Attachment 1 Confidential Documents Destruction SOW Revised 6282021.docx

Statement of Work Department of Veterans Affairs Veterans Health Care System of the Ozarks (VHSO) Fayetteville, Arkansas

1. CONTRACT TITLE: Onsite secured sensitive document destruction services

2. TYPE OF CONTRACT: Single Award, Firm-Fixed Price (FFP Contract)

3. PERIOD OF PERFORMANCE

a. Base year: October 1, 2019-September 30, 2020

b. Option Year 1: October 1, 2020 – September 30, 2021

c. Option Year 2: October 1, 2021- September 30, 2022

d. Option Year 3: October 1, 2022- September 30, 2023

4. BACKGROUND

To ensure confidential documents generated by the Veterans Health Care System of the Ozarks (VHSO) Facility are properly destroyed in accordance with VA Handbook 6300.0 “Records Management Procedure” Guidelines without incident, it is our intention to contract out document shredding services. The contractor and/or sub-contractor (hereinafter referred to as “contractor”) shall perform all work on-site, safeguarding documentation until it is properly destroyed and disposed of.

5. PLACE OF PERFORMANCE

The Veterans Health Care System of the Ozarks operated by the Department of Veteran Affairs, VISN 16, is comprised of one main campus, six off-site buildings located in Fayetteville, Arkansas and six community based outpatient clinics (CBOCs).

a. The following buildings are active participants for this contract and are as follows:

Main Campus: 1100 N. College Ave, Fayetteville, AR 72703: four connecting buildings- Building 1, 2, 21, Emergency and Primary Care and 8 exterior buildings- Building 3, 4, 5, 7, 30, 33, 44, and 46

b. Audiology/Home Based Primary Care: 180 E Sunbridge Drive, Fayetteville, AR 72703

c. Contracting Office: 2575 Keystone Crossing, Fayetteville, AR 72703

d. Township Clinic: 222 East Township, Fayetteville, AR 72703

e. Business Office: 38 W Sunbridge Drive, Fayetteville, AR 72703 1.e.1. Shred bins will be moved to 3930 Vantage Drive, Fayetteville, AR 72703 in June 2021

f. Facility Revenue: 12 W Sunbridge Drive, Fayetteville, AR 72703 1.f.1. Shred bins will be moved to 3930 Vantage Drive, Fayetteville, AR 72703 in July 2021

g. Homeless Program/HUD-VASH: 228 W Sunbridge Drive, Fayetteville, AR 72703

h. Branson, MO Community Based Outpatient Clinic: 5571 N. Gretna Road, Branson, MO 65616

i. Ozark, AR Community Based Outpatient Clinic: 2713 W. Commercial Street, Ozark, AR 72949

j. Fort Smith, AR Community Based Outpatient Clinic: 1500 Dodson Ave, Fort Smith, AR 72901 1.j.1. Fort Smith, AR Community Based Outpatient Clinic will move to 5700 Phoenix Place, Fort Smith, AR 72903 during option year 2. Date to be determined.

k. Jay, OK Community Based Outpatient Clinic: 1569 N. Main Street, Jay, OK 74346

l. Springfield, MO Community Based Outpatient Clinic: 1850 W. Republic St, Springfield, MO 65807

m. Joplin, MO Community Based Outpatient Clinic: 3015 Connecticut Ave, Joplin, MO 64803

6. GENERAL SCOPE OF WORK

6.1. The contractor shall provide all labor, personnel, and equipment including secured vehicles, supplies and materials, supervision, and other related services necessary to provide on-site commercial document destruction services for confidential waste (administrative papers, sensitive documents, hard bound journals, magazines and white and mixed paper, all temporary paper records which contain personally identifiable information (PII), personal health information (PHI), and VA sensitive information) at the Veterans Health Care System of the Ozarks (VHSO Fayetteville), to encompass its divisions and offsite facilities located in Fayetteville, Arkansas. Sensitive records are records that are national security classified or exempt from disclosure by statute, including the Privacy Act, or regulation. Information protection, destruction precautions, the documents (paper data), VHSO information containing social security number and other information covered by the privacy act shall be destroyed.

6.2. The Contractor will shred all collected material on site via a Contractor provided truck equipped with the appropriate shredding devices approved by the COR.

6.3. The Contractor will shred paper material in accordance with VA Directive 6371- “Destruction of Temporary Paper Records.” This directive requires that final destruction of paper records are pulped, macerated, or shredded to a degree that definitively ensures that they are not readable or re-constructible to any degree.

6.4. If on-site mobile shredding equipment does not shred documents to meet the requirement of final destruction being non-readable or non-re-constructible to any degree, and the final destruction is performed away from the VA facility it must be performed as per VA Directive 6371 which states:

“If this final destruction is performed away from a VA facility it must be performed by an information destruction contractor (or its subcontractor of third party) who has demonstrated that:

(1) Its destruction process constitutes final destruction as defined in this Directive; and

(2) It has implemented reasonable physical safeguards to protect VA temporary paper records during their transportation, transfer, or short-term storage prior to the completion of their final destruction. Long-term storage (e.g., more than 30 days) must be approved in advance and in writing by the VA organization that generated the temporary paper records.”

6.4.1. Any intermediary processes must protect the records until final destruction is completed.

6.5. Final destruction of record is the process of destroying temporary paper records to the degree that they are no longer readable or re-constructible to any degree. The Contractor will transport the on-site shredded materials to the Contractor yard in preparation for final destruction. In the yard, the shredded material is comingled and compacted with thousands of pounds of shredded paper. The paper is then compressed at 3,200 pounds per square inch into 2,000 pound bales. The bales are put in a secure trailer and transported to the paper mill where it is checked into a secure, gated facility. At the mill, the paper is placed into a hydro pulper, mixed with water and blended into slurry where the individual fibers are separated. The slurry goes through a series of operations including cleaning, washing, and color stripping where contaminants are removed. The final product is recycled pulp.

6.6. VHSO staff have the right to view (with no notice) further destruction of the on-site shredded material as performed at the Contactor’s locations at___________________________________________.

6.7. Certificate of Destruction: For interim destruction (shredding on-site), a written documentation consisting of an inventory of the amount of paper records collected at the date of service will be provided by the Contactor before departure from each facility site. To account for the amount of paper records collected, the Contractor will turn in the shred bin location list which identifies the bins that the Contractor was able to collect for shredding. Additionally, a written documentation (certificate of destruction) shall be provided by the contractor to attest to the completion of the destruction process after the final destruction of VA records has taken place. The certificate of destruction, see Appendix B, should come from the secured facility where final destruction has taken place.

6.8. VA Handbook 6300.1: “Records Management Procedure” shall be applicable to all record/media destruction. The procedure reads: “The authorized destruction of records that are classified or otherwise restricted from disclosure by statute, such as Privacy Act of 1974 or Title 38 USC, must be witnesses by a Federal employee or a contractor employee. If a contract is used to disposed restricted VA records, the facility Records Officer must authorize the use of a contractor or subcontractor employee to witness the destruction.”

7. QUANTITY OF CONTAINERS PER LOCATION

FORT SMITH, AR

OZARK, AR

JAY, OK

1569 N. Main Street, Jay, OK 74346

BRANSON, MO

Springfield, MO

Joplin, MO

3015 Connecticut Ave, Joplin, MO 64803

*These numbers are only an estimate. The contractor is required to conduct a walk-through of the facility to determine exact locations and quantities.

8. APPLICABLE DOCUMENTS, STANDARDS, LAWS AND/OR REGULATIONS

8.1. Contractor is solely responsible for meeting any current or future requirements approvals or certifications as may be levied by applicable legal, regulatory, accrediting body, governing body, and/or local/state/federal requirements as required by law. Due to continuous regulatory changes in both federal and state laws, the contractor shall be in compliance of new regulations within thirty (30) calendar days of notification. A list of applicable documents, standards, laws and/or regulations can be found in “SECTION 35” of this statement of work.

9. SPECIFIC REQUIREMENTS

9.1. VHSO personnel in all locations are in the practice of putting all sensitive or administrative documents, as well as other paper, small cardboard boxes etc., in locked containers located throughout all VHSO buildings.

9.2. Contractor shall provide “FULL SERVICE” shredding service for each respective area identified in paragraph 5. Full service indicates the contractor shall retrieve all security waste from all consoles and bring it to the shredding vehicle/site to conduct shredding.

9.3. Interim destruction shall be conducted ONSITE and at the specific location designated by the Government.

9.4. Pick-up of security waste shall be accomplished in accordance with the pick-up schedule listed in paragraph 9.5 and 10.1-10.3.

9.5. Location and Time (Monday through Friday during Normal duty hours 8:00AM-4:30PM)

10. HOURS OF OPERATION

10.1. Contractor is responsible for conducting business during normal business hours (normally between 8:00 a.m. to 4:30 p.m.) to facilitate communication between the Government and the Contractor, Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

10.2. If a holiday falls on a Sunday, the following Monday will be observed as the National Holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National Holiday by U.S. Government agencies. Also included would be any day specifically declared by the President of the United States. Contractor is not required to provide any service(s) on nationally recognized U.S. Government holidays, nor shall the contractor be paid for these holidays.

10.3. Any schedule services that lands on a holiday will be required to be perform the day before or after the holiday.

11. OVERTIME AND HOLIDAYS

11.1. Any overtime and/or holiday pay that may be entitled to the Contractor’s employee(s) shall be the sole responsibility of the Contractor and shall not be billed to nor reimbursed by the Government.

12. NATIONAL HOLIDAYS/SCHEDULE CHANGES

12.1. Listed below are the ten (10) national holidays.

12.2. Prior to any changes made to the schedule, the Contracting Officer Representative (COR) will notify the Contracting Officer (CO) in writing of the revised pick up schedule. A revised pick-up schedule will be provided to the contractor in writing along with the contract modification from the CO.

12.3. In the event additional services are needed, the COR will notify the contracting officer of the request. Once the CO authorizes the request for additional services, the contractor will be notified and will complete it. The contractor is only authorized to complete additional service requests with the authorization of the CO. The contractor shall only invoice and receive payment for containers/consoles/bins that are 100% emptied. In the event the Contractor fails to empty a container due to oversight, they have 24 hours (weekdays) from the time of notification to empty the container.

13. SERVICE CALLS

13.1. The Government may request additional shredding services outside the scope of this contract. Additional shredding services may include onetime bulk shredding, purges, etc... These additional shredding services will not be billable to the contract, but will be paid via Government Purchase Card (GPC), which shall not exceed $2,499.00 for each additional service. To support any additional services required, contractor shall provide price per service that will be inclusive of cost to include all labor, personnel, equipment, supplies, vehicles (shredding), materials, supervision and certifications/license.

13.2. Contractor shall provide information requested below as to where service calls are to be placed.

Name

Address

City, State, Zip Code

Toll Free Telephone Number

Local Telephone Number

Facsimile Number

Email Address

Web Site Address

Primary Service Representative

14. CONTRACTORS QUALIFICATIONS

14.1. Contractor shall be a firm regularly engaged document destruction service. Contractor’s personnel performing on this contract must be fully qualified and competent service technicians.

14.2. The Contractor will be required to update competency information throughout the life of the contract as changes to staff occur. Contractor must provide Government approval credentials of each service technician. Credentials must be provided prior to the employee being assigned services responsibilities on Government equipment listed herein.

14.3. As per VA Directive 6371, interim destruction must be carried out by either:

“a. A National Association for Information Destruction (NAID) certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction who has contracted to provide sufficient reasonable safeguards to protect the temporary paper records until final destruction has been completed; or

b. A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371.” (See Appendix C)

15. Contractors shall provide proof and adequacy of past performance history, references, and above required qualifications. All certifications must be current / valid and a copy call shall be furnished to the Government. When combined with Evaluation Factors, it will assist the Contracting Officer in making the best value and sound business judgment on behalf of the Government (See evaluation factors in FAR Clause 52-212-2 in APPLICABLE DOCUMENTS, STANDARDS, LAWS AND/OR REGULATIONS).

16. CERTIFICATE OF DESTRUCTION

16.1. The contractor shall prepare and submit to the medical facility’s COR, an original signed Certificate of Destruction (COD) for each pick up for each site within five (5) calendar days of each pickup. The COD may be sent via an electronic copy to the COR. The contractor shall maintain proper records concerning each COD issued. The COD shall as a minimum contain the following (see “Appendix C – SAMPLE CERT OF DESTRUCTION”):

a. Pickup/Delivery Location

b. Pickup/Delivery Date

c. Name of Government COR at Pickup Location

d. Amount of shredded waste (number of containers picked up and/or pounds shredded)

e. Destruction Certification Document Number

f. Destruction Certification Date

g. Any other information as determined necessary by the COR.

h. Signature of personnel viewing and confirming final destruction.

17. END OF MONTH SERVICE REPORT

17.1. At the end of each month of service, contractor shall provide a report that will provide the following information. This report is due within seven (7) calendar days after the end of the last day of the month (see “ATTACHMENT 1 – MONTHLY ACTIVITY LOG -SAMPLE”):

a. Date of services

b. Number of containers

c. Types of material destroyed

d. Total weight in pounds or tons

e. Contractor shall provide the list of facilities in which final destruction will occur, if destruction cannot be conducted onsite. The list should include the following minimal information about the facility:

f. Name of facility

g. Point of Contact

h. Address

i. Phone Number

18. CONTRACTOR PERSONNEL, BADGES AND PARKING

18.1. The contractor shall provide the COR with a list of employees expected to enter Government property to pick up confidential documents. While on VA premises, all contractor personnel shall comply with the rules, regulations, and procedures governing the conduct of personnel and the operation of the facility.

18.2. All Contractor personnel are required to be aware of and observe security, safety and environmental requirements of each Government facility. Including, but not limited to restricted area access, observing vehicle parking regulations and smoking restrictions.

18.3. Identification Badges

18.3.1. The contractor personnel will check in with the VA Police Dispatch Office. The member will leave a driver’s license and will be checked in/out utilizing an electronic vendor tracking system and issued a vendor badge. Upon initial registration, the name of the sales representatives, vendors and contractors will be logged into the police vendor tracking system then will be provided with a non-employee vendor identification badge by VA Police, for use during the visit. All contractors will wear the VA issued identification badge at all times while in the facility.

18.4. The contractor personnel must surrender VA issued identification badges to VA Police when leaving the facility. Contractor personnel shall wear distinctive clothing bearing the name of the Contractor, closed toe footwear, wearing badges bearing the Contractor name and the employees name in English. Furthermore, contractor personnel are prohibited from wearing shorts or sandals while providing services on Government grounds.

18.5. The contractor shall be required to comply with all security policies/requirements of each respective Government facility. All security policies/requirements must be met and employees cleared prior to the contractor performing work under this contract. Employees that cannot meet the security and clearance requirements shall not be allowed to perform work under this contract.

18.6. It is the responsibility of the contractor’s personnel to park in the appropriate designated parking areas. Parking information shall be coordinated with each facility COR.

18.7. The Government does not validate or make reimbursement for parking violations of the contractor’s personnel under any circumstance.

19. INCIDENT NOTIFICATION

19.1. The contractor shall notify VHSO’s COR and Privacy Officer within 24 hours of discovery of any incident which may potentially be a data breach, including a HIPAA Electronic Transactions and Code Sets, Privacy, Security or Standard Identifier Incident, or Use or Disclosure of Protected Health Information (PHI), whether secured (PHI which has been destroyed or in the alternative has been rendered unreadable, unusable or undecipherable) or unsecured (PHI) not secured through the use of a technology which renders it unusable, unreadable, or indecipherable through methodology specified by HHS in guidance issued under § 13402(h)(2) of the HITECH Act), not provided for by this Agreement and promptly provide a report to VHSO within ten (10) business days of the notification.

20. QUALITY CONTROL

20.1. The Contractor shall develop and maintain quality programs to ensure recycling services are performed in accordance with commonly accepted commercial practices and comply with VHSO requirements. 100% of the containers/consoles/bins must be emptied and shredded at each location per the schedule provided by the COR. If a container, console/bin is not emptied and shredded, the contractor shall notify the COR of the reason that a console/bin could not be emptied and shredded. The contractor shall only be invoicing and receive payment for containers/consoles/bins that are 100% emptied.

20.2. The Contractor shall develop and implement procedures to identify, prevent, and ensure non- recurrence of defective services.

20.3. At a minimum, the Contractor shall develop quality control procedures addressing the areas where the Acceptable Quality Level was not met and how corrective action will be taken.

21. SAFETY

21.1. The Contractor shall have in place a documented and comprehensive Health and Safety program to ensure all shredding activities are provided in a safe and secure manor. As a commitment to safety, the Contractor must be working towards achieving the Occupational Safety and Health Administration’s (OSHA) Voluntary Protection Program (VPP) Certification.

22. CONTRACTOR VEHICLES

22.1. All contractor vehicles utilized in the performance of this contract shall maintain insurance (up to the minimum coverage required by the respective state) and shall maintain current state vehicle registration.

22.2. All contractor employees shall possess a valid Arkansas state driver’s license and have a clean driving record. The contractor or his/her employee’s while performing under this contract shall use no personal vehicles to transport containers to and from the government and contractor site.

22.3. The contractor shall ensure that all contractor vehicles utilized for this performance contract are kept in proper working condition. The contractor vehicles shall be locked and properly secured at all times while at the government site or in route to and from contractor site. Vehicles used in the performance of the contract shall not be left unattended and unlocked at any time while transporting VHSO security waste.

22.4. Contractor shall provide a contingency plan for instances where equipment malfunctions occur during the shredding process, data breach occurs, emergency plan of action, etc...

23. CONTRACTOR FACILITIES

23.1. All security waste shall be shredded onsite at the VHSO premises. In the event that onsite shredding is not available due to unforeseen mechanical issues, the confidential material must be transported via locked secured vehicle to an appropriate VHSO approved Facility for shredding destruction and recycling.

23.2. Prior to beginning performance of the contract, the contractor facility designated to be the destruction site will be inspected by COR and the VHSO Privacy Officer and approved in writing. Until completion of destruction, the security waste material must be maintained in a secured holding area at all times to prevent any disclosure or unauthorized access.

24. SECURITY WASTE COLLECTION CONTAINERS

24.1. VHSO Fayetteville will provide their own containers. The size of the containers provided by VHSO Fayetteville shall be:

a. 36 gallon (or comparable size) containers that are suitable for clinical and office areas.

b. 65 and/or 95 gallon (or comparable size) lockable container with wheels (95 gal. must have four wheels) so it can be rolled.

24.2. The contractor shall notify the COR if additional containers of each size will be needed to replace broken/unserviceable containers. VHSO will provide additional 36/65/or 95 gallon containers as needed to accommodate higher levels of security waste received or that which is needed for transport.

24.3. The containers shall be kept locked at all times. VHSO shall provide three sets of keys for each lockable security waste container to the Contractor. One additional set of keys shall remain in the possession of VHSO Environmental Management Service and one set of keys shall be provided to the VHSO COR.

24.4. In the event the Government awards a follow-on contract to someone other than the incumbent contractor, the contractor will cooperate to the extent required to allow for an orderly changeover to the successor contractor. This transition shall be as smooth and transparent as possible to ensure no interruption in the services currently being provided.

24.5. The contractor shall deliver the required number of keys to the VHSO COR within 5 calendar days after contract award and approval of VHSO security suitability.

24.6. The contractor shall submit one point of contact for all locations to the COR within 5 days of contract award.

25. INFORMATION SECURITY

25.1. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

26. VA PRIVACY AWARENESS TRAINING

26.1. The following procedure for obtaining the required VA Privacy Awareness Training is a mandatory requirement for all employees, sub-contractors, agents, representative and management of the selected contract. It is the responsibility of the Contractor(s) to ensure that each contract employee understands and complies with the training during the VA Contractor Badge issue process. As all contract employees obtain contractor badges, the facility Privacy Officer will provide VA Privacy Awareness Training Literature and a concise education presentation to certify all Contractor staff is compliant with required Privacy Training. All contract employees working in the VHSO VAMC located in Fayetteville, AR or CBOCS must provide signatures with facility Privacy Officer confirming their completion of Privacy Training at time of presentation. Any non-compliant Contractor staff will be escorted from job site.

27. BUSINESS ASSOCIATE AGREEMENT

27.1. The contractor shall sign a Business Associate Agreement (BAA). If contractor has a national BAA on file with the Veterans Affairs, contractor shall provide a copy of it (see “ATTACHMENT 2 – BUSINESS ASSOCIATE AGREEMENT - BLANK”).

28. HANDLING OF RECORDS

28.1. Information or records accessed and/or created by the Contractor in the course of performing services under this contract are the property of the VA and shall not be accessed, released, transferred, or destroyed except in accordance with applicable federal law, regulations, and/or VA/VHA policy. The Contractor will not copy information contained in VA information systems, either by printing to paper or by copying to another digital format, without the explicit instruction and written approval from of the officials listed in paragraph a., above, except as is necessary to make single copies in the ordinary course of providing patient care. The Contractor will not commingle the data from VA information systems with information from other sources. Contractor shall report any unauthorized disclosure of VA information to the Contracting Officers Representative (COR).

29. BACKGROUND CHECK

29.1. All Contractor employees working with sensitive VA information are subject to background checks.

29.2. The contractor must provide proof of a cleared background check (as well as type and frequency) for each employee expected to handle VA information. This requirement is applicable to all subcontractor personnel requiring the same access. If the investigation is not completed prior to the start date of the contract, the prime Contractor will be responsible for the actions of those individuals they provide to perform work for VA.

· Position Sensitivity - The position sensitivity designated by the Contracting Officer Representative (COR) assigned to the contract is Low Risk although some key positions may be designated at higher levels. The risk level designations for public trust positions and the corresponding background investigation levels are defined in VA Directive 0710.

29.3. Performance - Contract performance shall not commence prior to receipt of the appropriate investigative documents.

Public Trust Risk Level Designation

Background Investigation Level

Low Risk

National Agency Check with Written Inquiries (NACI) - A NACI is conducted by OPM and covers a 5-year period. It consists of a review of records contained in the OPM Security Investigations Index (SII) and the DOD Defense Central Investigations Index (DCII), FBI name check, FBI fingerprint check, and written inquiries to previous employers and references listed on the application for employment. In VA it is used for Non-sensitive or Low Risk positions.

29.4. Contractor Responsibilities - The Contractor shall complete the required documents for each individual and provide a copy to the COR and the Contracting Officer within seven (7) days of contract award.

29.4.1. The Contractor shall bear the expense of obtaining background investigations.

30. SECURITY INCIDENT INVESTIGATION

30.1. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor has access.

30.2. To the extent known by the contractor, the contractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor considers relevant.

30.3. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

30.4. In instances of theft or break-in or other criminal activity, the contractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

31. LIQUIDATED DAMAGES FOR DATA BREACH

31.1. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any PPI the contractor processes or maintains under this contract.

31.2. The contractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

31.3. Each risk analysis shall address all relevant information concerning the data breach, including the following:

a. Nature of the event (loss, theft, unauthorized access);

b. Description of the event, including:

c. date of occurrence;

d. data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

e. Number of individuals affected or potentially affected;

f. Names of individuals or groups affected or potentially affected;

g. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

h. Amount of time the data has been out of VA control;

i. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

j. Known misuses of data containing sensitive personal information, if any;

k. Assessment of the potential harm to the affected individuals;

l. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

m. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

a. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

i. Notification

ii. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports

iii. Data breach analysis

iv. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution

v. One year of identity theft insurance with $20,000.00 coverage at $0 deductible and

vi. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

32. PHASE-OUT FOR FOLLOW-ON CONTRACTS

32.1. Prior to termination or completion of this contract, contractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

32.2. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part.

32.3. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship

33. AUTHORIZED SERVICES / CHANGES:

33.1. The contractor is advised that only the CO, acting within the scope of the contract has the authority to make changes which may affect the contract terms and conditions, quality, quantity, price, and/or delivery. It is highly encouraged and advised that the contractor contact the COR for approval in the event there are changes prior to proceeding. No other individual has the authority to make this binding changes and/or commitments.

33.2. In the event that the contractor commits to such changes at the direction of any other person than the CO, the changes shall be considered to have been made without proper authority and no adjustment shall be made in contract price to cover any increase in costs incurred as a result thereof.

34. APPLICABLE DOCUMENTS, STANDARDS, LAWS AND/OR REGULATIONS

34.1. The following are a list of various applicable standards, policies, regulations, and/or governing bodies. This list is not an all-inclusive list, therefore it is the responsibility of the contractor to ensure all applicable standards, policies, regulations, and/or governing bodies not listed here are adhere to. Furthermore, contractor is responsible to adhere to all current addition of applicable standards, policies, regulations, and/or governing bodies.

a. VA Directive 6371, dated April 8, 2014

b. NIST Special Publication 800-88, Revision 1

c. Federal Information Processing Standard (FIPS 199), Standards for Security Categorization of Federal Information and Information Systems

d. National Association for Information Destruction (NAID) Standards

e. FAR 52.12 Instructions to Offerors- Commercial Items (Jan 2017)

f. The Joint Commission

35. Prior to the award of this contract, the COR will conduct a walk-through of the contractor’s facility and perform an inspection of their vehicles to ensure they meet all the requirements indicated in the statement of work as well as VA Directive 6371.

36.

Appendix A

AGREEMENT FOR THE RESPONSIBLE DISPOSAL OF DESTROYED MATERIALS

(Between a Secure Destruction Service and Disposal Agent) The following Secure Destruction Service is NAID® or seeking NAID® Certification and is in possession of destroyed materials as identified below that it must responsibly dispose:

SECURE DESTRUCTION SERVICE FIRM: _____________________________

Address: _____________________________________________________________________________ Destroyed Materials consisting of: Shredded and Baled Paper The following Disposal Agent accepts the Destroyed Materials and will responsibly dispose of these materials in the method identified below:

DISPOSAL AGENT FIRM: ___________________________________________________________

ADDRESS: ________________________________________________________________________ Final Disposition Method of Materials Received: Re-pulp for Paper Remanufacturing By signature below, the Disposal Agent agrees to the following in accepting the Destroyed Materials from the Secure Destruction Service:

a. Disposal agent agrees to process and route the Destroyed Material by a mutually acceptable method and to mutually agreed destination that fulfills the obligation to keep them from entering the public realm in a manner in which they could be reconstituted (such as in packing material or animal bedding) or that is in violation of any environmental regulations.

b. The Disposal Agent agrees that the final disposition method identified above will be adhered to unless notice and permission has been obtained from the Secure Destruction Service firm in writing, in advance.

c. Under no circumstances will the Disposal Agent allow the material to be transferred in any way to an agent or entity that is not party to this agreement, and over whom there is no control of the ultimate fate of the material.

d. The Disposal Agent understands that the decision to use their firm to accept the destroyed Material and process it under the agreed manner is required by the NAID Certification standards.

e. The Disposal Agent understands that the decision by the Secure Destruction Service to transfer the Destroyed Materials to the Disposal Agent is made only in consideration of their ability and willingness to comply with this agreement.

f. The Disposal Agent does not accept the fiduciary responsibility to process and dispose of the Destroyed Materials as agreed herein.

g. The Secure Destruction Service also agrees that this is not an agreement that transfers any obligation or intention on the part of the Disposal Agent to provide secure destruction services.

Disposal Agent Representatives Signature:______________________________Date:_____________ Representative’s Printed Name: _______________________________________________________

Appendix B ***Sample Certificate of Destruction***

CERTIFICATE OF DESTRUCTION

The information described below was destroyed in the normal course of business pursuant to the organizational retention schedule and destruction policies and procedures.

Destruction Certification Document Number: VHSO Fayetteville- 001

Organization: Department of Veterans Affairs, Veterans Health Care System of the Ozarks Government Contact:

Charity Tisdale

Description of Information Disposed of/Destroyed:

Protected Health Information (PHI) Personally Identifiable Information (PII) Sensitive Information (SI) Electronic Protected Health Information (EPHI) Confidential/Temporary Records

METHOD OF FINAL DESTRUCTION:

Pulverization (</=) 1x5 millimeters);

Other: Equipment Used: Mobile Rotary Security Shredding Truck

Miscellaneous Entries:

Estimated Weight:1,000 lbs Number of Tips: 15 Type of tote/console: 64 Gallon

Records Destroyed By: John Doe

Authorized Signing Agent

Appendix C Minimum Standards for Information Destruction As Per VA Directive 6371 Information destruction contractors and subcontractors must be able to meet the following standards:

1) Physical and Operational Security

a) Monitored Alarm System(s) that include the following:

i) Motion Detectors;

ii) Door Contacts;

iii) Battery Back-Up; and

iv) Monitoring Service.

b) Taped Closed Circuit TV (CCTV) monitors with the following:

i) Fully Functional Cameras;

ii) Recording Devices; and

iii) Secure Recording Tape Library.

c) Sufficient Lighting to allow CCTV

d) Locks and Key Controls

e) Visitor Logs

i) Visitor In/Out Logs; and

ii) Visitor ID Badges.

f) Written Policies and Procedures

2) Documentation and Control of Resources

a) Documentation and control of employees:

i) Documentation of who has access to materials (minimum necessary access only is allowed); Documentation of background investigations (types and frequency);

ii) Documentation of citizenship, naturalization (no non-US citizens);

iii) Documentation of drug screen; and

iv) Documentation of re-evaluation of above items (at least every two years).

b) Documentation and control of destruction equipment:

i) Type (Mobile or Plant-Based);

ii) Manufacturer and Model;

iii) Serial Number; and

iv) Dates of non-operational downtime for repair.

c) Documentation and control of destruction and collection vehicles:

i) Vehicle make and model;

ii) License plate number;

iii) State/County of registration;

iv) Acceptable overnight storage address and location;

v) Acceptable roadworthiness of vehicles;

vi) Locks and security of vehicles; and

vii) Driver logs to show who has control of vehicle at any given time.

d) Documentation and control of all recipients of materials:

i) Name of individual/company;

ii) Address where received;

iii) Method of final disposition; and

iv) Certifications of destruction (general documentation acceptable as long as it is attributable to VA’s data (e.g., “bails shipped on <date> were pulped on <date>).

3) Other Operational Requirements

a) All destruction will take place within the enclosure of the destruction facility, which consists of four solid walls and a ceiling, and meets all criteria related to physical building security.

b) The only permissible uses of a mobile destruction vehicle will be within the enclosure of the destruction facility, on-site at the VA’s premises, or at an off-site location if approved of in advance by VA and is located within walking distance of the VA premises.

c) A log is kept to record the dates and times that the mobile destruction vehicle is operating within the destruction facility, which shall be made available to VA during an audit, by means of review of CCTV images.

d) The mobile destruction vehicle will be made available to VA for audit, within the enclosure of the destruction facility, during the initial audit and during all scheduled re-audits, for demonstration purposes.