Attachment_1_-_SOW.pdf

STATEMENT OF WORK

Shredding Service For

15th Medical Group Hickam AFB, HI

I. DESCRIPTION OF SERVICES

The contractor shall provide all labor, tools, materials and transportation for ON SITE document shredding services for the 15th Medical Group, Hickam AFB Hawaii, to include the HPARC Clinic, Mental Health Clinic and Bio Clinic as defined in this Statement of Work (SOW).

Contractor shall provide document shredding/destruction services on site at 15th Medical Group facilities every two weeks. The contractor shall shred all documents on-site while a Government employee is present. The contractor shall perform these services and disposal requirements in accordance with the standards specified in this contract Health Insurance Portability and Accountability Act (HIPAA) IAW 45 CFR 160 and 164, and the Joint Commission for Accreditation of Health Care Organizations (JCAHO). The contractor shall submit reports and documentation as identified throughout this SOW.

1.1. Place of

performance:

1.2 PERFORMANCE PERIOD: 16 Apr 2019 – 15 Apr 2020, plus four option years.

1.3 Invoices WILL BE submitted on a monthly basis through Wide Area Work Flow. The invoice must include the following as a minimum:

Date and time of service.

Company and service representative names.

Contract number.

A detailed description of what clinic received the service, documenting quantity of bins serviced.

Total cost.

1.4 Contractor must be certified and HIPAA compliant IAW 45 CFR 160 and 164.

II. GENERAL INFORMATION

1. Security Requirements. All personnel employed by the contractor in the performance of this contract, or any representative or subcontractor of the contractor entering the governmental installation, shall abide by all security regulations of the installation.

2. Initial drop off and delivery of secure storage containers. Deliver 39-gallon or similar secure/lockable storage containers to each duty section or clinic in accordance with Attachment 1, Bin Locations. Provide keys to locks as required by Facility Management.

15th Medical Group, Building 559, Hickam AFB Mental Health Clinic, Building 554, Hickam AFB HPARC Clinic, Bio Environmental Clinic, Building 1113 Building 2155

Hickam AFB Hickam AFB

3. Health Insurance Portability and Accountability Act (HIPAA). In accordance with

DoD 6025.18-R “Department of Defense Health Information Privacy Regulation,” January 24, 2003, the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the HIPAA Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and in DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DoD 6025.18-R or DoD 8580.02-R.

Individual has the same meaning as the term “individual” in 45 CFR 160.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 160.103, limited to the information created or received by the Contractor from or on behalf of the Government pursuant to the Contract.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law” in 45 CFR 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C. Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR 160.103, 164.501 and 164.304.

(b) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Contract.

(d) The Contractor agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor agrees to mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Clause.

(f) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor shall report to the Government any use or disclosure of the Protected Health Information not provided for by this Contract of which the Contractor becomes aware.

(h) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor shall provide access, at the request of the Government, and in the time and manner reasonably designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government, and in the time and manner reasonably designated by the Government.

(l) The Contractor shall make internal practices, books, and records relating to the use and disclosure of Protected Health Information received from, or created or received by the Contractor, on behalf of the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner reasonably designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor shall provide to the Government or an Individual, in time and manner reasonably designated by the Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

Destruction of CUIs (Controlled Unclassified Information) The 32 CFR 2002, establishes the CUI Program requirements for designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI. The 32 CFR 2002 requires that the destruction of CUI be accomplished "in a manner that makes it unreadable, indecipherable and irrecoverable," (32 CFR 2002.14(f)(2)).

(a) NIST Special Publication 800-88 Rev 1- The primary method of destruction of paper documents in the NIST SP 800-88 is "using cross cut shredders which produce particles that are 1 mm x 5 mm (0.04 in. x 0.2 in.) in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen" Note: When material is burned, residue must be reduced to white ash. (Table A-1: Hard Copy Storage Sanitization) Destruction of classified information Per DoDM 5200.01-V3 Storage and destruction Enclosure 3, subparagraph 17.d. Effective January 1, 2011, only equipment listed on an evaluated products list (EPL) issued by NSA may be used to destroy classified information using any method covered by an EPL. EPLs currently exist for paper shredders, punched tape destruction devices, optical media destruction devices (for compact discs (CDs) and digital video discs (DVDs)), degaussers (for magnetic media sanitization), and disintegrators (for paper and punched tape material). The EPLs may be obtained by calling (410) 854-6358 or at http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml

General Use and Disclosure Provisions Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health Information would not violate the HIPAA Privacy Rule, the HIPAA Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

Obligations of the Government Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) The Government shall provide the Contractor with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Contractor’s permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by the Government The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the HIPAA Privacy Rule, the HIPAA Security Rule, or any applicable Government regulations (including without limitation, DoD 6025.18-R and DoD 8580.02-R) if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative activities of the Contractor as otherwise permitted by this clause.

Miscellaneous

(a) Regulatory References. A reference in this Clause to a section in DoD 6025.18-R, DoD 8580.02-R, Privacy Rule or Security Rule means the section currently in effect or as amended, and for which compliance is required.

(b) Survival. The respective rights and obligations of this contract under the “Effect of Termination” provision of this Clause shall survive the termination of this Contract.

(c) Interpretation. Any ambiguity in this Clause shall be resolved in favor of a meaning that permits the Government to comply with DoD 6025.18-R, DoD 8580.02-R, the HIPAA Privacy Rule or the HIPAA Security Rule.

Attachment 1: Bin Locations

Section Location BLDG # Family Health Clinic Front Desk (1st floor) BLDG 559 Family Health Clinic Front middle hallway (1st floor) BLDG 559 Family Health Clinic Back middle hallway (1st floor) BLDG 559 Pediatrics Front Desk (1st floor) BLDG 559 Public Health Front side of PH Bay (1st floor) BLDG 559 Pharmacy Pharmacy office (1st floor) BLDG 559 TOPA Records Office (1st Floor) TOPA Outside MED office (1st floor) BLDG 559 TOPA Records Front desk (1st Floor) BLDG 559 Immunizations Room A210 (2nd Floor) BLDG 559 Flight Medicine Front Desk (2nd Floor) BLDG 559 D & T Flight Laboratory (2nd Floor) BLDG 559 RMO/CSS By mailbox (2nd Floor) BLDG 559 MDG Leadership Room B-205 (2nd Floor) BLDG 559 Dental Clinic B-Wing between B320/B321 (3rd Floor) BLDG 559 Dental Clinic Dental Command Section (3rd Floor) BLDG 559 Dental Clinic Front Desk (3rd Floor) BLDG 559

Mental Health Front desk BLDG 554

Bio Main Hallway BLDG 2155

HPARC Check in area BLDG 1113