QA_Final PWS Shredding (Sep_2020).pdf

September 2020

DOCUMENT DESTRUCTION SERVICES

Performance Work statement For Joint Base Andrews/Bolling-Anacostia

1. OBJECTIVE

This contract shall shred, destroy and dispose of paper materials with Personally Identifiable Information (PII) and other sensitive HIPAA related materials from the 316 Medical Group, located on Joint Base Andrews (JBA) and Joint Base Anacostia-Bolling (JBAB). The Contractor’s destruction techniques shall include shredding, pulverization, disintegration, purging, pulping and incineration in accordance with all National Association for Information Destruction (NAID) standards as well as all federal, state and local laws and ordinances.

The Contractor shall ensure the legal, proper safe-keeping and physical destruction of shred material in accordance with:

1. Privacy Act of 1974, 5 USC 552a

2. Federal Records Act, 44 USC Chapter 31

3. Contractor Rules of Behavior

4. 36 CFR 1220.14 Subpart A, General Provisions, General Definitions

5. 36 CFR 1226.24, Destruction of Temporary Records (formerly 1228.58)

6. 44 USC 3302 § 1228.58 Destruction of Temporary Records

The government adheres to the Privacy Act of 1974 that was established to insure government agencies protect the privacy of individuals and businesses with regard to information held by them. The Contractor shall execute the terms of this contract in a manner that will safeguard the confidentiality of all materials and information exposed to Contractor personnel in performance of this contract.

2. GENERAL REQUIREMENT

The Contractor shall provide all labor, supervision, equipment, uniforms, secured vehicles and other related services necessary to collect materials to be shredded and to provide on-site first destruction shredding resulting in the documents being unrecognizable and unreconstructed for the JBA and JBAB Medical Treatment Facility (MTF) and Dental Clinic. Bins shall be emptied every two weeks throughout the medical treatment facility. This requirement is solicited as a base (12-mos) plus four (4) option year periods

The Contractor shall collect and properly dispose of sensitive material/information in accordance with the specifications, terms and conditions of this Performance Work Statement. The Contractor shall provide all labor, equipment (including wheeled shred bin containers), supervision, and management to provide on-site material shredding of personally identifiable information that consists of paper materials containing personal, confidential and proprietary information.

The Contractor shall provide both onsite interim document destruction and final destruction services, to ensure to meet the standard of “the record is not readable or reconstruct able” for Government provided documents containing classified, sensitive, confidential, and medical records. The contractor shall provide secured lockable collection containers and quantities specific to each designated location throughout the medical facility for collection and storage of confidential documents until such time the shredding takes place.

2.1. Conformance Standards

a. Contractor shall maintain a chain of custody documentation.

b. Contractor shall provide locked security containers/bins that will hold all paper products for shredding, including color paper, color copy and file folders. All containers shall be constructed with a deadbolt lock and an offset document slot to prevent unauthorized removal of material.

c. Contractor shall collect material from the containers per the schedule for the MTF. Collected materials shall remain in the vendors sight at all times. Collected materials shall remain in locked containers while transporting from the collection sites to the mobile shredding vehicle.

d. Contractor shall maintain required and appropriate insurance and indemnifications for liability coverage for any and all incidences of occurrence resulting from any information breach that they are responsible for throughout the term of the contract.

e. Contractor shall be National Association for Information Destruction (NAID) AAA certified.

2.2. Bins

Contractor shall provide locked security containers/bins that will hold all paper products for shredding, including color paper, color copy and file folders. All containers shall be constructed with a keyed locking device and an offset document slot to prevent unauthorized removal of material. All containers must be fire retardant.

a. Containers shall store bins no larger than 64 gallons

b. Containers shall have locking mechanisms that are keyed a like with a master key that will open all containers.

c. A total of eight (8) master keys (5 for JBA and 3 for JBAB) will be provided to the point of contact (POC)

d. Numbers of containers to be provided and locations of collection/shredding are listed in the table below:

JBAB Bldg. Room No. Floor QTY

1300 Pharmacy/Rm 130 1 1

1300 Women’s Health/Rm 163 1 1

1300 Dental/Rm 231A 1 1

1300 Front Desk/Rm 113 and 143 1 1

17 Logistics/Rm 127G 1 1

3 Rm 204, 109 and 132 1 1

JBA Bldg. Room No. Floor QTY 1057 Logistics/Rm 1N-218 1 1

1050 Medical Equipment/Rm CB-7 B 1

1050 Medical Record/Rm B1-24 B 1

1050 Central Files/Rm B1-20 B 1

1050 JB-29 B 1

1050 Mental Health/Rm A4 4 1

1050 B1-1 1 1

1050 B1 -20 1 1

1050 TOPA/Rm G1 1 1

1060 Emergent Care/Rm 1K 1 1

1060 Radiology/Rm 1J 1 1

1060 Laboratory/Rm 1H 1 1

1060 Pharmacy/Rm 1H 1 1

1060 Orth podiatry/Rm 1B 1 1

1060 PEDS/Rm 2A 2 1

1060 Immunization/Rm 2A 2 1

1060 Pediatric/Rm 2A 2 1

1060 Oral Surgery/Rm 2H 2 1

1060 General Surgery/Rm 2H 2 1

1060 Surgical/Rm 2K 2 1

1060 Command Section/Rm 3K 3 1

1060 Medical Information Services/ Rm 3J 3 1

1060 Dermatology/Rm 3H 3 1

1060 Internal Medicine/Rm 3H 3 1

1060 Education & Training/Rm 3E 3 1

1060 Women’s Health/Rm 3A-B 3 1

1060 Ophthalmology/Rm 3A-B 3 1

1683 Pharmacy Off-Site 1 1

The contractor shall ensure:

a. That any container used to transport documents from the indoor containers to the shredding location is locked and attended at all times while being moved.

b. The task of document destruction for all containers is conducted from start to finish on-site at each facility on the scheduled service day.

The contractor shall provide:

a. Sufficient labor and equipment necessary to transport the collected documents from the indoor designated container locations to an outdoor designated location where shredding will take place.

b. Sufficient labor and sufficient mobile shredding vehicles capable of performing on-site shredding and destruction of approximately 6,000 to 8,000 pounds of confidential documents per hour.

Mobile shredding vehicle(s) shall be capable of shredding all PII material on-site to a shred size in conformance with the NAID standard of 5/8-inch by 1/2-inch cross cuts or smaller.

c. Equipment that is capable of shredding large volumes of documents per hour that will produce crosscut shred articles within a 1 x 5 millimeter, pulped for recycling and provides a certificate of destruction per the National Association of Information Destruction (NAID) standards for mobile units. Contractor will provide a Certificate of Destruction at the completion of shredding.

Existing contractor certification of destruction can be used if it contains the above information.

d. Sufficient labor, equipment and transportation necessary to transport the shredded materials in locked vehicles to paper mills for pulping and recycling.

e. A contingency plan for instances where:

i. Equipment malfunction occurs during the shredding process

ii. When a mobile shredding vehicle breaks down enroute to location for scheduled services or enroute to a pulping and recycling site.

f. Equipment malfunction on government property results in release of some type of hazardous waste (i.e. hydraulic oil, diesel fuel, etc.)

All shredding shall be witnessed by a contractor employee authorized to witness destruction of confidential documents or a government employee authorized to witness destruction of confidential documents. The authorized witness shall complete a certificate of destruction at the completion of each shredding/destruction service.

Upon arrival at each facility, the contractor shall report to the meeting location designated by the POC prior to performance of scheduled pick-up/shredding service.

The Government shall not sort paper, remove paper clips, staples, rubber bands or any other fasteners from restricted information. The Contractor shall provide the necessary recycling containers for use in Government designated storage areas in sufficient quantities for the storage of the recyclable materials prior to removal by the Contractor. After materials are completely shredded/made unrecognizable, the Contractor shall ensure 100% of the paper shall be recycled. The Contractor shall be responsible for disposing of all shredded material off-site.

1065 New Dental Bldg. – 1st Floor 1 1

1065 New Dental Bldg. – 2nd Floor 2 1

1060 Operating Room 2 1

1190 Family Advocacy 1 1

3. SPECIAL REQUIREMENTS

All Contractor vehicles utilized in this contract shall be insured and maintain current state vehicle registration. All Contractor employees shall possess a valid State Driver’s license and be insurable. The Contractor or his/her employees while performing under this contract shall use no personal vehicles.

Contractor shall be a legally registered to conduct business in the National Capital Region (NCR);

includes Maryland, Virginia, and Washington DC.

All vehicles used in the performance of this contract for the destruction of documents shall have the applicable government licensing and inspections for road worthiness on file.

When onsite Contractor personnel shall be uniformed with their name and company logo clearly identifiable. The Contractor shall ensure Contractor personnel’s clothes are clean and maintained in good repair. The Contractor shall be required to interrupt their work at any time so as not to interfere with the normal functions.

HIPAA Responsibility: Contractor agrees to comply with the requirements under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Notwithstanding anything to the contrary in this contract, all individually identifiable health information shall be treated as confidential by the parties in accordance with all applicable federal, state, or local laws and regulations governing the confidentiality and privacy of individually identifiable health information, including but without limitation, HIPAA and any regulations and official guidance promulgated there under , and the parties agree to take such additional steps and/or to negotiate such amendments to this contract as may be required to ensure that the parties are and remain in compliance with the HIPAA regulations and official guidance.

HIPAA Compliance – Health Insurance Portability and Accountability Act of 1996: the successful contractor shall be required to be in compliance with HIPAA requirements and will be required to sign a Business Associate Agreement. A copy will be maintained in the contract file and with the Privacy Officer.

3.1. Hours of Operation

The Contractor shall perform shredding/pick-up at Joint Base Anacostia-Bolling every two (2) weeks on a Monday between 0700 – 1500 Hours, except on a Federal holiday.

The Contractor shall perform shredding/pick-up at Joint Base Andrews every two (2) weeks on a Wednesday between 0700 – 1500 Hours, except on a Federal holiday.

The ten holidays observed by the Federal Government are New Year's Day, Martin Luther King Day, President's Day, Memorial Day, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving Day, and Christmas Day. Also, any other day declared by the President of the United States to be a national holiday. Any other day where JBA or JBAB is closed, the contractor shall perform normal pick-up duties on the next business day.

3.2. Continuation of Essential Contractor Services

IAW FAR Clause 252.237-7023 “Continuation of Essential Contractor Services” this requirement has been deemed as mission essential in support of the 316th MDG and its designated facilities located on JBA and JBAB. The contractor shall perform all services as essential.

3.3. Control of Security Waste

The Contractor shall be responsible for management, oversight, security, and control of all classified, sensitive, confidential documents and documents containing medical records stored in the locked containers, prior to and until completion of shredding or destruction of the documents.

The Contractor shall prepare and submit to the medical facility’s POC an original signed Certificate of Destruction the interim destruction conducted at each pick up for each site within three (3) working days of each pick up. The contractor shall maintain proper records concerning each Certificate of Destruction issued. The Certificate of Destruction shall as a minimum contain the following:

a) Pick-up/Delivery Location

b) Pick-up/Delivery Date

c) Name of Government POC at Pick-up Location

d) Amount of shredded waste (number and type of containers picked up and pounds shredded)

e) Destruction Certification Document Number

f) Destruction Certification Date

g) Any other information as determined necessary by the Information Security Officer

3.4. Activity Logs/Reports

The Contractor shall maintain an Activity Log of shredding/destruction services accomplished at each site. One copy of the Activity Log shall be provided to the facility POC after all documents have been shredded.

3.5. Quality Control. Contractor shall maintain a quality control program that ensures services are performed in accordance with these specifications throughout the entire contract period, and shall implement procedures to track, identify, prevent, remedy and ensure non-recurrence of defective services.

Additionally, the Contractor shall provide a method to accept and resolve customer complaints and notify the customer of the resolution, and shall immediately notify the Contracting Officer upon receipt of a customer complaint so joint validation may be accomplished. The Contractor is responsible for quality control and specification compliance.

3.6.

Performance Requirement Summary. The Performance Requirement Summary outlines the standard performance objectives to be performed by the contractor and the method of surveillance the COR will use to validate and inspect performance elements. Inspection of each element will be documented in the COR file.

Performance objectives define the desired outcomes and the level of service required to successfully meet the performance objective as shown in the following table:

Performance Objective Reference Performance

Standard

AQL

Empty of Bins Para 2 & 3.1 Pick-Up every two-weeks (Mondays for JBA and Wednesdays for

JBAB)

98%

Activity Log Para 3.3 Maintain an Activity Log of shredding/destructi on services accomplished at each site. One copy shall be provided to government after all documents have been shredded.

98%

4. SECURITY

The contractor and their personnel shall be subject to the same Federal laws, regulations, and standards regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular-A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST).

4. SECURITY