01 SOW Attachment 01 - AE Design SOW - EHRM Infrastructure Upgrades.docx

ARCHITECT-ENGINEER DESIGN SCOPE OF WORK

EHRM INFRASTRUCTURE UPGRADES

PROJECT NO: 521-20-901

PROJECT NAME: EHRM Infrastructure Upgrades – Birmingham VAMC, Birmingham, AL **The Certification and Accreditation (C&A) does not apply, a Security Accreditation Package is not required**

1. GENERAL INTENT:

The Contractor (herein referred to as “A/E”) shall provide Architect/Engineer (A/E) services to design a construction project at the VA Birmingham Health Care System (VABHCS) in accordance with this design scope of work.

2. STATEMENT OF WORK:

A/E Part One Services (also known as Design Phase) for this design project includes site visits, field investigation, studies and user interviews to prepare drawings, specifications and cost estimates for all facets of work and disciplines/trades to facilitate a construction project to upgrade the facility infrastructure to support the new Electronic Health Record Modernization (EHRM) system in accordance with VA OEHRM Site Infrastructure Requirements (provided by VHA). The project shall include, but is not limited to, upgrading facility fiber throughout the buildings to each IT closet, provide a redundant fiber run throughout the facility to each IT closet, provide redundant fiber mains to the demarcation room from the provider point, install approximately 100 additional IT outlets, install approximately 75 new electrical outlets throughout the facility, provide additional outlets in each IT closet, upgrade facility power distribution as required, upgrade facility HVAC distribution as required, physical security assessment and upgrades and hazardous material abatement.

A/E Part Two Services of this design project (also known as Construction Period Services) includes responding to construction contractor Requests For Information (RFIs) during the solicitation (solicitation support) and construction phases of the construction project, attendance at pre-bid, post-award and commissioning kick off construction project conferences, review of construction material submittals and shop drawings, approximately 4 site visits per month during construction (both scheduled and emergent) to ensure compliance with the design drawings and specifications, preparation of site visit reports, coordination with project commissioning requirements, review of any construction project modifications for cost and technical acceptability, attendance and participation during the final acceptance inspection, preparation of the punch list and preparation of record drawings of the completed construction project based on the construction contractor’s as-built drawings. The A/E shall prepare a submittal log to be utilized by the VA during construction period services, maintain RFI log and provide meeting minutes for weekly construction meetings throughout the duration of construction. All Part Two Services are optional line items and will not be exercised at the time of award.

“This project requires services of an independent commissioning provider. It is expected that the Commissioning Agent to provide commissioning services for all phases of the project (Pre-Design, Design Phase, Bid and Pre-Construction Phase, Construction Phase, Acceptance and Testing Phase and Warranty Phase). Commissioning for all new and renovation construction projects is mandated by the Energy Policy Act of 2005 and the Executive Orders 13423 and 13514. The Whole Building Commissioning Process Manual dated May 1, 2013 (revised November 1, 2013) is the VA standard for commissioning of all construction projects. This document is available on at http://www.cfm.va.gov/til/spclRqmts.asp. The commissioning requirements for each phase are detailed in The Whole Building Commissioning Process Manual. Commissioning during the Design Phase shall coincide with the A/E design project schedule phases. “

The above paragraphs constitute a basic outline of the work to be accomplished and in no way comprises all the details for design of this project. The A/E shall initiate detailed inspection of the project site to determine the needs and conditions for the design of this project. Copies of VA Birmingham Health Care System (VABHCS) Birmingham, AL record drawings and the EHRM infrastructure readiness assessment documents will be made available to the highest rated A/E firm; the A/E will verify the validity of the record drawings prior to the start of design work and conduct site investigations as necessary throughout the design.

The A/E shall be solely responsible for the management, including all associated labor, equipment, materials, mailing costs, and inspection, to meet the requirements of the design project. The A/E shall further provide meeting minutes for all meetings held under this design project.

The A/E firms’ representatives performing site investigations on VA Birmingham Health Care System (VABHCS) campus must have the following additional requirements before starting site investigations on campus:

1. Negative TB Test, within the past calendar year

2. N95 fit tested and documented

3. Clear Face Shield

4. N95 mask with no vent. Must be replaced when damaged or soiled

5. Pre and weekly negative COVID test while working in patient care areas

6. Daily visit at check-in station for COVID and temperature screening

a. Sticker/device must be worn visibly

7. Annual influenza shot is required for all staff performing work on Bham VA campus

8. Contractor badge must be obtained and worn by contractor or representative at all times while on campus The temperature checks are performed on the VA Birmingham Health Care System (VABHCS) campus and must be performed immediately when the contractor arrives on site. Temperature checks are currently performed at 19th Street Entrance. If at any time an employee of the A/E firm is found in deficiency of the listed a stop work order will be issued for safety of VA Birmingham Health Care System (VABHCS) patients. Any further questions please refence the below documents

· Seasonal influenza with Vaccines (SOW Attachment 08)

3. DESIGN WITHIN FUNDING LIMITATIONS:

The design shall be prepared by the A/E to permit the award of a construction contract, using Federal Acquisition Regulation procedures for the construction of the facilities, at a cost that does not exceed the project’s estimated construction.

4. DESIGN INDEPENDENCE, FURNITURE AND EQUIPMENT: Designs for construction must produce a “complete and usable” facility or improvement when constructed. VA policy (VHA Office of Capital Assets Management, Engineering and Support memo Updated Construction Guidance and Expectations dated Sep 12, 2016) requires the A/E to certify that their design (including all bid alternates/bid deducts) is independent of any future construction project. In addition, the A/E must certify that it has produced a design that does not include furniture and equipment that will be procured separately. Equipment that can be part of the design in the includes those items to meet code requirements for building occupancy, items covered in the VA’s Master Construction Specifications (PG-18-1) Divisions 1 through 10, 13 through 26 or 28 through 48, non-IT equipment items covered by Division 27 and items covered by Division Numbers 12 31 00, 12 32 00, 12 34 00 and 12 36 00.

The A/E shall submit as part of the Final Bid Documents submittal a signed letter on company letterhead stating the design’s independence.

5. DESIGN CRITERIA: The VA Technical Information Library (TIL) available at http://www.cfm.va.gov/til/index.asp is managed by the VA Office of Construction and Facility Management and is the master repository for all VA Numbered Standards for Construction to include design and construction specifications, procedures, standard details, BIM/CAD standards, equipment guides, space planning and design guides. The documents of the TIL shall be the minimum design criteria for all VA projects performed in the construction of new facilities and the modernization, alteration, addition, or improvement of its real property. All design documents shall be developed in accordance with the VA TIL, including (but not limited to) the following listed Department of Veterans Affairs References:

OIT Infrastructure Standard for Telecommunications Spaces v3.0 (21 August 2020)

The following references should also be used to complete the design documents:

· VA Standards Alert 017 – Infrastructure Standards for Telecommunications Spaces and all standards, guides, and manuals incorporated by reference (https://www.cfm.va.gov/til/sAlert/sAlert017.pdf)

· 00 VA OEHRM Site Infrastructure Requirements v1.9 (SOW Attachment 03)

· SOCAMES 6 Design Alert 1 (SOW Attachment 04)

Where conflicts exist between VA adopted codes and standards and the documents on the TIL, the A/E shall bring this to the attention of the VA. The resolution of the conflict shall be made by the authority having jurisdiction for VA to ensure consistency department wide.

6. DESIGN COLLABORATION: The A/E during this design project shall collaborate with the VHA Office of Healthcare Environment and Facilities Programs Special Engineering Program (HEFP/SEP) staff, VISN 7 and the Independent Life Safety Review Agent (LS Agent) for the project. Design submittal comments from these contractors, if concurred with by VA, shall be incorporated into the design. HEPF/SEP and/or VISN deliverables shall be coordinated with the A/E’s design submittals to ensure compliance with all requirements are met. The A/E is required to ensure all elements of the design adhere to the Life Safety Code, including recommendations for temporary construction barriers, prior to the Independent Life Safety review.

7. INDEPENDENT LIFE SAFETY REVIEW: The A/E shall incorporate any comments from the VA 3rd party life safety review.

8. ENVIRONMENTAL PROTECTION: The A/E shall assist the VA with completion of a National Environmental Policy Act (NEPA) assessment as required by the VA Birmingham Health Care System (VABHCS) Birmingham, AL. If the NEPA assessment results in potential environmental impacts, the A/E shall be responsible for completing any auxiliary documentation required per PG-18-17 NEPA Interim Guidance for Projects located on the TIL (http://www.cfm.va.gov/til/etc/NEPAGuidance.pdf). Additional requirements may include, but are not limited to, Environmental Assessment, Environmental Impact Statement, and Record of Decision. The NEPA analysis and concluding documentation must be completed by the Final Bid Documents submittal.

9. PHYSICAL SECURITY: The A/E must include a certified physical security specialist. The specialists must be involved with the design beginning with the concept phase and the qualifications must be submitted to the COR for review and approval prior to the concept/basis of design phase. The specialists shall meet the specific requirements listed in the Physical Security Design Manual for Mission Critical Facilities located on the TIL (http://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecMC.pdf). The A/E shall ensure that all aspects of the applicable VA Physical Security Design Manual (either Life-Safety Protected or Mission Critical Facilities; both will be applicable depending on the area the work is taking place) are incorporated into the design and shall prepare a written report acknowledging compliance as required by the VAMC. The A/E must inform the COR of any physical security items that will be difficult to achieve during the concept/basis of design phase of the design and assist the VA with waiver requests as necessary.

10. TELECOMMUNICATIONS DESIGN: In accordance with “Telecommunications and Special Telecommunications Systems Design Manual,” February 2016 (https://www.cfm.va.gov/til/dManual/dmTelecomm.pdf), paragraph 1.2 (d), Telecommunications design must be performed and stamped by a BICSI Registered Communications Distribution Designer (RCDD) for all projects.

11. SUBMITTAL REQUIREMENTS: Design submittals shall follow the requirements of Program Guide, PG-18-15, Volume C - A/E Submission Instructions for Minor and NRM Construction Program dated November 2008. This document is included as SOW Attachment 7. Submittal documents shall be prominently marked “For Official Use Only (FOUO)” if they contain qualifying data as defined in VHA Memorandum 2019-11-13 Sensitive Infrastructure Data Classification – For Official Use Only (FOUO). This memo is included as SOW Attachment 5, as it is hosted on a non-public VHA site (https://vaww.va.gov/vhapublications/ViewPublication.asp?pub_ID=8949).

The A/E shall deliver design submittal documents that follow the iterative phase breakdown for design work in PG-18-15 and as additionally specified below. Specific requirements for each discipline/work product listed under each phase can be found in PG-18-15; it is expected for the phase of design that each of the checked items in the SD/DD/CD columns will be completed for the submittal. The A/E shall attend a review meeting following each design submittal as indicated under the Project Schedule section of this Scope of Work. Each new submittal will incorporate all VA comments from the previous submittal. The Asbestos Abatement requirements in PG-18-15 are applicable at VA Birmingham Health Care System (VABHCS) Birmingham, AL due to the age of the facility.

The following submittals will be required for this project:

· Quality Assurance/Quality Control (QA/QC) Plan

· Basis of Design (BD) - 10% - In addition to the requirements in PG-18-15, a Basis of Design is required. Basis of Design is a narrative presentation of facts, sufficiently complete, to demonstrate that the project concept is fully understood, and that subsequent design details, and their ultimate presentation in the final drawings and specifications, will be based on sound architectural and engineering decisions. Conceptual drawings of the planned design and the initial cost estimate will additionally be included.

· Schematic Design (SD)- 35%

· Design Development One (DD) – 65%

· Construction Documents (CD)- 95%

· Final Bid Documents (Bid) – 100%

12. DRAWING FORMAT: All drawings shall adhere to VA project software requirements for Building Information Modeling (BIM) and Computer Aided Design (CAD) available at http://www.cfm.va.gov/til/projReq.asp. BIM software shall be Revit 2019 or the latest version available.

The A/E shall provide a computer 3D model and prepare various 3D renderings to present to VA throughout the design phase to adequately represent architectural, mechanical/electrical/plumbing (MEP), site conditions and other items in the design to aide with facility visualization and contractor coordination.

The project BIM model minimum requirements shall be developed to include the systems described below as they would be built, the processes of installing them and to reflect record drawing conditions (possibly incorporating into the VA Birmingham Health Care System (VABHCS) Danville IL Master Record Drawing – pending facility expertise). The deliverable model at the SD, DD and CD design phases shall be developed to include as many of the systems described below (but not limited to) as are necessary and appropriate at that design phase.

VA Birmingham Healthcare System (VABHCS) 1700 19th Street 1/29/2021 Birmingham, AL 35233

· Architectural/Interior Design

· Square Footage/Volume

· Room Names and Numbers

· Architectural Schedules

· Architectural Specialties and Woodwork

· Doors

· Windows

· Louvers

· Roof

· Floors

· Ceilings

· Vertical Circulation

· Walls/Curtain Wall Sizes, Shapes, & Material Data

· General Signage

· Schedules

· Furniture

· Equipment

· Structural

· Foundations

· Shafts and Pits

· Mechanical

· HVAC

· Plumbing

· Electrical/Telecommunications

· Power and Lighting

· Steam Distribution

· Other Engineering Data as Required

· Exterior Building Information

· Nurse Call System

· Asbestos/Hazardous Material Info

· Security System Information (Access Control, Security Cameras, Panic Alarms, Overhead Paging)

· Life Safety Information (Fire Extinguishers, Wall Ratings, Door Ratings, Fire Protection/Alarms)

· Departmental Ownership (By Common Name, Capital Asset Inventory Department Definition and Strategic Capital Investment Program Department Definition)

13. SUBMITTAL FORMATS: Submittals shall be submitted in electronic format and hard copy formats as listed below. Portable Document Format (.pdf), Microsoft Office Suite formats (.doc, .xls, and .ppt), Microsoft Project (.mpp) and Autodesk Revit Project (.rvt) files are acceptable. Submittals shall additionally be compliant with Section 508 of the Rehabilitation Act (29 U.S.C. '794 d); information on the requirements for accessible media can be found at http://www.section508.gov/. The A/E shall be responsible for providing:

Meeting/Conference Minutes Meeting minutes for all formal meetings and conferences held with the VA; including weekly construction meetings. Meeting minutes shall be submitted within seven (7) calendar days of the meeting or conference. All documents in any of the electronic formats listed above.

Minimum meeting minutes requirements

· Project name, number, meeting host, Meeting Name

· Date, Time, meeting ID, call in number, Duration, and consecutive number of total related meetings

· Participant list (Name, Title, Phone number (office and Mobile), Email, Attended Meeting (yes/no Check box)

· Meeting purpose, Roll call, COVID-19, and Additional Items

· Agenda items (Decisions, action items, and fixes or next steps)

· Next meeting date and time

· Detailed attachment list

Construction Cost Estimates Construction cost estimates shall comply with Manual for Preparation of Cost Estimates & Related Documents for VA Facilities dated March 8, 2011. This document is available on the TIL at http://www.cfm.va.gov/cost/index.asp. All estimates in any of the electronic formats listed above.

Quality Assurance/Quality Control (QA/QC) Plan

· All documents in any of the electronic formats listed above.

Basis of Design (BD)

· All documents in any of the electronic formats listed above.

· Two (2) half-size paper bond sets of drawings – 2 to VA

Schematic Design (SD)

· All documents in any of the electronic formats listed above.

· Two (2) half-size paper bond sets of drawings – 2 to VA

· Two (2) paper bond sets of specifications – 2 to VA

· Two (2) paper bond sets of investigation reports, design calculations, space planning data and cost estimate - 2 to VA

Design Development (DD), and Construction Documents (CD)

· All documents in any of the electronic formats listed above.

· Memo annotating what was not upgraded and corresponding justifications.

· One (1) full size paper bond sets of drawings - 1 to VA

· Two (2) half-size paper bond sets of drawings – 2 to VA

· Two (2) paper bond sets of specifications – 2 to VA

· Two (2) paper bond sets of investigation reports, design calculations, space planning data, construction schedule, construction statement of work (SOW) and cost estimate - 2 to VA

Final Bid Documents (Bid)

· PDF files of drawings, specifications, and any miscellaneous design analysis documents such as submittal log and physical security compliance report.

· Certified memo annotating what areas/times were not upgraded and the corresponding justifications.

· Certified memo that the A/E design is independent of future projects and includes all equipment required for the project to be activated/full functional.

· Word files of specifications.

· Revit and AutoCAD files of drawings.

· One (1) full size paper bond sets of drawings - 1 to VA

· Two (2) half-size paper bond sets of drawings – 2 to VA

· Two (2) paper bond sets of specifications – 2 to VA

· One (1) paper bond sets of investigation reports, design calculations, space planning data, construction schedule, construction SOW and cost estimate - 1 to VA

Construction Period Services (CPS)

Requests for Information (RFI) Requests for Information shall be submitted within three (3) calendar days of submittal to the A/E.

Submittal Reviews Submittal reviews shall be submitted within seven (7) calendar days of submittal to the A/E.

Site Visit Reports Site visit reports shall be submitted within seven (7) calendar days of the visit. All documents in any of the electronic formats listed above.

Modification/Change Order Requests Modification requests shall be submitted within seven (7) calendar days of submittal to the A/E. This includes the review of the contractor’s change order/modification proposal for construction change orders, as well as the formulation of an IGCE for the modification, as requested. The A/E's reply regarding his/her review of cost proposals and his/her recommendations shall include an independent breakdown of costs in detail, quantities, and unit prices and shall cover both additions and deductions of labor, materials, and equipment. The A/E shall also supply cost estimates as requested by the COR for Request for Proposals for anticipated changes.” All documents in any of the electronic formats listed above. Note - If major modification, VA will provide additional time and document format guidance.

Punch List Punch list shall be submitted within seven (7) calendar days of the final acceptance inspection. All documents in any of the electronic formats listed above.

Record Drawings Record drawings shall be delivered to the VA within thirty (30) calendar days after VA acceptance of the construction project. Autodesk Revit Project (.rvt) format and AutoCAD (.dwg) format.

14. PROJECT SCHEDULE/PERIOD OF PERFORMANCE: The A/E shall perform Part One Services/Design Phase work according to the schedule shown below. The A/E is also responsible for following specification Section 01 32 16.10 Architectural And Engineering CPM Schedules, which is located in SOW Attachment 06 - 01 32 16.01 EHRM Architectural and Engineering CPM Schedule. If a due date on the timeline below falls on a Holiday or Weekend, the submittal shall be due the following business day. The remaining timeline will not be shifted to accommodate Holidays or Weekends.

The 144 days listed in part one project schedule may fluctuate based on when 95% CD submittal meets all VA guidelines and acceptance is issued. If 95% CD submittal is not accepted due to insufficient design requirements throughout the design period and additional time is deemed necessary. It is the responsibility of the AE firm to cover all costs associated with such delays.

Part Two Services/Construction Period Services (optional Line Items) shall be performed for the length of time between the time the option(s) are exercised and acceptance of Construction Completion. The VA has 365 calendar days from final acceptance of the design to exercise the option(s) for Construction Period Services.

15. CONTRACT OVERSIGHT: All contracts for this project shall be awarded by the Program Contracting Activity Central (PCAC); only a warranted VA Contracting Officer shall have authority to change the terms and conditions of a contract. These changes may involve the contract award amount, contract period of performance, issuance of stop work orders and changes to the statement of work.

PCAC shall designate a Contracting Officer’s Representative (COR) to monitor and manage the A/E’s performance under the design project contract. The COR shall be a representative of the VA Birmingham Health Care System (VABHCS) Birmingham, AL Engineering Service Project Section and have the technical knowledge required to monitor and oversee the project.

A COR from the VA Birmingham Health Care System (VABHCS) Birmingham, AL Engineering Service Project Section shall also be designated for the construction project contract to monitor and manage the construction contractor’s performance under the construction project contract. This designation under the construction contract shall be considered equivalent to the industry standard of “Owner’s Representative” and does not supersede or eliminate the A/E’s responsibility for Part Two Services/Construction Period Services. The A/E ultimately shall be responsible for any errors and omissions with the design discovered during and after the construction phase.

16. OI&T INFRASTRUCTURE STANDARD FOR TELECOMMUNICATION SPACE:

The current version for this standard is version 3.0, dated August 21, 2020 (https://www.cfm.va.gov/til/dguide/OIT-InfrastrucStdTelecomSpaces.pdf). The design for this project at The VA Birmingham Health Care System (VABHCS) Birmingham, AL must meet the Campus Support Center (CSC) requirements of the Infrastructure Standard for Telecommunications Spaces.

The Infrastructure Standard for Telecommunications Spaces (The Standards) serves as the master reference document of criteria for Department of Veterans Affairs (VA) facility Information Technology (IT) support infrastructure. It defines the technical requirements necessary to maintain optimum reliability and efficiency within VA facilities and computing centers. IT Support Infrastructure is defined as all passive telecommunications and information technology equipment, and supporting physical space and equipment.

This standard is owned and maintained by Solution Delivery (SD) Data Center and Infrastructure Engineering and questions or concerns should be directed to the following email group: OIT ITOPS SD Data Center and Infrastructure Engineering.

Users must ensure their use of this technology/standard is consistent with VA policies and standards, including, but not limited to, VA Handbooks 6102 and 6500; VA Directives 6004, 6513, and 6517; and National Institute of Standards and Technology (NIST) standards, including Federal Information Processing Standards (FIPS). Users must ensure sensitive data is properly protected in compliance with all VA regulations. Prior to use of this technology, users should check with their supervisor, Information Security Officer (ISO), Facility Chief Information Officer (CIO), or local Office of Information and Technology (OI&T) representative to ensure that all actions are consistent with current VA policies and procedures prior to implementation.

17. EXEMPTIONS TO VA OEHRM SITE INFRASTRUCTURE REQUIREMENTS:

Any variances or exemptions to SOW Attachment 03, most recent version, must be referenced, documented and discussed with CO, COR and HEFP SEP. Following approval of variance or exemption, AE shall submit documentation describing variance or exemption, indicating reference in VA documentation, describe any mitigating measures, and include an attachment with documentation of discussion with CO, COR and HEFP SEP.

18. REPORTING REQUIREMENTS:

The Contractor shall be required to report to the Engineering Office Room 3403 to log in during normal working hours as well as after normal working hours. This check-in is mandatory.

19. SOW and ATTACHMENTS:

The following list of documents are attached to this SOW for A/E use and incorporation into the project documents:

· VHA Required Div 01 Specification Sections (See SOW Attachment 02)

· 00 VA OEHRM Site Infrastructure Requirements 1.9 (See SOW Attachment 03)

· SOCAMES 6 Design Alert 1 (See SOW Attachment 04)

· Sensitive Infrastructure Data Classification FOUO (See SOW Attachment 05)

· 01 32 16.01 EHRM Architecture and Engineering CPM Schedule (See SOW Attachment 06)

· Program guide, PG-18-15 Volume C – A/E Submission Instructions for Minor and NRM Construction program dates November 2008 (See SOW Attachment 07)

· Seasonal influenza with vaccines (See SOW Attachment 08)

· VHA Directive 1061 Prevention of Healthcare Associated Legionella Disease (See SOW Attachment 09)

· Site Self-Assessment X-Matrix (See SOW Attachment 10)

20. INFORMATION SECURITY

VA Handbook 6500.6 Appendix Clause:

VA Acquisition Regulation Solicitation Provision and Contract Clause (October 2008)

SUBPART 839.2 – Information and Information Technology Security Requirements

839.201 Contract clause for Information and Information Technology Security

Due to the threat of data breach or loss of information that resides on either VA-owned or contractor-owned systems, and to comply with federal laws and regulations, VA has developed an Information and Information Technology Security clause. To be used when VA information is used, stored, generated, transmitted, or exchanged by and between VA and a contractor, subcontractor or a third party in any format (e.g., paper, microfiche, electronic or magnetic portable media).

In solicitations and contracts where VA Information and/or Information Technology will be accessed or utilized, the contracting officer shall insert the clause found at 852.273-75, Security Requirements for Unclassified Information Technology Resources

852.273-75 - Security Requirements for Unclassified Information Technology Resources (interim- October 2008)

As prescribed in 839.201, insert the following clause:

1. The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA policies as VA personnel, regarding information and information system security. These include, but are not limited to Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configurations available from NIST’s Web site at:

http://checklists.nist.gov

1. To ensure that appropriate security controls are in place, Contractors must follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contracts” located at the following Web site :

http://www.iprm.oit.va.gov/Security_and_Privacy_Requirements_for_Contractors.asp

VA HANDBOOK 6500.6

APPENDIX C

VA INFORMATION AND INFORMATION SYSTEMS SECURITY/PRIVACY LANGUAGE

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

2. ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

3. VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR.

4. INFORMATION SYSTEM DESIGN AND DEVELOPMENT

a. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment.

b. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required.

c. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default “program files” directory and silently install and uninstall.

d. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges.

e. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle.

f. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties.

g. The contractor/subcontractor agrees to:

(1) Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies:

(a) The Systems of Records (SOR); and

(b) The design, development, or operation work that the contractor/subcontractor is to perform;

(2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and

(3) Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR.

h. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency.

(1) “Operation of a System of Records” means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records.

(2) “Record” means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person’s name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or voiceprint, or a photograph.

(3) “System of Records” means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

i. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as “Systems”), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hot-fixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems.

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than twenty (20) days.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within than twenty (20) days.

l. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g. for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology.

5. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE

a. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor’s security control procedures must be equivalent, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA’s network involving VA information must be reviewed and approved by VA prior to implementation.

b. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.

c. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor’s systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks.

d. The contractor/subcontractor’s system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA’s POA&M management process. The contractor/subcontractor must use VA’s POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments.