S02 36C26325Q0848.pdf

PAGE 1 OF 1. REQUISITION NO.

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NO. 5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

a. NAME b. TELEPHONE NO. (No Collect Calls) 8. OFFER DUE DATE/LOCAL

TIME

9. ISSUED BY CODE 10. THIS ACQUISITION IS UNRESTRICTED OR SET ASIDE: % FOR:

SMALL BUSINESS

HUBZONE SMALL

BUSINESS

SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

WOMEN-OWNED SMALL BUSINESS

(WOSB) ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

8(A)

NAICS:

SIZE STANDARD:

11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

12. DISCOUNT TERMS

13a. THIS CONTRACT IS A

RATED ORDER UNDER

DPAS (15 CFR 700)

13b. RATING

14. METHOD OF SOLICITATION

RFQ IFB RFP

15. DELIVER TO CODE 16. ADMINISTERED BY CODE

17a. CONTRACTOR/OFFEROR CODE FACILITY CODE 18a. PAYMENT WILL BE MADE BY CODE

TELEPHONE NO. UEI: EFT:

PHONE: FAX:

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT SUCH ADDRESS IN OFFER

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a UNLESS BLOCK BELOW IS CHECKED

SEE ADDENDUM

19. 20. 21. 22. 23. 24.

ITEM NO. SCHEDULE OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

(Use Reverse and/or Attach Additional Sheets as Necessary)

25. ACCOUNTING AND APPROPRIATION DATA 26. TOTAL AWARD AMOUNT (For Govt. Use Only)

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1, 52.212-4. FAR 52.212-3 AND 52.212-5 ARE ATTACHED. ADDENDA ARE ARE NOT ATTACHED.

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN _______________ 29. AWARD OF CONTRACT: REF. ___________________________________ OFFER COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND DATED ________________________________. YOUR OFFER ON SOLICITATION DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY (BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED SET FORTH HEREIN IS ACCEPTED AS TO ITEMS:

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a. UNITED STATES OF AMERICA (SIGNATURE OF CONTRACTING OFFICER)

30b. NAME AND TITLE OF SIGNER (TYPE OR PRINT) 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER (TYPE OR PRINT) 31c. DATE SIGNED

AUTHORIZED FOR LOCAL REPRODUCTION (REV. NOV 2021)

PREVIOUS EDITION IS NOT USABLE Prescribed by GSA - FAR (48 CFR) 53.212

7. FOR SOLICITATION

INFORMATION CALL:

STANDARD FORM 1449

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, & 30

636-25-4-9067-0094

36C26325Q0848 06-03-2025

Marie Weathers 605-347-2511 06-17-2025

10:00AM CDT

36C263 Department of Veterans Affairs Network 23 Contracting Office (NCO 23) VA Black Hills HCS Fort Meade Campus 113 Comanche Rd.

Fort Meade SD 57741

X 100

X

561990

$16.5 Million

X

N/A

X

36C263

Department of Veterans Affairs Central Iowa VA Healthcare System 3600 30th St.

Des Moines, IA 50310

Department of Veterans Affairs Network 23 Contracting Office (NCO 23) VA Black Hills HCS Fort Meade Campus 113 Comanche Rd.

Fort Meade SD 57741

Tungsten Electronic Invoicing VA Tungsten Number: AAA544240062 va.registration@tungsten-network.com Refer to VAAR 852.232-72

See CONTINUATION Page

Document Destruction in support of the Central Iowa VA Healthcare System and assigned location slisted in the Statement of work.

This solicitation is to establish a service contract for a base contract and four option years.

Period of Performance - Base Year - 08/01/2025 to 07/31/2026 Plus Four Option years.

See Section E within Addendum to FAR 52.212-1 for Instructions to Offerors.

See Section E, FAR 52.212-2 for Evaluation Factors.

Department of Labor Wage Determination documents applies to services performed. See attached wage determinations Technical questions shall be submitted in writing by 06/09/2025 by 10:00AM CST by marie.weathers@va.gov Quotes shall be submitted no later than 06/17/2025 by 10:00AM CST by marie.weathers@va.gov Contract award is contingent upon VA Leadership Approval.

Offerors are advised that it is possible that no award will be made pursuant to this solicitation. In no event shall the VA be responsible for any cost incurred by responding.

See CONTINUATION Page

636-3650160-3998-822300-3131-0300V3075 636-25-4-9067-0094

X X

X 1(one)

Scott Morrison

NCO2316L2-65423

36C26325Q0848

Table of Contents

SECTION A

A.1 SF 1449 SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

B.2 PRICE/COST SCHEDULE

B.3 STATEMENT OF WORK

B.4 IT CONTRACT SECURITY

SECTION C - CONTRACT CLAUSES

C.1 52.212-4 CONTRACT TERMS AND CONDITIONS—COMMERCIAL PRODUCTS

AND COMMERCIAL SERVICES (NOV 2023)

C.2 52.217-8 OPTION TO EXTEND SERVICES (NOV 1999)

C.3 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ...38

C.4 VAAR 852.232-72 ELECTRONIC SUBMISSION OF PAYMENT REQUESTS (NOV

2018)

C.5 VAAR 852.242-71 ADMINISTRATIVE CONTRACTING OFFICER (OCT 2020)

C.6 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.7 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (JAN 2025) (DEVIATION FEB 2025)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (SEP 2023)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

E.3 52.204-29 FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT

ORDERS—REPRESENTATION AND DISCLOSURES (DEC 2023)

E.4 52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL

SERVICES (NOV 2021)

E.5 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (MAY 2024) (DEVIATION

FEB 2025)

E.6 52.216-1 TYPE OF CONTRACT (APR 1984)

E.7 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

SECTION B - CONTINUATION OF SF 1449 BLOCKS

B.1 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR:

b. GOVERNMENT: Contracting Officer 36C263

Network 23 Contracting Office (NCO 23)

VA Black Hills HCS Fort Meade Campus

113 Comanche Rd.

Fort Meade SD 57741

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award Management, or

[] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears: MONTHLY (in arrears)

4. Billing/Accounting/Invoices

4.1 Payments shall be made monthly in arrears upon receipt of a properly prepared invoice.

IAW FAR 52.212-4 (g), FAR 52.232-33, and VAAR 852.232-72.

4.2 In order to comply with the Improper Payment Elimination and Recovery Act of 2010 (IPERA), the VA has mandated electronic invoice submission to the Veterans Affairs Financial Services Center (VAFSC). VAFSC has partnered with Tungsten Corporation e-Invoicing network for submissions of all electronic invoices to VA. Tungsten Network electronic invoicing is free to all VA vendors. In order to submit electronic invoices, all VA vendors must register with Tungsten Network by submitting an email to VA.Registration@tungsten-network.com or calling 1-877-752-0900 option 2 for Enrollment.

4.3 Invoices will be electronically submitted to the Tungsten website at Tungsten direct vendor support number is 877-489-6135 for VA contracts. The VA-FSC pays all associated transaction fees for VA orders. During Implementation (technical set-up) Tungsten will confirm your Tax Payer ID Number with the VA-FSC. This process can take up to 5 business days to complete to ensure your invoice is automatically routed to your Certifying Official for approval and payment. To successfully submit an invoice to VA-FSC please review “How to Create an Invoice” within the how to guides. All invoices submitted through Tungsten to the VA-FSC should mirror your current submission of Invoice, with the following items required. Clarification of additional requirements should be confirmed with your Certifying Official (your CO or buyer).

The VA-FSC requires specific information in compliance with the Prompt Pay Act and Business Requirements. For additional information, please contact:

Tungsten Support

Phone: 1-877-489-6135

Website: https://www.tungsten-network.com/us/support/

Department of Veterans Affairs Financial Service Center

Phone: 1-877-353-9791 Email: vafscched@va.gov

4.4 Reduction in Services: This is a fixed quantity contract for a specified number of hours.

If, at the end of the period of performance, the government has not utilized the total number of hours required under this contract because of a change in its requirements, the parties agree that they will attempt to negotiate in good faith a contract modification reducing the scope of the contract with a corresponding adjustment in the total contract price.

4.5 In no event will VA pay for hours worked that exceed the total number of hours specified in the contract for the period of performance.

4.6 Payments in full/no billing VA beneficiaries: The Contractor shall accept payment for services rendered under this contract as payment in full. VA beneficiaries shall not under any circumstances be charged nor their insurance companies charged for services rendered by the Contractor, even if VA does not pay for those services. This provision shall survive the termination or ending of the contract.

4.7 To the extent that the Veteran desires services which are not a VA benefit or covered under the terms of this contract, the Contractor must notify the Veteran that there will be a charge for such service and that the VA will not be responsible for payment.

4.8 The Contractor shall not bill, charge, collect a deposit from, seek compensation, remuneration, or reimbursement from, or have any recourse against, any person or entity other than VA for services provided pursuant to this contract. It shall be considered fraudulent for the Contractor to bill other third-party insurance sources (including Medicare) for services rendered to Veteran enrollees under this contract. Contractor shall submit an electronic invoice by the tenth (10th) of the following month services were performed to the Veterans Affairs Financial Services Center (VAFSC) e-Invoice through the website at https://portal.tungsten-network.com/Login.aspx. For questions regarding the submission of VA electronic invoices, OB10 customer service may be contacted at 1-877-489-6135.

4.9 For questions regarding invoice receipt or payment, please call VAFSC directly at 1-877- 353-9791 or email vafsccshd@va.gov.

AMENDMENT NO DATE

B.2 PRICE/COST SCHEDULE

ITEM INFORMATION

ITEM

NUMBER

DESCRIPTION OF

SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

12.00 MO __________________ __________________

VA Central Iowa Health Care System 3600 30th Street Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services PRODUCT/SERVICE CODE: R614 - Support - Administrative: Paper Shredding

LOCAL STOCK NUMBER: ..

Carroll VA Clinic Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services PRODUCT/SERVICE CODE: R614 - Support -

Mason City VA Clinic Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Ft Dodge VA Clinic Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

VA Outreach Center (CRRC) Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Marshalltown VA Clinic Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Knoxville VA Clinic Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Business and Fiscal Offices Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

South Side Clinic Document Destruction Contract Period: Base POP Begin: 08-01-2025 POP End: 07-31-2026 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Document Destruction Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services PRODUCT/SERVICE CODE: R614 - Support -

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Ft Dodge VA Clinic Document Destruction Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support

Contract Period: Option 1 POP Begin: 08-01-2026 POP End: 07-31-2027 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Document Destruction Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services PRODUCT/SERVICE CODE: R614 - Support -

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Ft Dodge VA Clinic Document Destruction Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support

Contract Period: Option 2 POP Begin: 08-01-2027 POP End: 07-31-2028 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Document Destruction Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services PRODUCT/SERVICE CODE: R614 - Support -

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Ft Dodge VA Clinic Document Destruction Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support

Contract Period: Option 3 POP Begin: 08-01-2028 POP End: 07-31-2029 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Document Destruction Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services PRODUCT/SERVICE CODE: R614 - Support -

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Ft Dodge VA Clinic Document Destruction Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support

Contract Period: Option 4 POP Begin: 08-01-2029 POP End: 07-31-2030 PRINCIPAL NAICS CODE: 561990 - All Other Support Services

GRAND TOTAL __________________

B.3 STATEMENT OF WORK

General Scope of the Contract:

The Va Central Iowa Health Care System (VACIHCS), located at 3600 30th Street, Des Moines, Iowa 50310 requires document destruction services in compliance with VA Directive 6371. Currently, VACIHCS generates approximately 290,000 pounds of paper per fiscal year with sensitive information, which is collected in locked security consoles located throughout the VA facility. It is the intent of the Department of Veterans Affairs to ensure the personally identifiable information (PII) of all individuals, including veterans, dependents, and employees, and other sensitive information that is contained in temporary paper records is properly disposed of:

1. Definitions of Used in this Statement of Work.

a. VACIHCS. (VA Central Iowa Health Care System)

b. C.O. (Contracting Officer)

c. I.S.O. (Information Security Officer)

d. Contractor. (Vendor that is awarded contract)

e. P. O.C. (Point of Contact)

f. P.I.V. All contractor personnel who will perform services at the

VA facility must acquire VA identification through the VA's Personal Identification Verification (PIV) system. The contractor personnel shall always wear visible VA contractor identification while on VA premises. The documentation to obtain a PIV badge will be provided by VA to the contractor after award. Contractor personnel will be required to be fingerprinted to receive a PIV badge. Any cost associated with PIV cards (i.e. judication) is the responsibility of the contractor.

g. Administrative. Billing, reports, issues, and documents. This includes any document destruction certificates requested of subcontractors.

h. Subcontractor. Any person, or business that takes possession of VA documents, from the contractor up to final destruction.

i. Appendix A. Location and number of bins located at VACIHCS and other locations described in the document.

j. Appendix A2. Container Locations

k. Appendix B. Chain of Custody Log.

l. Appendix C. VA Directive 6371

m. PII; PHI and VA documents. PII is any information about an individual including, but not limited to, education, financial transactions, medical history, and criminal or employment history, and information which can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, biometric records, including any other personal information which is linked or linkable to an individual.

n. Certification of Destruction. Written documentation that attests to the completion of the destruction process after the final destruction, as defined by VA Directive 6371 and this SOW. The certification is not considered a valid certification of destruction if completed and submitted prior to the final destruction of the records. The certification must contain sufficient information to attest to the final destruction of the temporary paper records, the destruction method used’ where they were destroyed’ and who was responsible for their final destruction. A certificate of destruction shall be provided by the contractor to VA after every service.

i. If the final destruction is completed by an information destruction contractor, then the written certification of destruction must be completed by the information destruction contractor.

ii. If the final destruction is completed by a subcontractor to the information destruction contractor, then the written certification of destruction must be completed by this third party, or by the information destruction contractor, with assurance from the third party that final destruction was completed. The assurance can be in general terms describing the destruction method, date of destruction and amount destroyed, i.e., 75 bales of shredded material.

iii. Certificate of Destruction documents must be in paper form with inked signatures and presented to the C.O.R. within 30 days of the final destruction. Permission to use electronic signatures or emailed copies, of any documentation, must be in writing to the C.O.R. for approval.

o. Final Destruction. The process through which temporary paper records are pulped, macerated, shredded, or otherwise destroyed to a degree that definitively ensures that they are not readable or reconstruct able to any degree. If this final destruction is performed away from a VA facility it must be performed by an information destruction contractor (or its subcontractor of third party) who has demonstrated that

i. Its destruction process constitutes final destruction as defined in this SOW; and

ii. It has implemented reasonable physical safeguards to protect

VA documents during their transportation, transfer, or storage (e.g., more than 01 days) must be approved in advance and in writing by the C.O.R.

p. Interim Destruction. Any physical destruction process that substantially reduces the risk that PII, PHI, or other VA sensitive information will be disclosed during transport and storage as defined in this SOW.

q. Chain of Custody. A written means of tracking the records that have been marked for destruction throughout the entire destruction process until a certificate of destruction is received. Attachment B. Chain of Custody Log shall be used by contractor and subcontractor (See 1.

Definition as used in this SOW; h. attachment b) for documentation.

r. Document destruction services. Consist of physically collecting confidential papers from consoles located throughout the VACIHCS on a regularly scheduled basis, to be mutually determined by the contractor and VACIHCS.

s. The destruction of the records must be witnessed by a VA employee who is authorized to witness the destruction process.

2. Administrative.

a. Billing. The contractor shall submit one monthly bill for all services during the billing period no more than 30 days after services have been rendered. Upon written or verbal notice from the COR, billing issues shall be resolved within 5 business working days or email the COR with a firm date of resolution.

b. Documentation. shall be in paper form, with inked signatures, unless written permission is granted by the C.O.R. (i.e. certificate of destruction, chain of custody log).

c. Electronic signature capture. shall not be permitted unless written permission is granted by the COR. The COR shall provide the POC a list of names, of VA employees, authorized to sign documentation.

d. P.O.C. Contractor shall provide one single person to handle all billing, customer service requests, or personnel issues. The preferred signor of documentation is the COR.

e. Issuance of P.I.V. Cards. The POC shall ensure all onsite staff are issued a PIV card within 30 days of contract award. Written notification to the C.O.R. is required within 24 hours if an employee’s PIV card is lost, stolen or revoked.

f. Chain of Custody. The Chain of Custody Log, must be presented to the C.O.R. no more than 30 days after documents final destruction, must be the original document (emailed or copy documents are prohibited), and fully filled out by all parties who take possession or stores documents prior to final destruction.

g. Conference calls. The COR shall have the right to request a conference call to resolve customer service, billing or documentation issues. The COR shall give a 24- hour notice via email to discuss any ongoing issues with the POC, their supervisor or the individual solely responsible for this contract. If resolution cannot be resolved through the conference call, the COR shall inform the Contracting Officer, and schedule a conference call to seek resolution or understanding.

3. Onsite Staff.

a. CODE OF CONDUCT. All Visitors, Patients and staff are bound to the code of conduct.

This includes contractors and their subcontractors. Violations of the code of conduct will be reported to the contractor P.O.C. via email or phone call. Any onsite personnel who violate the Code of Conduct shall be subject to revocation of PIV card and access to VA property.

b. Parking violations. The driver is responsible for parking in appropriate parking according to VA parking policy. The driver of the vehicle will be responsible for any parking violations issued by VA Police. If a driver is issued a citation or parking violation of any sort (i.e. warning or ticket) the POC shall inform the COR within 24 hours.

c. Disruption. Onsite staff shall not disrupt patient care or operations during services.

d. PIV cards. Onsite staff are required to wear PIV cards, have them visible and above the waistline while performing services.

e. Onsite logbook. Onsite staff are required to report to the COR’s office to sign the vendor logbook.

f. Console breach. Onsite techs shall immediately report any breach of a console to the COR.

g. Contractor personnel. Any onsite staff performing document destruction services for VACIHCS including the collection, staging, destruction, and transportation of the material must have the following:

i. Outstanding customer service skills

ii. One-year experience working in health care environment

iii. Knowledge of maintenance and operability of equipment used to perform document destruction

iv. The contractor personnel will be required to check-in at the

Environmental Management Services (EMS) Office before every service. There, they will receive keys to gain access to permitted areas and shall return the keys after every service.

v. Dress shall consist of uniforms, khakis, or similar clothing along with work shoes. Jeans are not allowed.

vi. Smoking is prohibited inside any buildings at the VA.

Designated smoking areas shall be adhered to at all times.

vii. Possession of weapons or contraband is prohibited and shall subject contractor employee to arrest and termination from future performance under this contract. Violations of VA regulations may result in citation answerable in the United States (Federal) District Court, not a local district, state, or municipal court.

4. Service Coordinator.

i. Contractor shall work with the VA COR to coordinate a definitive schedule of services. The table below shows the locations where the consoles shall be located, the approximate number of consoles for each location, and the estimated schedule of services. The consoles shall be provided to VA by the contractor. The consoles shall remain the property of the contractor.

ii. Federal Holidays. Services days that fall on a Federal Holiday will need to be rescheduled with coordination of the COR. Typically, services will either be the day before or the day after the Federal Holiday. The ten Federal Holidays observed by VA are:

• New Years’s Day

• Matin Luther King’s Birthday

• Memorial Day

• Independence Day

• Labor Days

• Columbus Day

• Veterans Day

• Thanksgiving Day

• Christmas Day

iii. Emergency services calls may be placed by VA to the contractor during normal business hours (8:00 AM to 4:30 PM CST), Monday through Friday. A telephone response from the contractor shall be received by VA within four hours of the service call.

iv. When an emergency service is requested by VA, the contractor response time shall be within twenty-four hours or one workday from the time of the notification at no additional cost to the VA.

v. The following location required for pick up:

• VA Central IA Health System:

3600 30th Street, Des Moines, IA 50310

• Carrol VA Clinic: 311 S Clark St. Suite 275, Carroll, IA 51401

• Mason City VA Clinic: 478 Tiffany Drive, Mason City, IA 50401

• Ft. Dodge Mental Health Clinic:

530 South 25th Street, Fort Dodge, IA 50501

• VA Outreach Center (CRRC):

1223 Center Street Suite 17, Des Moines, IA 50309

• Marshalltown VA Clinic: 201 E Merle Hibbs Blvd.

Marshalltown, IA 50158

• Knoxville Va Clinic: 1607 North Lincoln Street, Knoxville, IA 50138

• Business and Fiscal Offices:

6200 Aurora Ave. (5th and 6th floor) Urbandale, IA 50322

• Southside Clinic: 1121 East Army Post Road, Des Moines, IA 50315

5. Console.

i. Each proposed security console shall be securable, floor standing, and key secured with a restricted receiving slot.

ii. Tote secure console. Should be approximately 96-gal wheeled container that has an attached lid and is lockable. The container should be stored onsite in a space delegated by the COR in case of off hour emergencies at no additional cost to the VA.

Container is subject to approval of the COR.

iii. Console keys shall only be provided to authorized VA employees at the discretion and approval of the VA COR. The COR shall maintain a listing of authorized VA employees.

iv. The number of consoles is an approximate and may vary throughout the period of performance of the contract. Console quantities may increase or decrease by 10% with no additional charge to VA.

v. Investigations. Any console that is breached, broken, or unsecured in any way, shall be subject to an investigation of the COR, ISO and VA Police. During this time the console shall be secured in a secure area and is off limits to any contractor or VA employees until the investigation is completed. The COR shall inform the POC of the investigation and the bin#, and upon completion of the investigation, the COR shall provide a summary of the investigation (if needed) and release the bin back to service. Techs may be required to provide a written statement to the VA Police, COR or ISO.

vi. Collection containers distributed throughout the VA facility must be secured in a manner that prohibits unauthorized individuals from accessing records identified for destruction. The containers must provide physical safeguards such as locks and be placed in secure areas. The contractor and VA shall coordinate the placement of the containers.

vii. Consoles. Console sizes and types required must meet all federal, state, and local regulation for paper collection. An example includes but is not limited to National Fire Protection Agency (NFPA). Consoles shall be provided and installed on contract start date.

6. Destruction of Documents. The destruction shall be accomplished by the contractor in one of two methods:

i. Offsite Final Destruction. An acceptable method offsite final destruction would be to shred the paper onsite to a minimum of 5/8 inch or less, and then take the shredded paper off-site to be pulped and recycled. If this methodology is used, the contractor shall provide the VA Contracting Officer Representative (COR) with an unbroken VA chain of custody throughout the destruction process, otherwise known as cradle to the grave. Offsite destruction is any other location other than on the VA facility.

ii. Onsite Final Destruction. Acceptable methods of onsite final destruction for all content would include burning, pulping, and/or macerating. In addition, shredding with a shredder device that has a crosscutting capability to produce particles that are no larger than one millimeter by five millimeters (1 x 5 mm) in size, or that will pulverize/disintegrate paper material using disintegrator devices with a 3/32-inchsecurity screen. Other means of final destruction may be approved by VA. Physically located on VACIHC property. Onsite destruction is physically located on the VA facility.

iii. A VA representative, upon request, shall be allowed to inspect a contractor's (and subcontractor's) facilities or vehicles where the records are processed, and destruction takes place.

iv. Any contractor who handles the records until final destruction shall be bonded and insured, for paper/printed media destruction, and can provide reasonable physical safeguards for the records throughout the destruction process.

7. Requirements of the Contractor:

i. The contractor shall dispose of all materials resulting from the destruction of the confidential documents by recycling.

Means of recycling must be approved by the COR. The contractor shall provide a properly executed and signed certificate indicating that the paper was recycled to the COR after every service.

ii. The contractor shall submit a monthly report of the amount of paper collected for that month to the VA COR. At the end of each year a report must be provided totaling the poundage destroyed by content type and location. Format to be approved by the COR for all reporting documents.

iii. Contractor Security Control Assessment (CSCA) shall be completed within thirty days of contract award and yearly on the renewal date of contract if an option year is awarded.

iv. The contractor shall maintain a Business Associated Agreement between all subcontractors. In addition, a Business Associate Agreement must be in place between the contractor and any off- site final destruction locations.

v. The contractor shall be responsible for maintaining liability insurance for the duration of the contract and for following all pertinent federal and state regulations regarding transportation and destruction of classified medical documentation.

8. Additional Security and Confidentiality Requirements.

i. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

ii. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d)(l).

iii. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment.

9. Security Incident Investigation.

i. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.

The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

ii. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

B.4 IT CONTRACT SECURITY

1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.

2. VA INFORMATION CUSTODIAL LANGUAGE.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG), and/or Government Accountability Office (GAO) staff during periodic control assessments, audits, or investigations.

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements.

The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO (ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality- assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above- mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to this paragraph will only be granted with the written approval of the VA CO.

3.ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS.

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees and subcontractors only to the extent necessary to perform the services specified in the solicitation or contract. This includes indirect entities, both affiliate of contractor/subcontractor and agent of contractor/subcontractor.

b. Contractors and subcontractors shall sign the VA Information Security Rule of Behavior (ROB) before access is provided to VA information and information systems (see Section 4, Training, below). The ROB contains the minimum user compliance requirements and does not supersede any policies of VA facilities or other agency components which provide higher levels of protection to VA’s information or information systems. Users who require privileged access shall complete the VA elevated privilege access request processes before privileged access is granted.

c. All contractors and subcontractors working with VA information are subject to the same security investigative and clearance requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors shall be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office of Human Resources and Administration/Operations, Security and Preparedness (HRA/OSP) is responsible for these policies and procedures. Contract personnel who require access to classified information or information systems shall have an appropriate security clearance. Verification of a Security Clearance shall be processed through the Special Security Officer located in HRA/OSP.

Contractors shall conform to all requirements stated in the National Industrial Security Program Operating Manual (NISPOM).

d. All contractors and subcontractors shall comply with conditions specified in VAAR 852.204- 71(d); Contractor operations required to be in United States. All contractors and subcontractors working with VA information must be permanently located within a jurisdiction subject to the law of the United States or its Territories to the maximum extent feasible. If services are proposed to be performed abroad the contractor must state where all non-U.S. services are provided. The contractor shall deliver to VA a detailed plan specifically addressing communications, personnel control, data protection and potential legal issues. The plan shall be approved by the COR/CO in writing prior to access being granted.

e. The contractor shall notify the COR/CO in writing immediately (no later than 24 hours) after personnel separation or occurrence of other causes. Causes may include the following:

(1) Contractor/subcontractor personnel no longer has a need for access to VA information or VA information systems. (2) Contractor/subcontractor personnel are terminated, suspended, or otherwise has their work on a VA project discontinued for any reason.

(3) Contractor believes their own personnel or subcontractor personnel may pose a threat to their company’s working environment or to any company- owned property. This includes contractor-owned assets, buildings, confidential data, customers, employees, networks, systems, trade secrets and/or VA data.

(4) Any previously undisclosed changes to contractor/subcontractor background history are brought to light, including but not limited to changes to background investigation or employee record.

(5) Contractor/subcontractor personnel have their authorization to work in the United States revoked.

(6) Agreement by which contractor provides products and services to VA has either been fulfilled or terminated, such that VA can cut off electronic and/or physical access for contractor personnel.

f. In such cases of contract fulfillment, termination, or other causes; the contractor shall take the necessary measures to immediately revoke access to VA network, property, information, and information systems (logical and physical) by contractor/subcontractor personnel. These measures include (but are not limited to): removing and then securing Personal Identity Verification (PIV) badges and PIV – Interoperable (PIV-I) access badges, VA-issued photo badges, credentials for VA facilities and devices, VA-issued laptops, and authentication tokens.

Contractors shall notify the appropriate VA COR/CO immediately to initiate access removal.

g. Contractors/subcontractors who no longer require VA accesses will return VA- issued property to VA. This property includes (but is not limited to): documents, electronic equipment, keys, and parking passes. PIV and PIV-I access badges shall be returned to the nearest VA PIV Badge Issuance Office. Once they have had access to VA information, information systems, networks and VA property in their possessions removed, contractors shall notify the appropriate

VA COR/CO.

4. TRAINING.

TMS 10176 Infosec/ROB

TMS 20939 No Access

a. All contractors and subcontractors requiring access to VA information and VA information systems shall successfully complete the following before being granted access to VA information and its systems:

(1) VA Privacy and Information Security Awareness and Rules of Behavior course (Talent Management System (TMS) #10176) initially and annually thereafter. (2) Sign and acknowledge (electronically through TMS #10176) understanding of and responsibilities for compliance with the Organizational Rules of Behavior, relating to access to VA information and information systems initially and annually thereafter; and

(3) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system or information access [to be defined by…