HT940723Q0002 Attachment 01_PWS_Document Destruction.pdf

Performance Work Statement

90 MDG Document Destruction

Performance Work Statement (PWS) Document Destruction and Disposal 90 MDG – F.E. Warren AFB, WY

2 April 2020

PART 1

PERFORMANCE REQUIREMENTS

1.0 General: This contract is to provide bi-weekly, on-site document destruction services at F.E. Warren Air Force Base (AFB), Wyoming (WY). The services under this contract are non-personal services and are not inherently governmental or closely associated inherently governmental. The Government will not exercise any employer responsibilities or rights over contract personnel performing under this contract.

The Contractor is solely accountable and liable for its employees and is obligated to meet all contract terms and conditions. The prime Contractor also retains responsibility for any teaming partner or subcontractor and shall be accountable for their actions and performance. The Contractor is responsible for the performance of the entire scope of work and shall meet all performance standards.

1.1 Notice regarding contractor support. Potential offerors should be aware that DHA Central Markets Contracting Division (CM-CD) contractor support will be providing administrative support during this acquisition process for pre-award and post-award actions. DHA CM-CD contractor support will not be voting members of any source selection team, nor will they perform contracting officer duties.

1.2 Description of Services: The Contractor shall provide non-personal services to include all labor, parts, tools, materials, and transportation necessary to provide regularly scheduled, on-site document destruction services. The Contractor shall provide secure lockable storage bins, on-site destruction, and disposal of confidential documents to include sensitive Personal Identifiable Information (PII) and Protected Health Information (PHI) requiring proper handling and destruction under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Privacy Act of 1974.

The Contractor shall provide and place secure, lockable storage bins at various locations within the Medical Treatment Facility (MTF) and Health and Wellness Center as follows:

Total bins required:

Twenty-one (21), 36-gallon bins Three (3), 64-gallon bins.

Bin Locations:

Twenty (20), 36-gallon bins shall be placed at Bldg. 160 (FE Warren MTF) One (1) 36-gallon bin shall be placed at the Bldg. 475 (Health and Wellness Center) Three (3), 64-gallon bins shall be placed at Bldg. 160 (FE Warren MTF)

All bins shall be emptied, and on-site destruction shall be performed every two weeks during the normal operational hours of the MTF. Operational hours of the MTF are identified in paragraph 1.7 of this PWS.

The paper materials collected will include confidential documents containing sensitive PII and PHI requiring special handling and protection under HIPAA and the Privacy Act of 1974. The Contractor shall be responsible for providing the necessary chain-of-custody measures to comply with all applicable federal, state, and local laws and regulations. The Contractor shall provide a Certificate of Destruction at the conclusion of each shred service performed.

1.3 Objectives: The Contractor shall ensure all work accomplished in support of this PWS meets all applicable federal, state, and local laws, regulations, and directives to include safety, environmental, and OSHA procedures.

1.4 Scope: The Contractor shall perform document destruction in accordance with the PWS. During performance of the contract, the Government reserves the right to add or remove bins and/or the level of services required. A modification to the contract will be executed to incorporate these changes.

1.5 Period of Performance: The Period of Performance shall be for one (1) 12-month base period and four (4), 12-month option periods.

1.6 Post Award Conference/Periodic Progress Meetings. The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation (FAR) Subpart 42.5. Any required meetings will be conducted virtually through teleconference. The Contracting Officer and other government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the Contracting Officer will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. The Contractor shall take appropriate action to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

1.6.1 Non-Conformance Report (NCR). When the Contractor's performance is unsatisfactory, a NCR will be issued. The Contractor shall reply in writing within the period specified in NCR, giving the reasons for the unsatisfactory performance, corrective action taken, and procedures to preclude recurrence.

1.7 Hours of Operation. The Contractor is responsible for scheduling services between the hours of 7:00 a.m. to 4:00 p.m. Monday thru Friday, except federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor shall confirm its service schedule with the Government Point of Contact (POC) prior to providing services.

1.7.1 Recognized Holidays. The Contractor shall not schedule services on federally recognized holidays.

1.7.2 Planned Closures/Other Non-Duty Days. F.E. Warren AFB may be closed all or part of the day for Family Days and Wing Commander (MW/CC) declared down days. Those declared down days each year typically coincide with a federal holiday. On those days, the Contractor shall only schedule services during the hours the Government is open.

1.7.3 Unplanned Closures. During an unplanned closure due to unusual and compelling circumstances (natural disasters, emergencies, severe weather), services will not be required.

1.7.4 In the event the place of performance is closed (whether planned or unplanned) on a day where services were previously scheduled, the Contractor will have the following options:

1.7.4.1 Reschedule the work so it is performed the following day unless the following day falls on a weekend.

1.7.4.2 Reschedule the work on any day that is mutually satisfactory between the Government and Contractor.

1.8 Place of Performance. The work to be performed under this contract will be performed at the following location(s):

Bldg. 160 (MTF) and Bldg. 475 (Health and Wellness Center), located on F.E. Warren AFB, WY.

1.9 Security Requirements. Contractor personnel performing work under this contract must have an appropriate administrative, technical, and physical safeguard to protect all Government data, to ensure the confidentiality, integrity, and availability of Government data.

1.9.1 Security (Physical). All personnel employed by the Contractor in the performance of this contract, or any representative or subcontractor entering the governmental installation, shall abide by all security regulations of the installation.

1.9.2 Identification of Contract Employees. The Contractor employees performing services on the government installation shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and by displaying distinguishing badges or other visible identification while on a government facility. Contractor personnel shall identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence with government personnel.

1.9.3 Key Control. The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be submitted in writing to the Contracting Officer and Government POC. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the Contracting Officer and Government POC. The Government POC will designate key control POC (Primary and Alternate) in writing who will be responsible to maintain keys to the shred bin within their section.

1.9.3.1 In the event keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the Contracting Officer, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.9.3.2 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the Contracting Officer.

1.9.4 Lock Combinations (If applicable). The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s written Key Control Procedures.

1.10 Special Qualifications:

1.10.1 Conflict of Interest. The Contractor shall not employ any person who is an employee of the United States Government if the employment of that person would create a conflict of interest. The Contractor shall not employ any person who is an employee of the Department of Defense, either military or civilian, unless such person seeks and receives approval in accordance with Title 5, USC, Section

5536, DoD 5500.7-R (1993), as amended, and service directives.

1.11 Additional Information:

1.11.1 Government Support Personnel. The following Government personnel are considered primary contacts by the Government: Government POC and Security Office POC. The Government POC and Security Office POC information will be provided to the Contractor after award. The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the Contracting Officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 7:00 a.m. to 4:00 p.m., Monday thru Friday except Federal holidays or when the Government facility is otherwise closed.

1.11.2 Mission Essential. The performance of these services is non-mission essential during times of crisis or other emergency situations. Should a crisis or emergency be declared, the Contracting Officer or their representative will verbally advise the contractor if temporary suspension of work is required, followed by a written notification. The Contracting Officer will further notify the contractor verbally when the crisis or emergency has ended, with written notification to follow. Any contract price change resulting from such crisis or emergency situation will be negotiated via contract modification.

PART 2

DEFINITIONS & ACRONYMS

Definitions:

CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the Government. The term used in this contract refers to the prime company, their subcontractors, and their corporate level employees.

CONTRACTING OFFICER. A person with authority to enter into, administer, and or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

CONTRACT EMPLOYEES/PERSONNEL. The support personnel recruited and hired by the contractor management staff to perform the services as described in this contract.

DELIVERABLE. Anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

MEDICAL TREATMENT FACILITY (MTF). A military hospital, medical center, or clinic, providing outpatient and/or inpatient healthcare services for authorized personnel.

NON-CONFORMANCE. An output that does not meet the standard of performance associated with the Performance Work Statement.

PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

PLANNED CLOSURE. Non-performance Day(s) that the Government designates as a planned facility closure.

QUALITY. The degree of adherence to required performance standards and the successful achievement of outcomes.

UNPLANNED CLOSURE. A closure of a federal facility due to natural disaster, severe weather, military emergency, or any other closure that was not identified as a planned closure or included in the contract.

Abbreviations and Acronyms:

BAA – Business Associate Agreement CM-CD – Central Markets Contracting Division COR - Contracting Officer Representative DFARS - Defense Federal Acquisition Regulation Supplement DHA – Defense Health Agency DoD – Department of Defense FAR - Federal Acquisition Regulation HIPAA - Health Insurance Portability and Accountability Act of 1996 IAW - In Accordance With KO - Contracting Officer MDG – Medical Group

MTF - Medical or Military Treatment Facility NCR – Non-Conformance Report NLT - No Later Than PHI - Protected Health Information PII - Personally Identifiable Information PKO – Procurement Contracting Officer POC – Point of Contact PWS - Performance Work Statement USC - United States Code WAWF-RA - Wide Area Workflow – Receipt and Acceptance

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

Government Furnished Items and Services:

3.1. Services. The Government will assist the Contractor with completing any documentations and approvals required to obtain base access prior to performing services.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

Contractor Furnished Items and Responsibilities:

4.1 General. The Contractor shall furnish all services to include all labor, parts, tools, materials, and transportation required to perform work under this contract.

4.2 Materials. The Contractor shall provide secure, lockable storage bins to be located and used at various locations within the MTF and Health and Wellness Center.

4.3 Container Relocation. The Contractor may be required to relocate bins after coordination with the Government POC. Relocation will be at no additional charge to the government.

4.4 Equipment. The Contractor shall provide a mobile shredding truck. Equipment shall include all items necessary to meet the PWS requirements.

4.5 Personnel. The Contractor shall provide a collection team, who shall collect the secured bins and take the filled and secured contents to the Contractor's mobile shredding truck. All other personnel needed to meet the requirements of this PWS shall be provided by the Contractor.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1 Document Shredding:

5.1.1 Document destruction shall be performed on-site on a bi-weekly basis (26 times per year).

5.1.2 The Contractor shall provide lockable storage bins. The Contractor shall place these bins In Accordance With (IAW) the Facilities Manager Bin Location Directory, which will be provided to the Contractor after award. The Government Facilities Manager will provide updated listings if location changes are made.

5.1.3 The Contractor shall collect the secured bins and take the filled and secured contents to the contractor-provided mobile shredding truck located on-site. In a secured location, documents shall be immediately shredded; destruction is to be completed on-site.

5.1.4 The Contractor shall ensure at least one lockable container remains at the pick-up location while performing on-site shredding.

5.1.5 Upon completion of any service, a written service report shall be provided to Health Information Technology Division's POC or the Government POC with detailed information regarding destruction.

This report shall reference CLIN numbers from the contract and include pricing and total amount due.

5.1.6 The Contractor shall issue a "Certificate of Destruction" at the end of each service to certify that all material has been destroyed on location. This Certificate shall be given to the Health Information Technology Division's POC and the Government POC.

5.1.7 The Contractor shall invoice monthly IAW Wide Area Workflow (WAWF) instructions by the fifteenth day of the month for the previous month’s work. Invoices shall be for one month increments and accurately describe the month and year the invoice is for and the dates that services were provided during that month to include a company invoice attachment.

5.1.8 The contract price is inclusive of full collection and destruction services as detailed in this PWS.

The Government will not approve invoices for incomplete services.

5.1.9 The Contractor shall provide adequate chain-of-custody measures necessary to comply with all applicable federal, state, and local laws and regulations.

PART 6

APPLICABLE PUBLICATIONS

6. Applicable Publications: The Contractor shall abide by all applicable regulations, publications, manuals, and local policies and procedures. When a publication provided by the Government is subsequently revised, supplemented, replaced or rescinded, the Contractor, upon notification or receipt, shall comply.

PART 7

TECHNICAL EXHIBIT LISTING

7. Listings:

7.1 Technical Exhibit 1 – Performance Requirements Summary

7.2 Technical Exhibit 2 – Deliverables Schedule

Technical Exhibit 1

PERFORMANCE REQUIREMENTS SUMMARY

The following performance objective acceptable quality levels (AQLs) for minimum quality levels of service are required on this contract:

Performance Objective

PWS

Paragraph Reference

Performance Description

Method of Surveillance AQL

Document destruction on a routine bi-weekly basis during normal operational hours.

5.1

All bins emptied and on-site destruction performed every two weeks

Periodic Inspection Monthly Performance

No more than one customer compliant per month.

Service Report 5.1.5

Contractor shall provide a written service report at the completion of any service performed as required.

Report due NLT COB on day of service was provided.

Certificate of Destruction 5.1.6

Contractor shall provide a Certificate of Destruction at the end of each service.

Periodic Inspection Monthly Performance

Certificate due NLT COB on day of service was provided.

Monthly Invoices

5.1.7

Contractor shall invoice no later than the 15th of the month in WAWF w appropriate information and attachment.

Monthly Performance < 15 Days

Adequate chain-of-custody measures 5.1.9

Provide adequate chain-of-custody measures necessary to comply with all applicable federal, state, and local laws and regulations

100% Compliance w/ Zero Unauthorized Disclosures or Data Breaches

Technical Exhibit 2

CONTRACT DELIVERABLES SCHEDULE

Deliverable Frequency Number Required Format Provided To

Contract Manager contact information

NLT 10 business days after performance start date

1 Electronic copy via email CO and COR

Initial Placement of Bins

NLT 10 business days after performance start date

See PWS paragraph

1.2

Each Notify Government POC when complete

Service Reports Provided at the conclusion of each service.

Electronic or hard copy

Government POC

Certificate of Destruction

Provided at the conclusion of each service.

Electronic or hard copy

Government POC

PART 7

OTHER TERMS, CONDITIONS, AND PROVISIONS

7.1 Non-Disclosure/Non-Use Agreement. Performing work under this contract may involve access to sensitive or nonpublic information of other companies. The contractor must limit the use of sensitive and nonpublic information coming from the Government to the purposes specified in the contract by (1) safeguarding the nonpublic information from unauthorized use and disclosure; (2) limiting access to sensitive and nonpublic information to only those individuals who need it to perform services under the contract; (3) informing individuals who may have access to sensitive and nonpublic information about their obligations to use the information only to perform the services specified in the contract and to safeguard the information from unauthorized use and disclosure; (4) obtaining a copy of a signed non-disclosure agreement from each individual who may have access to sensitive and nonpublic information and providing the non-disclosure agreement to the PCO/CO upon request; and (5) reporting any violations of the requirements set forth in this paragraph to the PCO/CO; The report must include a description of the violation and what actions have been taken by the contractor in response to the violation.

7.2 Protection of Information. The contractor shall comply with all laws and regulations relating to Personally Identifiable Information (PII), Protected Health Information (PHI) and information covered under both the Privacy Act and HIPAA. The contractor shall analyze any breach of PII/PHI for which it is responsible under the terms of this contract under both the Privacy Act and HIPAA, if applicable, to determine the appropriate course of action under each requirement, if any. Protected Health Information (PHI) and Federal Information Laws: The contractor shall establish appropriate administrative, technical, and physical safeguards to provide adequate protection of information handled. Contractor will comply with all applicable laws and regulations, including data breach reporting and response requirements, IAW Defense Federal Regulation Supplement (DFARS) Subpart 224.1 (Protection of Individual Privacy), which incorporates by reference current versions DoDD 5400.11, “DoD Privacy Program,” and DoD 5400.11-R, “DoD Privacy Program.” The contractor shall also comply with federal laws relating to freedom of information and records management. The contractor shall analyze any breach of PII/PHI for which it is responsible under the terms of this contract under both the Privacy Act and HIPAA, if applicable, to determine the appropriate course of action under each requirement, if any.

7.2.1 Health Insurance Portability and Accountability Act (HIPAA). In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18-R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD MHS component, acting as a HIPAA covered entity, and a DoD contractor, acting as a HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18-R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated (or incorporated by reference) into the contract or agreement between the parties. Additional or supplemental instructions unique to HIPAA for this contract are as follows: Contract employees will be required to follow all guidance prescribed in 90MDGI 41-29, Health Insurance Portability and Accountability Act.

7.2.1.1 Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA shall have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy Practices (NoPP), Protected Health Information (PHI), Required by Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

7.2.1.2 Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein.

7.2.1.3 Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the contract holder.

7.2.1.4 Agreement means this BAA together with the documents and/or other arrangements under which the Business Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA.

7.2.1.5 Covered Entity shall generally have the same meaning as the term “covered entity” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the contract performance location.

7.2.1.6 Government Privacy Office means the MTF Privacy and Civil Liberties Office. The MTF Privacy Officer is the HIPAA Privacy and Security Officer for the facility.

7.2.1.7 DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD Military Health System (MHS). These issuances are DoD 6025.18-R (2003), DoDI 6025.18 (2009), and DoD 8580.02-R (2007).

7.2.1.8 DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are DoDD 5400.11 (2007) and DoD 5400.11-R (2007).

7.2.1.9 HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45 CFR 164.402.

7.2.1.10 HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach, and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part 160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C-D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111-5. See 78 FR 5665702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

7.2.1.11 Service-Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.

7.2.1.12 Confidentiality of Information. Unless otherwise specified, all financial, statistical, personnel, and/or technical data, which is furnished, produced or otherwise available to the contractor management staff or contract personnel during the performance of this contract are considered Government confidential business information and shall not be used for purposes other than performance of work under this contract.

The contractor and/or the contract personnel shall not release any of the above information without prior written consent of the PKO. All medical records, medical data and reports remain the property of the Government.

7.2.1.13 Patient lists, no matter how developed, shall be treated as confidential information in accordance with the Privacy Act and the Health Insurance Portability and Accountability Act (HIPAA). Lists and/or names of patients shall not be disclosed to or revealed in any way for any use outside the MTF, except through MTF-specified processes.

7.2.1.14 All inquiries and complaints shall be brought to the attention of the Government representative (PKO, KO, and/or COR).

7.2.1.15 Contractor and contract employees shall not respond to any media or other inquiries seeking Government information.

7.3 Privacy Act Breach Response:

7.3.1 Current version DoD 5400.11-R, “DoD Privacy Program,” incorporated herein by reference, defines a breach as the “actual or possible loss of control, unauthorized disclosure, or unauthorized access of personal information where persons other than authorized users gain access or potential access to such information for other than authorized purposes where one or more individuals will be adversely affected.” Within one hour of discovery, the breach shall be reported to the US Computer Emergency Readiness Team (US CERT), the MTF Privacy Officer, and the CO.

7.3.1.1 The contractor shall adhere to the reporting and response requirements set forth in the Office of the Secretary of Defense Memorandum 1504-07, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information,” June 5, 2009; DoD 5400.11-R, also incorporated herein by reference, and consult MTF Privacy Officer for guidance.

7.4 Emergency Health Care. The Government may provide emergency health care for contract employees having injuries or life-threatening medical emergencies while conducting services at the performance location. The contractor shall reimburse the Government for medical services provided in any case that contract personnel are not covered by workers’ compensation insurance, other health insurance or the individual is a military beneficiary entitling them to Government healthcare services.