VHR.SOW.TC.1006.doc

SOCIAL SECURITY ADMINISTRATION (SSA)

REQUEST FOR QUOTATION

SSA-RFQ-R08-11-1006

Verbatim Hearing Recording Products

May 9, 2011

POINT OF CONTACT:

Lisa Walker Phone: 303.844-7344 E-mail: lisa.walker@ssa.gov

TABLE OF CONTENTS

SECTION A – STANDARD FORM 1449

SECTION B – SUPPLIES – SERVICES - PRICING

SECTION C – TERMS AND CONDITIONS

SECTION D – BPA ATTACHMENTS

SECTION E – SOLICITATION PROVISIONS

BLANKET PURCHASE AGREEMENT

VERBATIM HEARING RECORDINGS

ADDENDUM TO STANDARD FORM (SF) 1449

In accordance with Federal Acquisition Regulation (FAR) 12.302 – Tailoring of Provisions and Clauses for the Acquisition of Commercial Items and FAR 12.303 – Contract Format, this addendum to the SF 1449 includes a continuation of the Schedule of Supplies/Services to be acquired in blocks 19 through 24 and other terms and conditions of the contract.

SECTION B – SUPPLIES-SERVICES-PRICING

B.1 General Information

The Social Security Administration (SSA) is awarding Blanket Purchase Agreements (BPAs) in order to, on an as needed basis, acquire Verbatim Hearing Recordings (VHR) for the Office of Disability Adjudication and Review (ODAR). All orders placed against this BPA are subject to the terms and conditions of the agreement. The VHR Contractor shall deliver the final product when a delivery ticket is issued. The potential Places of Performance are listed in Section D, Attachment A.

B.2 Pricing Schedule – see Section D, Attachment C B.3 Statement of Work A. Description of Product Specifications

The VHR Contractor for an SSA hearing, before an Administrative Law Judge (ALJ), is responsible for the delivery of a final product consisting of:

1. Complete, legible and accurate notes, in the Agency provided software format for digital proceedings, summarizing all aspects of hearing testimony and Administrative Law Judge (ALJ) directives at each hearing proceeding before an SSA ALJ;

2. A complete set of proposed and admitted exhibits offered by the claimant on the day of the hearing, along with any background records associated with the record available at the sites; and

3. A complete audible digital recording, on compact Disc (CD) and computer hard drive, of the verbatim record for each hearing proceeding before an SSA ALJ, labeled with the claimant’s name, social security number, hearing date and digital recording identification.

At remote sites, the VHR Contractors may be required to gain access to and prepare the site for performance of a video hearing session, including setting up and repacking hearing-related equipment if not already in place. Hearing-related equipment includes digital recording, video teleconferencing equipment, and electronic folder viewing equipment, if applicable. The VHR Contractors may be required to transport digital recording equipment to and from the location where the equipment is stored. At these sites, the VHR Contractors shall have access to building and room keys, as indicated in technical guidance provided by the Hearing Office Director or National Hearing Center (NHC) Director or his/her designee, case files, and verbatim hearing equipment. In addition, in furtherance of delivering a final product, the VHR Contractors will be authorized to make copies and transmit faxes of files and other documentation. They will also accept or initiate the video teleconferencing session if necessary. When justified, the VHR Contractors shall be allowed to make emergency phone calls.

The Hearing Office or NHCs are in the process of moving to an electronic file system. The VHR Contractors shall treat the electronic file in the same manner as a physical file. At remote sites, the VHR Contractor is responsible for presenting the case file to the claimant for their review. Whether this is a physical file or an electronic file recorded on a Compact Disc is irrelevant.

The VHR Contractor will make delivery of the final product in accordance with the delivery ticket instructions provided by the Contracting Officer or other Authorized Ordering Official placing the order.

B. Hearing Site and Time

SSA generally will conduct hearings on Monday through Friday, between 8:00 a.m. and 5:00 p.m., at locations specified by the Contracting Officer or other Authorized Ordering Official placing the order.

C. Responsibilities for Supplies

SSA will provide the VHR Contractor access to and use of its recording equipment and a CD pursuant to the Federal Acquisition Regulations on providing government-furnished equipment to contractors, codified at 48 C.F.R. Subpart 45.3. However, the VHR Contractor shall provide his or her own note paper and pens/pencils.

D. Placement and Cancellation of Orders

The VHR Contractor (unless the parties mutually agree to a different start-up time) is required to be available to begin delivering hearing recordings within five (5) working days after award. The Hearing Office or NHC normally will contact a VHR Contractor at least 48 hours before the date that hearings will occur, and place an oral order with the VHR Contractor seeking the delivery of recordings for certain hearings at specific time(s) and location(s). The oral order will be followed by a written confirmation by the Government. BPA RATES ARE BASED ON THE ORDER DATE, NOT THE HEARING DATE.

If SSA cancels all hearings scheduled for a particular day, SSA will not make any payment to the VHR Contractor, provided that SSA gives at least 24 hours advance notice. If SSA fails to provide such advance notice that it has cancelled all hearings on a particular day, the VHR Contractor is entitled to a $25 cancellation or appearance fee. If a VHR Contractor is scheduled for multiple hearings on the same day, and if SSA cancels one or more individual hearings without providing 24 hours advance notice, including circumstances when SSA cancels a hearing because of an incurable malfunction in SSA equipment that is not attributable to the VHR Contractor, the VHR Contractor is entitled to a cancellation or appearance fee of $5 per cancelled hearing not to exceed $25 for any one day. The VHR Contractor may request written confirmation of the cancellation for his or her business records. Likewise, the VHR Contractor must give 24 hours advance notice if he/she will be unable to fulfill an order. The VHR Contractor ultimately is responsible to SSA for delivery of the products ordered under the BPA. Neither party to the BPA shall be responsible for delivery or payment to the other party in the event that hearings do not convene due to circumstances beyond the parties’ control, such as natural disasters, terrorist attacks, or other similar emergency situations.

NOTE: The reason for not conducting a complete hearing is an Agency decision that is not within the purview of the VHR Contractor. The VHR Contractor receives their VHR fee only when they provide a product. A VHR Contractor that receives 24 hours notice of a cancellation will not be paid.

If the VHR Contractor produces a digital recording at the direction of the ALJ, who begins a recorded hearing, the VHR Contractor will be paid their VHR fee in accordance with the pricing set forth below:

The VHR Contractor will be paid a $5 fee for supplying a digital recording of the following:

· If claimant, representative or ALJ has requested a new hearing date and time prior to the start of the scheduled hearing.

· If the ALJ decides, after the hearing date has been set but prior to the start of the hearing, to issue a dismissal.

· If the hearing was not held as scheduled because the claimant/representative failed to appear, or requested representation.

The VHR Contractor will be paid a full fee for the following:

· The VHR Contractor delivers a final product in accordance with the Contract Specifications (Section B.3).

· Cases in which the hearing was convened and testimony was taken as scheduled, but not complete.

E.

Delivery Tickets The Contractor shall provide a completed delivery tickets/invoices to the Ordering Official for each day within five (5) working days following receipt by SSA of the completed product in accordance with the above specifications. The delivery ticket/invoice shall be completed for each day of scheduled hearings and all delivery tickets/invoices for the entire period will be provided at the same time for payment. See enclosed format to be used The VHR Contractor shall deliver the final product to the location indicated by the Contracting Officer or other Authorized Ordering Officials.

Unless otherwise agreed, all deliveries under this BPA must be accompanied by delivery tickets or sales slips containing, at a minimum, the following information:

(a) Name of VHR Contractor;

(b) BPA Number;

(c) Call Order Number;

(d) Date of Order;

(e) Name of Authorizing Official;

(f) Hearing Price; and

(g) Place and Time of Performance.

F. Failure to Deliver Final Product

The VHR Contractor’s failure to deliver a complete final product, as required by Section B.3 A of this BPA, subjects the VHR Contractor to legal liability for actual damages. Actual damages may include, among other things, the cost of conducting a rehearing or another hearing on a different date, the cost of obtaining witnesses for the rehearing or new hearing, and other costs related to SSA’s requirement to obtain a verbatim recording of the ALJ proceeding.

NOTE: A VHR Contractor is not an SSA employee and is only allowed the same limited access to Government areas as other members of the public. A VHR Contractor may not perform any services for SSA, other than those related to delivery of the product enumerated in the Statement of Work.

G. New VHR Contractor employees

A new VHR Contractor employee will be required to attend a non-compensated orientation session at the hearing office closest to the VHR Contractor employees’s home location. The session lasts approximately four hours during which time the hearing office member(s) explains the hearing process, demonstrates the equipment, and with the VHR monitors several hearings.

SECTION C - TERMS & CONDITIONS

C.1 Prohibitions

The VHR Contractor may not engage in any of the following:

· Performing any tasks other than those described in the Statement of Work;

· Accepting assignments from any Federal employee other than the Contracting Officer or an authorized Ordering Official;

· Accepting SSA office keys and/or access codes to ODAR Hearing Offices or NHCs (other than in remote sites);

· Accessing SSA computer networks;

· Utilizing SSA telephones for personal matters other than emergencies;

· Copying documents for the administrative record in hearings other than in remote sites;

· Filing documents relative to social security claims or other business matters;

· Monitoring hearings other than those hearings assigned to him or her on a particular day;

· Entering any SSA office space, including a rest area, unavailable to the public; or

· Failing to submit to and adhere to security procedures established for the public.

C.2 Extent of Obligation

This BPA does not obligate any funds. SSA is only obligated to the extent that the VHR Contractor actually delivers a final product, as described in the Statement of Work. SSA may cancel this BPA at any time with 30 days written notice. Furthermore, SSA does not guarantee that the award of a BPA will result in order placement or a certain volume of orders.

C.3 Ordering Periods The ordering period of this BPA will be from the date of award for five (5) years. Pricing for the first year will be effective from the date of award through the first September 30th. Thereafter, pricing for the second, third, and fourth years will be effective October 1st through September 30th of the following year. After September 30th of the fourth year, fifth year pricing will be effective from October 1st through the anniversary date of award.

C.4 Travel Travel costs shall be paid in accordance with the federal travel regulations (FTR) which can be accessed at www.gsa.gov/ftr. Note that a VHR Contractor will not be paid travel costs if he/she lives within 50 miles (local commuting distance) of any site. Travel costs to a remote site will be paid on a daily basis and NOT per hearing performed. Additionally, all travel costs to a remote site should include travel to and from the local district office in order to obtain access, background material, and recording equipment as necessary. On each pricing table submitted that includes travel costs, the VHR Contractor should breakdown these costs into transportation, lodging, and meals.

C.5 Purchase Limitation

BPA Call Orders are to be placed only by authorized individuals. The Contracting Officer may place orders against this BPA at any dollar value. Refer to Section C.5 of the BPA for a listing of additional authorized officials, including the dollar limitation on placing orders. The Contracting Officer must place any order that exceeds $3,000.00.

C.6 Method of Payment

A. Invoicing Procedures The Verbatim Hearing Recording (VHR) Contractor shall submit a monthly, consolidated invoice as set forth in this Section to the Hearing Office Director (HOD) or the Hearing Office or NHC designee. Section D, Attachment G is a sample copy of a complete and proper invoice.

B. Invoice Submission

The VHR Contractor shall be required to submit the consolidated monthly invoice to the Hearing Office or NHC designee. There are three (3) acceptable methods of submitting consolidated monthly invoices to the Hearing Office or NHC. The acceptable methods are electronically via e-mail, by regular mail, or by hand carrying it to the Hearing Office or NHC. The Hearing Office or NHC will date stamp the consolidated invoice upon receipt.

C. Invoice Requirements

Invoices submitted by VHR Contractor must include the following elements before the Office of Finance can process them for payment:

· Invoice Date

· Unique invoice number – every invoice submitted by a VHR Contractor must have a unique invoice number. For example: The VHR Contractors may number their invoices consecutively as long as they do not repeat a number, (1, 2, 3) and does not exceed 20 characters.

· VHR Contractor Name and Address

· ODAR Ordering Hearing Office or NHC Name and Address

· Tax Identification Number

· DUNS Number

· BPA Number

· Call Numbers (Hearing Office or NHC provides the CAN and SOC)

· Order Date

· Service date

· List of Delivery Ticket Numbers covered on the invoice

· Dollar amount requested per hearing

· Total breakdown between Hearing Fee and Travel Fee totals where applicable

· Consolidated Total

The VHR Contractor shall not submit a consolidated invoice prior to completion of services. If the invoice is incomplete and needs correction, the Hearing Office or NHC must resolve the deficiencies with the VHR Contractor before certifying and sending the invoice to the Office of Finance for payment. This may require the VHR Contractor to make corrections and resubmit their invoice to the Hearing Office or NHC, which could result in a delay in payment.

The VHR Contractor shall submit only one invoice to the Hearing Office or NHC per monthly period/payment cycle.

If a product is unacceptable, the Hearing Office or NHC Director should be immediately notified. The VHR retains a copy of the Delivery Ticket for billing purposes.

Electronic Funds Transfer (EFT): The Hearing Office or NHC will date stamp the consolidated invoice upon receipt. This will begin the 30-day payment window. The Office of Finance, Baltimore, Maryland, shall make payment in accordance with the Prompt Payment Act.

A VHR Contractor must meet certain requirements prior to using the EFT payment method:

A VHR Contractor must be registered in the Central Contractor Registration database. www.ccr.gov . The Contractor must renew his/her CCR registration on an annual basis. If the Contractor allows their CCR registration to expire, payment will not be made until the registration is renewed. In the event that the EFT information changes, the Contractor shall be responsible for providing the updated information to the CCR database. The CCR registration shall be current (indicated by showing an ‘active status) throughout the life of the BPA.

D. Consolidated Invoice Payment Inquiries All payment inquiries should be made by one of the following methods: phone or E-mail to the Department of Administrative Payments (DAP) Customer Service unit, online through the U.S. Department of Treasury’s Internet Payment Platform (IPP) System, or by phone via the Financial Interactive Voice Response System (FIVR).

Be sure to reference your Consolidated Invoice for the following information when making an inquiry:

· Contractor’s Name

· Contractor’s Tax ID #

· Invoice Amount

· Invoice #

Note: Do not fax invoice copies to the Office of Finance as a means of payment inquiry, unless you are instructed to do so by a Customer Service Representative. Duplicate invoice copies received in the Office of Finance can cause duplicate payments to occur, thus initiating the payment recovery process.

IPP System

(U.S. Dept. of the Treasury’s Internet Payment Platform (IPP) System):

https://www.ipp.gov/login/IPPLogon_Index.htm

The IPP System is a secure on-line system where payment history can be retrieved. To enroll, you will need to call the IPP Help Desk at (866) 973-3131. The Help Desk is available to assist users 8 a.m. through 6 p.m. Monday through Friday (excluding holidays). A User ID and password are required to view payment information. You may view payment data on-line (24-hours a day 7 days a week) or have it e-mailed directly to you. For additional information on the IPP System, go to https://www.ipp.gov.

FIVR/Customer Service:

(410) 965-0607

FIVR is an automated, self-service system that allows you to receive various payment information over the phone. Simply contact the phone number above and follow the voice prompts.

If you cannot get your answer via FIVR, you can reach a Customer Service Representative by selecting option 6. If no one is available to take your call, please be sure to leave a message and someone will get back to you at their earliest convenience, generally within 24 hours, during regular business hours.

E-mail:

Payment.Inquiries@ssa.gov

If you prefer, you may e-mail your payment inquiry request to the e-mail address above. A Customer Service Representative will respond to your request at their earliest convenience, generally within 24 hours, during regular business hours.

Payment Inquiries for Hearing Impaired Persons:

(410) 597-1395

The Office of Finance (OF) has installed a Telecommunications Device for the Deaf (TDD), a telephone line for the hearing impaired. You may access the services available on the FIVR system through TDD. If additional support is needed, Customer Services Representatives are available Monday through Friday between the hours 8am and 4pm EST.

For additional information, please visit the DAP Vendor Information web site at www.ssa.gov/vendor/.

C.7 Authorized Ordering Officials Individuals authorized to place Call Orders for services and sign as the “Ordering Official” under this Agreement are limited to the following positions and to the associated dollar limitations.

LIMITATION

Per BPA CALL

C.8 Notice of Individuals Authorized to Change the Terms and Conditions of this BPA The Contracting Officer is the only person with the authority to act as agent of the Government under this BPA. Only the Contracting Officer has authority to: (1) direct or negotiate any changes in the BPA; (2) modify or extend the period of performance; (3) change the delivery schedule; (4) authorize reimbursement to the VHR Contractor for any costs incurred during delivery under this BPA; or (5) otherwise change any terms or conditions of this BPA.

C.9 52.204-9 Personal Identity Verification of Contractor Personnel (SEP 2007)

(a) The Contractor shall comply with agency personal identity verification procedures identified in the contract that implement Homeland Security Presidential Directive-12 (HSPD-12), Office of Management and Budget (OMB) guidance M-05-24 and Federal Information Processing Standards Publication (FIPS PUB) Number 201.

(b) The Contractor shall insert this clause in all subcontracts when the subcontractor is required to have routine physical access to a Federally-controlled facility and/or routine access to a Federally-controlled information system.

C.10 AS 2401 - Protection of Confidential Information (DEC 2008)

(a) Confidential information, as used in this clause, means information or data, or copies or extracts of information or data, that is: (1) provided by the Social Security Administration (SSA) to the contractor for, or otherwise obtained by the contractor in, the performance of this contract; and (2) of a personal nature about an individual, such as name, home address, and social security number, or proprietary information or data submitted by or pertaining to an institution or organization, such as employee pay scales and indirect cost rates.

(b) The Contracting Officer and the Contractor may, by mutual consent, identify elsewhere in this contract specific information or categories of information that the Government will furnish to the Contractor or that the Contractor is expected to generate which are confidential. Similarly, the Contracting Officer and the Contractor may, by mutual consent, identify such confidential information from time to time during the performance of the contract. The confidential information will be used only for purposes delineated in the contract; any other use of the confidential information will require the Contracting Officer’s express written authorization. The Contracting Officer and the Contractor will settle any disagreements regarding the identification pursuant to the "Disputes" clause.

(c) The Contractor shall restrict access to all confidential information to the minimum number of employees and officials who need it to perform the contract. Employees and officials who need access to confidential information for performance of the contract will be determined in conference between SSA's Contracting Officer, Contracting Officer’s Technical Representative, and the responsible Contractor official. Upon request, the Contractor will provide SSA with a list of “authorized personnel,” that is, all persons who have or will have access to confidential information covered by this clause.

(d) The Contractor shall process all confidential information under the immediate supervision and control of authorized personnel in a manner that will: protect the confidentiality of the records; prevent the unauthorized use of confidential information; and prevent access to the records by unauthorized persons.

(e) The Contractor shall inform all authorized personnel with access to confidential information of the confidential nature of the information and the administrative, technical and physical safeguards required to protect the information from improper disclosure. All confidential information shall, at all times, be stored in an area that is physically safe from unauthorized access. See paragraph (f) below regarding the minimum standards which the safeguards must meet.

(f) Whenever the Contractor is storing, viewing, transmitting, or otherwise handling confidential information, the Contractor shall comply with the applicable standards for security controls that are established in the Federal Information Security and Management Act (FISMA). (These standards include those set by the National Institute of Standards and Technology (NIST) via the Federal Information Processing Standards (FIPS) publications and NIST Special Publications, particularly FIPS 199, FIPS 200, and NIST Special Publications - 800 series.)

(g) If the Contractor, in the performance of the contract, uses any information subject to the Privacy Act of 1974, 5 U.S.C. 552a, and/or section 1106 of the Social Security Act, 42 U.S.C. 1306, the Contractor must follow the rules and procedures governing proper use and disclosure set forth in the Privacy Act, section 1106 of the Social Security Act, and the Commissioner's regulations at 20 C.F.R. Part 401 with respect to that information.

For knowingly disclosing information in violation of the Privacy Act, the Contractor and Contractor employees may be subject to the criminal penalties as set forth in 5 U.S.C. Section 552(i)(1) to the same extent as employees of SSA. For knowingly disclosing confidential information as described in section 1106 of the Social Security Act (42 U.S.C. 1306), the Contractor and Contractor employees may be subject to the criminal penalties as set forth in that provision.

(h) The Contractor shall assure that each Contractor employee with access to confidential information is made aware of the prescribed rules of conduct, and the criminal penalties for violations of the Privacy Act and/or the Social Security Act.

(i) Whenever the Contractor is uncertain how to handle properly any material under the contract, the Contractor must obtain written instructions from the Contracting Officer addressing this question. If the material in question is subject to the Privacy Act and/or section 1106 of the Social Security Act or is otherwise confidential information subject to the provisions of this clause, the Contractor must obtain a written determination from the Contracting Officer prior to any release, disclosure, dissemination, or publication. Contracting Officer instructions and determinations will reflect the result of internal coordination with appropriate program and legal officials.

(j) Performance of this contract may involve access to tax return information as defined in 26 U.S.C. Section 6103(b) of the Internal Revenue Code (IRC). All such information shall be confidential and may not be disclosed without the written permission of the SSA Contracting Officer. For willfully disclosing confidential tax return information in violation of the IRC, the Contractor and Contractor employees may be subject to the criminal penalties set forth in 26 U.S.C. Section 7213.

(k) The Government reserves the right to conduct on-site visits to review the Contractor's documentation and in-house procedures for protection of and security arrangements for confidential information and adherence to the terms of this clause.

(l) The Contractor must include this clause in all resulting subcontracts whenever there is any indication that the subcontractor(s), engaged by the contractor, and their employees or successor subcontractor(s) and their employees might have access to SSA's confidential information.

(m) The Contractor must assure that its subcontractor(s) and their employees or any successor subcontractor(s) and their employees with access to SSA confidential information are made aware of the prescribed rules of conduct. For knowingly disclosing SSA's confidential information, any subcontractor(s) and their employees or successor subcontractor(s) and their employees may be subject to criminal penalties as described in section 1106 of the Social Security Act (42 U.S.C. 1306) and the Privacy Act (5 U.S.C. 552a).

C.11 AS 2402 – Protecting and Reporting the Loss of Personally Identifiable Information: Responsibilities Concerning Individual Employees (DEC 2008)

1. Definitions

The following terms are defined for the purposes of this clause:

“Agency” means the Social Security Administration (SSA).

“Employee(s)” means an individual(s) employed, including, for the purposes of this clause, management officials, by either the Contractor or subcontractor that are working under this contract.

“Handling PII” means having access, either currently or in the future, to personally identifiable information (PII), as defined in this clause.

“Lost, compromised, or potentially compromised PII” means that, while the Contractor/employee is in possession of PII, the PII has become physically missing (e.g., it has been stolen) or has been otherwise breached so that persons other than authorized users, and for other than an authorized purpose, have access or potential access to the PII, regardless of the form (e.g., electronic or physical) in which it was stored. Indications of lost, compromised, or potentially compromised PII include missing equipment (e.g., laptops and removable storage devices such as USB flash or “thumb” drives, CDs, DVDs, etc.) and/or paper documents potentially containing PII, as well as actions where PII was e-mailed in violation of the terms contained in Section 2.(d), E-mailing PII, below.

“Personally Identifiable Information” (PII): SSA follows the definition of PII provided by the Office of Management and Budget in OMB Memorandum OMB M-07-16: “The term ‘personally identifiable information’ refers to any information which can be used to distinguish or trace an individual's identity, such as their name, Social Security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.” Other examples of PII may include, but are not limited to: Social Security benefit data, official State or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number, home address, and medical information. Within this clause, “PII” shall specifically mean PII as defined above which: (1) SSA has a primary responsibility for and/or interest in protecting; and (2) is made available or becomes accessible to the Contractor and/or any subcontractor, including their respective employees, as a result of performing under this contract (e.g., under the contract, SSA directly furnishes PII to the Contractor/subcontractor, or the Contractor/subcontractor, in order to perform its duties under the contract, collects PII from outside sources, such as in a public survey).

“Secure Area” or “Secure Duty Station” means, for the purpose of this clause, either of the following, unless SSA expressly states otherwise on a case-by-case basis: (1) an employee’s official place of work that is in the Contractor’s or subcontractor’s established business office in a commercial setting, OR (2) a location within SSA or other Federal- or State-controlled premises. A person’s private home, even if it is used regularly as a “home office” (including that of a Contractor or subcontractor management official), shall not be considered a secure area or duty station.

2. Employee Responsibility in Safeguarding PII

The Contractor shall establish, maintain, and follow its own policy and procedures to protect PII, including those for reporting lost or compromised, or potentially lost or compromised, PII (see Section 4. (a), below). The Contractor shall inform its employees handling PII of their individual responsibility to safeguard it. In addition, the Contractor shall, within reason, take appropriate and necessary action to: (1) educate employees on the proper procedures designed to protect PII, as described below and as otherwise approved by the Agency; and (2) enforce their compliance with the policy and procedures prescribed as follows:

(a) General. Employees shall properly safeguard PII from loss, theft, or inadvertent disclosure. Employees are responsible for safeguarding this information at all times, regardless of whether or not the employee is at his or her regular duty station. Examples of proper safeguarding include, but are not limited to: maintaining the confidentiality of each employee’s individual password (by not sharing the password with any other individual or entity and not writing it down); verifying the identity of individuals before disclosing information to them; preventing others in the area from viewing PII on one's computer screen; consistently locking or logging off one's workstation when one is away; and ensuring that PII is appropriately returned or, upon receiving SSA’s approval, destroyed when no longer needed.

(b) Transporting PII Outside a Secure Area/Secure Duty Station. Note: The term “transporting” used here does not include shipping by a common or contract carrier, as defined in FAR 47.001, or by the U.S. Post Office. Terms and conditions regarding shipping will be provided by the Regional Management Officer (RMO).

(1) Employees shall make every reasonable effort to safeguard equipment, files, or documents containing PII when transporting information from a secure area/secure duty station. Employees must ensure that the laptops and other electronic devices/media being used to transport PII are encrypted and password protected. The Contractor shall make every reasonable effort to ensure that the encryption and password protection are in accordance with any SSA-prescribed standards or policies which shall be communicated separately from this clause. Employees must use reasonable protection measures when transporting PII, e.g., storing files in a locked briefcase, not leaving files and/or equipment in plain view.

(2) Employees transporting PII, including transporting PII duplications, such as electronic copies and photocopies, from their secure duty station or an otherwise secured area to an unsecured area shall obtain prior approval in accordance with the Contractor’s established policy. The Contractor shall provide employees with contact information and instructions based on the Contractor’s security/PII loss incident policy and procedures. (NOTE: Agency-prescribed contact information and instructions for reporting lost or possibly lost PII are discussed in Section 3. below.)

(3) Tracking files.

Unless the PII is being transported for disposal pursuant to the contract, (see (c) below), the Contractor shall, within reason, take appropriate and necessary action to ensure that the file(s) or document(s) being physically transported or transmitted electronically outside the secure area/secure duty station are tracked through a log: they must be logged out prior to transport as well as logged back in upon return. The Contractor can establish any mechanism for tracking as long as the process, at a minimum, provides for the following information to be logged:

· first and last name of the employee taking/returning the material;

· the name of the file or document containing PII that he/she intends to transport from the office;

· all the forms or media in which the PII was transported (e.g., electronic, such as laptop, thumb drive, CD—be as specific as possible; paper, such as paper file folders or printouts);

· the reason he/she intends to transport the file or document containing PII;

· the date he/she transported the file or document containing PII from the secure duty station; and

· the date he/she returned the file or document containing PII to the secure duty station.

Materials must be returned or documented as destroyed within 90 days of removal from the office or have Contractor supervisory approval for being held longer.

The log must be maintained in a secure manner. Upon request by the Agency, the Contractor shall provide the information from the log in a format (e.g., electronic or paper) that can be readily accessed by the Agency.

(c) Employee Disposal of PII. The marked statement below applies to this contract: [Contracting Officer: Mark the appropriate statement below.]

[ ] This contract entails employee disposal of PII. Employees shall follow the procedures described in [Contracting Officer: Fill in reference to appropriate section, paragraph, article, etc., of the contract as applicable. Page numbers are optional.]

[ X ] This contract does not entail employee disposal of PII. The Contractor shall, within reason, take appropriate and necessary action to ensure that the procedures detailed in (3) above pertaining to the logging of PII that is transported outside a secure area/from their secure duty station are followed.

(d) E-mailing PII. The Contractor’s corporate or organizational e-mail system is deemed not to be secure. Therefore, the Contractor shall put policies and procedures in place to ensure that its employees e-mail PII using only the following procedures in (1)-(2), below:

(1) Sending from an SSA e-mail address. If employees have been given access to the SSA e-mail system, they may use it to send e-mail messages containing PII in the body or in an unencrypted attachment but only to other SSA e-mail addresses (which contain the “name @ssa.gov” format) or to e-mail addresses belonging to an SSA-certified e-mail system. E-mail directed to any other address(es) may contain PII only if the PII is entirely contained in an encrypted attachment.

(2) Sending from a non-SSA e-mail system. If employees are using the Contractor’s own or any other non-SSA e-mail system (e.g., Yahoo!, Gmail), they may send e-mail messages transmitting PII only if the PII is entirely contained in an encrypted attachment; none of the PII may be in the body of the e-mail itself or in an unencrypted attachment. When e-mailing from such systems, this procedure applies when e-mailing PII to any e-mail address, including but not limited to, an SSA e-mail system address. Unless specifically noted otherwise, the Contractor and its employees are expected to conduct business operations under this contract using the Contractor’s own e-mail system, i.e., in accordance with the foregoing rules for transmitting PII.

3. Agency-Prescribed Procedures for Reporting Lost, Compromised, or Potentially Compromised PII.

“Lost, compromised, or potentially compromised PII” is defined in Section 1., above. The reporting requirement established in this section is for reporting all incidents involving PII, with no distinction between suspected and confirmed breaches.

SSA has its own reporting requirements for PII that is lost, compromised, or potentially compromised. The purpose of this section is to ensure that these requirements are met and that incident information is shared appropriately.

(a) Contractor Responsibility. In addition to establishing and implementing its own internal procedures referenced in Section 2., above, the Contractor is responsible for taking reasonable actions to implement Agency-prescribed procedures described in (c) below for reporting lost, compromised, or potentially compromised PII. These include educating employees handling PII about these procedures and otherwise taking appropriate and necessary steps to enforce their compliance in carrying them out.

(b) Potential Need for Immediate, Direct Reporting by the Employee. SSA recognizes that Contractor employees will likely make the initial discovery of a PII security breach. When an employee becomes aware or suspects that PII has been lost or compromised, he/she is required to follow the Contractor’s established security/PII loss incident reporting process (see Section 4. (a), below). The Contractor’s reporting process, along with SSA’s (see Section 3. (c) below), shall require the Contractor, and not necessarily the employee, in such circumstances to notify SSA of the incident. However, the Contractor shall inform each employee handling or potentially handling PII that he/she must be prepared to directly notify outside authorities immediately as described in (c)(4) below, if, shortly following the incident or discovery of the incident, he/she finds it evident that neither an appropriate Contractor nor SSA manager/contact can be reached. The Contractor should emphasize to the employee that timeliness in reporting the incident is critical.

(c) Procedures.

(1) When an employee becomes aware or suspects that PII has been lost, compromised, or potentially compromised (see 1. Definitions, above), the Contractor, in accordance with its incident reporting process, shall provide immediate notification of the incident to the primary SSA contact. If the primary SSA contact is not readily available, the Contractor shall immediately notify one of two SSA alternates, if names of alternates have been provided. The Contractor shall act to ensure that each employee, prior to commencing work on the contract, has been given information as to who the primary and alternate SSA contacts are and how to contact them. In addition, the Contractor shall act to ensure that each employee promptly receives any updates on such information as they are made available. Whenever the employee removes PII from a secure area/secure duty station, he/she must comply with the Contractor's security policies, including having on hand the current contact information for the primary SSA contact and the two alternates.

(2) The Contractor shall provide the primary SSA contact or the alternate, as applicable, updates on the status of the reported PII loss or compromise as they become available but shall not delay the initial report.

(3) The Contractor shall provide complete and accurate information about the details of the possible PII loss to assist the SSA contact/alternate, including the following information:

I.

Contact information;

II.

A description of the loss, compromise, or potential compromise (i.e., nature of loss/compromise/potential compromise, scope, number of files or records, type of equipment or media, etc.) including the approximate time and location of the loss;

III.

A description of safeguards used, where applicable (e.g., locked briefcase, redacted personal information, password protection, encryption, etc.);

IV.

An identification of SSA components (organizational divisions or subdivisions) contacted, involved, or affected;

V.

Whether the Contractor or its employee has contacted or been contacted by any external organizations (i.e., other agencies, law enforcement, press, etc.);

VI.

Whether the Contractor or its employee has filed any other reports (i.e., Federal Protective Service, local police, and SSA reports); and

VII. Any other pertinent information

The Contractor shall use the worksheet (or a copy thereof) following this clause to quickly gather and organize information about the incident.

(4) There may be rare instances outside of business hours when the Contractor is unable to reach either the primary SSA contact or any of the alternates immediately. In such a situation, the Contractor shall immediately call SSA’s Network Customer Service Center (NCSC) at 410-965-7777 or toll free at 1-888-772-6111 to file the initial report directly, providing the information in (c)(3) above and completing the attached worksheet to the best of its ability. Overall, during this time, the Contractor shall cooperate as necessary with the NCSC or any of the other external organizations described in (c)(3) above.

The Contractor shall document the call with the CAPRS (Change, Asset, and Problem Reporting System) number, which the NCSC will assign. The Contractor shall provide the CAPRS number to the primary SSA manager, or, if unavailable, one of the alternates to this manager as described above.

If an employee initially detects the loss, compromise, or potential compromise of PII and finds it evident that neither an appropriate Contractor nor SSA manager/contact can be promptly reached, the employee shall undertake the foregoing actions prescribed to the Contractor in this part (i.e., immediately call the NCSC, document the CAPRS number assigned to the call, etc.). (Reference Section 3.(b) above.)

(5) The Contractor and its employee(s) shall limit disclosure of the information and details about an incident to only those with a need to know. The security/PII loss incident reporting process will ensure that SSA’s reporting requirements are met and that security/PII loss incident information is only shared as appropriate.

4. Additional Contractor Responsibilities When There Is a Loss of PII.

(a) The Contractor shall have a formal security/PII incident reporting process in place that outlines appropriate roles and responsibilities, as well as the steps that must be taken, in the event of a security/PII loss incident. The plan shall designate who within the Contractor’s organization has responsibility for reporting the loss, compromise, or potential compromise of PII to SSA.

(b) In the event of a security/PII loss incident, the Contractor shall take immediate steps to address consequential security issues that have been identified, including steps to minimize further security risks to those individuals whose personal information was lost, compromised, or potentially compromised.

(c) The Contractor shall confer with SSA personnel in reviewing the actions the Contractor has taken and plans to take in dealing with the incident.

(d) The Contractor shall bear the responsibility and any cost for any data breach and/or remediation actions that might arise from the security/PII loss incident. If SSA determines that the risk of harm requires notification of affected individual persons of the security breach and/or other remedies, the Contractor shall carry out these remedies without cost to SSA.

5. Applicability of this Clause to Subcontractors/Subcontractor Employees

(a) The Contractor shall include this clause in all resulting subcontracts whenever there is any indication that the subcontractor and their employees, or successor subcontractor(s) and their employees, will or might have access to PII.

(b) The Contractor shall, within reason, take appropriate and necessary action to assure SSA that its subcontractor(s) and their employees, or any successor subcontractor(s) and their employees, with access to PII know the rules of conduct in protecting and reporting the loss or suspected loss of PII as prescribed in this clause, such as those regarding the e-mailing of PII as stated in Section 2.(d) above.

(c) Notification of Subcontractor Handling of PII. If the Contractor engages a subcontractor under this contract whose employee(s) will actually or potentially be given or have access to PII, the Contractor shall do the following:

(1) Notify in advance both the SSA RMO and the Contracting Officer of this arrangement, providing the subcontractor name(s) and address(es) and, upon request, a description of the nature of the PII to which the employee(s) will actually or potentially be given/have access (e.g., phone numbers, Social Security numbers); and

(2) Provide the SSA RMO the names of the subcontractor employee(s) who will actually or potentially be assigned and/or have access to the PII. The Contractor may satisfy this requirement when submitting the name(s) of the subcontractor employee(s) to the SSA RMO for the requisite security background check described in Section 6, below.

6.

Contractor/Subcontractor Background Checks – Security & Suitability Requirements Clause

For each Contractor and subcontractor employee handling PII, the Contractor shall fulfill the requirements of the Security & Suitability Requirements Clause, found in C.10 of this contract, to ensure that any such individual has the appropriate background checks.

Worksheet for Reporting the Loss, Compromise, or Potential Compromise of Personally Identifiable Information

Contractor and Subcontractor Employees: See last page of this attachment for instructions on completing this worksheet.

1. My primary SSA contact for reporting the loss, compromise, or potential compromise of PII is: Art Cota, Director, Center for Security and Integrity, SSA Region 8, 1961 Stout Street, Denver CO 80294; phone number: (303) 844-3278 The alternates to this primary contact are as follows:

First Alternate: Donna Palmer, Technical Expert, Center for Security and Integrity, SSA Region 8, 1961 Stout Street, Denver CO 80294; phone number (303) 844-7978.

Second Alternate: Phil Mocon, Security Specialist, Center for Security and Integrity, SSA Region 8, 1961 Stout Street, Denver CO 80294; phone number (303) 844-4016.

2. Information about the individual making the report to SSA’s Network Customer Service Center (NCSC):

Name:

Position:

Phone Numbers:

Work:

Cell:

Home/Other:

E-mail Address:

Check one of the following:

Management Official

Security Officer

Non-Management

Additional Information (to be provided when a contractor or subcontractor employee is reporting directly to the NCSC):

*Contractor/Subcontractor (circle as appropriate):

**SSA Contract Number (if known):

3. Information about the data that was lost/stolen:

Describe what was lost or stolen (e.g., case file, MBR (Master Beneficiary Record) data):

Which element(s) of PII did the data contain?

Name

Bank Account Info

SSN

Medical/Health Information

Date of Birth

Benefit Payment Info

Place of Birth

Mother’s Maiden Name

Address

Other (describe):

Estimated volume of records involved:

4. How the data was physically stored, packaged and/or contained?

Paper or Electronic? (circle one):

If Electronic, what type of device?

Laptop

Tablet

Backup Tape

Blackberry

Workstation

Server

CD/DVD

Blackberry Phone #

Hard Drive

Floppy Disk

USB Drive

Other (describe):

Additional Questions if Electronic:

a. Was the device encrypted?

b. Was the device password protected?

c. If a laptop or tablet, was a VPN SmartCard lost?

Cardholder’s Name:

Cardholder’s SSA logon PIN:

Hardware Make/Model:

Hardware Serial Number:

Additional Questions if Paper:

a. Was the information in a locked briefcase?

b. Was the information in a locked cabinet or drawer?

c. Was the information in a locked vehicle trunk?

d. Was the information redacted?

e. Other circumstances:

5. If the employee/Contractor/subcontractor who was in possession of the data or to whom the data was assigned is not the person making the report to the NCSC (as listed in #1), information about this employee/Contractor/subcontractor:

Name:

Position:

Phone Numbers:

Work:

Cell:

Home/Other:

E-mail Address:

Additional Information (to be provided when person who was in possession of the data or…