S02_Attachment 1_Statement of Work_STX Document Destruction Services_Amended SOW 11 Jun 2020 Romano.pdf

Statement of Work

36C25720Q0248

Attachment 1

STX Document Destruction Services

Revised June 11, 2020

1. General. Contractor required to provide secured collection, staging, shredding and recycling of paper documented confidential and sensitive information from the STVHCS designated locations. The Government shall not exercise any supervision or control over the contract service providers performing the services herein.

Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the

Government.

1.1. Description of Services / Introduction: The contractor shall furnish all necessary equipment, labor, and material to meet collection, staging, shredding, and disposal recycling services as outlined in this SOW.

CONTRACTOR SHALL ENSURE COMPLIANCE WITH ALL STATE, FEDERAL AND LOCAL

REGULATIONS AND LAWS. EMPLOYEES PROPOSED TO PERFORM WORK UNDER THE

CONTRACT MUST MEET ALL STATE, FEDERAL AND LOCAL REGULATIONS AND LAWS

INCLUDING BUT NOT LIMITED TO LICENSING, EDUCATION AND QUALIFICATION

REQUIREMENTS FOR THE TYPE OF SERVICES TO BE PERFORMED.

The Contractor must ensure employees proposed to perform work under the contract are not listed on the Health and Human Services-Office of Inspector General (HHS/OIG), List of Excluded Individuals/Entities on the OIG

Website (www.hhs.gov/oig).

1.1.1. Contractor qualifications. The contractor is required to be certified as a National Association for Information Destruction (NAID) document destruction service provider. The contractor is responsible for meeting minimum performance standard in this statement of work in accordance with

VA Directive 6371, dated April 8, 2014.

1.2. Invoicing: The contractor shall submit invoices in whole monthly increments in arrears. The invoicing period of performance shall start on the first day of the month and end on the last day of the month.

1.3. Collection sites. The contractor shall furnish all necessary equipment, labor and material to furnish complete secure shredding and disposal recycling services for the Department of Veterans Affairs (VA), South

Texas Veterans Health Care System (STVHCS). Services will be provided at the following locations:

• Audie L. Murphy, 7400 Merton Minter, San Antonio, TX 78229.

• Frank Tejeda OPC, 5788 Eckhert Rd, San Antonio, TX 78240.

• Balcones Heights OPC, San Antonio, TX 78201.

• North Central Federal OP Clinic, 17440 Henderson Pass, San Antonio, TX 78232.

• Shavano Park OPC, 4350 Lockhill Selma Ste. 200, San Antonio, TX 78249.

• Datapoint OP Clinics, 8410 Datapoint, San Antonio, TX 78229

• One Technical Building, 7411 John Smith, San Antonio, TX 78229.

• Kerrville Campus, 3600 Memorial Blvd, Kerrville, TX 78028.

• VA Villa Serena, 4455 Horizon Hill, San Antonio, TX 78229.

• Plaza Lecea, 5441 Babcock Rd, San Antonio, TX 78240.

• Bluff Creek OPC, 4210 Medical Dr., Ste. 280, San Antonio, TX 78229.

http://www.hhs.gov/oig

Attachment 1

• South Bexar OPC, 4610 E. Southcross, San Antonio, TX 78222.

• Victoria OPC, 1502 E. Airline #40, Victoria, TX 77901.

• Polytrauma Rehabilitation Program (PTRP) Facility, 4949 Gus Eckhert, San Antonio, TX 78240

• Fisher House, 7485 Wurzbach Rd, San Antonio, TX 78229.

• VA Oncology Clinic, 9102 Floyd Curl Dr., San Antonio, TX 78240.

• VA Veteran Center, 35 North, Ste 214, San Antonio, Tx 78233.

• North Bexar OPC, 16109 Nacogdoches Rd, San Antonio, TX 78247

1.3.1. Facility elevators. Freight elevators are available and must be used at Audie L. Murphy and Kerrville campus. Passenger elevators are available for contractor use at all locations. However, contractor must use freight elevators where available.

1.3.2. Loading docks, ramps, parking areas.

1.3.2.1. Loading docks. Loading docks are present at a few locations. Contractor may use as needed.

1.3.2.2. Ramps. Ramps are present at a few locations. Contractor may use as needed.

1.3.2.3. Parking areas. Parking, loading and unloading areas are available for contractor use. These areas are NOT specifically marked or identified for contractor use. The contractor shall coordinate with contracting officer representative for exact parking, loading and unloading areas.

1.3.2.4. Storage and staging area. The contractor is permitted to stage additional cabinets or bins in the pipe space located at Audie L. Murphy below the ground floor. Storage and staging area is also available at

Kerrville Campus. In both cases, the contractor shall coordinate with contracting officer representative for exact location of authorized staging area.

1.4. Historical data, frequency and facility cabinet quantity. Historical pounds per month data found in table 1 is provided as estimates only and does not reflect exact weights collected by the contractor.

Table 1

STVHCS Facility Estimated lbs. per Month

Audie L. Murphy 38,280

Frank Tejeda OPC 3240

North Central Federal Clinic (NCFC) 1560

One Technical Bldg 1680

Balcones Heights OPC 120

Attachment 1

Shavano Park OPC 120

Data Point Outpatient Clinics 660

Kerrville Campus 3420

VA Villa Serena 180

Plaza Lecea Office Bldg 180

Bluff Creek OPC 120

South Bexar County OPC 500

Victoria OPC 600

Polytrauma Transitional Rehabilitation Program (PTRP)

Facility

VA Radiation Oncology Clinic 100

Fisher House 60

VA Veteran Center 100

North Bexar OPC 100

1.4.1. Collection frequency. Contractor shall provide collection service at all locations on the frequency identified in table 2. Off schedule service requirements are outlined in paragraph 2.1.4.

Table 2

STVHCS Facility Collection

Frequency Collection Day

Audie L. Murphy – 1st floor Daily Monday - Friday

Audie L. Murphy - Grnd floor & Police Srvc Once per 7 days Monday

Audie L. Murphy - 2nd floor & 3rd floor Once per 7 days Tuesday

Audie L. Murphy - 4th floor & 5th floor Once per 7 days Wednesday

Audie L. Murphy - 6th floor & 7th floor Once per 7 days Thursday

Frank Tejeda OPC Once per 7 days Monday

One Technical Bldg Once per 7 days Monday

North Central Federal Clinic (NCFC) Once per 7 days Thursday

Victoria OPC Once per 14 days Monday

Attachment 1

Bluff Creek OPC Once per 14 days Tuesday

Plaza Lecea Office Bldg Once per 14 days Tuesday

Polytrauma Transitional Rehabilitation

Program (PTRP) Facility Once per 14 days Tuesday

VA Villa Serena Once per 14 days Tuesday

Fisher House Once per 14 days Wednesday

South Bexar County OPC Once per 14 days Wednesday

VA Radiation Oncology Clinic Once per 14 days Wednesday

VA Veteran Center Once per 14 days Wednesday

Balcones Heights OPC Once per 14 days Thursday

Data Point Outpatient Clinics Once per 14 days Thursday

Shavano Park OPC Once per 14 days Thursday

North Bexar OPC Once per 14 days Thursday

Kerrville Campus Once per 14 days Friday

1.4.2. Facility cabinet quantities. Contractor shall provide document destruction cabinet and bin quantities identified in table 3. The exact locations of cabinets and bins are found in Appendix A.

Table 3

STVHCS Facility Qty - 30 GAL Qty - 64 GAL Qty - 96 GAL

Audie L. Murphy 281 8 2

Frank Tejeda OPC 26

Balcones Heights OPC 2 1

North Central Federal Clinic (NCFC) 14

Shavano Park OPC 2

Data Point Outpatient Clinics 11

One Technical Bldg 16 1

Kerrville Campus 44

VA Villa Serena 3

Plaza Lecea Office Bldg 2 3

Bluff Creek OPC 4

South Bexar County OPC 2 1

Victoria OPC 10

Polytrauma Transitional Rehabilitation Program

(PTRP) Facility

VA Radiation Oncology Clinic 2

Fisher House 1

Attachment 1

VA Veteran Center 1

North Bexar OPC 2 1

425 8 9

Table 4

STVHCS Facility Frequency

Total

Annual

Containers

Serviced

Audie L. Murphy VA Medical Center - 1st floor - 92 ea

30 gallon

Daily: Monday -

Friday 23920

Audie L. Murphy VA Medical Center - 1st floor - 4 ea

64 gallon

Daily: Monday -

Friday

Audie L. Murphy VA Medical Center - Ground floor and Police Service (Bldg 4) - 59 ea 30 gallon Every 7 days 3068

Audie L. Murphy VA Medical Center - Ground floor and Police Service (Bldg 4) - 2 ea 64 gallon Every 7 days 104

Audie L. Murphy VA Medical Center - Ground floor and Police Service (Bldg 4) - 1 ea 96 gallon Every 7 days 52

Audie L. Murphy VA Medical Center - 2nd and 3rd floor - 77 ea 30 gallon Every 7 days 4004

Audie L. Murphy VA Medical Center - 2nd and 3rd floor - 1 ea 64 gallon Every 7 days 52

Audie L. Murphy VA Medical Center - 2nd and 3rd floor - 1 ea 96 gallon Every 7 days 52

Audie L. Murphy VA Medical Center - 4th and 5th floor - 25 ea 30 gallon Every 7 days 1300

Audie L. Murphy VA Medical Center - 4th and 5th floor - 1 ea 64 gallon Every 7 days 52

Audie L. Murphy VA Medical Center - 6th and 7th floor - 28 ea 30 gallon Every 7 days 1456

Frank Tejeda Outpatient Clinic - 27 ea 30 gallon Every 7 days 1404

Balcones Heights Outpatient Clinic - 2 ea 30 gallon Every 14 days 52

Balcones Heights Outpatient Clinic - 1 ea 96 gallon Every 14 days 26

North Central Federal Clinic - 14 ea 30 gallon Every 7 days 728

Shavano Park Outpatient Clinic - 2 ea 30 gallon Every 14 days 52

Datapoint Outpatient Clinics - 11 ea 30 gallon Every 14 days 286

One Technical Bldg - 16 ea 30 gallon Every 14 days 416

One Technical Bldg - 2 ea 96 gallon Every 14 days 52

Attachment 1

Kerrville Campus - 44 ea 30 gallon Every 14 days 1144

Villa Serena - 3 ea 30 gallon Every 14 days 78

Plaza Lecea Office Bldg - 3 ea 30 gallon Every 14 days 78

Plaza Lecea Office Bldg - 2 ea 96 gallon Every 14 days 52

Bluff Creek Outpatient Clinic- 4 ea 30 gallon Every 14 days 104

South Bexar Outpatient Clinic - 2 ea 30 gallon Every 14 days 52

South Bexar Outpatient Clinic - 1 ea 96 gallon Every 14 days 26

Victoria Outpatient Clinic - 10 ea 30 gallon Every 14 days 260

Victoria Outpatient Clinic – 1 ea 96 gallon Every 14 days 26

Polytrauma Rehab Program Facility - 2 ea 30 gallon Every 14 days 52

Fisher House - 1 ea 30 gallon Every 14 days 26

VA Radiation Oncology Clinic - 2 ea 30 gallon Every 14 days 52

North Bexar Outpatient Clinic - 2 ea 30 gallon Every 14 days 52

North Bexar Outpatient Clinic - 1 ea 96 gallon Every 14 days 26

1.5. Phase-in and Phase-Out of New Contractor. The Contracting Officer’s Representative (COR), Contracting Officer (CO), incumbent contractor and new contractor will coordinate the phase-out and phase-in of secured containers. The phase-out and phase-in period shall be accomplished prior of the start of the period of performance, unless otherwise authorized by the CO. Installation of all containers shall proceed in accordance with the accepted phase-out and phase-in schedule. The new contractor will submit the schedule for acceptance to the COR. The COR will ensure to provide to old contractor for any inputs, concerns, or unavailable dates. The CO will intervene as necessary to ensure a smooth transition. No area, room or location will be without a container by close of first day of period of performance.

2. Scope of Work. The contractor shall be responsible ensuring their proposed service solution(s) will effectively achieve performance requirements.

Contractor shall provide complete secured collection, shredding, disposal or recycling of paper and other documents generated through the sensitive document paper-recycling program or an alternative method of verifiable document destruction at the locations identified herein. The contractor shall be in compliant with most recent VA Directive 6371 Transmittal Sheet, April 8, 2014, for the “Destruction of Temporary Paper

Records.”

The contractor shall perform interim destruction of all material on site prior to leaving the area. Interim destruction is a reasonable physical safeguard that affords an additional layer of security for temporary paper

Attachment 1 records once they are identified for destruction. This may be while they are stored at a VA location awaiting final destruction or when they are removed from VA custody until final destruction is completed at an off-site location. It is generally accomplished through maceration, chopping, pulverization, or shredding where these processes do not render the material unreadable or where the material could be reconstructed.

A final destruction certificate or manifest from the destruction company shall be provided in an electronic monthly report identifying date collected, date destructed and facility location to the COR.

Contractor must also document and provide in an electronic weekly report to the COR of all containers serviced during each pick-up to validate all containers at each facility are being serviced. This report is due by 4:00 pm

CST on the first available duty day following weekly service.

White or colored paper and reams of paper can be placed into the collection containers for shredding and recycling. Contractor shall submit any limitations on items that can be included for shredding and recycling in this system, but it is expected that compact discs, paper clips, and staples can be placed in collection containers.

Evaluation of the restrictions shall be considered in award of the contract. Specification of what items shall be included in the collection/destruction shall be decision of the COR.

2.1. Collection schedule. The Contractor assumes all responsibility for the routine collection, in-house transportation, and storage of materials in accordance with collection schedule listed in table 2.

Storage or staging locations will be permitted upon approval of the COR at the Audie L. Murphy campus and the Kerrville campus. Contractor may store bins for the collection of documents from consoles prior to interim destruction being performed at COR approved locations. All bins are required to be locked and stored inside the approved storage location.

2.2. Containers. Contractor shall furnish all necessary containers and labor for individual generators collection of sensitive documents and recycling. The contactor shall provide lockable containers for the quantities and locations listed in Appendix A for use throughout the period of performance. All containers are to be in serviceable condition and compliant with HIPPA regulations and NFPA standards. Any containers deemed unserviceable by the COR shall be removed and replaced at no additional cost to the government.

All containers shall have posted on the exterior a listing of materials that can be deposited. Contractor shall provide replacement containers and/or material listing (to be posted on the containers) when damaged or broken due to normal fair wear and tear or change in collection practice.

Keys shall only be provided to the facility COR and the contractor.

All containers shall have a slot to insert paper and equipped with a locking mechanism allowing for opening by an identical key. A total of 15 keys shall be provided to the COR so that containers can be accessed by the government when necessary.

Attachment 1

Containers shall be cleaned inside and out quarterly and as needed if liquids or other inappropriate items are deposited within.

Contractor shall ensure security of contents from the point of collection to final destruction. Shredding is to be performed on-site, the Contractor shall leave exterior area where mobile shredder is used clean and free of any debris from their work/visit.

3. Hours of Operation. Services are expected to be performed between the hours of 8:00 AM and 4:00 PM

CST, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. In the event the scheduled pick-up falls on a holiday the contractor shall provide service the next business day.

3.1. Recognized Holidays. The Contractor shall ensure holidays are reflected in the schedules. The Contractor is not required to provide routine services on the following approved holidays:

- New Year’s Day - 1 January

- Martin Luther King Day - 3rd Monday in January

- Washington’s Birthday - 3rd Monday in February

- Memorial Day - last Monday in May

- Independence Day - 4 July

- Labor Day - 1st Monday in September

- Columbus Day - 2nd Monday in October

- Veteran’s Day - 11 November

- Thanksgiving Day - 4th Thursday in November

- Christmas Day - 25 December

If a holiday falls on a Saturday, the preceding Friday will be observed. If a holiday falls on Sunday, the following Monday will be observed. If a holiday falls on a scheduled service day, the Contractor will be responsible for rescheduling services for the first day after the holiday observance.

4. Security Requirements:

a. A prohibition on unauthorized disclosure: “Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without prior written agreement of the VA.”

b. A requirement for data breach notification: “Upon discovery of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor has access, the contractor shall immediately and

Attachment 1 simultaneously notify the COR, the designated ISO, and Privacy Officer for the contract. The term ‘security incident’ means an event that has, or could have, resulted in unauthorized access to, loss, or damage to VA assets, or sensitive information, or an action that breaches VA security procedures.”

c. A requirement to pay liquidated damages in the event of a data breach: “In the event of a data breach or privacy incident involving any Sensitive Personal Information (SPI) the contractor processes or maintains under this contract, the contractor shall be liable to the VA for liquidated damages for a specified amount per affected individual to cover the cost of providing credit protection services to those individuals.”

5. Information Security Requirements

5.1. General

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and

Handbooks as VA and VA personnel regarding information and information system security.

5.2. Access to VA Information and VA Information Systems

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and

VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

5.3. VA Information Custodial Language

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause

Attachment 1 expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data

- General, FAR 52.227-14(d) (1).

b. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

c. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

5.4. Security Incident Investigation

a. The term "security incident" means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor's notice to

VA shall identify the information involved, the circumstances surrounding the incident

(including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other

Attachment 1 compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

5.5. Liquidated Damages for Data Breach

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a "security incident" as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis.

Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

(1) Nature of the event (loss, theft, unauthorized access);

(2) Description of the event, including:

(a) Date of occurrence;

(b) Data elements involved, including any PU, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or potentially affected;

(4) Names of individuals or groups affected or potentially affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text;

(6) Amount of time the data has been out of VA control;

(7) The likelihood that the sensitive personal information will or has been compromised

(made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensitive personal information, if any;

(9) Assessment of the potential harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

Attachment 1

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $_37.50 per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

(1) Notification; Document Destruction Services

(2) One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution;

(5) One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5.6. Information Security and Privacy Training

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems;

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, VA Handbook

6500.6, Appendix E relating to access to VA information and information systems;

(2) Successfully complete the Privacy and Information Security Awareness and Rules of Behavior training and annually complete required security training;

(3) Successfully complete the appropriate VA Privacy and HIPAA training and annually complete required privacy training; and

(4) Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document - e.g., any role based information security training required in accordance with NIST Special Publication 800- 16, Information Technology Security Training

Requirements.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

5.7. Security Requirements for Unclassified Information Technology Resources

The contractor, their personnel, and their subcontractors shall be subject to the Federal laws, Attachment 1 regulations, standards, and VA Directives and Handbooks regarding information and information system security as delineated in this contract.

5.8. Security Accreditation Package

The C&A requirements do not apply, and a Security Accreditation Package is not required.

6. Compliance with Hospital Policies and Procedures. Contractor’s shall adhere to all hospital policies and procedures related to non-smoking except in designated areas and the requirement for using I.D. badges. In addition, the contractor must also adhere to the Information Security, Records Management and Privacy local and national policies prescribed herein:

Information Systems Officer, Information Protection: The contractor shall not have access to VA desktop computers nor shall they have access to online resources belonging to the government while conducting services in the application of complex adaptive systems theory to health care organizations.

The certification and accreditation requirements do not apply to this procurement nor is a security accreditation package required.

Privacy Officer: The contractor shall have access to Patient Health Information (PHI) and shall have the capability of accessing patient information during the services provided to the VA. All documents accessible to the Contractor shall be de-identified through the destruction of the sensitive information which is the purpose of this contract.

Records Manager: The following standard Items relate to records generated in executing this contract and should be included:

a. Contractor shall comply with all applicable records management laws and regulations, as well as

National Archives and Records Administration (NARA) records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII

Subchapter B, and those policies associated with the safeguarding of records covered by the Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion.

b. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C.

chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended and must be managed and scheduled for disposition only as permitted by statute or regulation.

c. In accordance with 36 CFR 1222.32, Contractor shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must be managed in accordance with Federal law. Electronic records and

Attachment 1 associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data.

d. STVHCS and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of

STVHCS or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701.

In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractor must report to STVHCS. The agency must report promptly to NARA in accordance with 36

CFR 1230.

e. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to STVHCS control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. Destruction of records is EXPRESSLY PROHIBITED unless in accordance with Paragraph

(4).

f. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The

Contractor (and any sub-contractor) is required to abide by Government and STVHCS guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

g. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with STVHCS policy.

h. The Contractor shall not create or maintain any records containing any non-public STVHCS information that are not specifically tied to or authorized by the contract.

i. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

Attachment 1

j. The STVHCS owns the rights to all data and records produced as part of this contract. All deliverables under the contract are the property of the U.S. Government for which STVHCS shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR

52.227-11 through FAR 52.227-20.

k. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take VHA-provided records management training, Talent Management

System (TMS) Item #10176, Privacy and Information Security, Rules of Behavior. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

7. Additional Service Requirements.

All VA sensitive information that is contained in paper records shall be handled by the most secure, economical, and effective means in accordance with legal requirements. Patient Identifiable Information (PII) is the most common form of sensitive information handled at VA; therefore, it requires the use of extraordinary procedures for its protection. PII that is not properly disposed of can result in actual or potential identity theft and cause personal hardship to the subject individuals. It is imperative that the appropriate means of destruction be used for all VA temporary paper records. VA’s preference is for a method of destruction that permits paper records to be recycled, while still meeting the requirements for final destruction. Procedures for the destruction of these records are identified in this document and outlined in VA Directive 6371.

8. Key Personnel. The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the Contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 7:00 a.m. to 3:30p.m., Monday thru

Friday except Federal holidays or when the Government facility is closed for administrative reasons. The

Contractor Representative’s name and telephone number must be provided by the contractor with the proposal.

All contract personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed. Third parties must be able to identify that contractor personnel are employed by the contractor.

Contractor shall have identifiable company uniforms or company ID badges.

9. Required Document Submittals. The contractor shall submit the following reports or documentation.

Attachment 1

a. Contractor must document and provide in an electronic weekly report to the COR of all containers serviced during each pick-up to validate all containers at each facility are being serviced. This report is due by 4:00 pm on the first available duty day following weekly service.

b. Weight ticket shall be provided in a monthly report by the 10th of each month identifying date, and facility location to the COR.

c. Contractor must, prior to departing the VA location, provide the COR or designated VA representative with documentation that acknowledges interim destruction and receipt of the temporary paper records.

d. A final destruction certificate or manifest from the destruction company shall be provided in a monthly report by the 10th of each month identifying date collected, date destructed and facility location to the COR.

10. Post Award Conferences or Periodic Progress Meetings. The Contractor shall attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal

Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the

Contractor's performance. At these meetings the contracting officer will apprise the Contractor of how the

Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the Government.

11. Quality Control. The contractor shall establish and maintain a complete Quality Control Plan to ensure the requirements of the contract are provided as specified.

The quality control plan shall comply with the requirements of FAR 52.246.4, Inspection of Services—Fixed

Price. The plan shall include the following:

a. An inspection system covering all the services specified in this PWS; must specify the areas to be inspected on a scheduled or unscheduled basis, how often inspection will be accomplished, and the title of the individual (s) who will perform the inspections.

b. The methods for identifying and preventing defectives in the quality of service performed before performance becomes unacceptable.

c. On-site records of all inspections conducted by the contractor and necessary corrective action taken.

This documentation shall be made available to the government during the term of the contract.

12. Government Review. The government will review the Contractor Quality Control Plan (QCP) to determine if it is adequate. If the plan is adequate, the government will accept the plan. If the plan is not adequate as submitted, the deficiencies will be identified to the contractor in writing. The contractor shall correct all

Attachment 1 identified deficiencies and submit a corrected Contractor Quality Control Plan within ten working days or contract start date, whichever is sooner. The government will also periodically review the way the contractor is conducting the quality control program by either reviewing the contractor's records, observing actual performance or both.

Appendix A – Container Locations

Audie L. Murphy - Ground Floor

RM # TYPE RM # TYPE

L010.1 1 30G GB127 1 30G

L031 1 30G FB032 1 30G

L001.3 1 30G H030 (sterile area) 1 30G

039.4 1 30G E009 1 30G

H017 1 30G E004 1 30G

038 1 64G C008 1 30G

H016 1 30G C006 1 30G

J002 1 30G C004 1 30G

J003 1 30G C012.1 1 30G

035 (Dish Rm) 1 64G C015 1 30G

H001.1 1-30G C035.1 1 30G

G003 1 30G C043 1 30G

G009 1 30G C021 1 30G

G011 2 30G D035 (Nurse Sta.) 1 30G

G011.2 2 30G D018 1 30G

PT001.2 1 30G GLA 1 30G

PT25.4 1 30G B009.8 (GLC) 1 30G

PT005 1 30G 1B109 1 30G

031 1 30G 1B112.2 1 30G & 1-96

F011.2 1 30G 1B112.11 1 30G

F011.8 1 30G 1A104 1 30G

F009 1 30G 1A144 2 30G

Attachment 1

GB105 3 30G 1A129 1 30G

GB013 (EMS) 1 30G 1C112 1 30G

FB030 1 30G 1C113 1 30G

GB126

(Warehouse) 2 30G 1C116 1 30G

FB031 1 30G 2A143 2 30G

Audie L. Murphy - 1st Floor

Svc Elevators 1 30G Z103 1 30G

S102.3 1 30G H111 1 30G

ER 144.1

(Admitting) 1 30G H117.5 1 30G

ER Nurses Station 1 30G H118.5 1 30G

ER V109 1 30G I100 1 30G

HR Admin 1 64G H102.1 1 30G

HR X113 2 30G & 2 64G H128 1 30G

HR X107 1 64G PT 117 (PM&R) 1 30G

X112 (Agency

Cashier) 1 30G PT101 (Lobby) 1 30G

124 (Public Rel.) 1 30G PT101.1 1 30G

Main Lobby 1 30G PT 161 1 30G

OEF/OIF 1 30G PT180 1 30G

Y102.3 (VCS

Store)

1 30G PT133.2 1 30G

Building 4 1 30G 117 2 30G

Q114 1 30G B102.1 1 30G

N126 2 30G B110 1 30G

Travel (@N126) 2 30G A134 1 30G

J118.7 1 30G A137 1 30G

Attachment 1

J110 1 30G A118 1 30G

J106 1 30G 107 1 30G

J103 2 30G E100.1 1 30G

Q107 1 30G E133 1 30G

Q108 1 30G C101 1 30G

124 1 30G C112 1 30G

127 1 30G C127 1 30G

U105 (Out

Pharmacy) 3 30G C125 1 30G

131 (Blood Draw) 1 30G D123 1 30G

132 (BD) 1 30G D125 1 30G

P140 (In Patient

Pharm) 4 30G D104.1 1 30G

P121 1 30G D102 1 30G

P117 1 30G G100.9 1 30G

P115 1 30G G100.1 1 30G

P&LMS (T112.3,

T107, T111) 6 30G G107 1 30G

T106 (Blood

Bank) 1 30G G116 1 30G

T119 2 30G G135 1 30G

T118 1 30G G122 1 30G

Z102 1 30G K101 2 30G

H110 1 30G M101 1 30G

Audie L. Murphy - 2nd Floor

RM # TYPE RM# TYPE

P207 1 30G Z221 1 30G

P209 1 30G E206 1 30G

P209.6 1 30G E224 1 30G

W202 1 30G C235 1 30G

Attachment 1

Q202 1 30G C208 1 30G

250 1 30G C214 1 30G

M203.2 1 30G C219 1 30G

M204.3 1 30G C223 (in SICU) 1 30G

M212 1 30G SICU 3 30G

L213 1 30G A237 1 30G

K203 1 30G A227 1 30G

K202 1 30G A226 1 30G

237 1 30G A233 1 30G

F203 1 30G A201 1 30G

N204 (Surgery

Nurse Station) 2 30G A248.1 (Behind Door) 1 30G

N225 1 30G A209 1 30G

232 1 30G A219 1 30G

E218 1 30G 220 (Pain Clinic) 1 30G

F205 (Outpatient

Surgery) 1 30G

227 (Pharmacy

Residence) 1 30G

N239 (PACU) 1 30G H208 1 30G

Z201 1 30G H212 1 30G

Z202 1 30G PT 249 1 30G

Audie L. Murphy - 3rd Floor

B317 1 30G D315 1 30G

B318 1 30G D316 3 30G

B321 1 30G D317.1 1 30G

B329 1 30G & 1-64G E301 2 30G

B332 1 30G E302 1 30G

A304.10 1 30G E305 1 30G

C340 1 30G F300 2 30G

Attachment 1

C331 1 30G F308 1 30G

C324 1 30G F308.1 1 30G

C317 1 30G E307 1 30G

D300 1 30G C316.1 1 30G

D310 1 30G C312.2 1 30G

D311.4 1 30G & 1-96G C311.3 1 30G

C300 1 30G

Audie L. Murphy - 4th Floor

D403 1 30G D412 1 30G

D404 1 30G A433 1 30G

D405 1 30G A407 2 30G

D406 1 30G B405 1 30G

D408 1 30G B408 1 30G

D411.1 1 30G B415 1 30G

C406.1 2 30G

Audie L. Murphy - 5th Floor

A507 1 30G C508.6 1 30G

A512 1 30G C508.18 1 30G

B507 1 30G C512 1 30G

B515 1 30G C516 1 30G

B515.2 1 30G MICU Clerk 1 30G

Break Room 1 64G

Audie L. Murphy - 6th Floor

Attachment 1

C608 1 30G A613 1 30G

C639.1 1 30G A635 1 30G

C639.2 1 30G A636 1 30G

C624 1 30G A637 1 30G

C648.4 1 30G B605 1 30G

A606 1 30G B609 1 30G

B615 1 30G

Audie L. Murphy - 7th Floor

D710.1 1 30G A706 1 30G

D710.7 1 30G A703 2 30G

E703 1 30G A750 1 30G

E708 1 30G A721 1 30G

E716.1 1 30G B703 1 30G

E716 1 30G B701 1 30G

E718 1 30G B710 1 30G

Audie L. Murphy Totals

TOTAL 96G 2

TOTAL 64G 8

TOTAL 30G 281

TOTAL 291

SHAVANO PARK VA OUTPATIENT CLINIC

240 1 30G 241.1 1 30G

TOTAL 30G 2

BALCONES HEIGHTS VA OUTPATIENT CLINIC

S104 1 30G G101 1 30G

Attachment 1

S104 1 96G

TOTAL 96G 1

BLUFF CREEK VA OUTPATIENT CLINIC

260 2 30G 280 2 30G

TOTAL 30G 4

VA VILLA SERENA BLDG

L128 1 30G 202.12 1 30G

R154 1 30G

TOTAL 30G 3

NORTH BEXAR VA OUTPATIENT CLINIC

2 30G 1 96G

VA ONCOLOGY CLINIC

RM # TYPE

NO RM# 2 30G

VICTORIA VA CLINIC

150.43 1 30G 150.5 1 30G

150.34A 1 30G 150.43B 1 96G

150.2 2 30G 150.19 1 30G

Attachment 1

150.2 1 30G 150.40 1 30G

150.22 1 30G 150.41 1 30G

TOTAL 30G 10

DATA POINT VA CLINIC

130.1 1 30G 305 1 30G

150.17 1 30G 307 1 30G

150.25 1 30G 338 1 30G

253 1 30G 325 1 30G

222 1 30G 201 1 30G

206 1 30G

TOTAL 30G 11

NORTH CENTRAL FEDERAL VA CLINIC

175 1 30G 188.1 1 30G

158 1 30G 102.2 2 30G

142 3 30G 103 1 30G

121.0 1 30G 101.3 2 30G

112 1 30G 119 1 30G

TOTAL 30G 14

ONE TECH BLDG

120.1 1 30G 404.3 2 96G

110.4 1 30G 404.5 1 30G

108 1 30G 404 1 30G

104.2 1 30G 700 1 30G

Attachment 1

402.0 1 30G 700.13 1 30G

206 1 30G 1205 1 30G

201 1 30G 1205.14 1 30G

400 1 30G 1210 1 30G

400.9 1 30G

TOTAL 30G 16

VA Veteran Clinic

NO RM# 1 30G

TOTAL 30G 1

KERRVILLE VA HOSPITAL

004 1 30G 324 1 30G

1A-116 1 30G 332 1 30G

021A 1 30G 340 1 30G

2B-104A 1 30G 347 1 30G

2B137 1 30G 363 1 30G

1 30G 382 1 30G

105A 1 30G 386 1 30G

109A 1 30G 415 1 30G

112A 1 30G 417 1 30G

119 1 30G 446 1 30G

1B129 1 30G 469 1 30G

1 30G 619 1 30G

138 1 30G 664 1 30G

Attachment 1

150 1 30G 701 1 30G

1 30G BLDG 1/ POLICE 1 30G

146A 1 30G BLDG 2 1 30G

127 1 30G BLDG 29 / ROOM 202 2 30G

215 1 30G BLDG 18 1 30G

218A 1 30G BLDG 46 1 30G

238 1 30G BLDG 96 1 30G

270 1 30G

250 1 30G

258 1 30G

TOTAL 30G 44

PLAZA LECEA OFFICE BLDG

301.13 1 30G 321 2 30G

321 2 96G

TOTAL 30G 3

SOUTH BEXAR COUNTY VA

123 1 96G 126 1 30G

112 1 30G

POLYTRAUMA REHABILITATION FACILITY

101 1 30G 230 1 30G

Attachment 1

FISHER HOUSE

100 1 30G

TOTAL 30G 1

FRANK TEJEDA VA OUTPATIENT CLINIC

1A175 1 30G 1B129 1 30G

1A204 2 30G 2A209 1 30G

1A129 2 30G 2A179 1 30G

1A159 1 30G 2A157 2 30G

1A146 1 30G 2A130 1 30G

1A165 3 30G 2A122 1 30G

1B142 1 30G 2A112 2 30G

1B142.17 1 30G 2A199 1 30G

1B115 2 30G 1B114 3 30G

TOTAL 30G 27

*NOTE: All areas must be picked up. If no answer, return at a later time during the day and notify your supervisor.

*NOTE: The number and location of containers are subject to change due to personnel moves or as workflow determines.