the frequency of collections. Purges of large volumes of materials may be arranged as a special and additional service. Office purges or special service shall be arranged through the COR.

L. GOVERNMENT-APPROVED CONTAINERS: Collection of materials in all areas shall be from contractor-provided, government-approved containers. All changes to collection containers must be approved by the local facility management prior to placement.

M. MAINTAINING CONTAINERS AND COLLECTION AREA: The contractor shall return the containers to their original location after servicing. The contractor will also be responsible for immediately cleaning up any debris, etc., which may occur during servicing of containers. All materials identified in para A. DESCRIPTION OF SERVICES located on the ground within ten feet of the container, whether by the contractor or placed there by facility personnel, shall be picked up by the contractor during the shredding process, leaving the area intact. Any refuse (trash) remaining shall be identified to the COR (or facility housekeeping / EMS staff) for removal and disposal. Collected material will always be secured and under the control of the contractor during the collection and shredding process.

Containers are to be constructed with a deadbolt lock and an offset document slot to prevent unauthorized removal of material. The unit is to securely hold approximately 100 pounds of material. Containers (non-wheeled style) can be no larger than 32 gallons. Wheeled containers can be no larger than 95 gallons. Collections shall always remain in the vendor’s sight. Items shall remain in locked containers while transporting from collection sites to the mobile shredding vehicle.

All services provided under this contract must be performed in conformance with VA Directive 6371. http://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=742&FType=2

N. OFF-SITE DISPOSAL: The contractor shall transport all material in a locked vehicle. Contractor will dispose of all shredded material at a licensed off-site disposal area selected by the contractor. Material will be destroyed with the standards set forth in VA Directive 6371 April 8, 2014 (Destruction of Temporary Paper Records). Disposal shall comply with all existing local, state, and federal regulations. The contractor shall be responsible for any permit or fees associated with the use of off-site disposal locations. All materials will be shredded by producing particles that are 1x5 millimeters in size or that will pulverize/disintegrate paper material using disintegrator devices with a security screen. All materials shall be shredded in a mobile shredding vehicle prior to removal from the premises and all materials shall meet a VA Directive 6371 shredding requirement before being disposed of according to all local, state and federal regulations. If the mobile vehicle cannot meet the VA Directive 6371 requirement the contractor shall transport the shredded materials to a secure facility in order to meet that final requirement.

O. REPORTS AND RECORDS: Contractor shall provide the following information (at a minimum).

· Monthly report and invoice detailing actual tonnage of materials shredded.

· Certificates of destruction for each location.

· Certificates of destruction shall document the chain of custody of all materials up to the final destruction of the material.

· Certificates of destruction shall identify at a minimum,

· Date of Pickup from facility

· Amount (in weight) picked up

· VA personnel signing for pickup

· VA Hospital location

· Bin location(s)

· Destruction Date

· Amount (in weight) destroyed

· Final signature of personnel who witnessed destruction of materials.

· Total actual weight of materials destroyed

A copy of each certificate of destruction will be supplied on a minimum of a monthly basis to the Privacy Officer, Record Manager, and COR. A list of station personnel will be provided to the contractor upon award of contract and/or kick-off meeting.

· The vendor will supply a final destruction sample to the Privacy Officer on a quarterly basis.

· Contractor shall be required to submit monthly documentation on recycling credits and poundage of shredding.

Contractor shall monitor the usage of containers and under no circumstances are containers to be added and/or removed from locations without prior approval from the COR. Contractor shall notify the COR if containers are being underutilized or if additional containers are needed for any particular area at all locations.

The contractor will provide personnel government approved security clearance, and or training records upon request. Weekly collection invoices for the main facility and all associated CBOCs will be delivered to the facility COR within five business days of collection.

P. Minimum Standards for Information Destruction: Information destruction contractors and subcontractors must be able to meet the following standards:

1. Physical and Operational Security

a. Monitored Alarm System(s) that include the following:

• Motion Detectors;

• Door Contacts;

• Battery Back-Up; and

• Monitoring Service.

b. Taped Closed Circuit TV (CCTV) monitors with the following:

• Fully Functional Cameras;

• Recording Devices; and

• Secure Recording Tape Library.

c. Sufficient Lighting to allow CCTV

d. Locks and Key Controls

e. Visitor Logs

• Visitor In/Out Logs; and

• Visitor ID Badges.

f. Written Policies and Procedures

2. Documentation and Control of Resources

a. Documentation and control of contractor:

b. Documentation and control of employees:

• Documentation of who has access to materials (minimum necessary access only is allowed);

• Documentation of background investigations (types and frequency);

• Documentation of citizenship, naturalization (no non-US citizens);

• Documentation of drug screen; and

• Documentation of re-evaluation of above items (at least every two years).

c. Documentation and control of destruction equipment:

• Type (Mobile or Plant-Based);

• Manufacturer and Model;

• Serial Number; and

• Dates of non-operational downtime for repair.

d. Documentation and control of destruction and collection vehicles:

• Vehicle make and model;

• License plate number;

• State/County of registration;

• Acceptable overnight storage address and location;

• Acceptable roadworthiness of vehicles;

• Locks and security of vehicles; and

• Driver logs to show who has control of vehicle at any given time.

e. Documentation and control of all recipients of materials:

• Name of individual/company;

• Address where received;

• Method of final disposition; and

• Certifications of destruction (general documentation acceptable as long as it is attributable to VA’s data (e.g., “bails shipped on <date> were pulped on <date>).

Q. Other Operational Requirements

a. All destruction will take place within the enclosure of the destruction facility, which consists of four solid walls and a ceiling, and meets all criteria related to physical building security.

b. The only permissible uses of a mobile destruction vehicle will be within the enclosure of the destruction facility, on-site at the VA’s premises, or at an off-site location if approved of in advance by VA and is located within walking distance of the VA premises.

c. A log is kept to record the dates and times that the mobile destruction vehicle is operating within the destruction facility, which shall be made available to VA during an audit, by means of review of CCTV images.

d. The mobile destruction vehicle will be made available to VA for audit, within the enclosure of the destruction facility, during the initial audit and during all scheduled re-audits, for demonstration purposes.

R. QUALITY CONTROL AND QUALITY ASSURANCE FOR CONTRACT SERVICE: The contractor shall be responsible for effective implementation of their Quality Control Program, and shall be responsive to the requirements of the Government’s Quality Assurance Plan conducted by the COR.

a. Quality Control. The contractor shall have a Quality Control program to assure that the requirements of the contract are provided as specified. One copy of the Contractor’s basic Quality Control Program shall be submitted for approval by the COR. Subsequent changes to the approved Quality Control Program must also be reviewed and approved by the COR with final approval by the Contracting officer. The program shall include, but not be limited to the following.

1. An inspection system covering the performance indicators given in the Quality Assurance/Performance Requirements table below.

2. A method for identifying deficiencies in the quality of services performed before the level of performance becomes unacceptable.

3. A file of all quality control inspections inspection results, and any corrective action required shall be maintained by the Contractor throughout the duration of this contract. This file shall be the property of the Government and shall be available to the COR during normal working hours. The file shall be turned over to the Government within 14 days of completion of termination of the contract.

b. QASP: A (Quality Assurance Surveillance Plan (QASP) has been developed for in-house operations or to implement a service contract. It is designed to aid the Government in providing effective and systematic surveillance of all aspects of document and media destruction. This plan provides for monitoring all contract requirements through a combination of methods. These are:

1. Random observation

2. Client/Customer Complaints

3. Surveillance Activity Checklist

The QASP is a “living document” and the Government may review and revise it on a regular basis. However, the Government shall coordinate changes with the contractor. Updates shall ensure that the QASP remains a valid, useful, and enforceable document. Copies of the original QASP and revisions shall be provided to the contractor and Government officials implementing surveillance activities.

The objective of this surveillance plan is to evaluate how the Government or contractor is performing in key areas. We are primarily interested in the final product or service being provided and not the details of the accomplishment.

Quality Assurance / Performance Requirements Table

Department of Labor - Wage Determination Compliance

Compliance with FAR 52.219-14 and 15 U.S.C. § 657s Limitations on Subcontracting

***Report of Non-Compliance shall be directed to SBA for remediation by the CO.***

Possible fines and debarment may be imposed. Please see Note 7.1 under this table.

Note 7.1: IAW 13 CFR § 125.6(g), Whoever violates the requirements set forth in paragraph (a) of this section shall be subject to the penalties prescribed in 15 U.S.C. 645(d), except that the fine shall be treated as the greater of $500,000 or the dollar amount spent, in excess of permitted levels, by the entity on subcontractors. A party's failure to comply with the spirit and intent of a subcontract with a similarly situated entity may be considered a basis for debarment on the grounds, including but not limited to, that the parties have violated the terms of a government contract or subcontract pursuant to far 9.406-2(b)(1)(i) (48 CFR 9.406-2(b)(1)(i)).

Performance Monitoring:

a. The government will periodically evaluate the contractor's performance by appointing representative(s) from serviced facilities to monitor performance to ensure services are received.

b. The government representative will evaluate the contractor's performance through intermittent observation and on-site inspections of the contractor's quality control program and receipt of complaints from facility personnel.

c. Routine shreds will be observed by a government representative at random intervals no less than once per month.

d. The government representative will perform on-site inspections of the contractor's facility(s) no less than once annually.

e. The government may increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections or because of repeated customer complaints. The government will also receive and investigate complaints from various customers located on the installation.

f. The contractor shall be responsible for initially validating customer complaints. However, the government representative shall make final determination of the validity of customer complaint(s) in cases of disagreement with customer(s).

ACCEPTABLE PERFORMANCE

The Government shall document positive performance. Any report may become a part of the supporting documentation for any contractual action.

UNACCEPTABLE PERFORMANCE

When unacceptable performance occurs, the COR shall inform the contractor. This will normally be in writing unless circumstances necessitate verbal communication. In any case the COR shall document the discussion and place it in the COR file.

a. When the COR determines formal written communication is required, the COR shall prepare a Contract Discrepancy Report (CDR) and present it to the contractor's program manager.

b. The contractor shall acknowledge receipt of the CDR in writing. The CDR will specify if the contractor is required to prepare a corrective action plan to document how the contractor shall correct the unacceptable performance and avoid a recurrence. The CDR will also state how long after receipt the contractor has to present this corrective action plan to the COR. The Government shall review the contractor's corrective action plan to determine acceptability.

c. Any CDRs may become a part of the supporting documentation for any contractual action deemed necessary by the CO.

S. SUSTAINABILITY: To meet emergency preparedness guidelines contractor will provide plan to insure 96 hours of sustainability.

T. GOVERNMENT REMEDIES: The contracting officer shall follow FAR 52.212-4, Contract Terms and Conditions-Commercial items (Oct 2018), for contractor's failure to perform satisfactory services or failure to correct non-conforming services.

U. SAFETY REQUIREMENTS: In the performance of this contract, the Contractor shall take such safety precautions as the Contracting Officer may determine to be reasonably necessary to protect the lives and health of Contractor’s employees and occupants of the building. The Contracting Officer/COTR shall notify the Contractor of any safety issues and the action necessary. Such notice, when served on the Contractor or his representative at the work site shall be deemed sufficient for the corrective actions to be taken. If the Contractor fails or refuses to comply promptly, the Contracting Officer may issue an order stopping all or part of the work and may hold the Contractor in default.

V. INVOICES:

0. Invoices shall be submitted monthly in arrears in accordance with 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV 2018)

0. Payments shall be made in arrears upon receipt of a properly prepared invoice

0. The VA has mandated electronic invoice submission to the Veterans Affairs Financial Services Center (VAFSC). VAFSC has partnered with Tungsten Network e-Invoicing network, for submissions of all electronic invoices to VA. Tungsten Network electronic invoicing is free to all VA vendors. In order to submit electronic invoices, all VA vendors must register with Tungsten Network by submitting an email to VA.Registration@Tungsten-Network.com or calling 1-877-489-6135 for Enrollment.

0. All invoices shall reference the vendor’s name and address, customer name, contract number, appropriate obligation/funding order number, description of services provided, quantity, unit price, and total invoice amount (any additional info). Invoices shall also include any payment discount terms.

0. Invoices must include CLIN/SLINS from the schedule of the contract in order to ensure timely reconciliation and payment. Each station will provide a unique PO number.

W. Other Pertinent Information or Special Considerations.

0. Laws and Ordinances. The contractor shall comply with all applicable laws, ordinances, and regulations (Federal, State, City or otherwise) covering operations performed under this contract. Contractor shall be bonded, insured, and certified by the National Association for Information Destruction, Inc. (NAID) for paper/printed media destruction, and knowledgeable of the following guidelines and practices:

0. Association for Records Managers and Administrators, International (ARMA)

0. American Society for Industrial Security (ASIS)

0. Contractor is responsible for maintaining all containers in clean, odor free, secure, and safe condition.

0. Contracting Officer’s Representative (COR). At the time of contract award, the VA shall designate a COR to represent the contracting officer in furnishing technical guidance and advice regarding the work being performed under this contract. The foregoing is not to be construed as authorization to interpret or furnish advice and information to the contractor.

0. Liability Insurance. Contractor must maintain liability insurance in the amount of $1 million to include covering claims of negligence and/or other torts alleged to have been committed by the Contractor, its employees, and/or its sales representatives, including, but not limited to, any allegations arising out of the presence of the Contractor's representatives in patient care areas. Contractor will provide Government with proof of insurance upon request. All representatives of the Contractor who will be present in-patient care areas will comply with all applicable Government policies governing visitors to patient care areas. Contractor agrees to defend, indemnify, and hold harmless Government and any agents and employees of Government from any and all liabilities, claims, actions, or suits for personal injury or death arising out of or in connection with the presence of Contractor's representatives in patient care areas. Defense of any claims against Government entities will be conducted in accordance with the procedures of the United States Department of Justice governing claims under the Federal Tort Claims Act.

2. INFORMATION AND INFORMATION TECHNOLOGY SECURITY REQUIREMENTS:

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

The contractor/subcontractor will report any incident or breach of information to the COR and facility Privacy Officer within one (1) hour of becoming aware of the incident.

A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d)(1).

The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be enough grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, Confidentiality of Medical Quality Assurance Records and/or Title 38 U.S.C. 7332, Confidentiality of Certain Health Records Pertaining to Drug Addiction, Sickle Cell Anemia, Alcoholism or Alcohol Abuse, or Infection with Human Immunodeficiency Virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement (BAA).

14.In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third- party for damages arising from any incident, or obtain injunctive relief against any third-party arising from, or related to, the incident.

16. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information or personally identifiable information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term “data breach” means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

Each risk analysis shall address all relevant information concerning the data breach, including the following:

(a) Nature of the event (loss, theft, unauthorized access);

(b) Description of the event, including:

(i) date of occurrence;

(ii) data elements involved, including any PII, e.g.: full name, social security number, date of birth, home address, account number, disability code;

(c) Number of individuals affected or potentially affected;

(d) Names of individuals or groups affected or potentially affected;

(e) Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, e.g., unencrypted, plain text;

(f) Amount of time the data has been out of VA control;

(g) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(h) Known misuses of data containing sensitive personal information, if any;

(i) Assessment of the potential harm to the affected individuals;

(j) Data breach analysis as outlined in 6500.2 Handbook, Management (Security and Privacy Incidents), as appropriate; and

(k) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(a) Notification;

(b) One year of credit monitoring services consisting of automatic daily monitoring of at least three (3) relevant credit bureau reports;

(c) Data breach analysis;

(d) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(e) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(f) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

20. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

· Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, relating to access to VA information and information systems;

· Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training;

· Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

· Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access (to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document - e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.)

The contractor shall provide to the contracting officer and the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within one (1) week of the initiation of the contract and annually thereafter, as required.

(a) Note – all employees who have access to VA information is required to take the training. This includes the drivers who pick up the information, the workers in the plant who sort and shred the information, etc.

Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

A. PRIVACY TRAINING: The contractor and all subcontractors are required to complete annual privacy training TMS 20939. The document should be read and signed and returned to the COR and Privacy Officer.

B. CONFIDENTIALITY: Contractor shall have a complete, approved Business Associate Agreement (BAA) with the VA.

NO KEYS SHALL BE PROVIDED FOR ANY CONTAINERS TO VA PERSONNEL WITHOUT THE APPROVAL IN WRITING BY THE CONTRACTING OFFICER

C. RECORD MANAGEMENT: When Federal agencies acquire goods or services, they need to determine what Federal records management requirements should be included in the contract. Federal contractors often create, send, or receive Federal records. Federal contracts should provide clear legal obligations describing how the contract employees must handle Federal records. Agency records officers, procurement counsel, and acquisitions officers must discuss how to integrate records management obligations into their existing procurement processes. NARA has developed the following language to be included as an agency-specific term and condition in Federal contracts for a variety of services and products. The majority of contracts should include language on records management obligations, but each contract should be evaluated individually. For example, the data-rights paragraph (Paragraph 10 below) may not be appropriate for all contracts. Instead, agencies may be better served by one of the established data-rights clauses in the Federal Acquisition Regulations.

This language should not replace specific records management requirements included within Federal information system contracts.

RECORDS MANAGEMENT OBLIGATIONS

A. Applicability This clause applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists.

B. Definitions “Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

C. Requirements

1. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

2. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

3. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be…