36C25918Q9958-001.docx

36C25918Q9958

PAGE 1 OF

1. REQUISITION NO.

2. CONTRACT NO.

3. AWARD/EFFECTIVE DATE

4. ORDER NO.

5. SOLICITATION NUMBER

6. SOLICITATION ISSUE DATE

a. NAME

b. TELEPHONE NO. (No Collect Calls)

8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY

CODE

10. THIS ACQUISITION IS

UNRESTRICTED OR

SET ASIDE:

% FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ

IFB

RFP

15. DELIVER TO

CODE

16. ADMINISTERED BY

CODE

17a. CONTRACTOR/OFFEROR

CODE

FACILITY CODE

18a. PAYMENT WILL BE MADE BY

CODE

TELEPHONE NO.

DUNS:

DUNS+4:

PHONE:

FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER 18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19.

20.

21.

22.

23.

24.

ITEM NO.

SCHEDULE OF SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA

26. TOTAL AWARD AMOUNT (For Govt. Use Only) 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA

ARE

ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________

29. AWARD OF CONTRACT: REF. ___________________________________ OFFER

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

DATED ________________________________. YOUR OFFER ON SOLICITATION

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED

SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER) 30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION

(REV. 2/2012)

PREVIOUS EDITION IS NOT USABLE

Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

36C25918Q9958 09-20-2018 Monica Gary 918-577-3855 09-24-2018

5:00PM (CT)

36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

1011 Honor Heights Drive Muskogee OK 74401 X X 561990 $11 Million X N/A X Sheridan VA Medical Center 1898 Fort Rd Sheridan WY 82801 36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

1011 Honor Heights Drive Muskogee OK 74401

Department of Veterans Affairs Financial Service Center PO Box 149971 Austin TX 78714-9971 See CONTINUATION Page On-site secure document destruction services, with on-site weighing and contractor provided receptacles, per PWS.

The Offeror in block 17a certifies: (check if applicable) _____1. that it remains small for the size standard set for this procurement and that it has status as an SDVOSB concern, recognized as valid by Center for Verification and Evaluation (CVE) in VIP.

The Offeror in block 17a (representing itself, its subcontractors, its third parties) and in response to this RFQ, certifies: (check & complete items that apply) ____2. that it has a current NAID certificate, is bonded and insured, per VA Directive 6371 ____3. that it has current capabilities to satisfy the Minimum Standards for Information Destruction in Appendix A of VA Directive 6371 _____4. that it is available to start on [insert date here] __________________________________________ at Sheridan, WY, if awarded the contract.

See CONTINUATION Page X X X one(1) Monica Gary

NCO1614L2-5620

Table of Contents

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C259 Department of Veterans Affairs Network Contracting Office

NCO 19

1011 Honor Heights Drive Muskogee OK 74401

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

3. INVOICES: Invoices shall be submitted in arrears:

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contractor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests.

Department of Veterans Affairs Financial Service Center PO Box 149971 Austin TX 78714-9971 ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

B.2 LIMITATIONS ON SUBCONTRACTING-- MONITORING AND COMPLIANCE (JUN 2011)

This solicitation includes FAR 52.219-6 Notice of Total Small Business Set-Aside. Accordingly, any contract resulting from this solicitation will include this clause. The contractor is advised in performing contract administration functions, the CO may use the services of a support contractor(s) retained by VA to assist in assessing the contractor's compliance with the limitations on subcontracting or percentage of work performance requirements specified in the clause. To that end, the support contractor(s) may require access to contractor's offices where the contractor's business records or other proprietary data are retained and to review such business records regarding the contractor's compliance with this requirement. All support contractors conducting this review on behalf of VA will be required to sign an “Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement” to ensure the contractor's business records or other proprietary data reviewed or obtained in the course of assisting the CO in assessing the contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs. Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the contractor to protect proprietary information as required by FAR 9.505-4, obtaining access to proprietary information, paragraph (b). The contractor is required to cooperate fully and make available any records as may be required to enable the CO to assess the contractor's compliance with the limitations on subcontracting or percentage of work performance requirement.

B.3 SUBCONTRACTING COMMITMENTS--MONITORING AND COMPLIANCE (JUN 2011)

This solicitation includes VAAR 852.215-70, Service-Disabled Veteran-Owned and Veteran-Owned Small Business Evaluation Factors, and VAAR 852.215-71, Evaluation Factor Commitments. Accordingly, any contract resulting from this solicitation will include these clauses. The contractor is advised in performing contract administration functions, the CO may use the services of a support contractor(s) to assist in assessing contractor compliance with the subcontracting commitments incorporated into the contract. To that end, the support contractor(s) may require access to the contractor's business records or other proprietary data to review such business records regarding contract compliance with this requirement. All support contractors conducting this review on behalf of VA will be required to sign an “Information Protection and Non-Disclosure and Disclosure of Conflicts of Interest Agreement” to ensure the contractor's business records or other proprietary data reviewed or obtained in the course of assisting the CO in assessing the contractor for compliance are protected to ensure information or data is not improperly disclosed or other impropriety occurs. Furthermore, if VA determines any services the support contractor(s) will perform in assessing compliance are advisory and assistance services as defined in FAR 2.101, Definitions, the support contractor(s) must also enter into an agreement with the contractor to protect proprietary information as required by FAR 9.505-4, obtaining access to proprietary information, paragraph (b). The contractor is required to cooperate fully and make available any records as may be required to enable the CO to assess the contractor compliance with the subcontracting commitments.

B.4 Application of Simplified Acquisition Procedures (SAP) for Solicitation and Resultant Contract This solicitation and resultant contract will be conducted using FAR Part 13 Simplified Acquisition Procedures (SAP) in accordance with FAR Part 13.5 Simplified Procedures for Certain Commercial Items, as these services are considered a commercial service.

B.5 Estimated Quantities Sheridan VA Medical Center estimates that it will require 42,000 pounds of documents to be destroyed every 12 months, from date of award.

B.6 PRICE/COST SCHEDULE – Services per the PWS The maximum aggregate ceiling value for this indefinite quantity contract is $________________ [To be inserted upon award.] (“Maximum Ceiling Value”).

Refer to the table below for the guaranteed minimum amount.

Contract Period of Performance: contract award to September 2023.

ITEM INFORMATION

Post Award Meeting. Estimated 2 hours (at Sheridan VAMC).

Post award meeting covers contractual orientation with key people such as COR, CO and contractor’s representative as well as commencing contractual security requirements. The meeting will include a site visit of the location where documents are collected by the contractor prior to being transported to the truck for weighing, per the PWS.

This is the GUARANTEED MINIMUM AMOUNT for the life of this IDIQ contract. The Government does not guarantee that it will place any order under this contract in excess of the guaranteed minimum award amount.

Document destruction services, per the PWS.

(Contract Year 1:

award to 09-30-2019)

Document destruction services, per the PWS.

10-01-2019 to 09-30-2020)

Document destruction services, per the PWS.

10-01-2020 to 09-30-2021)

Document destruction services, per the PWS.

10-01-2021 to 09-30-2022)

Document destruction services, per the PWS.

10-01-2022 to 09-30-2023)

B.7 PERFORMANCE WORK STATEMENT (PWS)

Document shredding of Temporary Records at VA Sheridan Health Care System, WY

PURPOSE:

Veterans Affairs requires a qualified Contractor to provide on-site secure document destruction services, in accordance with this performance work statement (PWS) and VA Directive 6371, to include provision of secure 65-gallon containers and interim destruction. Services are anticipated every other week and must be accomplished in a cost effective, safe, efficient and secure manner for the VA and in support of the VA Mission.

Services are required for the period of performance and at the location outlined in this PWS.

Period of Performance: refer to the Price Cost Schedule of this contract for the period of performance dates and frequencies.

Location: Refer to block 15 on page 1 of SF1449.

This is a non-personal services contract. The Contractor, it’s employees, agents and subcontractors shall not be considered government employees for any purpose. Contractor shall furnish all labor, materials, parts, equipment, tools, shipping, transportation, insurances, licenses, certifications and supervision necessary to provide services in accordance with this Performance Work Statement (PWS). The Contractor is responsible for all charges, fees, applications and procurement of all permits, licenses, registrations and certificates, pursuant to lawful application of the provision of services. For a contract of this size, scope and complexity, the successful Contractor must perform in a professional manner as recognized by commercial industry standards as good to excellent.

Background: The incumbent Contractor is performing on contract no. VA259-15-D-0283. The amounts and processes occurring on the incumbent contract are similar to those required in this SOW. Refer to Tasks and Requirements in this PWS for current required outcomes.

QUALIFIED CONTRACTOR: To fully qualify in performing services on this contract, and per this PWS, the Contractor must demonstrate, and maintain throughout the life of the contract, the following requirements:

1) compliance with VA Directive 6371 Destruction of Temporary Paper Records dated 04/8/2014, and

2) obtaining and maintaining a secure mobile containment unit with capacity to accommodate the amounts and weight of un-shredded material that are anticipated for collection under this contract, and per the anticipated frequencies, and

3) obtaining and maintaining a secure mobile containment unit with capabilities to shred and destroy from the large 65-gallon containers, and

4) obtaining and maintaining enough 65-gallon containers on-site at the location to satisfy the accumulation of documents between services at the location,

5) demonstrated service performance in accordance with all applicable laws, ordinances, regulations and service requirements as enforced by Federal, state, local and industry,

6) capabilities and availabilities to commence services within 5 business days following issuance of a task order signed by the CO.

Contractor must provide current certifications to CO and COR upon award, and provide immediate written notice to the CO and COR within 5 days following any change in certification, licensing, or update in equipment, applicable to this contract and PWS.

Contractor Personnel Requirements: The Contractor shall provide personnel capable of performing pick up and shred services. Additionally, all personnel shall pass a Government specified background investigation per VA Handbook 0710 prior to working with Personally Identifiable Information. The position sensitivity for this effort has been designated as Low Risk and the level of background investigation is a National Agency Check with Written Inquiries (NACI). The Contractor will coordinate with the COR for all Security Issues. The COR will coordinate the NACI process through the VA Human Resources and with cooperation from the Contractor and Contractor personnel. The Contractor is required to provide personnel who will have no criminal history in their record in order to perform services in accordance with this PWS.

According to the VA Handbook 0710, dated 2016:

1) All contract personnel assigned to work for or on behalf of VA must undergo a background investigation commensurate with the risk and sensitivity level designation associated with the work to be performed, at the level indicated in the contract through the use of the Position Designation Tool.

2) The investigation is required regardless of the location of the work. This includes Contractor employees who use technology for remote access to VA facilities or VA information technology systems as well as those who have direct physical access to any VA data outside of any VA facility.

3) The COR must submit a background investigation request and supporting documents for all Contractors in Non-Sensitive positions to the SIC within five calendar days of the contract award. If the SIC cannot apply reciprocity for previously adjudicated background investigations, they will initiate the investigation within five days of receiving all required, complete documentation associated with the request. Administrations can develop their own internal procedures for processing Contractor investigations, but the final adjudication of Contractor investigations must be determined by the SIC.

4) The Contractor will have five days to complete e-QIP and certify and release the required documentation to the SIC. After the Contractor returns a complete, valid e-QIP package, the investigation will be submitted to OPM for processing within five days.

5) Failure of the Contractor to complete the background investigation process, to include e-QIP and submission of fingerprints and all required documents in a correct and legible form, will result in the revocation of access and removal of the specified noncompliant individual from the contract until such time as the background investigation is scheduled at OPM.

6) VA is not currently a member of the National Industrial Security Program (NISP) and does not have the authority to enter into any national security classified contracts. Approval of any potential classified contracts must be made by the Director, Office of Operations and National Security.

TASKS and REQUIREMENTS: The Contractor shall provide the tasks and requirements for onsite, secure document destruction services, during the applicable period of performance, and within the constraints of this PWS and the terms and conditions of this contract.

Summary of Services: Services involve Contractor provision of 65-gallon containers, remaining on-site for collection of un-shredded material. Services also involve Contractor weighing un-shredded material on-site. Destruction also occurs on-site at the location. VA staff observe these processes. VA Records Officials also perform random observations of the process. Contractor provides VA with a Certificate of Destruction.

Important: Contractor must comply with VA Directive 6371 Destruction of Temporary Paper Records dated 04/8/2014 (“6371”), and any future updates of this Directive, during the performance of services on this contract.

Schedule - It is anticipated that services will be required every other Friday. The commencement of the schedule is dependent upon issuance of each task order. Upon issuance of a task order, the Contractor shall provide a service at sufficient frequency to ensure paper and material do not accumulate at the site beyond reasonable capacity of the containers. Under task order services, the secure mobile containment unit shall be emptied when 50% full or greater.

Number of Containers: The VA estimates 13-15 of the 65-gallon containers will be needed to store un-shredded material between services. This is an indefinite quantity indefinite delivery contract. Amounts and frequencies are subject to change.

Amounts: Refer to section titled, “Estimated Quantities”, of the contract for anticipated weight every 12 months.

1) On-site secure document destruction means the Contractor shall furnish on-site, commercial, secured collection and destruction of confidential documents, paper and patient privacy information.

2) Contractor must provide secure steps for containment, pickup at point of collection, shredding per Veteran Health Administration (VHA) standards and VA Directive 6371, and end recycling.

3) Contractor is responsible for providing, at no additional cost to the government, enough secure, 65-gallon containers to satisfy the services, every other week, and to reside at the location for use in accordance with this PWS. The number of containers must be enough to accommodate accumulation of un-shredded material and ensure proper closure of the container, while eliminating safety risks during user transportation or movement of container.

4) The Contractor is responsible for collecting the large 65-gallon containers from the secure area at the location. All containers will be locked and secured until time of destruction. The Government shall provide access to shred bin locations, generally the warehouse, in compliance with pickup services, excluding government holidays.

5) Prior to shredding, each container must be weighed, on-site, by the Contractor to provide an accurate weight of material being shredded by the Contractor. VA does not provide scales or mechanisms for weighing on-site. Contractor is responsible for providing calibrated, mobile scales (weighing equipment) for weighing on-site at location. Calibration records for the scales being used during the service must be provided to COR or VA Records Officer upon request.

6) The Contractor will shred the contents from the large 65-gallon containers, on-site.

7) Contractor must coordinate arrival on site with COR to afford the VA staff an opportunity to observe the Contractor performing the steps on-site. VA Records Officials also perform random observations of the process.

8) Interim Destruction - Contractor must perform Interim Destruction at location and under observation and inspection by the COR or VA Records Officer, per VA Directive 6371 Destruction of Temporary Paper Records dated 04/8/2014 (“6371”). Interim destruction does not definitively ensure paper is not readable or reconstructable to any degree, but does ensure they are not readable or reconstructable without extraordinary effort. This destruction of temporary records is a preliminary step that will allow for secure transport of records until such time as their final destruction.

9) Final Destruction - The destruction process must assure that paper is not readable or reconstructable to any degree.

10) Site Clean-up - The Contractor shall assure its processes do not create an unclean or unsafe environment for SVAHCS and do not damage or destroy government property.

11) Final Inspection - The COR will notify the vendor of any issues raised from the destruction of paper from each location.

12) Certification of Destruction - Contractor must provide the COR with a Certification of Destruction, per VA Directive 6371, that attests to the completion of the destruction process after the destruction of VA records has taken place, and for every completed service. The certification is not valid if submitted prior to the actual destruction of the records.

13) Contractor shall notify COR if shredding is not possible due to emergency, equipment malfunction, or weather. Initial notice shall occur by phone with Contractor providing confirmation in writing to the COR, with a copy to the CO. Contractor is required to notify COR and CO in writing if final locations of waste dump changes from existing City landfill/recycling facility.

SERVICE REPORTS:

Contractor shall provide the COR with individual Service Reports pertaining to tasks and requirements performed at the location. All Service Reports are to be signed and dated by the designated Contractor’s Representative and provided to the COR at the end of each performance. Service reports must be legible. Complete service reports must be received by the VA POC, COR or CO before any invoice can be certified for payment.

Each Service Report must legibly document the following to be considered complete:

1. Name of Contractor and contract number

1. Purchase order number

1. Contractor Service Report number/log number/Certificate of Destruction number

1. Contractor Personnel in attendance during the applicable Service period, to include their full name

1. Hours performed during the applicable Service period. Date, Time (starting and ending) of services

1. Description of services performed during the applicable Service period

1. Description of problems reported by the COR/user (if applicable)

1. Identification of containers serviced, if applicable

1. Identify details of any calibrations performed and results of such

1. Signatures, as needed, at time of services from Contractor technicians performing service and name of authorized VA Employee who witnessed service described

1. Full name of COR, stating whether present during services or absent

1. Process of destruction

1. Total and tare weight

1. Weight of paper shredded prior to shredding

1. Size of particles after processing

1. Details of Final Destruction method including location of waste disposal and facility organizational name, date/time of disposal, as a minimum

1. Clear description of the process of destruction, per VA Directive 6371

1. Copy of most current scale calibration certificate

CONTRACT OVERSIGHT BY THE CONTRACTOR

Contractor Representative and Point of Contact - The Contractor shall specify an individual who shall serve as a single point of contact for all Contract issues. Contractor must provide the COR and Contracting Office with the Contractor’s Representative contact details, to include cell phone and email, as a minimum:

1) Within 5 business days of contract award,

2) Within 5 business days after contract Option Period renewal, and

3) Within 5 business days prior to a change in the COR by the Contractor.

The Contractor’s Representative must be easily accessible by phone and return COR calls within 48hours of a voice message left by the COR.

Changes in Personnel - Changes to Contractor personnel that involve either:

1) Contractor-proposed substitutes of existing Contractor personnel, or

2) Adjustments to the Contractor personnel qualifications must be disclosed to the COR at least three (3) days prior to making any permanent substitutions of staff, and

3) Providing a detailed written explanation of the circumstances necessitating the proposed substitutions, and any additional information requested by the COR.

Replacement Contractor personnel must have comparable qualifications to those of the personnel being replaced, and must satisfy the requirements listed in the Qualifications section of this PWS. The COR must provide approval of any Contractor replacement personnel prior to being privy to service details or commencing services under this PWS and contract.

The COR will:

1) Notify the Contractor within 15 days after the receipt of all required information of the decision on the proposed substitutes.

2) Only consider changes of key personnel if notified via written communications.

CONTRACT OVERSIGHT BY THE VA

Contracting Officer’s Representative (COR) -Upon contract commencement, the Contracting Officer will notify the Contractor in writing as to the COR assigned to this contract, and upon reassignment of a new COR, as applicable. Contractor shall only respond to requests for service from the COR or the CO. If service is requested from any source, other than the COR or the CO, the Contractor is to advise the individual of this requirement and refuse to respond. Any billing resulting from unauthorized service will not be paid by the government.

The COR will periodically evaluate the Contractor’s performance to ensure services are received in accordance with this PWS. The COR will evaluate the Contractor’s performance through review of the deliverables and Contractor’s performance.

Authority of the COR - The Contracting Officer is the only person authorized to approve changes in any of the requirements of this contract. In the event the Contractor affects any changes at the direction of any person other than the Contracting Officer, the changes will be considered to have been made without authority and no adjustment will be made in the contract price or schedule to cover any increase in costs incurred as a result thereof. The

Contracting Officer shall be the only individual authorized to accept nonconforming work, waive any requirement of the contract, and/or modify any term or condition of the contract. The Contracting Officer is the only individual who can legally obligate Government funds. No costs chargeable to the proposed contract can be incurred before receipt of a fully executed contract or specific authorization from the Contracting Officer.

Government Alternate Points of Contact (POC) – Emergencies Only - The COR will identify Alternate Points of Contact (POC) to be used only for instances of emergencies when the COR is not easily contactable. These will be individuals in supervisory or managerial roles within the VA department responsible for monitoring performance on this contract. The Contractor will be provided this information within 5 days of an Alternate POC being assigned. An Alternate POC does not replace the COR nor do they replace the Contracting Officer during the performance and administration of this contract, nor does it relinquish or diminish the Contractor’s requirements in relation to the performance of this Contract.

Placing Orders for Services – The COR is designated by the Contracting Officer as the only authorized point of contact for communicating Task and Requirement related details to the Contractor’s Representative. The Contractor will only be required to fulfil Tasks and Requirements, and the COR will be authorized to proceed to communicate with the Contractor on Tasks and Requirements, upon receipt of a funded Task Order which has been signed by a VA warranted Contracting Officer from the Administrative Contracting Office identified on page 1 of this contract. Performance of tasks must not exceed the dollar values and period of performance outlined in the Task Order, or its respective modifications. If service is requested outside the Task Order terms and conditions, the Contractor is to advise the COR of this, refuse to respond to the order request, and immediately follow up in writing with the Contracting Officer. Any billing resulting from unauthorized service will not be paid by the government. Within 48 hours of commencement of each Task and contract related service, the COR and the Contractor’s Representative must respectively provide written confirmation of such to the CO. The VA will strive to provide the Contractor a signed Task Order within 10 days of performance being required on Tasks. Refer to section in this PWS for Service Reports as well as the Ordering clauses in this contract.

SAFETY AND COMPLIANCE: The Contractor must perform services in accordance with:

1) All federal, state and local laws, whether or not related to the performance of contract services.

2) Local, state and federal Occupational Safety and Health guidelines and legislation, to include Occupational Safety and Health Administration (OSHA);

3) Local, state and federal guidelines and legislation, as well as OKC VAHCS Directives and guidelines, relating to privacy protection laws

Contractor’s Safety Plan: Contractor must submit a Safety Plan to the CO at time of award. This will be provided to the COR and SVAHCS Safety Officer for evaluation and approval. Prior to implementation of any changes in the Contractor’s Safety Plan, a revised Safety Plan must be provided to the COR and CO. Written approval from the COR must be received by the Contractor prior to implementing new Safety Plans.

Medical Center Directives and Policies: Each VA Medical Center has directives and policies that are updated from time to time. The COR can provide more detailed information to the Contractor of these upon commencement of the contract and throughout the term of the contract, as needed. VA universal policies include parking, possession of weapons, cell phone use, and use of photography as well as smoking on VA property. Contractor’s must comply with posted rules and signs on federal property. Violations of such policies may result in individual fines or citation answerable in the United States (Federal) District Court.

QUALITY

Contingency Plan - The Contractor’s written contingency plan shall be provided at time of award detailing actions that will be taken by the Contractor in the event of equipment failure, insufficient Contractor staffing, or unexpected event(s) that result in services not being completed to the standards in the PWS, as well as the VA Directive 6371. The Contractor’s contingency plan must align with the Purpose of this PWS and document the Contractor’s efforts in good faith to maintain services with limited or no risk in satisfying the terms of the PWS and compliance with the contract. COR will provide written approval to the Contractor once the Contractor’s contingency plan is acceptable and meets these criteria. If the plan does not meet these criteria or the plan will not feasibly and realistically work for the facility, the Contractor will be required to make adjustments that are mutually agreeable with the facility and the Contractor’s operational capabilities. The contingency plan must be finalized and agreed upon by both parties within 10 business days of contract award.

Quality Control Plan (QCP) - Contractor will develop and maintain a quality program ensuring services are performed in accordance with commonly accepted commercial practices, and the requirements of this PWS. At a minimum, the contractor must develop Quality Control Procedures (QCP). Contractor must develop and implement Quality Control Procedures to identify, prevent, and ensure non-recurrence of defective services.

QCP - either a paper version or emailed version of the QCP must be provided to the COR and CO upon request. Contractor must be prepared to comply with requests as soon as:

1. Within 30 days of contract award, and

1. Within 30 days prior to a major change in the QCP by the Contractor.

Remedy or Rework - Rework or Remedy is defined as performing the Service again until the Purpose of this PWS is achieved in full. This involves less than Satisfactory Service by the Contractor and as noted by the COR. Rework or Remedy must occur within a reasonable time, but no more than 5 business days of the notice of the rework or remedy requirement from the COR and at no additional cost to the Government. In the event climate or weather conditions make it unsuitable for Services, the entire service date will be re- scheduled to a date and time mutually agreeable to the Contractor and the COR. Postponement as a result of these circumstances will not reflect any penalties assessed to the Contractor or to the Government.

FEDERAL HOLIDAYS AND STANDARD BUSINESS HOURS - Standard Business Hours at the VA Medical Center are between 8:00am and 4:30pm Monday-Friday excluding Federal holidays, except by special alternate arrangement, coordinated and authorized by the COR.

The Federal Government observes the following days as holidays. Federal Holidays can be found at the OPM website. At time of writing, the information can be found at https://www.opm.gov/policy-data-oversight/snow-dismissal-procedures/federal-holidays/ The Federal Government observes the following days as holidays.

*Holidays that fall on Saturday are observed on the preceding Friday. Holidays that fall on Sunday are observed on the following Monday.

In addition to the days designated as holidays, the Government observes the following days:

· Any other day designated by Federal Statute

· Any other day designated by Executive Order Any other day designated by the President of the United States to be a Federal holiday

DEFINITIONS

Acceptance Signature - VA employee who is authorized to sign-off on the Service Report Authorization Signature - COR's signature; indicates COR accepts work status as stated in Service Report.

CO - Contracting Officer Contractor Employees – has the same meaning as Contractor Personnel Contractor Personnel - has the same meaning as Contractor Employees COR – Contracting Officer’s Representative OSHA – Occupational Safety and Health Administration PWS – Any reference to PWS in this contract means “performance work statement” and is not to be confused P.W.S. which also known in industry to mean potable water system. This is a performance based service acquisition. Further details can be obtained in FAR Part 37.6.

Service Report - a documentation of the services rendered for each incidence of work performance under the terms and conditions of the contract.

Services – includes those identified in the Purpose of this PWS SOW – for the purpose of this contract SOW has the same meaning as PWS, and refers to the PWS in this contract.

SR –Service Report Contractor Personnel – are personnel and/or employees who shall be suitably knowledgeable in the field related to the services in this PWS in order to satisfactorily perform services in accordance with the PWS. The Contractor shall provide personnel experienced and qualified to perform the required services in accordance with industry practices and standards.

VA - Department of Veterans Affairs VAHCS – VA Health Care System VAMC – Veterans Affairs Medical Center VA Mission Statement: “To fulfill President Lincoln's promise “To care for him who shall have borne the battle, and for his widow, and his orphan” by serving and honoring the men and women who are America’s Veterans.”

36C25918Q9958 VHA - Veterans Health Administration Page 1 of Page 1 of B.8 VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE (APPENDIX C of VA HANDBOOK 6500-6, March 12, 2010)

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontrator shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

c. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

d. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

e. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

f. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

g. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted for, using VA-approved encryption tolls that are, at minimum, FIPS 140-2 validated.

h. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

i. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

4. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy…