P09-PWS - Medical Records Storage.docx

Performance Work Statement Medical Records Storage – VA San Diego Healthcare System, Station 664

BACKGROUND

The Department of Veterans Affairs (VA), VISN 22, VA San Diego Healthcare System (VASDHS) intends to establish a contract to provide Medical Records and Destruction Services. The terms and conditions of the contract shall be in accordance with the specifications and requirements contained herein and GSA contract GS-03F-049GA. Pricing for services will not exceed the ceiling prices negotiated in the GSA contract. The compensation levels proposed should reflect a clear understanding of work to be performed and should indicate the capability of the proposed compensation structure to obtain and retain suitably qualified personnel to meet mission objectives. After award, meetings will be arranged with parties involved to discuss moving records.

SCOPE

VA San Diego Healthcare System requires NARA certified offsite, storage, retrieval, document transportation, destruction services of medical records, and patients’ files. The off-site records management services include filing and organizing records, round-the-clock security, and automated tracking and management support. The storage facility must meet the minimum requirements to ensure compliance with all applicable laws, regulations, and other formal guidance, such as NARA, HIPPA, FAR, VAAR. The Contractor shall provide long-term or short-term storage for records that do not require conversion to electronic form. Requests for services shall be made by the COR and/or the Health Information Management Service (HIMS) personnel through phone, email, and/or fax.

PLACE OF PERFORMANCE

Records shall be picked up and delivered from or to the following addresses:

a) VA San Diego Healthcare System 3350 La Jolla Village Dr., San Diego, CA 92596

PERIOD OF PERFORMANCE

Base Year: 08/01/2026 – 07/31/2027 Option Year 1 (OY1): 08/01/2027 – 07/31/2028 Option Year 2 (OY2): 08/01/2028 – 07/31/2029 Option Year 3 (OY3): 08/01/2029 – 07/31/2030 Option Year 4 (OY4): 08/01/2030 – 07/31/2031

DESCRIPTION OF SUPPLIES AND SERVICES

MANAGEMENT OF RECORDS

Each file shall be individually indexed as per NARA and use retention codes or a retention schedule by the Contractor.

ACCESS CONTROLS AND SAFEGUARDS

Store the VA/VHA records as per NARA approved methods. The Contractor must have 24-7 security systems including motion sensors and access codes to enter our storage area. Only the contractor employees are allowed into the warehouse/storage areas.

FILE STORAGE AND SAFEGUARDS

Medical records, electronic files, insurance records, business records, and legal case files, must be stored in a location that is retrievable, secure from damage (flooding, not stored near EMI emitting devices, and heat sources) in the locations that have a media “vault” or climate (moisture and temperature) controlled secure facility.

FILE INDEXING

Each box has a barcode index for retrieval. The VA/VHA uses retention code or schedule to manage files. There is an indexing field specifically designed for that. A barcode is applied to the file, and it’s returned to the original box. Accurate retrieval of each item is essential due to time constraints for a specific purpose.

SHREDDING AND DESTRUCTION

Must be a NARA and VA approved method (see Shredding Specifications below). The destruction of documents must be requested in writing and approved by the appropriate VHA COR.

SHREDDING SPECIFICATIONS

The contractor agrees to abide by the following references: NIST 800-88 (EPLS) 1x5 mm crosscut (as stated in Para (a) below)), 41 CFR Part 101-45 and 44 U.S.C. 3302 1228.58. VA Directive 6371 applies to Destruction of Temporary Paper Records.

A. The contractor shall provide offsite document destruction services in the presence of a VA employee for Government provided documents containing classified, sensitive confidential and medical records. The documents (paper data) shall be destroyed (shredded) using crosscut shredders which produce particles that are 1x5 millimeters in size, or to pulverize/disintegrate paper materials using disintegrator devices equipped with 3/32-inch security screen. Protected information contained on any other form of media will be removed, obliterated, or the media destroyed by or in the presence of a VA employee or contractor employee (approved by the COR) in such a manner that is compliant with the National Institutes of Standard and Technology (NIST) Special Publication 800- 88.

B. Paper records that contain Personal Identifiable Information (PII) or Protected Health Information (PHI) must be destroyed by shredding, burning, pulping, macerating as a final destruction method. These documents shall not be abandoned, sold or resold. Final destruction is that the material is “no longer readable or reconstruct able.

C. No Personal Identifiable Information or Sensitive information will ever be placed in an authorized dumpster or similar device, until it has been shredded in compliance with regulations.

D. The contractor agrees to destroy all records that need to be destroyed, and the contractor shall ensure that PII and other sensitive temporary records (in the security containers provided by the contractor) are protected until they are actually destroyed.

E. Contractor Privacy/Cyber Security Training: A Business Associate Agreement (BAA) will be generated by the VA and approved by the contractor and the VA/VHA. Furthermore, the BAA stipulates that contractors must take the VA Privacy Policy Training, and the Privacy/Information Security Training prior to starting work with PII/PHI and then annually thereafter. The contractor must submit certificate of completion to the COR and Contracting Officer that conforms to VHA Privacy Training yearly. Note: the contractor may use an alternate training for privacy and security training, however, if must be approved by the VHA Privacy & Security Officers.

CERTIFICATION OF DESTRUCTION

A. The contractor shall prepare and submit to the medical facility’s COR an original signed Certificate of Destruction for each pick up for each site within three (3) working days of each pick up. The contractor shall maintain proper records concerning each Certificate of Destruction issued. The Certificate of Destruction shall as a minimum contain the following:

1. Pick-up/Delivery Location

2. Pick-up/Delivery Date

3. Name of Government COR

4. Amount of shredded waste (# of containers picked up and/or pounds shredded)

5. Destruction Certification Document Number

6. Destruction Certificate Date

7. Any other information as determined necessary by the Security Officer

8. Government Employee or Authorized Contractor representative (approved by the COR) who witnessed the destruction.

PROGRAM MANAGEMENT SERVICES

Contractor shall provide program management personnel who have an understanding of the VA Records Management system. The named Program Manager shall provide a single point of contact for dealing with intake and outtake of records. The Program Manager will:

A. Train departments regarding storage processes, including procedures for storage and retrieval and customized labels for boxes sent to off-site storage.

B. Provide labor to facilitate relocation of records to appropriate storage sites: Contractor’s NARA certified Record Center.

C. Facilitate conversion and user access to material held at the Contractor NARA Certified Record Center.

D. Facilitate destruction of records beyond their VA specified retention period by notifying record custodians, obtaining required authorizations, and destroying records.

E. Inventory all boxes transitioned to Contractor Record Center.

F. Contractor will provide an online ordering system that will allow users to order boxes electronically, document record type identification prior to submission, order labels for boxes and request record intake.

Contractor shall store boxes of records in a NARA certified facility. Contractor shall provide long-term or short-term storage for records that do not require conversion to electronic form.

EMERGENCY PAPER RETRIEVAL

Contractor shall be capable of retrieving and delivering paper records on an emergency basis twenty-four hours a day and three hundred sixty-five days per year. Records may be delivered in Contractor-owned and staffed vehicles or by courier. A 24-hour delivery requirement from the time of formal notification is required.

CONTRACTOR RESPONSIBILITIES

A. Contractor must provide for the transportation, pick-up and delivery, and storage of all paper records that are required to be stored off site from the Loma Linda facilities (inventory records are maintained by the COR and disposing of all shredded materials as per the NIST 800-88 (NSA-EPL). All shredding shall be witnessed by a VA employee or an authorized Contractor employee (authorized by COR) for destruction of sensitive VA material. After the destruction of the material, the Contractor shall provide a certificate of destruction to the VA Facility COR for retention. All documents are to be identified through bar coding and inventory sheets.

B. Contractor shall maintain a current inventory of all paper & electronic records. Records belonging to the VA that currently exist in a VA facility or an outside third party must be transitioned from their current place of storage.

C. Contractor is responsible for maintaining liability insurance for the duration of the contract and for following all pertinent federal and state regulations with regard to transportation and destruction of classified / confidential documentation. The contractor certifies that all data will be protected until final destruction. The contractor shall be the point of contact for liability should an incident occur (for mitigation purposes) after the data is picked up by the contractor.

D. The contractor delivers and picks up records and new documents from the facility as requested by the COR. No guarantees are made as to the estimated pickup and delivery frequencies or volumes, or the quantities. The contractor shall be available for emergency pick up or delivery.

E. Transportation of records – Contractor must communicate and correct labeling differences between the VA government entity and the contractor prior to taking custody.

F. Records indexing and retrieval at the carton file or document level G. Highly secure transportation and destruction services available as needed H. Classification, retention and destruction management per customer schedule I. Management reporting to ensure compliance, monitor services and control costs J. The contractor shall be responsible for ensuring contractor employees providing work on this contract are fully trained and completely competent to perform the required work K. Equipment: The contractor shall provide mobile equipment to do all shredding as per the specifications stated above.

L. Shall maintain current inventory of all paper and electronic records

VA HEALTHCARE SYSTEM RESPONSIBILITIES

A. Request, receive, transfer and distribution of paper records for those cases in which a paper record is required.

B. Provide the contractor with 24 hours’ notice for a scheduled pick-up, except where noted as Vital Records.

C. Monitor all records and destruction in accordance with the RCS-10, VHA Directive 6371, and VHA Handbook 6500.

D. Maintain a current inventory of all paper and electronic records

CONTRACTOR PERSONNEL SECURITY REQUIREMENTS

A high level of security will be applied as documents are transported in enclosed locked vehicles by the Contractor’s permanent staff. All vehicles are required to be secure at all times – whether parked or in transit – by having all windows closed and all doors locked. Contractor shall be responsible for management, oversight, security, and control of all classified, sensitive, confidential documents and documents containing medical records stored in the locked containers, prior to and until completion of storing, shredding or destruction of the documents. The contractor is capable under the law should an employee’s view, take or release sensitive information unlawfully.

All records in the contractor’s possession must be secure from the moment they leave VA’s site to document storage.

The contractor’s security and technology processes shall be based upon a security policy that meets VA standards and is checked from time to time by the COR. This policy will cover security roles and responsibilities, information classification, physical security, password policies, incident reporting, change control, data privacy, encryption, external connection guidelines, and similar topics. Data management and access procedures are to be compliant with industry standards. Encryption technologies should be used to transmit sensitive patient data to meet or exceed HIPAA standards. A chief security coordinator must oversee the security and audit team.

Contractor shall obtain security clearances for all personnel who have access to VA records, whether in paper or electronic form. Employees must be cleared by VA security prior to starting VA related work which entails completion of the Questionnaire for Non-Sensitive Positions form and clearance via SIC- Security Investigations Center. Employees will then be processed for fingerprinting. Once the Personal Identification Verification (PIV) system is established at the VAHS, the contractor agrees to abide by the new security requirements that will be provided upon implementation.

Contractor personnel are required to read, write, speak, and understand the English language, unless otherwise specified in this contract or agreed to by the Government. Contractor shall bear the expense of obtaining background investigations from recruited personnel, including replacement personnel. Contractor shall pre-screen all personnel requiring access to the computer systems to ensure they maintain a U.S. citizenship or legal alien status. The position sensitivity impact for this effort has been designated as Moderate Risk and the level of background investigation is MBI. At this time, the current estimated costs for such investigations are as follows:

LEVEL OF SENSITIVITY

BACKGROUND INVESTIGATION LEVEL

APPROXIMATE COST

Moderate Risk

Minimum Background Investigation

$1,632.00

The contractor shall be required to furnish all applicable employee information required to conduct the investigation, such as, but not limited to, the name, address, and social security number of contractor personnel. The VA shall provide all the necessary instructions and guidance for submission of the documents required to conduct the background investigation.

Contractor shall employ sufficient number of cleared staff members to ensure that all work processes included in the statement of work can be performed. Contractor shall provide each employee with an identification badge, which shall be displayed on the outer garment at all times.

Contractor must possess all licenses, permits, accreditation and certificates as required by law. The Contractor shall perform the required work in accordance with Joint Commission (JC), Veterans Health Administration (VHA) and other regulatory standards. JC standards may be obtained from:

Joint Commission on Accreditation of Healthcare Organizations One Renaissance Blvd Oakbrook Terrace, IL 60181 Contractor shall agree that all deliverables, associated working papers, and other material deemed relevant by the contractor in the performance of this task order are the property of the United States Government. Contractor shall agree that all individually identifiable health information shall be treated with the strictest confidentiality. Access to records shall be limited to essential personnel only. Records shall be secured when not in use. The contractor shall comply with the Privacy Act, 38 U.S.C. 5701, 38 U.S.C. 7332, and 5 U.S.C. 552(a) ET. Seq. Contractor staff shall sign confidentiality statements as required. Contractor shall comply with all provisions of the Health Information Portability and Accountability Act (HIPAA) including but not limited to privacy, security of electronic health data, and adherence to standards and code sets as required by HIPAA. Contractor shall ensure the confidentiality of all patient and employee information and shall be held liable in the event of breach of confidentiality. Contractor staff must sign confidentiality statements as required. Any person who knowingly or willingly discloses confidential information from the VA may be subject to fines.

CONTRACTOR VEHICLES

All contractor vehicles utilized in this contract shall be insured and maintain current state vehicle registration. It is the Contractor’s responsibility to ensure that all contractor employees possess a valid State Driver’s license and have no traffic violations on his/her driving record. The contractor or his/her employees, while performing under this contract shall use no personal vehicles

INSURANCE REQUIREMENTS

The contractor is required to provide copies of proof of Worker’s Compensation that complies with Federal and State Worker’s Compensation and Occupational disease statues, and provide proof of General Liability Insurance, within 15 calendar days after notification of contract award and agrees to maintain the insurance requirement while the contract is in effect.

A. The Contractor agrees to procure and maintain, while the contract and/or BPA is in effect, Workers Compensation and Employee’s Public Liability Insurance in accordance with Federal and State of California laws.

1. Workers’ compensation and employer’s liability: Contractors are required to comply with applicable Federal and State workers’ compensation and occupational disease statutes. If occupational diseases are not compensable under those statutes, they shall be covered under the employer’s liability section of the insurance policy, except when contract operations are so commingled with a contractor’s commercial operations that it would not be practical to require this coverage. Employer’s liability coverage of at least $100,000 shall be required, except in States with exclusive or monopolistic funds that do not permit workers’ compensation to be written by private carriers.

2. General liability: The contracting officer shall require bodily injury liability insurance coverage written on the comprehensive form of policy of at least $500,000 per occurrence.

3. Property damage liability insurance shall be required only in special circumstances as determined by the agency.

4. Automobile liability: $200,000 per person; $500,000.00 per occurrence and $20,000.00 property damage.

5. Before commencing work under the contract, the Contracting Officer shall require the Contractor to furnish certification from his/her insurance company indicating that the coverage specified herein has been obtained and that it may not be changed or canceled without guaranteed thirty (30) days’ notice to the Contracting Officer in writing.

B. The Government shall be held harmless against any or all loss, cost, damage, claim expense or liability whatsoever, because of accident or injury to persons or property of others occurring in the performance of the contract.

C. The Contractor shall be responsible for all damages to property, which may be done by any employee engaged in the performance of this contract.

ADDITIONAL REQUIREMENTS

· Certificate of Destruction: A “Certificate of Destruction” shall be provided after each job.

· VA Handbook 6300.1 “Records Management Procedure” shall be applicable to all record/microfiche destruction. The procedure reads: “The authorized destruction of records that are classified or otherwise restricted from disclosure by statute, such as PA or Title 38 USC, must be witnessed by a federal employee or a contractor employee. If a contract is used to dispose of restricted VA records, the facility Records Officer must authorize the use of a contractor or subcontractor employee to witness the destruction.

· Confidentiality of material destruction: Contractor personnel shall comply with the confidentiality in the destruction of all VA documents. Any contractor personnel found to be reading or mishandling any of the VA materials shall be promptly removed from performing the job. The person(s) involved shall not be allowed to return to the VA premises for any future requests or to perform the job under this contract.

· HIPAA

· The contractor will have to abide by the standard Business Associate Agreement (BAA) in accordance with the Health Insurance Portability and Accountability Act of 1996. The BAA will be supplied to the contractor from the VA after the contract is awarded.

· Restrictions: The VA Hospital is a government facility. Loading dock hours are limited, so contact any of the authorized personnel below for availability. Do not leave data anywhere unattended.

· Privacy and Security Standards: The contractor must abide by the VHA Privacy and Security Standards as per the VHA Handbook 1605.1 & 6500.

The Contractor shall be aware of the requirements of 38 CFR 7332 and agrees to abide by them:

Any individually identifiable information related to VHA treatment of drug abuse, alcoholism, sickle cell anemia, and testing or treatment for HIV has special protection under 38 U.S.C. Section 7332. The information can only be disclosed as authorized by 38 U.S.C. 733, and the implementing VA regulations at 38 CFR 1.460-1.496. [VHA HBK 1605.1] The contractor is aware of the requirements of 38 CFR 5701 and agrees to abide by them:

The VA Claims Confidentiality Statute, 38 U.S.C. 5701, implemented by 38 CFR Section 1.500-1.527. This statute provides for the confidentiality of all VA patient and claimant names and home addresses (and the names and home addresses of their dependents) and permit disclosure of the information only when specifically authorized by the statute. Title 38 CFR Sections 1.500-1.527 are not to be used in releasing information from patient medical records when in conflict with 38 CFR 1.575-1.584, 38 CFR 1.460-1.496, or 45 CFR Parts 160 and 164. [VHA HBK 1605.1] The contractor is aware of the requirements of 38 CFR 7505 and agrees to abide by them:

Confidentiality of Healthcare Quality Assurance Review Records, 38 U.S.C. 5705, implemented by 38 CFR Section 17.500-17.511. This statute provides that records and documents created by VHA as part ofa designated medical quality-assurance program are confidential and privileged and may not be disclosed to any person or entity except when specifically authorized by statute. [VHA HBK 1605.1] The contractor is aware of the requirements of HIPAA and agrees to abide by them:

HIPAA (Public Law (Pub. L.) 104-191) implemented by 45 CFR Parts 160 and 164. This statute provides for the improvement of the efficiency and effectiveness of health care system by encouraging the development of health information systems through the establishment of standards and requirements for the electronic transmissions, privacy, and security of certain health information. VHA must comply with the Privacy rules when creating, maintaining, using, and disclosing individually identifiable health information. [VHA HBK 1605.1] The contractor is aware of the requirements of the Privacy Act and agrees to abide by them:

The Privacy ACT, 5 U.S.C. 552a, implemented by 38 CFR Section 1.575-1.584. Generally, the Privacy Act provides for the confidentiality of individually identified and retrieved information about living individuals that is maintained in a Privacy Act system of records and permits disclosure of Privacy Act- protected records only when especially authorized by the statute. The Privacy Act provides that the collection of information about individuals is limited to that which is legally authorized, and necessary. All information must be maintained in a manner that precludes unwarranted intrusion upon individual privacy. Information is collected directly from the subject individual to the extent possible. At the time information is collected, the individual must be informed of the authority for collecting the information, whether providing the information is mandatory or voluntary, the purposes for which the information will be used, and the consequences of not providing the information. The Privacy Act requires VHA to take reasonable steps to ensure that its Privacy Act-protected records are accurate, timely, complete, and relevant. [VHA HBK1605.1]. The contractor agrees to protect all VA/VHA data under the Privacy Act and HIPAA Security Rule.

DISASTER RECOVERY

The contractor shall assure seamless service with extensive disaster recovery and backup plans and procedures. In case of sudden loss of data communications and/or computer processing capability through disasters such as fire, water, explosion, or sabotage, critical business functions should continue to operate until normal processing capability is restored.

NARA Facility The Contractor’s commitment to security must be superior with a warehouse in compliance with 36 CFR 1228, subpart K, certified by the National Archives and Records Administration (NARA).

NO SMOKING POLICY

Except in designated smoking areas, smoking is strictly prohibited inside and, on the patios, and balconies of all buildings and within 25 feet of all openings of all buildings. It is also prohibited inside all VA Healthcare System vehicles. “Smoking” is defined as the burning of any cigarette, cigar or other tobacco product.

HOURS OF SERVICES

The Contractor shall perform the services as specified herein Monday through Friday between the hours of 7:00 a.m. – 5:00 p.m. PDT The Contractor is not required to provide services on the following U.S. Government holidays, nor will the Contractor be paid for these holidays except for emergency/rush requests and will be scheduled between the contractor and the COR only.

National holidays observed by the Federal Government:

If a holiday falls on a Sunday, the following Monday will be observed as the National Holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National Holiday by U.S. Government agencies. Also included would be any day specifically declared by the President of the United States.

STANDARD QUALITY ASSURANCE

a) The Contractor must be in compliance with the Business Associate Agreement.

b) The Contractor must abide the Quality Assurance Surveillance Plan provided to monitor the accuracy and timeliness of retrieval and delivery of administrative and medical records.

c) The contractor is held responsible for the accurate movement of administrative and medical record boxes. Any loss of protected health information shall result in the contractor being held liable for identity theft and charges by the patient.

d) The contractor must exceed a 95% accuracy and timeliness of delivery to the VA Loma Linda Healthcare System. The CO will notify the contractor in writing on a monthly basis of any negative issues concerning the quality and timeliness of delivery. The CO will provide detailed information for the contractor to correct discrepancies.

e) The contractor shall maintain acceptable services, reporting systems and quality controls as specified herein. Failure to comply with the specified terms and conditions and/or failure to perform satisfactorily may be grounds for termination of the contract.

INSPECTIONS

The Government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections. Likewise, the Government may decrease the number of quality control inspections if performance dictates. The Government will also receive and investigate complaints from various customers located at the business locations.

CONTRACTOR PERSONNEL

A. Contractor’s Program Manager. The Contractor shall provide a Program Manager who shall be responsible for the performance of work. The name of this person shall be designated in writing to the Contracting Officer. The Contractor’s program manager shall have full authority to act for the Contractor on all matters relating to daily operations of this contract.

B. Contractor Employees. The Contractor shall not employ persons for work on this contract if such employee is identified to the Contractor as a potential threat to the health, safety, security, general well-being, or operational mission of the installation and its population.

C. The Contractor shall perform services in accordance with the ethical, professional and technical standards of the healthcare industry as consistent with the Department of Veterans Affairs Regulations and Procedures.

BADGES AND PARKING

All contractor personnel are also required to wear Vendor ID Badges noting contractor’s name, personal name, position title and photo of contractor personnel.

It is the responsibility of the contractor’s personnel to park in the appropriate designated parking areas. Parking information is available from the participating healthcare center’s Security Office. VA will not validate or make reimbursement for parking violations of the contractor’s personnel under any circumstance.

ORDERING, INVOICE AND PAYMENT

Company Name:

Address:

City, State, Zip

Phone No:

Fax No:

Contact Name:

E-mail:

Contractor shall list in the spaces below the name(s) and address(es) of customer service departments with whom the Government facilities will place orders:

No advance payments shall be authorized. Payment shall be made monthly for product provided during the billing month in arrears in accordance with FAR 52.212-4, para.(i) upon submission of a properly prepared invoice for prices stipulated in this contract for products delivered and accepted in accordance with the terms and conditions of the contract and/or BPA, less any deductions stipulated in this contract and/or BPA.

Payment of invoices may be delayed if the appropriate invoices as specified in the contract are not completed and submitted as required. Each Fiscal Year, a new PO will be generated for funding.

DELIVERY REQUIREMENTS

All deliveries for this contract shall be FOB Destination only. Deliveries will be made upon request of the COR.

POST-AWARD PERFORMANCE CONFERENCE

The Contracting Officer may schedule a post-award performance conference with the contractor if deemed necessary for contract orientation purposes.

PERFORMANCE STANDARDS

Performance standards desired services: The Government performs surveillance to determine if the contractor exceeds, meets or does not meet these standards.

The Performance Requirements Summary in the Statement of Work (SOW) includes performance standards. The Government shall use these standards to determine contractor performance and shall compare contractor performance to the Acceptable Quality Level (AQL).

for non-urgent documents and files from time of formal notification.

Review Request log for non-urgent requirements filled and unfilled.