Shredding SOW revised 060722.docx

STATEMENT OF WORK

SHREDDING SERVICES

Revised 06/07/2022

1. GENERAL SCOPE OF WORK

1.1. The statement of work (SOW) details the requirements for the Centers for Medicare & Medicaid Service (CMS) shredding services. Contractor shall provide all labor, supervision, management support, transportation, supplies, equipment and materials necessary to perform shredding services in accordance with privacy, security, and performance requirements as detailed in this SOW. A total of 50 top open locked uniform in color shred bins and 17 Consoles are required.

1.2. At the discretion of the Contracting Officer, this contract may be for one (1) Base year and may include one to four (1-4) Option years.

Base Year: August 28, 2022 Option Year #1: August 28, 2023 Option Year #2: August 28, 2024 Option Year #3: August 28, 2025 Option Year #4: August 28, 2026

1.3. The purposes of this contract, is to provide Shredding Services defined as the collection and shredding of the contents of locked security containers and consoles of various sizes placed throughout the Agency. CMS will request a recurring shredding schedule depending on the anticipated needs of the Agency. The containers and consoles size(s) and schedule may be adjusted at any time by the Agency to better complement the end-user's requirements. CMS is soliciting competitive bids to select a Contractor that meets its requirements for the shredding and destruction of confidential documents. No minimum or maximum shredding weight is guaranteed or implied.

2. LOCATIONS

2.1. 7500 Security Blvd, Baltimore, MD [28] [26 pickups per year]

2.2. 7205 Windsor Blvd, Baltimore, MD [3] [12 pickups per year]

2.3. 7210 (North) Ambassador, Baltimore, MD [3] [12 pickups per year]

2.4. 7111 Security Blvd, Baltimore, MD [6] [12 pickups per year]

2.5. Chevy Chase Building, Suite 8-199 7501 Wisconsin Ave, Bethesda, MD?? [4] [12 pickups per year]

2.6. Hubert H. Humphrey Building, Suite 441G, 200 Independence Avenue SW, Washington, DC 20201 [4] [12 pickups per year]

3. CONFIDENTIALITY

3.1. Confidentiality of all information is required. The Contractor shall maintain confidentiality in accordance with best industry practices in compliance with federal and state laws, and in compliance with the National Association for Information Destruction requirements for Contractor certification.

3.2. The Contractor's personnel designated to work with confidential records shall be required to sign a statement of confidentiality guaranteeing non-disclosure of information prior to performing any work described in this contract. The confidentiality statement shall be designed, implemented, and maintained by the Contractor. If requested, the statement of confidentiality shall be made available for viewing by CMS.

3.3. The Contractor shall not inspect, view, peruse, copy, or examine any material or documents whether designated for shredding, disposal or not. In addition, the Contractor shall not otherwise disclose, release, or communicate any information, including materials or documents to any third person, individual, organization or entity not employed or approved by CMS. Should any violation or breach of this provision occur, such shall constitute cause for immediate termination of the contract upon receipt of written notice of the violation or breach by the Contractor.

4. CONFORMANCE STANDARDS

4.1. Material picked up from all CMS locations shall be destroyed by shredding, wet pulping, macerating, chopping, or otherwise so it becomes not readable or re-constructible.

4.2. Contractor shall possess current AAA certification, be bonded, and insured as a confidential document destruction company as certified by the National Association for Information Destruction (NAID). A lapse of NAID certification during the term of the contract resulting from this bid shall be good cause for CMS termination of the contract.

4.3. Contractor shall perform all work in accordance with the guidelines of Federal, State and local ordinances. All safety practices prescribed by these agencies shall be followed.

4.4. Contractor and staff shall comply with the federal Privacy Act of 1974, Health Insurance Portability and Accountability Act (HIPAA), and the Archivist of the United States governing methods of destroying records, (36 C.F.R. 1228.58, Destruction of Temporary Records).

4.5. Contractor shall provide a Certificate of Destruction for each job completed as witness to the interim and final destruction of material collected from the CMS main campus and its outlying buildings. The Certificate of Destruction (COD) must include:

1. Location of agency facility;

2. Date service provided;

3. Number of containers (for scheduled shredding);

4. Cost per container;

5. Number of pounds (for bulk shredding);

6. Signature and title of Contractor employee performing services;

7. Name of CMS authorized/designee witness if any.

4.6. Scales used by the Contractor must be certified to weigh the material shredded.

4.7. The contractor and their personnel shall be subject to the Federal laws, regulations, standards, and CMS Directives and Handbooks regarding information and information system security as delineated in this contract.

5. HOURS OF WORK

5.1. Contractor shall schedule retrieval/pick-up times during normal business hours. Normal business hours for shredding pick-up and bin-exchange services are defined as Monday through Friday from 8:00 am to 4:30 pm, excluding Federal holidays, or as otherwise coordinated with the Contracting Officer Representative (COR) or his/her designee.

5.2. The 11 holidays observed by the Federal Government are: New Year’s Day, Martin Luther King Day, President’s Day, Memorial Day, Juneteenth National Independence Day, Independence Day, Labor Day, Columbus Day, Veteran’s Day, Thanksgiving Day and Christmas Day. Also, any other day declared by the President of the United States to be a national holiday.

5.3. CMS would like shredding services to be scheduled at recurring established hours.

· CMS would like the option to increase or decrease scheduled shredding frequency depending on volume.

· CMS would like prices set at a fixed rate for each period of performance for the following:

1. to empty extra bins during the regular scheduled service,

2. per bin for purge services requests,

3. cost for service cancellation

· Contractor will re-scheduled onsite shredding to the next business day on Federal holidays.

5.4. Ad-HOC:

CMS shall have the option to request additional shredding services to support large purges, and office moves that cannot be supported through already scheduled service.

6. SUPPLIES & EQUIPMENT

6.1. Contractor shall provide and will maintain ownership of uniform color lid locking shred bins and consoles (clearly marked to indicate the container is only for deposit of “Confidential Documents for Destruction”) to be placed in designated locations throughout the CMS and outlying sites for the collection of paper to be shredded.

Contractor shall add additional locking shred bins for new locations with at least one-month prior notification at current contract rate.

6.2. The number of containers and consoles at locations, their size various offices, as well as the frequency of services, may change upon CMS request in accordance with its needs. Currently, the containers and consoles are to be placed in the copier rooms and central office areas. Contractor shall be notified of any anticipated modification.

6.3. Contractor shall provide a truck specifically designed for shredding services. The truck must have the capacity to handle the volume of material generated or produced through the course of government business and must safely and completely destroy all materials whether stapled, clipped, bound, etc. The vehicle must be equipped with locking doors to secure shred materials and provide security of information from unauthorized access, weather elements, or loss of data during transport from the CMS site to the final shredding facility site. If interim destruction of materials is provided, these services shall make the material not readable and not re-constructible without extraordinary effort.

6.4. Couriers shall use tamper resistant serial numbered ties on all bags leaving CMS facilities if shredding is not performed onsite. At all times, the secure information and shred bags retrieved from all CMS sites shall be secure and monitored, from time of pick-up by the contractor, during transport, and during the shredding/baling and final destruction process.

6.5. Material collected for destruction shall be kept in a manner that prevents their content from being read by individuals with no official business need or right to access the data contained in these records. The method of collecting and processing this material shall also prevent the loss or theft of these records until their final destruction.

6.6. Any facility where material is held prior to being converted to an un-re-constructible state shall have the following requirements:

· A monitored alarm system for areas where materials are held;

· A closed-circuit camera system that monitors access points into destruction areas.

· The system shall have playback capabilities for up to 90 days.

6.7. CMS will not provide hand trucks or other equipment to assist the Contractor.

6.8. Containers and Consoles:

· All containers and consoles shall be equipped with attached lid and locking devices.

· Containers and consoles shall be of uniform color, and be clearly marked to indicate the container is only for deposit of “Confidential Documents for Destruction”

· Containers and consoles must have either a top slot or side slot near the top designed to prevent theft of materials by reaching in.

· Containers and consoles must have a tamper evident locking system and be made of a fire-resistant material.

· Contractor will supply CMS representative with a key for locking all containers and consoles. If a key is lost, the Contractor will supply a new key at no additional charge to the agency.

· CMS will be allowed to place additional non-permanent signage on containers and consoles at its discretion.

· Contractor shall retain ownership of the containers and consoles.

· Contractor shall submit to CMS a complete description of the material type, size, color, signage and other features of containers and consoles selected by Contractor and accepted by CMS for services under this agreement.

· Contractor shall be responsible for maintaining all containers and consoles in good working order, cleaning containers as necessary and providing replacement and/or additional containers and consoles as may be requested by CMS during the term of contract.

· Contractor shall agree that CMS shall not be responsible for any liability incurred by the Contractor or the Contractor's personnel arising out of the possession, use, maintenance, delivery, return, and/or collection from the containers and consoles provided by the Contractor.

7. LABOR

7.1. Contractor shall provide labor to collect shred bins/bags from designated facility locations. Access to buildings will be during normal business hours through available CMS personnel. Contractor shall be responsible for disposing of all shredded material off-site at their own expense. Contractor personnel involved in the actual handling and shredding of documents shall wear a contractor-provided, clearly readable identification badge, which shall display the name of the employee and the company. Contractor personnel’s clothes are to be clean and maintained in good repair.

7.2. Contractor shall be required to shred, pulp, macerate, chop, or otherwise definitively destroy the information contained in the bins. The destruction of the information will be witnessed either by a CMS employee or, as pre-authorized by the CMS organization, by a contractor employee with subsequent destruction certificates to document the retrieval, transport, shredding, and final destruction of the paper with contractor signature attestation as witness to the shredding.

7.3. Contractor shall provide a key to the lockable shred bin containers to the facility Contracting Officer’s Representative (COR) to use in case of an emergency. Contractor shall not allow anyone access to the shred containers without permission from the COR or CO. Any damaged or broken locks shall be replaced by the contractor. Shred bin containers shall be labeled and maintained in designated, secure areas of the facility.

7.4. Contractor shall be responsible for collecting shred bins/console bags at each facility and secure transport of them to contractor shred site. At no time shall the Contractor leave a collection bin/bag unattended or unlocked. Contractor shall arrive at the designated collection area to begin retrieval of the shred bins/bags and shall perform the necessary transfer/exchange to return the empty containers to those same locations after the retrieval process is complete. A tour of locations of shred bins will be provided by the COR and/or personnel identified by the COR.

7.5. Contractor’s vehicles used to perform service under this contract shall be locked and the keys removed from the vehicles when not in use. Vehicle(s) shall be identified and parked in a predetermined location agreeable to both the CMS and the Contractor.

7.6. If an interim destruction of documents is not conducted, Contractor shall provide the facility with documentation that an interim destruction is not practicable.

7.7. Contractor shall provide the facility with documented evidence of the amount and date the material was collected prior to transporting off-site If final data destruction is conducted off-site.

7.8. Contractor shall provide a certification of destruction once the service is complete. Contractor shall provide a written statement of assurance that all documents (sensitive data) intended for shredding were completely destroyed and unreadable utilizing methods that render the material unreadable and/or unrecoverable. The certificate of destruction shall also state when the documents were destroyed and that all sensitive data is protected from unauthorized disclosure from the point of retrieval from the CMS to the final destruction facility.

7.9. Included on invoices, Contractor shall provide Contract Line Item Numbers (CLIN). The invoices should mirror the structure of the contract price schedule and itemize the charges as shown in the contract. The invoice should state the description of the service as it appears in the CLIN, date, time, and number of bins serviced. The invoice should include the date of shredding, environmental details, and poundage of paper shredded for the month being billed.

8. SCHEDULING

8.1. For the solicitation phase, the contractor shall provide information concerning shredding ability and security procedures. This shall include a schedule for pick-up once every week for designated facilities with completion during normal office hours. Additional pickups may be requested as needed for special projects or periods of excessive destruction needs when containers become full before the next scheduled pickup. The contractor shall stipulate what contaminants and other items will not be acceptable in the collection bins. The retrieval-pickup schedule and container placement will be reviewed periodically by contractor and COR together and on an “as-needed” basis to adjust for the maximum usage of the containers. Services performed for CMS under this contract may not be subcontracted or assigned.

9. SECURITY REQUIREMENTS

9.1. The performance of this contract requires the Contractor to have routine, escorted access to the CMS. CMS requires that all Contractor personnel involved in the actual handling and shredding of documents at any facility and who have access to Protected Health Information (PHI) shall undergo Criminal History Background Check under State and Federal regulations and NAD certification, is required, any criminal violations that disqualify an employee from being employed in a capacity where they may come into contact with confidential information cannot be employed on this contract. The cost for such investigation shall be borne by the contractor. The contractor shall be required to furnish all applicable employee information to conduct the investigation. If the investigation is not completed within 40 days from contract award, the Contractor shall be responsible for the actions of those individuals they provide to perform work for CMS. Failure to complete a background investigation may result in contractor personnel being removed from the contract and no longer performing services.

9.2. Contractor shall provide the name and address of the party conducting your criminal history record checks. If the criminal history record check is not conducted through an official state crime bureau, what levels of criminal offenses are included in the criminal history record check. The Certification and Accreditation (C&A) requirements do not apply, and a Security Accreditation Package is not required.

9.3. Strict adherence to CMS security operations and procedures is required. Contractor shall maintain a current Driver’s License. The Driver will not be permitted to enter CMS Facilities without a current Driver’s License.

9.4. The Contractor has 24 hours to inform the COR that the employee no longer works for them, however if the individual leaves employment on a pick-up day, they shall inform the Contracting Office and COR immediately by phone, or e-mail.

9.5. Contractor employees are prohibited from possessing weapons, firearms, or ammunition, on themselves or in their contractor-owned or privately-owned vehicle while on CMS property.

9.6. If the Contracting Officer finds it in the best interest of the Government he/she may at any time during the performance of this contract order the Contractor to remove any of his/her personnel from further performance under this contract for reasons of their moral character, unethical conduct, security reasons and violation of on-site building rules. In the event that it becomes necessary to replace any Contractor personnel for any of the above reasons, the Contractor shall bear all costs associated with such removal, including the costs for the replacement of any personnel so removed. These charges shall not be chargeable to the Government.

9.7. In the event of an accident on CMS property or involving Government personnel or property, the Contractor shall submit a report immediately to the Contracting Officer and COR in a letter form that shall include the following: (1) the time and date of occurrence; (2) the place of occurrence; (3) a list of personnel directly involved; and (4) a narrative or description of the accident to include chronological order of the accident and circumstances.

9.8. The Contractor shall not hold any discussions or release any information relating to the contract to anyone not having a direct interest in performance of this contract, without written consent of the COR with final approval of the Contracting Officer. This restriction applies to all news releases of information to the public, industry or Government agencies.

9.9. A Contractor Security Control Assessment (CSCA) is required within 30 days of contract approval and annually on the due date of the contract renewal. This should be returned to the CO/COR or CO/COR can also request that a CSCA be completed by the contractor anytime there are potential security issues identified or suspected by CMS or to ensure that applicable security controls are being implemented.

10. GENERAL

10.1. Contractors and contractor personnel visiting any CMS facility/site shall be subject to the same Federal laws, regulations, standards, and CMS Directives as CMS personnel regarding information and information system security.

10.2. If CMS determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for CMS to withhold payment to the contractor or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

************************** END OF SOW ***************************