HT940725Q0003A Attachment 1 Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT

for

On-Site Shredding/Destruction Personal Identifiable Information (PII) and Protected Health Information (PHI)

375th Medical Group (375 MDG)

310 W. Losey St Scott AFB, IL

1. Scope: The contractor shall perform bi-weekly (every other week) on-site shredding/destruction of all the PII and PHI documents IAW the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The contractor shall provide lockable containers for the collection of PII/PHI documentations, to include a mix of assorted; paper document, forms, card stock-patient information cards, patient record folders, CD’s, plastic radiographic film/cardboard sleeves, plastic medicine bottles with patient labels and printed adhesive patient labels. Plastic radiographic film/cardboard sleeves maybe combined with paper documents or have separate pick up.

1.1.Recognized Holidays: In general, federal holidays falling on a Saturday are observed on the preceding Friday whereas holidays falling on a Sunday are observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed below.

Holiday New Years Day Birthday of Martin Luther King, Jr.

President’s Day Memorial Day Juneteenth National Independence Day Independence Day Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day

1.2. In the event a scheduled pick-up falls on a federal holiday, the contractor shall coordinate and reschedule the pick-up with the Contracting Officer Representative prior to the holiday or within two business days following the holiday.

2. Description of Service: The contractor will provide and maintain (10 stationary & 29 mobile) lockable PII/PHI collection containers (mobile container size to be approximately 64 gallon each) (stationary containers can be substituted with mobile containers).

3. Place of Performance: On bi-weekly schedule, the Contractor will pick up the materials to be shredded and will perform on-site shredding of all PII/PHI at the 375MDG – Bldg. 1530

(Medical Systems loading dock – Primary or Logistics loading dock - Alternate) and the Satellite Pharmacy - Bldg. 1948. During the bi-weekly shredding schedule, the contractor must be able to accept and shred on-site, plastic medicine bottles with adhesive labels without any additional cost. There are approximately 3 – 4, 64-gallon containers of sticky label bottles per pickup. During the bi-weekly shredding schedule, the contractor must be able to accept and shred on-site, non-metallic plastic radiology films and cardboard sleeves without any additional cost.

On the morning of the first day of contract period of performance the contractor will coordinate and deliver the lockable collection containers with locks/keys for each area identified and listed on Attachment 1.

Per designated bi-weekly schedule, the HIPAA Privacy Officer (HPO) Andrea Fennell or their designated 375MDG representative will ensure that the mobile collection containers are assembled at the loading dock to meet the contractor. The HPO will consolidate collection containers to ensure maximum capacity of each container. The HPO will observe and validate the destruction process and will contact the 375MDSS/SGSM Contract Services Office or the Contract Officer if any issues or concerns arise.

Disposal processes could include shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.

Contractor shall insure that any subcontractor, consultant, agent, vendor, or other third party to whom it provides Protected Health Information will implement, in a reasonable and appropriate manner, the technologies and methodologies with respect to rendering Protected Health Information unusable, unreadable, or indecipherable to unauthorized individuals.

The number of full containers fluctuates between 6-20 per trip, with a minimum of 170 container pick-ups and a maximum of 300 container pick-ups in a 12-month period.

During periods of 375MDG clean-out/purging (approximately 2-3 times in a 12-month period) a special pick-up, other than the bi-weekly may be scheduled, by the Contract Officer Representative, at same price per container. Will work with the company to schedule the special pick-up. Contractor will invoice for number of bins picked up on day of service.

HIPAA Privacy Rule establishes requirement for covered entities to have appropriate administrative, technical, and physical safeguards in place to protect the privacy of PHI, including the disposal of such information. See 45 CFR 164.530(c). The HIPAA Privacy and Security Rules requires the 375th Medical Group to reasonably safeguard protected health information (PHI) from any intentional or unintentional use or disclosure. Therefore, covered entities should safeguard against disposing trash containing PHI in locations, such as dumpsters, that are accessible by the public or other unauthorized individuals. Therefore, proper disposal methods must be used.

The contractor shall comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The contractor shall hold all disclosed confidential, proprietary information or trade secrets in trust and confidence and agrees that it shall be held only for the contemplated purpose of destruction and shall not be used for any other purpose nor disclosed to a third party.

3. Initial Performance Period: 23 June 25 – 22 June 26 (with 4 Option Periods).

Base PoP: 23 June 25 – 22 June 26 OY 1: 23 June 26 – 22 June 27 OY 2: 23 June 27 – 22 June 28 OY 3: 23 June 28 – 22 June 29 OY 4: 23 June 29 – 22 June 30

3.1. Hours of Operation: Monday – Friday 0800-1500

The Following are

4. Contractor Provided Equipment:

Licensed & trained driver/s-operator/s. Licensed-registered-insured mobile on-site shredder vehicle/unit, capable of PII/PHI shredding/destruction in most expedient time frame (average shred time is estimated at 60-90 minutes at each location). Driver/s and Operator/s should be able to pass 375th Security Forces local law enforcement files check for entry onto Scott Air Force Base. The contract manager, alternate(s) and contractor employees working on this contract must be able to read, write, speak, and understand English. Conflict of Interest: The Contractor shall not employ any person who is an employee of the United States Government if the employment of that person would create a conflict of interest. The Contractor shall not employ any person who is an employee of the Department of the Air Force (DAF), either military or civilian, unless such person seeks and receives approval IAW DoD 5500.7-R, Joint Ethics Regulation, and AF policy. Appearance: Hair (including facial hair, beards, mustaches, and sideburns) shall be controlled (restrained) or trimmed. Hair shall not interfere with safe work practices, look un-kept or be unclean. Hair styles and colors shall be within acceptable community standards of appearance for the work being performed. Body Alterations: Visible body alterations (piercing, tattoos, cosmetic skin or body part alterations) shall be limited to and IAW accepted business appearance and shall not interfere with safe work practices, look unkempt, or be vulgar or offensive in any manner. The Contracting Officer will have final determination on any questionable issue. Clothing: Contractor shall provide common uniform types for their employee’s/personnel working on this contract. Uniforms shall be IAW accepted community standards of dress for the work being performed. Uniforms shall be neat, clean, shall fit correctly to provide a professional appearance. Uniform cost, cleaning and maintenance are the contractors’ financial responsibility. Employee Identification: Contractor employees shall be required to wear a contractor always provided identification badge on their outer garment/uniform while working on Scott AFB. Badges will include permanent photo, typed/embossed employee name & contract company name. Contractor personnel shall be easily recognized as Contractor employees by uniform, identification badges and/or patches.

Badges/patches/etc. should not interfere with safe work practices and are the financial responsibility of the contractor.

Contractor will provide 10 stationary & 29 mobile new lockable collection containers with locks & keys. Containers should be sturdy and lockable, and all locks will be keyed the same.

Mobile container size to be approximately 64 gallons each. Mobile collection containers should be able to tolerate weather with-out damage if scheduled shred days/times are during periods of rain, snow, etc. Containers should have slotted top opening to allow deposit of PII/PHI documents but constrictive enough to prevent persons from reaching in and removing any item.

Containers appearance should be conducive to a medical/professional office environment and should maintain good color and working order throughout the period of performance of the contract. Containers damaged or considered in inappropriate condition for continued use in medical office environment (as determined by Contracting Officer) will be exchanged by the contractor at no cost to Government. Containers should be labeled near the slotted top, indicating its use as PII/PHI Shredding Container. Government user should be allowed to place AF Visual Information sticker/label on container tops, indicating that these containers will “NOT BE USED FOR CLASSIFIED DOCUMENTS” destruction.

5. Government Provided Items: The government will provide locations for the locked collection containers (mobile/stationary see Attachment 1), have mobile containers at the loading dock on the scheduled days & times and will provide access to loading docks for mobile shredder vehicle. Contractors can request driver/operator long-term base entry passes through the Contract Officer or Contract Administrator.

6. Publications:

DoDM 6025.18-R Implementation of the Health Insurance Portability and Accountability Act (HIPPA) Privacy Rule in DoD Health Care Programs.

Supporting Regulations for Disposing PHI (Publications) A. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule establishes the requirement for covered entities to have appropriate administrative, technical, and physical safeguards in place to protect the privacy of protected health information (PHI), including the disposal of such information. See 45 CFR 164.530(c).

B. The Department of Defense Health Information Privacy Regulation (DoD 6025.18-R) implements the above part of the HIPAA Privacy Rule within the Military Health System (MHS).

See C14.3.

C. The HIPAA Security Rule establishes the requirements for covered entities to implement policies and procedures regarding the disposal of electronic PHI. See 45 CFR 164.310(d)(2).

D. The DoD Health Information Security Regulation (DoD 8580.02-R) implements the above part of the HIPAA Security Rule within the MHS. See C3.5.3.

Attachment 1 (12 June 2025)

Location List PHI/PII Mobile/Wheeled Lockable Shred Containers throughout the 375MDG (29 Total)

4– Main Pharmacy 1– Referral Mgmt.

2 – Satellite Pharmacy 2 – Laboratory 1 – Radiology 1 – Drug Demand Reduction 1 – Case Management 1 – Dental Clinic 1 – Family Advocacy/ Mental Health 1 – Flight Medicine 1 – Central Appointment Desk 2 – Patient Administration / TOPA 1 – HIPAA Office 1 – Bioenvironmental Engineering

1 – OB/GYN

1 – Optometry 1 – Outpatient Records 1 – Pediatric Clinic 2 – Primary Care Clinic 1 – Physical Therapy 1 - Education and Training 1 - Disease Management / HAWC

Location List of PHI/PII Stationary Locked Shred Containers throughout the 375 MDG (10 Total) 1 – Immunization 1 – Readiness 1 – Vet Clinic 1 – Public Health

1 – MRI

1 – Resource Management Office/UBO 1 – Orderly Room 1 – Command Section 1 – Command Section Breakroom 1 – Pediatrics/Scott Family Health Clinic Check-in

ADDENDUM 1: 375th SECURITY FORCES REQUIREMENT:

Contractor Consent to Background Checks: The contractor and, as applicable, subcontractor shall not employ persons for work on this contract if such employee is identified as a potential threat to the health, safety, security, general wellbeing or operational mission of the installation and its population, nor shall the contractor or subcontractor employ persons under this contract who have an outstanding criminal warrant as identified by Law Enforcement Agency Data System (LEADS) through the National Crime Information Center. LEADS checks will verify if a person is wanted by local, state, and federal agencies. All contractor and subcontractor personnel must consent to LEADS background checks. Contractor and subcontractor personnel who do not consent to an LEADS check will be denied access to the installation. Information required to conduct an LEADS check includes: full name, driver’s license number, and/or social security number, date of birth of the person entering the installation, and completion of a background check questionnaire. The contractor shall provide this information using the Scott AFB Form 21, Contractors Consent for Background Check, and shall submit it in conjunction with the contractor’s request for either base or vehicle passes. Completion of a successful LEADS check does not invalidate the requirement for an escort when contractor or subcontractor personnel are working within controlled or restricted areas.

Contractors shall ensure their employees and those of their subcontracts have the proper credentials allowing them to work in the United States. Persons later found to be undocumented or illegal aliens will be remanded to the proper authorities. The contractor shall not be entitled to any compensation for delays or expenses associated with complying with the provisions of this clause. Furthermore, nothing in this clause shall excuse the contractor from proceeding with the contract as required.

To obtain unescorted access to the installation, all contractor’s credentials must be IAW the REAL ID Act of 2005. If a contractor does not have credentials that are compliant with the REAL ID Act, they must be escorted at all times. For more information, and to determine what credentials are and are not compliant, go to https://www.dhs.gov/real-id-public-faqs.

Badges: The contractor is required to provide identification badges for their employees. All contractor personnel shall wear these badges while on duty on the government site. Badges are required to identify the individual, company name, and be clearly and distinctly marked as contractor. Size, color, style, etc. are to be mutually agreed to by contractor and government.

The contractor’s identification badge will not be used as an entry requirement for installation entry or into any government designated controlled or restricted area. All DBIDS cards/passes will be turned in to the Visitors Control Center upon expiration of pass and/or completion of contract.

Contractor Registration of Vehicles on Scott AFB:

All contractor or contractor employees’ vehicles used for the performance of this contract shall comply with all local, state and federal regulations. Additionally any pass shall be surrendered to Security Forces upon demand to positively identify a persons need to be on Scott AFB.

https://www.dhs.gov/real-id-public-faqs https://www.dhs.gov/real-id-public-faqs

Access to Installation during Force Protection Conditions (FPCONs):

Contractors will be assigned a mission essential designation IAW requirements contained in Scott Air Force Base Antiterrorism-Integrated Defense Plan 31-1 (AT-IDP). Only the installation commander or the unit commander requesting contract support will assign the mission essential designation.

Property Protection:

Property protection for facility where the contractors’ primary work center is located will be the responsibility of the local facility manager and local Government Security Manager, or their duly authorized representative IAW AFI 31-101, Integrated Defense and command/local directives.

The contractor shall safeguard all government-owned equipment and materials in his/her possession or use.

Safeguarding Classified or Unclassified Information: The contractor shall meet Air Force standards for storing, processing, and handling classified information and systems. Additionally, all resources (e.g. maps, publication/instructions, photos) provided by the government to assist the contractor in the performance of their contract will be surrendered upon termination of employment or the end of the contract performance period.

Non-Disclosure Agreements: To safeguard information, the contractor shall enter into non-disclosure agreements with the responsible local security manager.

Privacy Act: Work on this project requires that personnel have access to Privacy Information.

Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

Contractors Working in Controlled or Restricted Areas The unit requesting contract support will provide escort(s) for contractors at all times when within a controlled area. Contractors shall not escort other contractor employees within controlled or restricted areas. In addition, contractors shall fulfill, maintain, and comply with all security requirements IAW AT-IDP, and command/local directives.

Access to Government Facilities with Controlled or Restricted Areas The contractor shall comply with security regulations imposed by the installation commander and/or the agency responsible for the project location. Due to specific mission requirements inherent in the nature of controlled or restricted areas on Scott AFB, the government may direct the contractor to leave the controlled or restricted areas at any given time.

Contractors Responsibilities while Working within Controlled or Restricted Areas Only contractor personnel with proper authority and qualifications shall enter a controlled or restricted area. Certain facilities require the issuance of an AF Form 1199. The government, at any time, may revoke the AF Form 1199. The procedures for the issuance of an AF Form 1199 are contained in AT-IDP. Contractors shall not escort other contractor employees within controlled or restricted areas. In addition, contractors shall fulfill, maintain, and comply with all security requirements contained in AT-IDP.

Access to Government Facilities with Controlled or Restricted Areas for Replacement Contractors The unit requesting contract support will continuously escort replacement contractors, not initially possessing the proper clearances and requiring entry to controlled or restricted areas.

Replacement contractors shall submit paperwork within 30 days of being assigned to obtain an approved security clearance or favorable review. Replacement contractor personnel shall obtain a security clearance prior to working with, or having direct access to, classified material. In addition, replacement contractor personnel shall obtain a “Favorable Review” prior to having access to a Controlled Area. The above information shall be submitted to 375 AMW/IP.