IA02 PWS - Final - IRAHC Shredding Services.pdf

PERFORMANCE WORK STATEMENT (PWS)

ON-SITE DOCUMENT AND HARD-DRIVE DESTRUCTION SERVICES

UNITED STATES ARMY MEDICAL DEPARTMENT ACTIVITY (USA MEDDAC),

FORT KNOX, KENTUCKY

PART 1

GENERAL INFORMATION

1. General: This is a non-personal services contract to provide on-site document and hard-drive destruction services. The Government shall not exercise any supervision or control over the contract service providers (CSPs) performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1. Description of Services/Introduction. The Contractor shall provide all personnel, labor, supervision, management support, transportation for pick-up and delivery services, equipment, and materials to include contractor furnished consoles and carts as required and necessary for the performance of providing on-site document destruction services of Protected Health Information (PHI) and Personally Identifiable Information (PII) and hard drive destruction for USA Medical Department Activity (MEDDAC)-Fort Knox, Kentucky and its work sites on Fort Knox, Blue Grass Army Depot, KY; and Camp Atterbury, Indiana. This contract includes all functions, tasks, and responsibilities normally inherent to providing on-site PHI and PII document destruction and hard drive destruction services. Requirements for this effort are determined by demand based on USA MEDDAC daily patient load.

1.2. Background. USA MEDDAC consists of: a full service health clinic and 12 ancillary facilities located on Fort Knox, Kentucky; 1 occupational health clinic and 1 ancillary facility located on Blue Grass Army Depot-Lexington, Kentucky;

and 1 health clinic and 1 ancillary facility located on Camp Atterbury-Edinburgh, Indiana. USA MEDDAC is a part of the Defense Health Agency headquartered at Falls Church, Virginia. USA MEDDAC is subject to accreditation by the Joint Commission (JC). On-site document and hard-drive destruction of PHI/PII information media destruction have been provided under contract for over 19 years. On-site hard drive destruction has been performed for the past 13 years.

1.3. Objectives. The contractor shall provide on-site PHI/PII document destruction services and hard drive electronic media destruction services meeting federal Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 Code of Federal Regulations (CFR) and other references listed within this PWS.

1.4. Scope. The Contractor shall provide all personnel, labor, supervision, management support, transportation for pick-up and delivery services, equipment, and materials to include contractor furnished consoles and carts as required and necessary for the performance of providing on-site document destruction services of PHI (PHI) and Personally Identifiable Information (PII) and hard drive destruction for USA Medical Department Activity (MEDDAC), Fort Knox, Kentucky. Services include all functions, tasks, and responsibilities normally inherent to providing on-site PHI, PII, and hard drive destruction services. Requirements for this effort are determined by demand based on USA MEDDAC daily patient load. The estimated annual poundage of PHI/PII shredded is 41,000 pounds averaging between 2,700 and 3,400 pounds monthly.

The estimated hard drive electronic media to be destroyed annually is 500 pounds. On-site document destruction services shall be made bi-weekly (twice per month). Additionally, these services shall include secure pick-up and on-site destruction of PHI, PII, and computer hard drives at USA MEDDAC work sites located on: Fort Knox, Kentucky; Blue Grass Army Depot-Lexington, Kentucky;

and Camp Atterbury-Edinburgh, Indiana. The Contractor shall establish and maintain a system of records to control and account for work performed. The Contractor shall prepare all administrative correspondence incidental to work covered by this contract. All work under this contract shall be accomplished in accordance with regulations, laws, standards, or specifications cited in this contract Performance Work Statement (PWS).

1.4.1. The contractor shall have direct experience in providing on-site document destruction operations for PHI/PII and hard drive destruction. The firm must have gained this experience as a result of being regularly engaged in the business of providing medical facility on-site PHI/PII paper destructions as well as on-site computer hard drive destruction services for health care/patient care environments (e.g., inpatient and outpatient medical treatment facilities). The contractor shall submit a statement of experience as a company providing on-site document destruction operations supporting hospital PHI/PII and on-site hard drive destruction services with the proposal. The minimum level of acceptable experience required is the immediate 36 months from the date initially established for submission of proposal. Only firms with both on-site PHI/PII and on-site hard drive destruction within a healthcare facility shall be considered for award.

1.4.2. Certification. The contractor shall be AAA certified by National Association for Information Destruction Inc. (NAID), bonded, and insured. Both paper/printed media and micro media (hard drive) endorsements must be obtained and remain current throughout the entire contract period as of contract start date. The contractor shall provide the Contracting Officers Representative (COR) with one copy of each certification upon contract award and upon renewal.

1.4.3. Liability Insurance. The contractor is responsible for maintaining liability insurance in the amount of $1,000,000.00 for the duration of the contract. The contractor shall provide the COR with one copy of the liability insurance certificate upon contract award and upon renewal.

1.4.4. Business Associate Agreement. The contractor shall sign a HIPPA Business Agreement with USA MEDDAC Fort Knox regarding the protection of patient privacy information prior to the contract start date with original copy provided to the COR.

1.5. RESERVED

1.6. General Information

1.6.1. Reserved.

1.6.2. Quality Assurance. The government shall evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan. This plan is primarily focused on what the Government must do to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.6.3. Recognized Holidays. Federal holidays falling on a Saturday shall be observed on the preceding Friday; holidays falling on a Sunday shall be observed on the following Monday. The contractor is not required to perform services on these holidays:

New Year’s Day, January 1st Martin Luther King’s Birthday, 3rd Monday in January Presidents’ Day, 3rd Monday in February Memorial Day, last Monday in May Juneteenth, June 19th Independence Day, July 4th Labor Day, 1st Monday in September Columbus Day, 2nd Monday in October Veteran’s Day, November 11th Thanksgiving Day, 4th Thursday in November Christmas, December 25th

1.6.4. Hours of Operation. The contractor shall conduct business between the hours of 8:00 am – 3:30 pm, Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.6.5. Place of Performance. The work to be performed under this contract will be performed at: USA MEDDAC Fort Knox, Kentucky; Blue Grass Army Depot- Lexington, Kentucky; and Camp Atterbury-Edinburgh, Indiana.

1.6.6. Type of Contract. The government will award a Firm Fixed Price (FFP) contract.

1.6.7. Security Requirements. Contractor personnel performing work under this contract must comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures which will be provided to the contractor by a government representative within five working days of contract award. The contractor shall provide all information required for background checks to meet installation access requirements to be accomplished by the USA MEDDAC Security Office for National Agency Check with Inquiries and local background check for the Provost Marshalls, as applicable, for Fort Knox, Blue Grass Army Depot, and Camp Atterbury. Access will be granted/denied at respective sites using CSP’s driving license in accordance with provisions set forth in Fort Knox Policy Memorandum-14, Fort Knox Bar Letters, (enclosure 1), and the provisions of Blue Grass Army Depot and Camp Atterbury Access Roster Requirements. CSP’s failing to meet access conditions will not be permitted on Fort Knox, Blue Grass Army Depot, or Camp Atterbury. CSPs shall comply with all personal identity verification requirements as directed by DoD, HQDA and/or local policy. CSPs shall comply with all personal identity verification requirements as directed by Department of Defense (DOD), Headquarters Department of the Army (HQDA) and/or local policy. In addition to the changes otherwise authorized by the changes clause of the base contract to this task order, should the Force Protection Condition (FPCON) at any facility or installation change, the government may require changes in contractor security matters or processes.

1.6.7.1. Physical Security. The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

At the close of each work period, government facilities, equipment, and materials shall be secured.

1.6.7.2. Key Control. The Contractor shall coordinate with the COR or the Government point of contact at the government facility for access to the building.

All access/key cards issued by the Government for use only during that day’s visit to government facilities and returned to the Government at the end of that day’s work in the government facilities are not lost or misplaced, are not used by unauthorized people, and are not duplicated. The Contractor shall develop procedures covering access/key card control that shall be included in the

1.6.8. Training.

1.6.8.1. AT Level I Training. Anti-Terrorism Level 1 Training is required for all Department of Defense civilian, military, and contractor requiring access to Army installations facilities and controlled access areas. At-Level 1 Training must be completed by employees within 30 calendar days after contract start date, or within 30 days of on-boarding. Thereafter, AT-Level 1 Training must be completed annually. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR within 30 calendar days after training completion. AT-Level I awareness training is available at the following website: https://jko.jten.mil/courses/AT-level1/launch.html .

1.6.8.2. iWATCH Training. The contractor and all associated sub-contractors shall brief all CSPs on the local iWATCH program by viewing a short video on how you as a contractor can be vigilant and report suspicious activities, “See Something Say Something”, as you perform you job in support of the U.S. Army contract. (Approximately 8 min, 28 sec.)

https://www.youtube.com/embed/vlzYhQp7fPw?vq=medium or https://youtu.be/2uIDscKiNU0 . iWATCH Training must be completed within 30 calendar days after contract start date, or within 30 days of on-boarding.

Thereafter, AT-Level 1 Training must be completed annually. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR within 30 calendar days after completion of training.

1.6.8.3. Controlled Unclassified Information (CUI) training. Controlled Unclassified Information training is required for all Department of Defense civilian, military, and contractor personnel with access to Government CUI. The mandatory CUI training course must be completed within 30 days of on-boarding and annually, thereafter. The course is accessible via the Center for Development of Security Excellence, Defense Counterintelligence, and Security Agency website https://securityawareness.dcsa.mil/cui/index . The contractor shall submit certificates of completion for each affected employee to the COR within 30 calendar days after completion of training.

1.6.8.4. Health Insurance Portability and Accountability Act (HIPAA) training.

The Health Insurance Portability and Accountability Act and Privacy Act training is required of all Defense Health Agency civilian, military, and contractor personnel. HIPPA Training must be completed by employees within 30 calendar days after contract start date, or within 30 days of on-boarding. Thereafter, HIPPA Training must be completed annually. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee to the COR within 30 calendar days after training completion. The course is accessible via the Joint Knowledge Online website https://www.jcs.mil/JKO/ . The contractor shall submit certificates of completion https://jko.jten.mil/courses/AT-level1/launch.html https://jko.jten.mil/courses/AT-level1/launch.html https://www.youtube.com/embed/vlzYhQp7fPw?vq=medium https://youtu.be/2uIDscKiNU0 https://securityawareness.dcsa.mil/cui/index https://www.jcs.mil/JKO/ for each affected employee to the COR within 30 calendar days after completion of training.

1.6.8.5. Access and General Protection/Security Policy and Procedures.

Contractor and all associated sub-contractors CSPs shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. The contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.9. Post Award Conference/Periodic Progress Meetings. The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The contracting officer, Contracting Officers Representative (COR), and other Government personnel, as appropriate, may meet periodically with the contractor to review the Contractor's performance. At these meetings the contracting officer will apprise the contractor of how the government views the Contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.6.10. Contracting Officer Representative (COR). The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration The COR is authorized to perform the following functions: assure that the Contractor performs the technical requirements of the contract: perform inspections necessary in connection with contract performance:

maintain written and oral communications with the Contractor concerning technical aspects of the contract: issue written interpretations of technical requirements, including Government drawings, designs, specifications: monitor Contractor's performance and notifies both the Contracting Officer and Contractor of any deficiencies; coordinate availability of government furnished property, and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting order.

1.6.11. Key Personnel. The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the contracting officer. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to the daily operation of this contract. The contract manager or alternate shall be available between 8:00 am- 3:30 pm ET, Monday through Friday except Federal holidays or when the government facility is closed for administrative reasons. The designee shall have a minimum of 24 months of direct experience managing mobile on-site document and hard-drive destruction service operations.

1.6.12. Identification of Contractor CSPs. All contractor personnel shall wear distinctive company uniforms displaying the company’s name while performing duties under this contract. In addition, all staff will be issued and wear USA MEDDAC identification badge while working in USA MEDDAC buildings.

Contractor personnel arriving at Fort Knox shall report to the Logistics Division Environmental Services Office, building 871, room 1601 for identification badge prior to beginning work and sign-out at the same room prior to final departure from the work site. Contractor personnel arriving at Camp Atterbury, Indiana will report to bldg. 2 Troop Medical Clinic to sign-in and to receive a temporary identification badge if required for use that day. Contractor personnel arriving at Blue Grass Army Depot will report to bldg. 1 Occupational Health Clinic to sign-in and to receive a temporary identification badge if required for use that day.

Contractor personnel's uniform shall be clean and maintained in good repair.

1.6.13. Phase-In/Phase-Out Period. To minimize any decreases in productivity and to prevent possible negative impacts on additional services, the Contractor shall have personnel on-board, during the phase in/ phase out periods. During the phase in period, the Contractor shall become familiar with performance requirements in order to commence full performance of services on the contract start date.

PART 2

DEFINITIONS, ACRONYMS, AND ABBREVIATIONS

2. Definitions, Acronyms, and ABBREVIATIONS:

2.1. DEFINITIONS:

2.1.1. CONTRACTOR. A supplier or vendor awarded a contract to provide specific supplies or service to the government. The term used in this contract refers to the prime.

2.1.2. CONTRACTING OFFICER. A person with authority to enter into, administer, and / or terminate contracts, and make related determinations and findings on behalf of the government. Note: The only individual who can legally bind the government.

2.1.3. CONTRACTING OFFICER'S REPRESENTATIVE (COR). An employee of the U.S. Government appointed by the contracting officer to assist in the administration of the contract. Such appointment shall be in writing and shall state the scope of authority and limitations. This individual has authority to provide technical direction to the Contractor as long as that direction is within the scope of the contract, does not constitute a change, and has no funding implications. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.4. DEFECTIVE SERVICE. A service output that does not meet the standard of performance associated with the Performance Work Statement.

2.1.5. DELIVERABLE. Anything that can be physically delivered, but may include non-manufactured things such as meeting minutes or reports.

2.1.6. HIPAA -the federal Health Insurance Portability and Accountability Act of 1996. The primary goal of the law is to make it easier for people to keep health insurance, protect the confidentiality and security of healthcare information ad help the healthcare industry control administrative costs.

2.1.7. KEY PERSONNEL. Contractor personnel that are evaluated in a source selection process and that may be required to be used in the performance of a contract by the Key Personnel listed in the PWS. When key personnel are used as an evaluation factor in best value procurement, an offer can be rejected if it does not have a firm commitment from the persons that are listed in the proposal.

2.1.8. PHYSICAL SECURITY. Actions that prevent the loss or damage of Government property.

2.1.9. PROTECTED HEALTH INFORMATION (PHI). Individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium.

2.1.10. PERSONALLY IDENTIFIABLE INFORMATION (PII). any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual."

2.1.11. QUALITY ASSURANCE. The government procedures to verify that services being performed by the Contractor are performed according to acceptable standards.

2.1.12. QUALITY ASSURANCE Surveillance Plan (QASP). An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance.

2.1.13. QUALITY CONTROL. All necessary measures taken by the Contractor to assure that the quality of an end product or service shall meet contract requirements.

2.1.14. SUBCONTRACTOR. One that enters into a contract with a prime contractor. The Government does not have privity of contract with the subcontractor.

2.1.15. WORK DAY. The number of hours per day the Contractor provides services in accordance with the contract.

2.1.16. WORK WEEK. Monday through Friday, unless specified otherwise.

2.2. ACRONYMS AND ABBREVIATIONS:

AR Army Regulation CFR Code of Federal Regulations COR Contracting Officer Representative CSP Contract Services Provider DA Department of the Army DD250 Department of Defense Form 250 (Receiving Report) DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DOD Department of Defense FAR Federal Acquisition Regulation HIPAA Health Insurance Portability and Accountability Act of 1996 KO Contracting Officer

MEDDAC Medical Activity OCI Organizational Conflict of Interest PHI Protected Health Information PII Personally Identifiable Information PIPO Phase In/Phase Out POC Point of Contact PRS Performance Requirements Summary PWS Performance Work Statement QA Quality Assurance QASP Quality Assurance Surveillance Plan TE Technical Exhibit USA United States Army

PART 3

GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3. GOVERNMENT FURNISHED ITEMS AND SERVICES:

3.1. Materials: The Government will provide contractor CSPs involved with the collection and destruction of PHI/PI documents and computer hard drives with a temporary Ireland identification badge that shall be worn during all on-site PHI/PI and on-site hard drive destruction while at USA MEDDAC sites. Contractor personnel shall report to the Logistics Division Environmental Services Office, building 871, room 1601 for identification badge prior to beginning work and sign-out at the same room prior to final departure from the work site. Contractor personnel arriving at Camp Atterbury, Indiana will report to bldg. 2 Troop Medical Clinic to sign-in and to receive a temporary identification badge if required for use that day. Contractor personnel arriving at Blue Grass Army Depot will report to bldg. 1 Occupational Health Clinic to sign-in and to receive a temporary identification badge if required for use that day.

PART 4

CONTRACTOR FURNISHED ITEMS AND SERVICES

4. CONTRACTOR FURNISHED ITEMS AND RESPONSIBILITIES:

4.1 General: The Contractor shall furnish all supplies, equipment, facilities and services required to perform work under this contract that are not listed under Section 3 of this PWS.

4.2. Collection Consoles. The contractor shall provide locking consoles in the appropriate size(s) for the collection of the Materials intended for document destruction. Individual activity lockable collection console shall not exceed the exterior dimensions of 21 inches wide by 21inches deep by 36 inches high with document slot for use at each activity collection points unless otherwise approved by the COR. The contractor shall provide lockable collection consoles in quantities and locations listed in Technical Exhibit A. The contractor shall provide two keys per collection console to the Environmental Services Branch for management and access to the collection consoles between scheduled pick-ups.

4.3. Bulk Transport Carts. Contractor shall provide a minimum of four lockable 32-gallon bulk PII/PHI HIPAA slotted transport carts with wheels and slotted for paper collection of material between service dates for activity purges or activity container overfills and purges. All transport carts used to transport material from designated shred collection points to the shredder truck shall have the empty transport cart weight placed on each transport cart in permanent black magic marker. Collection transport carts shall be provided to the government at no cost. The contractor shall provide two keys per cart to the Environmental Services Branch for management and access to the transport carts between scheduled pick-ups.

4.4. Vehicles. The contractor shall provide vehicle(s) capable of on-site document destruction of all types of PHI, PII, and hard drive material at time of service. Vehicle shall be equipped with high speed mobile document destruction equipment and interior camera for viewing the material being shredded and destroyed. The vehicle shall also be equipped with a Legal for Trade scale for weighing shred material picked up from each location. The contractor shall maintain calibration of scale per manufacturer guidelines or at least annually.

The contractor shall provide a copy of the Legal for Trade Scale calibration data to the COR within 15 calendar days of contract start date and annually thereafter.

The contractor shall ensure all equipment is serviceable and complies with all federal, state, and OSHA laws and regulations.

PART 5

SPECIFIC TASKS

5. Specific Tasks:

5.1. The contractor shall furnish all personnel, supervision, tools, materials, equipment, transportation, vehicles, and other replenishment supplies and services necessary to provide on-site document destruction and hard drive destruction services for all USA MEDDAC supported activities listed in Exhibit A of this PWS. Procedures shall be consistent with the federal Health Insurance Portability and Accountability Act of 1996, commercial standards, all local, state and federal laws and the requirements of this PWS. All services performed shall meet the prescribed standards of the Performance Requirements Summary (PRS) to be regarded as acceptable.

5.2. Specific Tasks and Standards for document destruction PHI/PII documents and computer hard drive destruction.

5.2.1. TASK: Arrival Time. For work at Fort Knox: The contractor shall report to Logistics Division Environmental Services Office, building 871, room 1601 between 08:00-09:00 AM ET on established scheduled document and hard-drive destruction day(s). For work at Camp Atterbury: The contractor shall report to bldg. 2 Troop Medical Clinic reception desk between 08:00 AM-12:00 PM ET on established scheduled document and hard-drive destruction day(s). For work at Blue Grass Army Depot: The contractor shall report to bldg. 1 Occupational Health Clinic reception desk between 08:00 AM-12:00 PM ET on established scheduled document and hard-drive destruction day(s).

5.2.1.1. STANDARD: On scheduled days to begin document destruction and/or hard-drive destruction operations, the contractor reports to: Fort Knox, Logistics Division Environmental Services Office, building 871, room 1601 between 08:00- 09:00 AM ET; Camp Atterbury, building 2, reception desk, between 08:00 AM- 12:00 PM ET; or Blue Grass Army Depot, building 1, reception desk, between

08:00 AM-12:00 PM ET.

5.2.2. TASK: Certificate of Destruction: The contractor shall provide a Certificate of Destruction that all HIPAA PHI/PII confidential materials and hard drives collected were properly destroyed in accordance with all applicable laws and regulations (such as Sarbanes-Oxley, HIPAA, NAID, and the FACTA Disposal Rule) within five calendar days of the destruction. The certificate shall include the location, service date(s), destruction certificate number, individual serial numbers of all computer hard drives destroyed, and weights of paper/printed and hard drives.

5.2.2.1. STANDARD: HIPAA PHI/PII and Hard Drive destruction. The contractor shall shred all PHI/PII and computer hard drives on-site and provide a certificate of destruction listing each individual hard drive serial number to the COR within five calendar days of the destruction.

5.2.3. TASK: Recycling Shredded Material. After materials are completely shredded/made unrecognizable, 100% of the paper shall be commercially recycled. The contractor shall be responsible for disposing of all shredded material off-site at Contractor’s own expense.

5.2.3.1. STANDARD: Final Disposition of Materials. The contractor shall recycle all shredded materials and maintain a record of final disposition for each service date. The contractor shall provide the COR with written documentation of final disposition within 5 days upon request. Sending shredded material to a landfill is strictly prohibited.

5.3. Specific Tasks and Standards for Document and hard-drive destruction Materials.

5.3.1. TASK: Contractor shall perform shredding of paper and other micro media such as computer drives, CD's, DVD's, Mylar, stored data, and other similar items containing personal, confidential, and proprietary information with state-of-the-art, high capacity, high speed mobile document and hard-drive destruction truck(s).

5.3.1.1. STANDARD: Document Destruction Size. The contractor shall shred paper/printed media and micro media meeting NAID’s pierce and shred, HIPAA, and FACTA requirements. Materials shall be shred so that any information contained within the materials cannot be read or reconstructed. All sensitive information shall be made unrecognizable via document destruction.

5.3.1.2. STANDARD: All document destruction shall be no more than five-eighth inch crosscut, pierce and tear technology, performed with hands-free shred and shred materials be on-site at USA MEDDAC facilities/ locations. PHI shall be rendered essentially unreadable, indecipherable, and otherwise incapable of being reconstructed prior to its removal. All document destruction shall be accomplished at each generating government facility. Under no circumstances shall PHI/PII information or hard drives leave any government facility parking area prior to destruction.

5.3.1.3. STANDARD: The Contractor shall utilize high speed mobile document and hard-drive destruction truck(s) with interior camera for viewing the material being shredded/destroyed, of which shall be witnessed by the COR or his/her designated representative.

5.3.1.4. STANDARD: The contractor shall weigh each transport cart containing shred material using a legal for trade scale that is a component of the shred truck. All weights shall be printed out on the shred truck Legal for Trade scale printer with copy provided to the COR prior to final departure from USA MEDDAC. The empty transport cart tare weight shall be subtracted from the shred weight to determine the actual shred weight cart unless the legal for trade scale is designed and provides that function.

5.3.1.5. Upon completion of service, the contractor shall report to COR or his/her designated representative, return "Identification Badge(s)", and sign out using name, date, and time departed.

5.4. TASK: Locking Collection Consoles. The contractor shall provide locking consoles in the appropriate size(s) for the collection of the Materials as approved by the COR intended for document and hard-drive destruction for, but not limited to, all USA MEDDAC Fort Knox activities identified in exhibit A.

5.4.1. Standard: The contractor shall ensure shred collection consoles are lockable and the material unable to be retrieved once placed in the console unlocked by a representative of USA MEDDAC or by the contractor.

5.4.2. Standard: The contractor shall adjust quantities of shred collection consoles throughout USA MEDDAC locations and buildings based on mission.

5.4.3. Standard: Collection consoles shall be provided to the government at no cost.

5.4.4. STANDARD: The contractor shall issue a minimum of two keys per console to the COR for management of the collection of consoles.

5.4.5. STANDARD: The contractor shall provide durable bags with string closures for placement inside the lockable console and provide ten replacement bags for replacement in the event of malfunction.

5.4.6. STANDARD: The contractor shall maintain and repair consoles on an as needed basis or within forty-eight hours of notification by the COR.

5.5. TASK: Shred Material Collection. The contractor shall maintain 100% accountability while performing collection and transport of shred material from consoles to the Contractor’s high speed mobile shred truck.

5.5.1. STANDARD: The contractor shall collect shred material in designated lockable impervious carts.

5.5.2. STANDARD: The contractor shall maintain 100% security of all shred collection carts during collection and transport from the activity holding areas to the contractor’s vehicle for on-site document and hard-drive destruction truck(s) for destruction. The contractor shall not leave transport carts or opened consoles filled with confidential information unattended, i.e. hallways, lobbies, corridors, shred truck, etc., at any time.

5.5.3. STANDARD: The contractor shall re-secure the activity consoles immediately after removal of the document destruction material and re-positioning of the durable collection bag.

5.5.4. STANDARD: The contractor may be accompanied by the COR or his designee to ensure that all consoles are properly collected, sensitive information is being properly handled, transported, and disposed of in accordance to all federal, state, and local regulations.

5.6. TASK: Shred Material and Vehicle Security.

5.6.1. STANDARD: The contractor shall ensure the document and hard-drive destruction truck is locked and the keys removed when not in immediate use.

5.6.2. STANDARD: The contractor shall place the Contractor’s name and telephone number on the vehicle and parked in a predetermined location agreeable to both USA MEDDAC COR and the contractor to perform on-site shredding and hard drive destruction.

PART 6

APPLICABLE PUBLICATIONS

6. Applicable Publications (Current Editions)

6.1. The Contractor must abide by all applicable regulations, publications, manuals, and local policies and procedures.

6.1.1. DoD 6025.18-R, DoD Health Information Privacy Regulation

6.1.2. DoD 5400.11-R, Department of Defense Privacy Program

6.1.3. HIPAA Privacy Rule, 45 CFR Part 160 and Subparts A and E of Part 164

6.1.4. Health Insurance Portability and Accountability Act

6.1.5. OTSG/MEDCOM Policy Memo 14-004, Standardized Security

Training

6.1.6. Public Law 104-191

6.1.7. 36 CFR 1220.14 Subpart A, General Provisions, General Definitions

6.1.8. 44 USC 3302, section 1228.58, Destruction of Temporary Records

6.1.9. Privacy Act of 1974

6.1.10. National Association for Information Destruction (NAID)

PART 7

ATTACHMENT/TECHNICAL EXHIBIT LISTING

Attachment/Technical Exhibit List:

7.1. Technical Exhibit A – Performance Requirements Summary

7.2. Technical Exhibit B – Deliverables Schedule

7.3. Technical Exhibit C – Workload Data

7.4. Technical Exhibit D – Console Locations

TECHNICAL EXHIBIT A

Performance Requirements Summary

PERFORMAN

CE

OBJECTIVE

PERFORMANCE

STANDARD

PERFORMANCE

THRESHOLD

METHOD OF

SURVEILLANC

E

1.3.

Compliance with Laws, Regulations, Rules, and

PWS

100% HIPAA, Patient Privacy Information and hard drive on-site destruction compliance IAW HIPAA Privacy Rule, Federal regulations, and PWS

Zero violations or validated customer complaints per month

Surveillance Checklist and Customer Complaint

5.2.1. Arrival

Time

85% compliance of contractor completing document and hard-drive destruction services during established hours per pick-up schedule

No more than one contract schedule pick-up violation per quarter.

Surveillance Checklist and Customer Complaint

5.2.2.

Certificate of Destruction

100% compliance of contractor providing certificates of destruction within five calendar days after services

Zero violations per month

Surveillance Checklist

5.5.2. Cart and

Console Security

100% compliance of maintain security of all shred collection carts during collection and transport to shred truck

Zero violations per month

Observation and Customer Complaint

TECHNICAL EXHIBIT B

DELIVERABLES SCHEDULE

Deliverable Frequency # of

Copies Format Submit To

1.4.2. AAA

certified by National Association for Information Destruction Inc.

(NAID), bonded, and insured, for both paper/printed media and micro media (hard drive).

Upon contract award and upon every contract option renewal

One Digital or paper (hard copy)

COR

1.4.3. Liability

Insurance.

Upon contract award and upon every contract option renewal

One Digital or paper (hard copy)

COR

1.4.4. Business

Associate Agreement.

Prior to the contract start date.

One Digital or paper (hard copy)

COR

1.6.8.1. AT Level I

Training.

Within 30 calendar days after training completion.

One Digital or paper (hard copy)

COR

1.6.8.2. iWatch Training.

Within 30 calendar days after training completion.

One Digital or paper (hard copy)

COR

1.6.8.3. Controlled

Unclassified Information Training.

Within 30 calendar days after training completion.

One Digital or paper (hard copy)

COR

1.6.8.4. Health

Insurance Portability and

Within 30 calendar days after

One Digital or paper (hard copy)

COR

Accountability Act (HIPAA) Training.

training completion.

5.2.2. Certificate

of Destruction.

Within five

(5) days of destruction.

One Digital or paper (hard copy)

COR

5.2.3.1. Final

Disposition of Materials.

Within five

(5) days upon request by

COR.

Digital or paper (hard copy)

Digital or paper (hard copy)

COR

5.3.1.4. Weights. Prior to

departure from document and hard-drive destruction site.

One paper (hard copy)

COR

5.4.4. Console

Keys.

Upon delivery of console.

Two (2) keys per console keys COR

TECHNICAL EXHIBIT C

WORKLOAD DATA

12-Month Period

Historical Annual Weight (in U.S. Pounds) of Documents and Hard Drives Shredded for Total Each Period (Fort Knox, Camp Atterbury, and Lexington)

01 MAY 2021 – 30 APR

2022 41,187

01 MAY 2022 – 30 APR

2023 41,314

01 MAY 2023 – 30 APR

2024 31,000

01 MAY 2024 – 30 APR

2025 27,782

TECHNICAL EXHIBIT D

CONSOLE LOCATIONS

BLDG

Activity Room Number

Quantity Floor

Fort Knox, Kentucky 122 Binter Pharmacy-Dispensing Area

(Government collection barrels here lined with Contractor bags instead of consoles)*

*12 1

871 Logistics-Healthcare Technology Management

1611 1 1

871 Logistics-Break Room 1620 1 1 871 Radiology Corridor 1 1 871 Radiology/Laboratory Reception 1401 1 1 871 Laboratory-Phlebotomy 1 1 871 Laboratory-Core 1407 1 1 871 Pharmacy-Core (Government collection barrels here lined with Contractor bags instead of consoles)*

*10 1

871 Primary Care Clinic-Reception 1254 1 1 871 Primary Care Clinic-Cubicle Area 3 1 871 Primary Care Clinic-Immunization 1255 1 1 871 Physical Therapy-Reception 1101 1 1 871 Specialty Clinic-Copy Room 2236A 1 2 871 Specialty Clinic-Office 2235 1 2 871 Headquarters-Copy Room 2402 1 2 871 PAD-Records Room 2416 1 2 871 PAD- Copy Room 2443 1 2 871 PAD- Office 2432 1 2 871 PAD- Copy Room 2439 1 2

871 IMD 2300 1 2

871 Behavioral Health-Reception 2170A 1 2 871 Behavioral Health-Corridor intersection Corridor 1 2 871 Behavioral Health-Corridor end Corridor 1 2 871 Behavioral Health-Corridor end near rear exit Corridor 1 2

853 Ireland Annex 100 1 1 853 Ireland Annex 124A 1 1 853 Ireland Annex 121 1 1 853 Ireland Annex 234 1 2

853 Ireland Annex 200 1 2 853 Ireland Annex Corridor left end 1 3

853 Ireland Annex Corridor right end

1 3

853 Ireland Annex 319 1 3 853 Ireland Annex 332 1 3 853 Ireland Annex 334 1 3 853 Ireland Annex Elevator

Lobby 1 3

858 Emergency Medical Services (Ambulance)

3 1 1

1020 Preventive Medicine 118 1 1 1022 Dental and Public Health Command and Facilities Management 111 1 1

1022 Dental and Public Health Command and Facilities Management

213 1 2

1022 Dental and Public Health Command and Facilities Management

235 1 2

1006 Veterinary Animal Clinic 105 1 1 1489 Army Wellness Center Reception 1 1

2020 Soldier Readiness Processing 17 1 1 2724 Jordan Dental Clinic 107 1 1 5949 Nelson Troop Medical Clinic 105 1 1 5949 Nelson Troop Medical Clinic 102 1 1 6586 MEDDAC Training 1 1 1 6289 Margetis IDES Center 156 1 1

Blue Grass Army Depot-Lexington, Kentucky

S-1 Occupational Health Clinic 2 1 52 Industrial Hygiene 2 1

Camp Atterbury-Edinburgh, Indiana 2 Troop Medical Clinic 6 2 1

14 MEDD HQ/ANAM/BH 118 1 1

Note: Quantity and location may change based on activity mission requirement.

Quantity and location may change based on activity mission requirements.