SWC_121_Specifications_ITB_v2.pdf

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 1

Specifications for SWC #121 Shredding Services

A. Scope of Contract

The purpose of this ITB is to competitively procure shredding services for paper or printed media to ensure compliance with State and federal privacy laws and to mitigate risk to user agencies across the State by providing a program focused on safeguarding confidential information from being accessed and used for fraudulent purposes.

B. Definitions

As Needed Shredding Service

The collection and shredding (Mobile or Plant-Based) of contents from bins on a non-scheduled or situation arises basis.

Contract Administrator Main point of contact for contract at Central Procurement Office.

Contract Manager A representative of the Contractor and single point of contact for the

State Contract Administrator responsible for addressing broad contract issues and requests brought to them by the State Contract Administrator or Authorized User.

Mobile Shredding Secure destruction activities carried out using mobile commercial-grade destruction equipment that destroys Paper or Printed Media within an enclosed and secured vehicle (truck or trailer) at the Authorized User’s site.

Paper or Printed Media Information printed on paper or other material that can be read by the naked eye without the assistance of a special device, such as documents, ID badges, credit/debit cards and photos.

Plant-Based Shredding Secure destruction activities carried out using fixed-location commercial-grade destruction equipment that conducts the entire process, including the staging, destruction, baling and storage of destroyed materials, within a secure building environment. May also be referred to as Mobile Shredding Services.

Purge Service An information destruction project that is defined by the Authorized User as an inordinately large amount of confidential customer media to be destroyed.

Scheduled Shredding Service

The collection and shredding (Mobile or Plant-Based) of contents from bins on a regularly scheduled basis that is mutually agreed upon by Contractor and Authorized User (e.g. once a week, twice a month, etc.)

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 2

C. Scope of Work

Contractors responding to this ITB shall provide services in the following service categories for shredding services:

• Mobile Shredding

• Plant-Based Shredding

• Purge Service (Per Bin/Container Size)

D. General Administrative Requirements

1. Contract Manager.

The Contractor shall designate a Contract Manager for the contract. The Contract Manager shall be a single point of contact for the State Contract Administrator and be responsible for addressing broad contract issues and requests brought to them by the State Contract Administrator or Authorized User. The Contract Manager shall have the authority and competence to address and correct any issues related to the contract. The Contractor shall notify the State Contract Administrator in writing within three (3) business days of assigning a new Contract Manager. Contact information shall be provided for each Contractor location awarded under SWC 121. Authorized Users must be able to reach out to each location with questions including, but not limited to the following: scheduling, billing, invoices, estimates, and service.

2. Escalation Tree.

An agreed upon escalation tree of employees and contact information shall be provided by the awarded Contractor(s) within five (5) business days after the contract award. This document shall provide contact information to be used when either party has questions or concerns regarding the contract, specifically if an issue with the contract must be escalated.

The “tree” must include employee names, titles, phone numbers, and email addresses and must be listed in ascending order by position. The document may not be abused by either party to reach the highest-ranking employee with questions or issues that may be addressed by a lower position. Contact information must be provided starting with the Contractor’s Contract Manager or administrative position and ending with a position that has high-level decision-making power for the party. The number of positions may differ for each party.

This escalation tree is to include “branches” for billing/invoicing and reporting information contacts. If the contact is the same as the Contract Manager, that must be specified.

3. Customer Service.

The Contractor shall respond by phone or email to any call or email sent by the State or its Authorized Users within a maximum of two (2) business days.

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 3

4. Service Transition.

a) After contract award, the Contractor shall work with the Authorized User and any other organizations designated by the Authorized User to ensure an orderly transition of services and responsibilities under the contract and to ensure the continuity of those services required by the Authorized User.

b) The Contractor understands and agrees that each Authorized User has different needs and shall set up their own schedules, billing location(s), and contact information for each location.

c) The Contractor shall assist the Authorized User by providing a contact(s) for each service location/area for areas of billing, servicing, and disputes

E. Certification Requirements

1. NAID Certification.

a) Contractor shall be an AAA-certified member in good standing with the National

Association for Information Destruction (NAID). Contractor agrees to maintain NAID certification throughout the entirety of this contract at no additional charge to the State. Contractor shall immediately notify Contract Administrator if Contractor fails to maintain NAID certification. Contractor and all approved subcontractor(s) shall supply the State with a copy of NAID certification when requested at no additional charge to the State.

b) All shredding facilities used during the performance of this contract shall be NAID certified.

c) Contractor(s) shall submit proof of NAID certification(s) to the State’s Contract Administrator annually.

F. Pricing and Invoicing

1. Pricing Structure.

a) Contractor shall provide “not to exceed” pricing for Mobile and Plant-Based shredding for Paper or Printed Media on a per bin per trip occurrence.

b) Contractor shall provide “not to exceed” pricing for Mobile and Plant-Based Purge Services on a per bin per trip occurrence.

2. Fees

a) Contractor shall provide pricing inclusive of all associated costs for these services.

Contractor shall not charge any additional fees or hidden fees that are not defined within this contract.

b) Installation Fee is defined as a one-time charge Contractors may apply for the initial delivery of Authorized User approved bins to a brand new or transitioning location.

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 4

3. Invoicing Requirements

a) State Agencies may have special invoicing requirements including, but not limited to, centralized billing or billing by serviced location. The Contractor shall accommodate invoicing requirement requests by Agencies at no extra charge to the State.

b) Contractor shall work with Agencies to confirm where invoices are to be sent, whether it is through a paper statement sent to a physical address or sent electronically to an email address.

c) Agency requests and Contractor accommodation of invoice requests shall not conflict with Terms and Conditions Section 6.4. Invoice Requirements.

G. Service Requirements

1. Bin Requirements

a) The Contractor shall coordinate with each Authorized User to determine the number and size of bins required to meet Authorized User needs. The quantity or location of bins may change per Authorized User at any time per request of Authorized User;

Contractor shall coordinate with Authorized Users as to quantities needed per location.

b) The Contractor shall not assign minimum or maximum quantities of bins to any Authorized User utilizing this contract.

c) Contractor must have the ability to supply three (3) different-sized locking bins to accommodate paper/records collection at Authorized User locations. The three sizes must fall within one of each of the following inclusive ranges: 28-32, 60-70 and 90-100 gallons. Respondents are allowed to bid additional bin sizes, but one bin from each of the three inclusive ranges above are the minimum requirements. Additional bin sizes may be added to the contract based on what is in the best interest of the State at the time of contract award.

d) All bins shall be provided free of charge to the Authorized User with no rental or delivery/pickup fees.

e) The 28-32 gallon bin shall meet Joint Commission Standards (JCAHO) and have a maximum capacity of 32 gallons.

f) Contractor shall maintain all bins in operable condition, replacing locks, lids, handles, etcetera as needed. Contractor shall replace and repair damaged bins at no additional charge to the Authorized User; the Authorized User determines if a bin needs to be replaced.

g) Contractor shall clearly mark bins for their intended use with a list of items that may or may not be placed in bins.

h) The Contractor shall retain ownership of the bins. The Contractor shall agree that the State shall not be responsible for any liability incurred by the Contractor, the Contractor’s employee, or subcontractor personnel arising out of the possession, use, maintenance, delivery, return, or collection from the bins provided by the Contractor.

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 5

2. Bin Servicing

a) All materials shall be destroyed to the applicable NAID specifications. If at any point these specifications are updated by NAID it is the Contractor’s responsibility to abide by the new specifications and notify Contract Administrator immediately.

b) Contractor shall provide “Certificate of Destruction” at the end of each service to Authorized User representative on the same day of service. Certificate of Destruction format shall be at the discretion of the Authorized User.

c) Contractor shall provide additional destruction documentation at the request of Authorized Users.

d) Contractor agrees that the Authorized User, at any time throughout the contract, may accompany the Contractor during any collection, hauling, weighing, or destruction process being conducted by the Contractor for mobile destruction. Contractor shall not restrict or in any way limit the Authorized User’s right or ability to oversee any services provided by the Contractor.

e) For Mobile Shredding Services, the Contractor shall clean up the immediate document destruction area and ensure that all loose materials are collected and removed each time document destruction services are performed.

f) Authorized Users reserve the right to decide which shredding service is best for them and which service maintains the required level of security for sensitive documents.

3. Delivery and Servicing of Bins

a) The Contractor shall deliver all bins and have them available for Authorized User use within five (5) business days of request/purchase order, unless otherwise specified and agreed upon by Authorized User.

b) Delivery and retrieval shall be made during normal business hours only, 8:00 a.m. to 4:30 p.m. Monday through Friday except for State holidays, unless prior approval for other times has been obtained from the Authorized User in writing.

c) Contractor shall deliver bins on the dates and times agreed upon by the Authorized User and Contractor. The Authorized User has the right to refuse any unscheduled pick-ups without charge or penalty.

d) Contractor shall be responsible for delivery, set-up and all transportation costs.

e) Contractors and subcontractors are required to sign-in and sign-out at all State facilities.

Security provisions for all State facilities must be strictly observed.

f) Contractors shall utilize proper entrances, exits, and elevators designated by authorized users at each State facility.

4. Scheduled Services

a) Contractor shall coordinate with Authorized Users to schedule recurring service times and dates.

b) The Authorized User shall request scheduled shredding service depending on the anticipated need of the Authorized User. The bin size(s) and schedule may be adjusted

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 6 at any time, with five (5) business days written advance notice, by the Authorized User to better complement the Authorized User’s requirements.

c) Contractor agrees to notify Authorized User within two (2) hours of knowledge if not able to fulfill a scheduled shredding service appointment. Contractor agrees to complete service within twenty-four (24) hours of missed appointment, unless otherwise specified and agreed upon in writing by Authorized User.

H. As Needed and Purge Services

1. As Needed Services

Occasionally, existing Authorized Users may have an unexpected shredding service need; in these situations, the Contractor shall complete service request within five (5) business days upon notification or purchase order from Authorized User, unless otherwise specified and agreed upon in writing by Authorized User.

2. Purge Services

a) Authorized Users must request a quote from the Contractor awarded the region in which the location needing purge service resides. Authorized Users may also request a quote from any additional Contractors on contract awarded in other regions. Authorized Users that request quotes from additional Contractors awarded in other regions shall select the Contractor who provides the lowest quote.

b) Contractor shall honor Purge Service pricing for:

• All bin sizes specified in Section G. of these Specifications

• Banker boxes or containers up to 2.4 cubic feet in size

I. Security Requirements

1. High Security Locations

a) The Contractor is advised that for all State facilities, the Contractor and their employees shall strictly abide by all State policies and procedures at all times. Deviations from these policies by the Contractor, their employees or subcontractor personnel will not be tolerated and will be considered grounds for corrective action and may warrant contract cancellation.

b) At all locations, the Contractor’s onsite employee shall be required to provide a government-issued photo identification for inspection upon entering all State facilities and may be subject to TBI background checks. Upon request by the Authorized Users for background check(s), the Contractor shall absorb all costs to obtain the requested TBI background check(s).

c) Visits to all State facilities require proper check-in and check-out; on no occasion will service be provided without proper contact with those personnel in charge of the facility. Security provisions for all State facilities must be strictly observed. The Contractor shall coordinate access to the State facility with the Authorized User.

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 7

d) Contractors providing services to High Security Locations are required to have background checks of onsite employees, give a forty eight (48) hour notice upon arrival, and shall be escorted while on the premises when providing service to those High- Security Locations.

e) All Contractor and subcontractor personnel shall have visible identification at all times.

Contractor and subcontractor personnel shall be required to provide photographic identification for inspections upon entering all State facilities.

2. Handling of Confidential and Sensitive Material

a) Contractors shall maintain the confidentiality of all information. All records shall be disposed of in a confidential manner. Removal of records to the municipal dump is not permitted. The Contractor shall:

i. Ensure no violation of any State, federal or local law, including HIPAA guidelines;

ii. Ensure that there are appropriate safeguards to prevent use or disclosure of the information;

iii. Immediately inform the affected Authorized User and the Contract

Administrator of any use or disclosure of information; and

iv. Contractors shall ensure that all subcontractor and third-party entity (i.e. paper mills, trucking companies, etc.) employees are aware and prohibited from disclosing confidential information.

b) Contractor shall enter into a Business Associate Agreement (BAA) with the State as described in Attachment A of the Contract.

3. Social Security Administration (SSA) Required Provisions for Data Security.

The Contractor shall comply with limitations on use, treatment, and safeguarding of data under the Privacy Act of 1974 (5 U.S.C. 552a), as amended by the Computer Matching and Privacy Protection Act of 1988, related Office of Management and Budget guidelines, the Federal Information Security Management Act of 2002 (44 U.S.C. §3541, et seq.), and related National Institute of Standards and Technology guidelines.

a) In addition, the Contractor shall have in place administrative, physical, and technical safeguards for data.

i. The Contractor shall specify in its agreements with any agent or subcontractor that will have access to data that such agent or subcontractor agrees to be bound by the same restrictions, terms and conditions that apply to the Contractor pursuant to this Section;

ii. The Contractor shall not duplicate in a separate file or disseminate, without prior written permission from the State, the data governed by the Contract for any purpose other than that set forth in this Contract for the administration of the State. Should the Contractor propose a redisclosure of said data, the Contractor must specify in writing to State the data the Contractor proposes to redisclose, to whom, and the reasons that justify the redisclosure. State will not

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 8 give permission for such redisclosure unless the redisclosure is required by law or essential to the administration of the State.

iii. The Contractor agrees to abide by all relevant federal laws, restrictions on access, use, and disclosure, and security requirements in this Contract.

iv. The Contractor shall maintain a current list of the employees of such contractor with access to SSA data and provide such lists to State upon request and at any time there are changes.

v. The Contractor shall restrict access to the data obtained from State to only those authorized employees who need such data to perform their official duties in connection with purposes identified in this Contract. The Contractor shall not further duplicate, disseminate, or disclose such data without obtaining State’s prior written approval.

vi. The Contractor shall ensure that its employees:

1. Properly safeguard PHI/PII furnished by State under this Contract from loss, theft or inadvertent disclosure;

2. Receive regular, relevant and sufficient SSA data related training, including use, access and disclosure safeguards and information regarding penalties for misuse of information;

3. Understand and acknowledge that they are responsible for safeguarding this information at all times, regardless of whether or not the Contractor employee is at his or her regular duty station;

4. Ensure that laptops and other electronic devices/ media containing PHI/PII are encrypted and/or password protected;

5. Send emails containing PHI/PII only if the information is encrypted or if the transmittal is secure; and,

6. Limit disclosure of the information and details relating to a PHI/PII loss only to those with a need to know.

vii. Contractor employees who access, use, or disclose State or State SSA-supplied data in a manner or purpose not authorized by this Contract may be subject to civil and criminal sanctions pursuant to applicable federal statutes.

viii. Loss or Suspected Loss of Data - If an employee of the Contractor becomes aware of suspected or actual loss of PHI/PII, the Contractor must notify State immediately upon becoming aware to report the actual or suspected loss. The Contractor must provide State with timely updates as any additional information about the loss of PHI/PII becomes available.

ix. If the Contractor experiences a loss or breach of said data, State will determine whether or not notice to individuals whose data has been lost or breached shall be provided and the Contractor shall bear any costs associated with the notice or any mitigation.

x. State may immediately and unilaterally suspend the data flow under this Contract, or terminate this Contract, if State, in its sole discretion, determines

SWC 121 Shredding Services, Specifications, Event #32110-13596 Page 9 that the Contractor has: (1) made an unauthorized use or disclosure of State SSA-supplied data; or (2) violated or failed to follow the terms and conditions of this Contract.

xi. This Section further carries out Section 1106(a) of the Act (42 U.S.C. 1306), the regulations promulgated pursuant to that section (20 C.F.R. Part 401), the Privacy of 1974 (5 U.S.C. 552a), as amended by the Computer Matching and Privacy Protection Act of 1988, related Office of Management and Budget ("OMB") guidelines, the Federal Information Security Management Act of 2002 ("FISMA”) (44 U.S.C. 3541 et seq.), and related National Institute of Standards and Technology (“NIST”) guidelines, which provide the requirements that the SSA stipulates that the Contractor must follow with regard to use, treatment, and safeguarding data in the event data is exchanged with a federal information system.

xii. Definitions

1. “SSA-supplied data” or “data” as used in this section – information, such as an individual’s social security number or income, supplied by the Social Security Administration to State to determine entitlement or eligibility for federally-funded programs (covered by a CMPPA between SSA and F&A, and IEA between SSA and State).

2. “Protected Health Information/Personally Identifiable Information” (PHI/PII)(45 C.F.R. 160.103; OMB Circular M-06-19) – Protected health information means individually identifiable health information that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or

(iii) Transmitted or maintained in any other form or medium.