DRAFT PWS- Document Destruction.pdf

PART I: GENERAL INFORMATION

Performance Work Statement

A. Introduction VA Northern Indiana Health Care Systems (VANIHCS) has a requirement for document destruction services at the two (2) main campuses in Fort Wayne and Marion, one (1) Mental Health Annex in Fort Wayne; and Five (5) community-based outpatient clinics (CBOC) in Huntington, IN, Muncie, IN, Peru, IN, Mishawaka, IN. & Defiance Ohio. Contractor shall provide secure, on-site destruction service. Service shall include providing and placing a predetermined number of secure and lockable containers at the eight (8) designated locations and shall include continuous, consistent, bi-weekly, or monthly service as listed on the Schedule of Supplies or Services and Price/Costs.

B. Background

VANIHCS is a medical facility providing both inpatient and outpatient care and services. Documents with personally-identifiable information (PII) and other VA sensitive information are temporarily generated and shall be destroyed to ensure patient and employee information is protected.

C. Scope

1. Contractor shall provide and service secure document containers on a consistent, regularly scheduled basis with their own equipment. All destruction is required to be performed on-site with certificates of destruction and weight reports provided for each service, processed through pulping down to 1/8 of an inch or less to ensure that destroyed material is not readable or reconstructable in any way per VA Directive 6371 and Appendix A .

2. Performances of these services May involve exposure to information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions such as the Privacy Act of 1974 and HIPAA Privacy Rule, and information that could be withheld under the Freedom of Information Act.

3. Examples of VA sensitive information include the following: Individually-identifiable medical information, benefits, personnel information, financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, law enforcement information, and information that is confidential and privileged in litigation, such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege, and other information which, if released, could result in violation of law or harm or unfairness to any individual or group, or could adversely affect the National interest or the conduct of Federal Programs.

D. Applicable Documents The object of this contract to provide patient and employee privacy by destroying confidential information documents in accordance with the following:

1. VA Directive 6371, Destruction of

Temporary Paper Records https://www.va.gov/vapubs/Search_action.cfm

2. Privacy Act of 1974, 5 USC 552a https://bja.ojp.gov/program/it/privacy-civil-liberties/authorities/statutes/1279

3. NARA Records Management, 36 CFR Chapter XII Subchapter B.

https://www.ecfr.gov/current/title-36/chapter- XII/subchapter-B

4. NSA/CSS 02-01, Evaluated Products List for High Security Crosscut Paper Shredders https://www.nsa.gov/Portals/75/documents/resources/everyone/media-destruction/January%202025%20Quarterly%20Updates/NSAEPLPaperShredd ersJanuary2025.pdf?ver=EahYNvGrUezJYHOAYwmckg%3d%3d https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=276410&FileName=VA-248-12-R-0083-002.PDF

5. NSA/CSS 02-02-P, Evaluated Products List for High Security Disintegrators https://www.nsa.gov/Portals/75/documents/resources/everyone/media-destruction/January%202025%20Quarterly%20Updates/NSAEPLPaperDisinte gratorsJanuary2025.pdf?ver=b-3f794uT5r_vDa8Ow_nCA%3d%3d

6. VA Directive 6300, Records, and Information Management https://www.va.gov/vapubs/Search_action.cfm

7. VA Directive 6500, Information Security Program https://www.va.gov/vapubs/Search_action.cfm

8. 36 CFR 1220.14 Subpart A, General Provisions, General Definitions https://www.ecfr.gov/current/title-36/chapter- XII/subchapter-B/part-1220/section-1220.14

9. 36 CFR 1226.24, Destruction of Temporary Records (formerly 1228.58) https://www.ecfr.gov/current/title-36/chapter- XII/subchapter-B/part-1226/section-1226.24

10. 44 USC 3302 § 1228.58

Destruction of Temporary Records https://www.archives.gov/about/laws/disposal-of-records.html

11. VA Directive and Handbook 0710, Personnel Suitability and Security Program https://www.va.gov/vapubs/Search_action.cfm

PART II: WORK REQUIREMENTS

A. Technical Requirements

1. Contractor shall meet all requirements of Federal, State or City codes regarding operations of this type of service. The contractor must possess a License as a Confidential Document Destruction Company and hold certification as meeting all standards as mandated through HIPAA in handling, transporting, storage and destruction of confidential documents.

2. All paper documents picked up shall be handled in accordance with the Privacy Act and destroyed on site at the time of pickup. This shall require final destruction of records on site. Interim destruction shall be followed with final destruction procedures. The trucks shall be secured, sealed and locked after pick up.

3. The Contracting Officer’s Representative (COR) shall monitor the service. Any change in the company’s certification, accreditation or ownership shall be disclosed to VANIHCS COR immediately.

4. Contractor shall be responsible for the maintenance and serviceability of all aspects of each secure document container including all lock mechanisms. Contractor shall provide keys for each type of lock used to the COR on all secure document containers to VANIHCS for emergency purposes.

5. Bins shall be locked and the material unable to be retrieved once it is placed in the container unless it is unlocked. The contractor shall ensure all destroyed items from VA NIHCS are recycled.

6. Contractor shall not allow anyone access to the shredding containers without permission from COR.

7. Contractor shall be responsible for visual inspection of locks. Any damaged or broken locks shall be replaced by Contractor.

8. Contractor shall comply with all established confidentiality and non-disclosure policies and procedures per industry standards, VA guidelines per VA Directive 6371 and Appendix A of same.

B. Record Management.

1. Federal Records related to this policy, regardless of medium, shall be created, maintained, and dispositioned in accordance with the VHA Records Control Schedule (RCS) 10-1, General Records Schedule (GRS) or another NARA-approved records schedule, if applicable.

2. Federal Records shall be stored per the National Archives & Records Administration (NARA) Records Management, as described in 36 Code of Federal Regulations (CFR) Chapter XII Subchapter B.

C. Deliverables

1. Contractor shall provide secure lockable containers with one set of keys for these containers at each site location.

2. Contractor shall inspect for damage of broken locks. Contractor to replace containers as needed when broken or damaged.

3. Contractor shall provide service at each site per the set schedule. If for any reason service cannot be delivered within the scheduled timeframe, the contractor shall provide an explanation in writing to the CO https://www.vendorportal.ecms.va.gov/FBODocumentServer/DocumentServer.aspx?DocumentId=276410&FileName=VA-248-12-R-0083-002.PDF to include a firm commitment of when the service will be completed.

4. Contractor shall provide certifications of destruction for each completed destruction; interim and/or final.

Final destruction certification shall ensure that information on the destroyed records is neither readable nor reconstructable.

5. A Business Associate Agreement (BAA) shall be completed prior to award.

6. Contractor shall provide monthly total poundage of paper destroyed including total cost for each location for the previous month, by the first business day of each month.

7. Valid NAID and ARMA, Certifications and Confidential License issued throughout contract life. Provided to the COR annually or upon request.

PART III: SUPPORTING INFORMATION

A. Security

1. Background Investigations and Special Agreement Checks

a) All contractor employees are subject to the same level of investigation as VA employees who have access to VA Sensitive Information. The level of background investigation commensurate with the level of access needed to perform the statement of work is moderate risk.

b) All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training (Course - 10176) and Privacy and HIPAA Training (Course – 10203). The successful Contractor shall be required to be in compliance with HIPAA requirements and will be required to sign a Business Associate Agreement with the VA. This training can be accessed online through the VA Talent Management System (TSM) or the VA can provide a video to the Contractor to show to its employees that will be performing on this contract. Proof of training is required. The COR will provide the details required for obtaining the VHA Privacy Policy Training.

c) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior.

2. The contractor shall bear the expense of obtaining background investigations. If the investigation is conducted by the Office of Personnel Management (OPM) through the VA, the contractor shall reimburse the VA within 30 days.

a) Contractor shall check in with Environmental Management Service (EMS) prior to collection of locked containers.

B. Travel This requirement does not require travel outside of the locations provided.

C. Place of Performance

The service shall take place at the following locations

VANIHCS, Fort Wayne Campus, 2121 Lake Avenue, Fort Wayne, IN VANIHCS, Mental Health Annex, 2500 East State Boulevard, Fort Wayne, IN VANIHCS, Marion Campus, 1700 E 38th Street, Marion, IN VANIHCS, Huntington CBOC, 2859 Northpark Avenue, Suite 110, Huntington, IN 46750 VANIHCS Muncie CBOC, 3401 North Morrison Rd. Muncie, IN 47304 VANIHCS Peru CBOC, 750 N Broadway, Peru, IN VANIHCS, Mishawaka Campus, SJCC 1540 Trinity Place, Mishawka, IN

VANIHCS, Defiance CBOC, 800 N Clinton Street, STE B, Defiance, Ohio 43512

1. Hours of Work Hours of Work are defined as Monday through Friday from 7:00am to 4:00pm; excluding federal holidays and weekends or as otherwise arranged with the COR.

2. The eleven normal holidays observed by the Federal Government are:

1. New Year’s Day

2. Martin Luther King, Jr. Day

3. President’s Day

4. Memorial Day

5. Juneteenth: Freedom Day

6. Independence Day

7. Labor Day

8. Columbus Day

9. Veteran’s Day

10. Thanksgiving Day

11. Christmas Day

12. Any other day declared by the President of the United States to be a national holiday.

13. When one of the above referenced holidays falls on a Sunday the following Monday will be the observed holiday.

14. When one of the above referenced holidays falls on a Saturday, the preceding Friday will be the observed holiday.

3. Contractor shall have the ability to provide 24 hour emergency service for containers that are full and need to be picked up during a non-scheduled pickup time and/or for work performed outside normal working hours of coverage at the request of the Contracting Officer or the COR. Emergency Orders shall be paid for by a separate Purchase Order Number and that Purchase Order Number will be provided to the contractor and be invoiced separately. Contractor shall not provide emergency service unless they have been given a separate Purchase Order or Purchase Card Order.

D. Government Furnished Property None

E. Qualifications of Key Personnel Contractor shall identify by name the key management and technical personnel to the CO and COR prior to contract performance. Contractor shall be sufficiently staffed to meet the needs as outlined in the mandatory tasks and deliverables. Contractor’s workforce shall be adequately informed and educated regarding the handling and destruction of VA sensitive information per established regulations and directives. Contractor personnel shall abide by all VA policies and procedures while performing service on VA property.

F. Confidentiality and Non-Disclosure Contractor employees shall be bound by the Business Associate Agreement.

PART IV: CONTRACTOR PERSONNEL AND MANAGEMENT

A. Contractor Badges. Contractor personnel shall wear a laminated contractor identification badge at all times when performing services under this Contract. The badge will contain a personal picture, name of employee, and Contractor's name. Badges shall be worn on the outer garment attached to the outer shirt or jacket pocket by a button or clip or worn around the neck secured by an appropriate identification card lanyard.

B. Safety/Security Requirements. The Contractor shall comply with all applicable federal, state, and local laws and ensure performance is secure while protecting material, equipment, and supplies from damage and loss.

VA Police has full authority for law enforcement and security activities on VA property and shall have the express right to inspect for security violations at any time during the term of the contract.

C. Personnel Conduct: Contractor personnel shall conduct themselves in a professional manner (i.e. timeliness, communication; spoken, written, and limit access to the assigned areas.). The Government may require the Contractor to remove any employee performing under this contract for reasons of suspected misconduct, security breach, or suspected to be under the influence of alcohol, drugs, or any other incapacitating agent.

Contractor employees shall be subject to dismissal from the premises upon determination by the Contracting Officer that such action is necessary in the interests of the Government. The hospital director or designated representative has the authority to bar individuals from the Government facility. The removal from the job site or dismissal from the premises shall not relieve the Contractor of the requirement to provide sufficient personnel to perform the services as required by this performance work statement. The Government shall not be liable for any expenses incurred due to the removal of Contractor personnel.

D. Weapons: Contractor personnel are not authorized to carry or possess personal weapons to include, but not limited to, firearms and knives with a blade in excess of three inches, while assigned under this contract.

E. Check-In: All contractors are required to check-in with the local EMS services office.

PART V: CONTRACT MANAGEMENT

The contract shall be managed through the Government Performance Work Statement (PWS) and Quality Assurance Surveillance Plan (QASP).

1. Post-Award Contract Kick-Off Meeting: The purpose of this meeting is to ensure a mutual understanding of the requirements as outlined within the PWS. Prior to contract performance, the Contracting Officer will arrange for a meeting with the Contractor and COR to discuss the work in general, address any Contractor questions, to include contract administration matters and issues for clarification, that require resolution before performance commences.

2. Site Access: The Government shall coordinate the scheduling of work to coincide with site access. The Government shall be responsible for providing access to the respective areas scheduled for performance.

3. The Contractor shall furnish the names of all Contractor personnel to be on-site per visit, via e-mail.

The names shall be provided seven (7) business days prior to the scheduled service date. The Contractor shall alert the Government to any changes in personnel as soon as the need for a change is known.

PART VI: INCIDENT MANAGEMENT

1. The Contractor shall immediately communicate any accidents, equipment, or environmental damages that are seen prior to or during contract performance to the COR.

a. The Contractor shall notify the COR immediately.

b. The Contractor shall provide the Government with a written Incident Report, to include the time, date, location, description of the incident, and names of involved parties.

c. Examples of such incidents that need to be reported include, breach of containment area, unauthorized personnel entering performance sites, vandalism, etc.

2. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

4. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

5. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

PART VII: CONTRACT MANGEMENT

The contract shall be managed through the Government Performance Work Statement (PWS) and Quality Assurance Surveillance Plan (QASP). The Contractor’s management plan shall establish the strategy and plan to manage all aspects of the contract, to include quality.

1. Post-Award Contract Kick-Off Meeting: The purpose of this meeting is to ensure a mutual understanding of the requirements as outlined within the PWS. Prior to contract performance, the Contracting Officer will arrange for a meeting with the Contractor and COR to discuss the work in general, address any Contractor questions, to include contract administration matters and issues for clarification, that require resolution before performance commences. All clarifications of ambiguities shall be formalized with a PWS revision and contract modification.

2. Site Access: The Government shall coordinate the scheduling of work to coincide with site access. The Government shall be responsible for providing access to the respective areas scheduled for performance.

3. Site Preparation: The COR shall be responsible for coordinating the moving of furniture and equipment in sites scheduled for sensitive document destruction services.

4. Contract Management Plan: The Contractor shall prepare a Contract Management Plan (CMP). The Government-approved CMP serves as the mutual understanding between the Government and the Contractor on how the contract will be managed. The CMP shall contain the Contractor’s proposed approach to performing the requirements under the PWS regarding the following:

a. Technical Approach

b. Barriers, Removal, and Disposal Processes

c. Management Approach

d. Schedule Management

PART VIII: QUALITY MANAGEMENT

The Contractor shall furnish the names of all Contractor personnel to be on-site per visit, via email. The names shall be provided 7 days prior to the scheduled service date. The Contractor shall alert the Government to any changes in personnel as soon as the need for a change is known.

PART IX: PERFORMANCE STANDARDS AND QUALITY MEASUREMENT

Performance standards define desired services. The Government performs surveillance to determine if the Contractor exceeds, meets, or does not meet these standards. The Government shall use these standards to determine Contractor performance and shall compare Contractor performance to the Acceptable Quality Level (AQL). The Quality Assurance Surveillance Plan (QASP) method of surveillance will be by random inspection.

The QASP

Performance Objective Performance Standard Acceptable

Quality Level Surveillance Method Frequency

Certifications/License

Page 3. PART II: WORK REQUIREMENTS Section C. Deliverables 5.

Valid NAID and ARMA, Certifications and Confidential License issued throughout contract life

100% Visual inspection of original; copy shall be maintained in COR file

Upon initial contract award; Upon renewal and request thereafter

Certification Adhere to HIPPA guidelines

Page 3. PART III:

SUPPORTING

INFORMATION.

Section 1. b.

Services are completed IAW HIPPA guidelines

95% Visual inspections Every sensitive document control service

Provide Lockable Containers/Bins

Page 2.

PART II: WORK

REQUIREMENTS

Section C.

Deliverables 1.

For all Lockable Containers/Bins proposed for use during contract performance at time of proposal submission; For all new Lockable Containers/Bins proposed for use after proposal submission;

Government vetted and approved for usage during contract performance;

100% COR visual verification of Lockable Containers/Bins

Upon initial and new Lockable Containers as required by Government

Provide Certificate of Destruction Page 3.

PART II: WORK

REQUIREMENTS

Section C.

Deliverables 4.

Contractor shall provide written destruction report to include the date, weight and site locations

100% Verification of reports by COR

Every Service

Provide Key to Lockable Containers

Page 2.

PART II: WORK

REQUIREMENTS

Section C. Deliverables 1.

Contractor to provide a key to Lockable Containers to the COR

100% Visual Verification by

COR

Upon initial contract award

Access to Lockable Containers

Page 2.

PART II: WORK

REQUIREMENTS

A 6.

Contractor shall not allow anyone access to the containers without permission from COR or Contracting Officer

100% Visual Verification by

COR

Revised as necessary to address changing sensitive document control needs

Inspection of Locks on Containers

Page 2.

PART II: WORK

REQUIREMENTS

Section C.

Deliverables 2.

Contractor shall inspect for damage of broken locks. Contractor to replace containers as needed when broken or damaged

100% Visual verification by

COR

As needed

Provide Equipment to Shred Sensitive Document

Page 1.

PART I: GENERAL

INFORMATION

Section C, 1.

Contractor to provide equipment onsite for destruction of all sensitive documents.

Sensitive document must be unrecognizable

100% Visual inspection by

COR

Every service

Provide Sensitive Document Destruction Management Plan

Page 6.

PART VII: CONTRACT

MANGEMENT

4.

Includes methodology, sensitive document management program, schedule, equipment, Technical approach and Management approach

95% Visual inspection by

COR

Revised as necessary address changing sensitive document control needs

Provide Sensitive Service Control Logbook

Contractor shall maintain all performance records and reports; bound logbook in which pages can be easily removed and re-inserted;

recommendations and reports shall be for the duration of the contract maintained; provided to the COR upon contract completion

95% Visual inspection by

COR

Inspection upon Government request;

final submission to COR upon contract completion

Provide Certificate of Destruction Service Report

Contractor shall provide CDSR upon completion of destruction site visit

100% Verification by COR Upon completion of each service.

Contractor shall furnish 2 days after completion of service

Respond to Special Sensitive Document Services

Contractor to acknowledge special requests within 8 hours of notification; respond to special requests within 10 hours of notification; notify the COR that services cannot be completed within 24 consecutive hours.

95% COR monitoring of acknowledgment and response time in comparison to request time

All special requests

Post-Award Contract Kick-Off Meeting

Contractor attend meeting prior to contract performance

95% Meeting sign-in sheet Once

Provide names of Contractor personnel

Provide 7 days prior to service date; Alert Government of any changes in personnel

95% Verification of submitted names to Contractor personnel on site by COR

Every service

Incident Management;

communicate any accidents, equipment, or environmental damages

Provide a written Incident Report to include the time, date, location, description of the incident, and names of involved parties to the

COR

95% Verification of reported incidents

Upon incident occurrence

Performance below the AQL shall be immediately addressed upon notification of failure to meet a prescribed standard as outlined within the PWS and QASP. The Contractor shall have 48 hours to provide a response which includes an improvement strategy for addressing the issue. A Contract Discrepancy Report shall be generated for Contractor failure to consistently meet standards and/or failure to correct performance deficiencies. Failure to meet the Acceptable Quality Levels may result in a negative Contractor Evaluation in the Contractor Performance Assessment Reporting System (CPARS) which may limit a Contractor’s ability to receive future Government contracts. Repeated failure to meet the AQL may also result in contract termination for default.

PART X: GLOSSARY

AQL Acceptable Quality Level CBOC Community-Based Outpatient Clinic(s) CMP Contract Management Plan COR Contracting Officer’s Representative CO Contracting Officer EMS Environmental Management Service IAW In Accordance With PWS Performance Work Statement POC Point of Contact PCR Project Completion Report

VANIHCS Northern Indiana Health Care Systems VAMC VA Medical Center