Attachment 1 - PWS Atlanta Shredding Services.rtf

Health Eligibility Center (HEC) Atlanta, Georgia Document Disposal Services Performance Work Statement

PURPOSE: The purpose of this project is for pickup and final destruction of Temporary Paper Records containing VA sensitive information that has undergone Interim Destruction (Shredding) from the Veterans Health Administration, Health Eligibility Center (HEC).

BACKGROUND: The Health Eligibility Center (HEC), a subunit of Member Services under the Chief Business Office, provides eligibility and enrollment determination services and conducts Income Verification for Veterans Health Administration (VHA). Paperwork generated while conducting business contains Personally Identifiable Information (PII) and or Federal Tax Information (FTI) that must be disposed of using appropriate processes to meet the VA’s “Destruction of Temporary Paper Records” standards.

OBJECTIVES: To obtain document disposal services of temporary paper records containing VA sensitive information by employing appropriate safeguards and measures for the pick-up, transport, and final destruction of such paper records as to prevent loss, use, or disclosure of Personally Identifiable Information (PII) or Federal Tax Information (FTI).

SCOPE: The Contractor shall provide, on-site pick-up and/or on-site final destruction services twice weekly at the Health Eligibility Center (HEC), Atlanta GA, and ensure final disposal/destruction of shredded material is conducted using a process in which the temporary paper records are burned, pulped, macerated, shredded, or otherwise destroyed to a degree that absolutely ensures that they are not readable or reconstructable to any degree.

The Contractor shall provide seven 95 gallon locking bins with wheels and paper slot for use on-site. The Contractor shall issue a Certificate of Pick-up and a Certificate of Final Destruction as describe in this Performance Work Statement.

DEFINITIONS:

Certification of Destruction. Written documentation that attests to the completion of the destruction process, after final destruction of VA temporary paper records have taken place. Certification documentation can be in the form of a letter, memo, or any format attesting to complete destruction. This certification is not considered a valid certification of destruction if completed and/or submitted prior to the final destruction of the records.

The certification should contain sufficient information to attest to the final destruction of the temporary paper records – what temporary records were destroyed, the date when they were destroyed, what destruction method was used, where they were destroyed, and who was responsible for their final destruction.

SPECIFIC MANDATORY TASKS AND ASSOCIATED DELIVERABLES

Description of Tasks and Associated Deliverables: The Contractor shall ensure accuracy, timeliness, and completion of all tasks under this effort. Deviations in dates for service must be mutually agreed to in writing by the Contracting Officer’s Representative (COR) and Contractor.

Specifically, the Contractor shall perform the following tasks:

Task One: The contractor shall provide/make available/maintain seven (7), 95 gallon locking bins, with wheels and paper slot for use on-site at the Health Eligibility Center (HEC).

These bins will be maintained at the HEC for the duration of the contract. If a bin becomes unserviceable, the contract will be notified and shall bring a replacement bin on the next scheduled pick-up service.

Deliverable 1a: seven (7) ninety-five (95) gallon locking bins.

Task Two: On-site pick-up and interim destruction of records.

Deliverable 2a: Pickup/processing of bins, twice a week – Tuesday and Thursday, between 8:00 A.M. and 3:00 P.M. (See Performance Period for Holiday scheduling) Contents will be:

The empty bins will be returned to the designated shredding bin placement area by HEC associates.

Deliverable 2b: Provide a certificate of pick-up and certificate of pick- up/interim destruction.

Task Three: Provide Final Destruction services of designated records. Ensure VA’s Standard for destruction of material is met (See Final Destruction definition above) Deliverable 3a: Ensure final destruction of identified material is conducted using one of the following methods.

Deliverable 3b: The Contractor shall provide a certificate of destruction after every instance of final destruction. (See Para 5, a. Definitions above)

6.4 Task Four: Employee background checks

Deliverable 4a: The Contractor shall conduct background security checks and/or establish security control procedures for service contract personnel, with satisfactory results.

Task Five: All companies that are part of the executed contract should ensure background checks are conducted with satisfactory results Deliverable 5a: Documentation of background investigations (types and frequency)

Task Six: Reporting the Contractor shall provide to the COR written notification when it cannot meet any of the tasks or deliverable as soon as it becomes aware of the situation, but not later than the scheduled event.

Deliverable 6a: The Contractor shall provide written notification to the COR.

6.6 Schedule of Mandatory Deliverables:

Reference Deliverable Due Date 1a 7 x 95 Gallon locking bins 1 week from date of award 2a Pick up bins twice per week – Tuesday and Thursday, between 8:00 A.M. and 3:00 P.M On scheduled pic- up days 2b Provide a certificate of pick-up / transfer Prior to departing the VA facility 3a Ensure final disposal/destruction of shredded material is conducted using one of the following methods: records are pulped, macerated, shredded, or otherwise destroyed to a degree that definitively ensures that they are not readable or reconstructable to any degree No later than 5 days after every pickup.

3b Provide/issue a Certificate of Final Destruction After every instance of final destruction 4a All companies are mandated to have employees with company security clearances, ensuring background checks are conducted with satisfactory results for any employee working on this contract. (This includes any sub-contractor) Prior to contract start/prior to employees working with VA material.

5a Provide documentation of background investigations Prior to start of contract 6a The Contractor shall provide to the COR written notification when it cannot meet any of the tasks or deliverables As soon as possible after awareness of inability to perform

Other Operational Requirements

Performance Period: The period of performance shall be a 12-month base period with 4, 12-month option periods.”

There are eleven (11) Federal holidays set by law (U.S.C. Title 5 Section 6103): Under current definitions, four are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

Place of Performance: Performance shall take place at:

VA Health Eligibility Center Member Services 2957 Clairmont Road N.E.

Atlanta, GA 30329 and

Contractor’s site and/or recycling site.

Contact Information:

Key Personnel: Certain skilled experienced professional and/or technical personnel are essential for accomplishing the work to be performed. These individuals are defined as "Key Personnel" and are those persons whose resumes shall be submitted within five working days of award of contract and marked by the vendor as "Key Personnel". Substitutions shall only be accepted if in compliance with “Substitution of Key Personnel" provision identified below.

Name Title

2. Substitution of Key Personnel: All Contractor requests for approval of substitutions hereunder shall be submitted in writing to the COR and the Contracting Officer at least twenty-five (25) calendar days in advance of the effective date of the substitution, whenever possible, and shall provide a detailed explanation of the circumstances necessitating the proposed substitution, a complete resume for the proposed substitute, and any other information requested by the Contracting Officer, or the COR, which they deem necessary to approve or disapprove the proposed substitution. Proposed substitution personnel shall have qualifications equal to or exceeding those of the personnel they will replace. Additionally, new personnel shall not commence work until all necessary security requirements have been fulfilled and resumes provided. The COR and the Contracting Officer will evaluate such requests and promptly notify the Contractor of approval or disapproval in writing.

The Contractor shall be responsible for managing and overseeing the activities of all Contractor personnel, as well as subcontractor efforts used in performance of this effort. The Contractor's management responsibilities shall include all activities necessary to ensure the accomplishment of timely and effective support, performed in accordance with the requirements contained in the Performance Work Statement. Resumes submitted for employees assigned to perform under this Performance Work Statement shall contain documented experience directly applicable to the functions to be performed. Further, these prior work experiences shall be specific and of sufficient variety and duration that the employee is able to effectively and efficiently perform the functions assigned. In addition, the security clearance of each individual should be disclosed. If a clearance has not been completed on an individual, please state whether the clearance is in progress.

Government and Contractor Responsibilities:

If the final destruction is witnessed by a contractor (or subcontractor or third party), then the contractor must submit a valid certificate of final destruction to the VA organization that created the temporary paper records.

Final destruction must be carried out by either:

A NAID certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction; or

A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371 Appendix A

If one or more subcontractors (or third parties) handle VA temporary paper records before final destruction, then the contract shall require documentation in any and all subsequent contracts or agreements between the primary information destruction contractor and their subcontractors or third parties that the subcontractors or third parties shall provide sufficient reasonable safeguards for the temporary paper records, to the same standards required of the primary contractor, throughout the destruction process.

Certificates of destruction from information destruction contractors will be maintained by the VA in accordance with applicable VA Records Control Schedules and should be completed and provided to the VA organization that created the temporary paper records only after final destruction has actually taken place. VA personnel responsible for documenting the final destruction of temporary paper records must develop a tracking method for ensuring that a certificate of destruction is submitted for every shipment of temporary paper record released to an information destruction contractor.

Certification documentation can be in the form of a letter, memo, or any format attesting to its complete destruction.

This certification is not considered a valid certification of destruction if completed and submitted prior to the final destruction of the records.

The certification should contain sufficient information to attest to the final destruction of the temporary paper records – what temporary records were destroyed, the date when they were destroyed, what destruction method was used, where they were destroyed, and who was responsible for their final destruction

Veterans’ Health Administration (VHA) programs and facilities must enter into a fully executed Business Associate Agreement with all information destruction contractors who complete interim and/or final destruction off-site or not under the direct control and monitoring of VHA personnel

Quality Standards for Deliverables: Performance Measures/Standards: General quality measures, as set forth below, will be applied to each work product received from the Contractor under this Performance Work Statement.

Performance Measures/Standards: General quality measures, as set forth below, will be applied to each work product received from the Contractor under this Performance Work Statement.

Final Destruction. The process through which temporary paper records are pulped, macerated, shredded, or otherwise destroyed to a degree that definitively ensures that they are not readable or reconstructable to any degree.

If the final destruction is witnessed by a contractor (or subcontractor or third party), then the contractor must submit a valid certificate of final destruction to the VA organization that created the temporary paper records

If final destruction is not carried out by VA employees, it must be carried out by either:

A NAID certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction; or

A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in this Document

All destruction will take place within the enclosure of the destruction facility, which consists of four solid walls and a ceiling, and meets all criteria related to physical building security.

Clarity Work Products shall be clear and concise.

Consistency to Requirements All work products must satisfy the requirements of this Performance Work Statement.

Formal Acceptance or Rejection of Deliverables: The VA shall have the authority to accept or reject any deliverables.

Security and Privacy Requirements

The position sensitivity required for individual background security checks shall be commensurate with the risk level designated for the contract being Low, Moderate, or High Risk.

The A&A requirements do not apply to this requirement, and a Security Accreditation Package is not required.

3. General Contractors, Contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

All Contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for Contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

Contract personnel who require access to national security programs must have a valid security clearance. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the Contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

The Contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the Contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the Contractor or subcontractor prior to an unfriendly termination.

VA information should not be co-mingled, if possible, with any other data on the Contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the Contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of Contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

Prior to termination or completion of this contract, Contractor/subcontractor must not destroy information received from VA, or gathered/created by the Contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a Contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the Contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

The Contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

The Contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on Contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the Contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

If VA determines that the Contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the Contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

If a VHA contract is terminated for cause, the associated Business Associate Agreement must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

The Contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

The Contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the Contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The Contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

Notwithstanding the provision above, the Contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the Contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that Contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the Contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

To the extent known by the Contractor/subcontractor, the Contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the Contractor/subcontractor considers relevant.

With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

In instances of theft or break-in or other criminal activity, the Contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The Contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The Contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

The Contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence.

(b) Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

(3) Number of individuals affected or potentially affected.

(4) Names of individuals or groups affected or potentially affected.

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

(6) Amount of time the data has been out of VA control.

(7) The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons).

(8) Known misuses of data containing sensitive personal information, if any.

(9) Assessment of the potential harm to the affected individuals.

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate: and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Based on the determinations of the independent risk analysis, the Contractor shall be responsible for paying to the VA liquidated damages in the amount of the current fair market price, as determined by the VA, to cover the cost of providing credit protection services to affected individuals, consisting of the following:

(1) Notification.

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

(3) Data breach analysis.

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

14. RISK DESIGNATION:

This contract is designated as Moderate Risk.

15. MINIMUM STANDARDS FOR INFORMATION DESTRUCTION:

Information destruction contractors and subcontractors must be able to meet the following standards:

Documentation and Control of Resources

Locks and security of vehicles; and