Attachment 1 - Statement of Work - Long term Document Pick Up and Storage.docx

1. General Information

Record Pick-up and Storage Statement of Work

1.1 Background: The Veterans Health Administration (VHA) Member Services Income Verification Division (IVD) receives financial information from the Internal Revenue Service and Social Security Administration to determine Veterans’ household income. The Veterans will receive an income verification case and work directly with IVD. If the Veteran has out-of-pocket medical expenses or financial losses, the Veteran can fax or mail the documents to IVD. In accordance with record retention policy, IVD must store these documents for 7 years. IVD closes over 120,000 cases each year and does not have the storage capacity to store documents for 7 years, thus looking for a third-party vendor to pick up and store the IVD documents at an offsite location.

1.2 Contractor’s Key Personnel: The Contractor shall provide an employee point of contact who shall be responsible for the performance of the work. The employee shall have full legal authority to act for the Contractor on all work matters relating to daily operations of this requirement. The individual shall be available between 7:00 a.m. to 5:00 p.m., EST, Monday through Friday except Federal holidays or when the VHA facility is closed. The Contractor shall provide an enough properly trained and qualified employees to perform the work of this requirement.

1.3 Health Eligibility Center Location - 2957 Clairmont Rd NE, Atlanta, GA 30329. The records are located on the 4th floor and elevators are available for use.

2. Contractor Responsibilities and Tasks

2.1 The contractor will pick up the IVD boxes from the Health Eligibility Center (HEC) and store at an offsite location for the required record retention and then shred documents after record retention period ends. The contractor must be readily available to respond to inquiries to locate documents upon request and send back to VHA IVD via certified mail.

2.2 The Department of Veteran Affairs reserves the right to tour the facility or conduct site visits upon request.

2.3 The contractor is responsible to produce and submit a product production schedule for Government approval within 30 days after the contract is awarded. Once approved, the production schedule will be adhered to. The contactor will supply their own pallets, shrink wrap and transportation of the documents. The contractor must use the filling identified (section 2.7) by the VHA IVD and be able to retrieve those documents when requested via encrypted email. Within the email, IVD will provide in addition to the identifiers the full SSN and Veteran name. IVD will request no more than 10 records a year. The average weight of one record is no more than one pound.

2.4 The contractor is responsible to ensure the documents are stored in a secure location under appropriate conditions to ensure no damage occurs to the documents. The record storage environment must be controlled to ensure preservation of the documents. The temperature and humidity shall be monitored for preservation. Ideal temperatures for paper records vary between 65- and 72-degrees Fahrenheit. Relative humidity should be between 40 and 55 percent. Air quality must also be monitored for proper ventilation. The facility must be secure to ensure protection of data on the documents and the vendor must have insurance to protect for any unforeseen damages. Only vendor employees with a bona-fide “need to know” shall have access to the records. Any record breach must be reported to the VHA MS Privacy office and IVD within 24 hours of discovery. The email for the privacy office is VHAMSServicesPrivacy@va.gov.

2.5 IVD will put documents into boxes based on income year and organized by the Veteran’s last four of the SSN. Within each box will also be an inventory list for every record within the box that contains the Veteran’s full name and SSN. See section 2.7 for the list of identifiers on the outside of the box used to assist the contractor with locating documents within the boxes when called upon. Once box is located, the vendor will use the inventory list to locate the exact Veteran record.

2.6 IVD will provide the documents boxed up and labeled and closed with secure security tape. The contractor shall shrink wrap and place boxes on pallets at the HEC and then take to an offsite storage location. The facility where the boxes are located does not have a loading dock and the pallets cannot enter the building. There is a parking lot and a parking garage that may be used for shrink-wrapping and palletizing the boxes.

2.7 The below identifiers are located on each Veteran Box for look up and reference. The Contractor shall locate documents upon request based on the below identifiers.

· Income Year

· Last four of the Veteran’s SSN for the first and last folder in the box (copy from front of box)

· Box Number

· Employee initials

2.8 The vendor will provide the bar code inventory label for IVD to tape to the outside of the box. Vendor will provide updates on the boxes until at storage location and provide certification back to IVD with final count and final destination.

2.9 The contractor shall acknowledge any document requests within 24 hours after the request is received and provide the requested documents within 72 hours after the initial request is receive via certified mail. The Vendor will provide the tracking information once the documents are mailed.

2.10 The table below shows the income years required for storage and the estimated number of boxes for pick up. Each income year must be stored for the reminder of the required record retention which is documented in the table in section 3.0.

2.11 The vendor will follow the below process for document destruction:

1. If the final destruction is witnessed by a contractor (or subcontractor or third party), then the contractor must submit a valid certificate of final destruction to the VA organization that created the temporary paper records

2. Final destruction must be carried out by either:

a) A NAID certified, bonded, and insured contractor (and its subcontractors or third parties) for paper/printed media destruction; or

b) A non-NAID-certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in VA Directive 6371 Appendix A

3. If one or more subcontractors (or third parties) handle VA temporary paper records before final destruction, then the contract shall require documentation in any and all subsequent contracts or agreements between the primary information destruction contractor and their subcontractors or third parties that the subcontractors or third parties shall provide sufficient reasonable safeguards for the temporary paper records, to the same standards required of the primary contractor, throughout the destruction process.

4. Certificates of destruction from information destruction contractors will be maintained by the VA in accordance with applicable VA Records Control Schedules and should be completed and provided to the VA organization that created the temporary paper records only after final destruction has actually taken place. VA personnel responsible for documenting the final destruction of temporary paper records must develop a tracking method for ensuring that a certificate of destruction is submitted for every shipment of temporary paper record released to an information destruction contractor. Certification documentation can be in the form of a letter, memo, or any format attesting to its complete destruction.

a) This certification is not considered a valid certification of destruction if completed and submitted prior to the final destruction of the records.

b) The certification should contain sufficient information to attest to the final destruction of the temporary paper records – what temporary records were destroyed, the date when they were destroyed, what destruction method was used, where they were destroyed, and who was responsible for their final destruction

2.12 Veterans’ Health Administration (VHA) programs and facilities must enter into a fully executed Business Associate Agreement with all information destruction contractors who complete interim and/or final destruction off-site or not under the direct control and monitoring of VHA personnel. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

3.0 Record retention schedule

Records

Records

Records

4.0 The contractor shall pick up each income year as the boxes become ready for pick up. Currently all of 2016 and 2017 is ready for pick up. VHA IVD will inform the contractor at least 30 days in advance for the next record pick up for years 2018 and 2019.