Inactive

SOURCES SOUGHT SYNOPSIS DESCRIPTION This is a SOURCES SOUGHT SYNOPSIS and is for informational / market research purposes only. THIS IS NOT A REQUEST FOR PROPOSAL, QUOTATION OR BID, NOR A SYNOPSIS OF ... SOURCES SOUGHT SYNOPSIS DESCRIPTION This is a SOURCES SOUGHT SYNOPSIS and is for informational / market research purposes only. THIS IS NOT A REQUEST FOR PROPOSAL, QUOTATION OR BID, NOR A SYNOPSIS OF A PROPOSED CONTRACT ACTION UNDER FAR SUBPART 5.2. No reimbursement will be made for any costs associated with providing information in response to this synopsis or on any follow up information. NO SOLICITATION IS CURRENTLY AVAILABLE. The purpose for this synopsis is to conduct market research to help identify capable, potential sources and to establish if this requirement can be set-aside for small business or other socio-economic programs to include: Small Business, 8(a) firms, Historically Underutilized Business Zones (HUBZone), Women-Owned, Economically Disadvantaged Women-Owned Small Business (EDWOSB) and Service-Disabled Veteran Owned Small Business (SDVOSB). NAICS Code: 561990 All Other Professional, Scientific, and Technical Services Small Business Size Standard: $16.5M PSC/FSC: R614 Support Administrative: Paper Shredding GENERAL INFORMATION: The Department of Veterans Affairs intends to procure services for document destruction for a base plus 4 option years for the VA Puget Sound Health Care System and surrounding CBOC s in accordance with the following Statement of Work. Statement of Work Document Destruction Services VA Puget Sound Health Care System BACKGROUND The Department of Veterans Affairs, VA Puget Sound Health Care System (VAPSHCS) would like to establish a document destruction services contract for the Seattle and Tacoma Washington areas. The Contractor shall provide on-site document destruction services for the Seattle VA Medical Center, the American Lake VA Medical Center, VA Dupont Office, and seven (7) Community Based Outreach Clinics (CBOC) in the Puget Sound area to include the following: Mount Vernon, Port Angeles, Silverdale, Edmonds, Puyallup, Olympia, and Everett. This requirement is critical to ensuring the security of our veterans. OBJECTIVE To establish a contract for document destruction services throughout the VA Puget Sound Healthcare System. This will be a base year contract. PERIOD OF PERFORMANCE 04/01/2022 09/31/2023 with 4 option years PLACE OF PERFORMANCE: VA Puget Sound HCS Seattle 1660 S. Columbian Way Seattle, WA 98108 VA Puget Sound HCS American Lake 9600 Veterans Drive SW Tacoma, WA 98493 VA Dupont Office 1495 Wilmington Dr Suite 360 Dupont, WA 98327 Mount Vernon VA Clinic 307 S 13th St. Mt. Vernon, WA 98274 North Olympic Peninsula VA Clinic 1114 Georgiana St. Port Angeles, WA 98362 Silverdale VA Clinic 9177 Ridgetop Blvd NW Silverdale, WA 98383 Federal Building Seattle 909 1st Ave Seattle, WA 98104 Puget Sound HCS 4585 Texas Way Seattle, WA 98199 Vet Center 305 S. Lucile St. Seattle, WA 98108 Edmonds VA Clinic 21616 76th Ave. W Suites 107 & 112 Edmonds, WA 98026 Olympia Medical Center 500 Lilly Rd NE Suites 201 & 204A Olympia, WA 98506 Puyallup VA Clinic at Sunrise Medical Center 11102 Sunrise Blvd E Bldg. 3, Suites 204 & 209 Puyallup, WA 98374 Everett VA Clinic 220 Olympic Blvd Everett, WA 982031 Description of Services This is a non-personal service and is for a Contractor to furnish all personnel, equipment, acceptable receptacles and supplies, insurance, proper licensing, tools, materials, travel, transportation, and supervision necessary to provide Document Destruction Services for the Veteran Affairs (VA) Puget Sound Healthcare System. The Government shall not exercise any supervision or control over the contract service providers performing the service heroin. Such contract service providers shall be accountable solely to the contractor, who in turn is responsible to the Government. General Procedure 6.1 The contractor shall provide all labor, personnel, equipment, supplies, shipping (origin), secured vehicles, materials, supervision and other related services necessary to provide on-site commercial document destruction services for the VA Medical Centers, CBOC s and administrative facilities listed in Attachment A, in accordance with VA regulations. 6.2. The goal of this procurement is to establish a safe and uniform process for shredding of documents that may or may not include sensitive data from the VAPSHCS locations. The use of secure shredding services will enable the Veterans Administration to ensure that patient sensitive data will be protected. 6.3. No guarantees are made as to the estimated pick-up and delivery frequencies or volumes, or the quantities of bulk containers. The estimated information provided in the scope of work is based on historical data. The locations for the bulk containers are subject to change by the Government. The Government shall notify the contractor of location changes within five working days of any changes. 6.4. This is a new requirement. Interested vendors must have at least three (3) years of experience in providing commercial shredding services. Shredding services must be completed on-site at time of collections. Shred output size must be confetti size or smaller. Shredding Specifications The contractor shall provide onsite document destruction services in the presence of a VA employee for Government provided documents containing classified, sensitive, confidential, and medical records. The documents (paper data) shall be destroyed (shredded) per commercial standards including two-factor shredding. Two-factor shredding is defined as the destruction of material through a two-step process. Bulk document shredding will be on an as needed basis. The VA will contact the vendor with an estimated amount of the boxes and/or pallets of documents and set up a time and ate for the vendor to destroy. At times there might be items that are not considered paper. The vendor must have the capability to shred items such as ID bands, CDs, ID cards, and other non-paper items. These items will be placed in a special bin that will be picked up and incinerated at an off-site location. This will be scheduled before so the appropriate bins can be provided. At times there may be a need for additional containers and/or locations. Contractor shall provide no more than twenty (20) additional containers and/or locations to be included with original quote. Intermittent/Emergency Orders If additional onsite shredding is needed, the contractor shall be available within 7 business days for for unscheduled service and prices shall be in accordance with the location fee that is listed in the contract schedule. Control of Security Waste The Contractor shall be responsible for management, oversight, security, and control of all classified, sensitive, confidential documents and documents containing medical records stored in the locked containers, prior to and until completion of shredding or destruction of the documents. Security Waste Collection Containers (Bins, Consoles, Rolling Bins) The Contractor shall deliver the required number of locked security waste containers with key-locking lids at each VA facility. The containers shall be placed at the designated locations directed by the POC. The containers shall always be kept locked. Temporary paper records that are collected for destruction must be kept in a manner that will prevent their content from being read by individuals with no official business need or right to access the data contained in them. The method of collecting and processing these temporary paper records must also prevent their loss or theft until their final destruction. Contractors, subcontractors (or third parties) who handle VA temporary paper records shall require documentation in any and all subsequent contracts or agreements between the primary information destruction contractor and their subcontractors or third parties that the subcontractors or third parties shall provide sufficient reasonable safeguards for the temporary paper records, to the same standards required of the primary contractor, throughout the destruction process. The contractor shall provide two sets of keys for each bulk container. One set of keys shall always remain in the possession of the contractor or his employees while at the Government site. The second set of keys shall be provided to the medical facility s designated staff member. Once documents are in the shred box, no human contact with the documents unless authorized by the designated VA employee for the purpose of shredding or retrieval of items if required. The Contractor is responsible for maintaining all bulk containers in a clean, safe, and odor-free condition The number of containers may change as needs change. Contractor shall offer or remove containers as needed. Certification of Destruction The contractor shall prepare and submit to the medical facilities COR an original signed certificate of destruction for each pick-up for each site within three (3) working days or each pick-up. Methods of interim destruction carried out by an information destruction contractor must be witnessed by a VA employee or, if authorized by the VA organization that created the temporary paper records, a contractor (or subcontractor or third party) employee may act as witness. If a contractor (or subcontractor or third party) employee is the witness, then that individual must, prior to departing the VA location, provide the designation VA representative with documentation that acknowledges receipt of the temporary paper records. VA personnel responsible for documenting the final destruction of temporary paper records must develop a tracking method for ensuring that a certificate of destruction is submitted for every shipment of temporary paper record released to an information destruction contractor. When final destruction is carried out by a contractor (and its subcontractors or third parties) must be a NAID certified, bonded, and insured contractor for paper/printed media destruction; or a non-NAID certified contractor (and its subcontractors or third parties) who can satisfy the standards outlined in this Appendix. The contractor shall maintain proper records concerning each Certificate of Destruction issued. The COS/POS shall be emailed to the COR. Activity Logs/Reports The Contractor shall maintain an activity log of shredding/destruction services accomplished at each site. One copy of the activity log shall be provided to the facility POC after all documents have been shredded. Contractor Personnel Provide all personnel, supervision, transportation (secure vehicles), and labor necessary to perform driving, pick-up, and shredding of documents the specified locations. All personnel shall have the skills, knowledge, and training to satisfactorily perform the services required. Contractor will be responsible for training, providing uniforms, equipping, supervising, and discharging employees. The contractor shall provide qualified employees. Qualified is defined as: An employee who has passed the security and clearance requirements. The contractor shall be required to comply with all VA security requirements The contractor shall be responsible for coordinating with the facility POC and providing all information required of employees for performance of work. All security requirements must be met, and employees cleared prior to the contractor performing work under the contract. Provide each employee with a printed and laminated identification card containing the following information that is consistent with the employee information provided to the agency: Employee Typed Name Employee s Title Employee s Signature Employee s Photograph Company Name Ensure that all Employee s: Display (on their person) the picture identification card that clearly identifies them as authorized messengers for the contractor Wear company Logo uniforms. Employees that cannot meet the security and clearance requirements shall not be allowed to perform work under this contract. A VA employee shall be designated to escort the contractor to all areas until all documents are shredded to the proper dimensions. Privacy Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor s rights to use data as described in Rights in Data General, FAR 52.227-14(d)(1) VA Information should not be co-mingled, if possible, with any other data on the Contractors/Subcontractors information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct site inspections of contractor data and job duties, and destruction/media sanitization procedures follow VA directive requirements. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered, created by the contractor while performing this contract without prior written approval by the VA. Any data destruction done on behalf of the VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic media Sanitization. Self-Certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back-up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information of information systems after execution of the contract, of if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. Records Management Citations to pertinent laws, codes and regulations such as 44 U.S.C Chapters 21,29,31; Freedom of Information Act (5 U.S.C. 552); Privacy Act (5 U.S.C. 552a); 36 CFR Part 1222 and Part 1228. Contractor shall treat all deliverables under the contract as the property of the U.S. Government for which the Government Agency shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Contractor shall not create or maintain any records that are not specifically tied to or authorized by the contract using Government IT equipment and /or Government records. Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected by the Freedom of Information Act. Contractor shall not create or maintain any records containing any Government Agency records that are not specifically tied to or authorized by the contract. The Government Agency owns the rights to all electronic information (electronic data, electronic information systems, electronic databases, etc.) and all supporting documentation created as part of this contract. Contractor must deliver sufficient technical documentation with all data deliverables to permit the agency to use the data. The Government Agency owns the rights to all data/records produced as part of this contract. Contractor agrees to comply with Federal and Agency records management policies, including those policies associated with the safeguarding of records covered by the Privacy Act of 1974. These policies include the preservation of all records created or received regardless of format [paper, electronic, etc] or mode of transmission [e-mail, fax, etc] or state of completion [draft, final, etc]. No disposition of documents will be allowed without the prior written consent of the contracting officer. The Agency and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Willful and unlawful destruction, damage or alienation of Federal Records is subject to the fines and penalties imposed by 18 U.S.C. 2701. Records may not be removed from the legal custody of the Agency or destroyed without regard to the provisions of the agency records schedule. Contractor is required to obtain the contracting officer s approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, this contract. The contractor (and any sub-contractor) is required to abide by Government and Agency guidance for protecting sensitive and proprietary information. Information Security The C&A requirements do not apply, and a Security Accreditation package is not required. Document destruction is performed on-site to ensure VA sensitive information is protected. Once Shredded, the confetti-sized pieces are recycled. The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and privacy officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associated must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (entities) of jurisdiction, including the VA OIG and Security Law Enforcement. The contractor, it s employees and its subcontractors and their employees shall cooperate with the VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. Liquidated damages for data should be consistent with the requirements of 38 U.S.C §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity of the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term data breach means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Risk Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access) Description of the event including the following: Date of Occurrence Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code. Number of individuals affected or potentially affected Names of individuals or groups affected or potentially affected. Ease of logical data access to the lost, stolen or improperly accessed data considering the degree of protection for the data, E.G., unencrypted, plain text. Amount of time the data has been out of VA control. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons) Known misuses of data containing sensitive personal information, if any Assessment of the potential harm to the affected individuals Data Breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, As appropriate; and Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $_________ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: Notification One-year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports Data breach analysis Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution One year of identity theft insurance with $20,000 coverage at $0 deductible, and Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. Quality Control The contractor shall develop and maintain quality programs to ensure refuse and recycling services are performed in accordance with commonly accepted commercial practices. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. At a minimum, the contractor shall develop quality control procedures addressing the areas when the Acceptable Quality Levels are not met. Quality Assurance The Government may inspect each task as completed or increase the number of quality control inspections if deemed appropriate because of repeated failures discovered during quality control inspections. Likewise, the Government may decrease the number of quality control inspections if performance dictates. The Government will also receive and investigate complaints from various customers located at the business locations. Provide professional customer service (i.e. being able to address concerns, issues, and other administrative functions in a timely and professional manner). Timely manner in the context of this contract means no later than close of 48 business hours. The VA POC and COR shall be able to contact the contractor at any time, when contract work is in progress, to provide notices, reports, or requests from the contracting officer or his/her representative. Ensure the work be carried out in such a manner that there will be no interference with the proper execution of Government business. All persons employed in contract work shall, while on the premises, comply with all building regulations. Provide the VA Medical Center POC and COR with two (2) contacts (a primary and al alternate) who the VAMC Center can reach during contractor s business hours. Information to include: Name Contact numbers (cell) A 24-hour emergency contact (name, telephone #, Mobile #) available during Contractor s non-business hours. Insurance Requirements The contractor is required to provide copies of proof of Worker s Compensation that complies with Federal and State Worker s Compensation and Occupational disease statues, and provide proof of General Liability Insurance, within 15 calendar days after notification of contract award. In accordance with FAR subpart 28.307-2. Liability: Workers compensation and employer s liability. Contractors are required to comply with applicable Federal and State workers compensation and occupational disease statutes. If occupational diseases are not compensable under those statutes, they shall be covered under the employers liability section of the insurance policy, except when contract operations are so commingled with a contractor s commercial operations that it would not be practical to require this coverage. Employer s liability coverage of at least $100,000 shall be required, except in States with exclusive or monopolistic funds that do not permit workers compensation to be written by private carriers. General Liability the contracting officer shall require bodily injury liability insurance coverage written on the comprehensive form of policy of at least $500,000 per occurrence. Property damage liability insurance coverage shall be required written on the comprehensive form of policy of at least $500,000 per occurrence The contractor shall meet all requirements of Federal, State and City codes regarding operation of this type of business. The contractor shall be responsible for protecting the personnel furnishing the services under this contract. The contractor shall possess at least the minimum amount of liability insurance for operation of courier services within the states of Oregon, Washington, Idaho, and Alaska. Badges and Parking All contractor personnel are also required to wear Vendor ID badges noting contractor name, Personal name, and Photo of contractor. It is the responsibility of the contractor s personnel to park in the appropriate designated parking areas. Parking information is available from the participating healthcare center s Security Office. VA will not validate or make reimbursement for parking violations of the contractor s personnel under any circumstances. Changes The awarded contractor is advised that only the Contracting Officer, acting within the scope of the contract has the authority to make changes which affect the contract in terms of quality, quantity, price or delivery. Tn the event the contractor effects any such change at the direction of any person other than the contracting officer, the change shall be considered to have been made without authority and no adjustment shall be made in the contract price to cover any increase in costs incurred as a result thereof All route changes must be provided to the VAMC point of contact and contracting officer within 72 hours of change. All scheduled pickup times and dates must still be adhered to during a route change unless agreed upon by the VAMC point of contact and the contracting officer. All pickups and deliveries must be within the required dates and times as noted on attachment A. Any deviations from the scheduled pickup times and dates must be agree upon by the VAMC point of contact and contracting officer All changes to deliver times and dates require notification via email or phone call to the VAMC point of contact and the contracting officer. Provide to the VA contracting officer and VA COR a Disaster Contingency Plan. The plan must address what alternative actions contractor will implement to fulfill its obligation in the event of employee strikes, inclement weather, natural disaster, traffic accident and unforeseen events. The VA Contracting Officer and VA COR will approve/reject the Plan within 15 calendar days of submission. If not approved, the VA contracting officer will notify the contractor as to the areas of the Plan that are unacceptable. Changes and resolution shall be achieved through mutual agreement between VA and contractor. NO smoking Policy Smoking is strictly prohibited on ALL Federal Properties Hours of Service The contractor shall perform the services as specified herein Monday through Friday except for National Holidays (see below) between the hours of 7:30am 4:30pm The contractor is not required to provide service on the following U.S. Government Holidays, nor will the Contractor be paid for these holidays. New Year s Day Jan 1st Martin Luther King s Birthday Third Monday in January President s Day Third Monday in February Memorial Day Last Monday in May Independence Day July 4th Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day November 11th Thanksgiving Day Fourth Thursday of November Christmas Day December 25th If a holiday falls on Sunday, the following Monday will be observed as the National Holiday. When a holiday falls on a Saturday, the preceding Friday is observed as a National Holiday by U.S. Government Agencies. Also included would be any National holiday specifically declared by the President of the United States. VA Requirements and Responsibilities Ensure that the company has and maintains insurance coverage valued at $1,000,000 made payable to the VA Medical Center to cover the costs to reconstruct a lost, stolen or destroyed deposit Maintain a copy of the insurance certificate Provide accurate and complete addresses and contact information. VA POC shall notify contractor accordingly if there are changes to the center s information Provide access to the center Ensure that all bins are available for shredding within the scheduled time. Evaluate the contractor s performance under this contract Have and maintain at each VA POC, a performance Log Matrix (see below) showing the details of each shredding pickup to include date, time of pickup and any issues that may have occurred. If an item is mistakenly dropped in the bin, the designated key holder will, at his/her discretion, open the bin to retrieve the item. Service Contract Act Wage Determinations The appropriate wage determinations are hereby incorporated by reference for each geographic location represented in this solicitation. The appropriate wage determinations shall be found at the Department of Labor website: http://www.dol.gov Deliverables Deliverable #...