SOW - 652-328 Improve Specialty Care Access.pdf

Central Virginia VA Health Care System Richmond VA Medical Center 1201 Broad Rock 07/26/2024 Richmond VA 23249

ARCHITECT-ENGINEER DESIGN SCOPE OF WORK

Improve Specialty Care Access

PROJECT NO: 652-328

PROJECT NAME: Improve Specialty Care Access

ESTIMATED COST OF CONSTRUCTION: $12,649,250

1. GENERAL INTENT:

The Contractor (herein referred to as “A/E”) shall provide Architect/Engineer (A/E) services to design a construction project at the Central Virginia VA Health Care System in accordance with this design scope of work.

2. STATEMENT OF WORK:

A/E Part One Services (also known as Design Phase) for this design project includes site visits, field investigation, studies, and user interviews to prepare drawings, specifications, and cost estimates for all facets of work and disciplines/trades to facilitate a construction project to construct approximately 9000 square foot roof top addition to Building 500. Refer to SOW Attachment 07 for the preferred location).

This addition will provide space for additional specialty care clinics to provide a wide range of outpatient serves to Veterans.

A/E Part Two Services of this design project (also known as Construction Period Services) includes responding to construction contractor Requests For Information (RFIs) during the solicitation (solicitation support) and construction phases of the construction project, attendance at pre-bid, post-award and commissioning kick off construction project conferences, review of construction material submittals and shop drawings, approximately 2 site visit per month during construction (both scheduled and emergent) to ensure compliance with the design drawings and specifications, preparation of site visit reports, coordination with project commissioning requirements, review of any construction project modifications for cost and technical acceptability, attendance and participation during the final acceptance inspection, preparation of the punch list and preparation of record drawings of the completed construction project based on the construction contractor’s as-built drawings. The A/E shall prepare a submittal log to be utilized by the VA during construction period services, maintain RFI log and provide meeting minutes for weekly construction meetings throughout the duration of construction. All Part Two Services are optional line items and will not be exercised at the time of award.

The above paragraphs constitute a basic outline of the work to be accomplished and in no way comprises all the details for design of this project. The A/E shall initiate detailed inspection of the project site to determine the needs and conditions for the design of this project. Copies of Central Virginia VA Health Care System record drawings will be made available to the highest rated A/E firm; the A/E will verify the validity of the record drawings prior to the start of design work and conduct site investigations as necessary throughout the design. SOW Attachment 07 – Central Virginia VA Health Care System Campus Map will give A/E firm a basic understanding of the Central Virginia VA Health Care System campus.

Project Objectives:

Using design charrettes with the VA, the A/E will determine the desired use of the space, including the services that will occupy and use the space.

Determine the necessary structural design elements necessary to support the new addition.

Taking into consideration the information from design charrettes, determine the best architectural layout to meet the VA goals for service delivery and patent flow.

Design the Mechanical, Electrical, and Plumbing (MEP) systems to meet the determined requirements of the new space.

Design shall incorporate a minimum of 10% of the construction budget as deductive alternates.

Each alternate shall be progressively deductive in nature and shall be non-scope impacting.

A/E shall conform to the VA Information Security requirements, located in Section 18, outlining the contractor’s requirement to protect VA information and VA information systems.

Site Assessment:

Conduct a thorough assessment of existing utilities (electrical, chilled/heating water, domestic water/hot water, medical gases, etc.) that will be used to feed the new space.

As-built documentation of the existing facility will be provided, however the A/E is responsible for verifying all as-built conditions.

Evaluate structural, electrical, mechanical, and architectural requirements for the new space being designed.

Assess and document any sources of asbestos that will be disturbed due to the construction and require abatement.

Architectural Design:

The architectural design shall meet VA standards and incorporate design elements from the

PACT Space Module design guide.

Interior design elements shall align with the established Richmond VAMC interior design standards and incorporate natural elements and recycled materials. The interior design shall also conform to the VA Interior design manual.

The design shall provide a welcoming atmosphere and efficient workplace.

Patient privacy criteria must be met in all aspects.

All rooms shall be ADA compliant and meet the VA Barrier Free Design guide.

Consider adjacent spaces during the design process.

MEP Design:

Provide electrical design in compliance with NEC, NFPA 99 and the VA Electrical Design Manual.

Provide fully sprinklered spaces and integrate fire protection / detection systems into existing facility system.

The HVAC design shall conform to the VA HVAC Design Manual and provide independent environmental controls for each room. The HVAC controls shall integrate directly with the existing facility Johnson Controls DDC system. The new space shall have an air-side independent HVAC system that serves only this new space.

The new space shall have its own IT telecom room and IT infrastructure designed in accordance with the Infrastructure Standards for Telecommunication Spaces (latest version)

The plumbing design shall conform to the VA Plumbing Design Manual and conform to Richmond VAMC plumbing fixture standards.

Structural Design:

Provide structure design with necessary elements to ensure existing structural foundations and components allow for the vertical expansion over the 1S area.

Structural design shall conform to the requirements of the VA Structural Design Guide.

This vertical expansion includes conversion of the existing roof deck to the new space and a full height interstitial above the new floor. Vertical spacing (floor to interstitial deck and interstitial deck to underside of roof deck) shall match the existing facility.

Structural and foundation designs shall be such to support this expansion only and no future vertical expansion shall be incorporated into the design.

The A/E shall be solely responsible for the management, including all associated labor, equipment, materials, mailing costs, and inspection, to meet the requirements of the design project. The A/E shall further provide meeting minutes for all meetings held under this design project.

The A/E firms’ representatives performing site investigations on Central Virginia VA Health Care System campus must have the following additional requirements before starting site investigations on campus:

1. Negative TB Test, within the past calendar year

2. Face mask with no vent. Must be replaced when damaged or soiled

3. Annual influenza shot is required for all staff performing work on Central Virginia VA Health Care

System campus

4. Contractor badge must be obtained and worn by contractor or representative at all times while on campus If at any time an employee of the A/E firm becomes ill, they should not remain or report to work at Central Virginia VA Health Care System.

Seasonal influenza with Vaccines (SOW Attachment 07)

3. DESIGN WITHIN FUNDING LIMITATIONS:

The design shall be prepared by the A/E to permit the award of a construction contract, using Federal Acquisition Regulation procedures for the construction of the facilities, at a cost that does not exceed the project’s estimated construction which will be included in the Request for Proposal (RFP) issued to the highest rated firm.

4. DESIGN INDEPENDENCE, FURNITURE AND EQUIPMENT: Designs for construction must produce a “complete and usable” facility or improvement when constructed. VA policy (VHA Office of Capital Assets Management, Engineering and Support memo Updated Construction Guidance and Expectations dated Sep 12, 2016) requires the A/E to certify that their design (including all bid alternates/bid deducts) is independent of any future construction project. In addition, the A/E must certify that it has produced a design that does not include furniture and equipment that will be procured separately. Equipment that can be part of the design in the includes those items to meet code requirements for building occupancy, items covered in the VA’s Master Construction Specifications (PG-18-1) Divisions 1 through 10, 13 through 26 or 28 through 48, non-IT equipment items covered by Division 27 and items covered by Division Numbers 12 31 00, 12 32 00, 12 34 00 and 12 36 00.

The A/E shall submit as part of the Final Bid Documents submittal a signed letter on company letterhead stating the design’s independence.

5. DESIGN CRITERIA: The VA Technical Information Library (TIL) available at http://www.cfm.va.gov/til/index.asp is managed by the VA Office of Construction and Facility Management and is the master repository for all VA Numbered Standards for Construction to include design and construction specifications, procedures, standard details, BIM/CAD standards, equipment guides, space planning and design guides. The documents of the TIL shall be the minimum design criteria for all VA projects performed in the construction of new facilities and the modernization, alteration, addition, or improvement of its real property. All design documents shall be developed in accordance with the VA TIL, including (but not limited to) the following listed Department of Veterans Affairs References:

PG-18-1 Master Construction Specifications SOW Attachment 01 VHA Required Division 01 Specification Section List PG-18-3 Design and Construction Procedures [Including but not limited to: Codes, Standards, and Executive Orders] PG-18-4 Standard Details and CAD Standards PG-18-5 Equipment Guide List H-18-8 Seismic Design Handbook PG-18-9 Space Planning Criteria PG-18-10 Design Manuals (by discipline) [Including but not limited to: Guiding Principles checklists as indicated for Minor Projects in Sustainable Design Manual, Life Cycle Cost Analysis]

PG-18-12 Design Guides (graphical, by function) PG-18-13 Barrier Free Design Guides PG-18-14 Room Finishes, Door, and Hardware Schedules PG-18-15 Minimum Requirements for A/E Submissions PG-18-17 Environmental Compliance Manual H-7545 VA Cultural Resource Management Procedures OIT Infrastructure Standard for Telecommunications Spaces v3.0 (21 August 2020)

The following references should also be used to complete the design documents:

VA Standards Alert 017 – Infrastructure Standards for Telecommunications Spaces and all standards, guides, and manuals incorporated by reference (https://www.cfm.va.gov/til/sAlert/sAlert017.pdf)

Where conflicts exist between VA adopted codes and standards and the documents on the TIL, the A/E shall bring this to the attention of the VA. The resolution of the conflict shall be made by the authority having jurisdiction for VA to ensure consistency department wide.

6. DESIGN COLLABORATION: The A/E during this design project shall collaborate with the VHA Office of Healthcare Environment and Facilities Programs Special Engineering Program (HEFP/SEP) staff, VISN 6 and the Independent Life Safety Review Agent (LS Agent) for the project. Design submittal comments from these contractors, if concurred with by VA, shall be incorporated into the design. HEPF/SEP and/or VISN deliverables shall be coordinated with the A/E’s design submittals to ensure compliance with all requirements are met. The A/E is required to ensure all elements of the design adhere to the Life Safety Code, including recommendations for temporary construction barriers, prior to the Independent Life Safety review.

7. INDEPENDENT LIFE SAFETY REVIEW: The A/E shall incorporate any comments from the VA 3rd party life safety review.

8. ENVIRONMENTAL PROTECTION: The A/E shall assist the VA with completion of a National Environmental Policy Act (NEPA) assessment as required by the Central Virginia VA Health Care System.

If the NEPA assessment results in potential environmental impacts, the A/E shall be responsible for completing any auxiliary documentation required per PG-18-17 NEPA Interim Guidance for Projects located on the TIL (http://www.cfm.va.gov/til/etc/NEPAGuidance.pdf). Additional requirements may include, but are not limited to, Environmental Assessment, Environmental Impact Statement, and Record of Decision. The NEPA analysis and concluding documentation must be completed by the Final Bid Documents submittal.

9. PHYSICAL SECURITY: The A/E must include a certified physical security specialist. The specialists must be involved with the design beginning with the concept phase and the qualifications must be submitted to the COR for review and approval prior to the concept/basis of design phase. The specialists shall meet the specific requirements listed in the Physical Security Design Manual for Mission Critical Facilities located on the TIL (http://www.cfm.va.gov/til/PhysicalSecurity/dmPhySecMC.pdf). The A/E shall ensure that all aspects of the applicable VA Physical Security Design Manual (either Life-Safety Protected or Mission Critical Facilities; both will be applicable depending on the area the work is taking place) are incorporated into the design and shall prepare a written report acknowledging compliance as required by the VAMC. The A/E must inform the COR of any physical security items that will be difficult to achieve during the concept/basis of design phase of the design and assist the VA with waiver requests as necessary.

10. TELECOMMUNICATIONS DESIGN: In accordance with “Telecommunications and Special Telecommunications Systems Design Manual,” February 2016 (https://www.cfm.va.gov/til/dManual/dmTelecomm.pdf), paragraph 1.2 (d), Telecommunications design must be performed and stamped by a BICSI Registered Communications Distribution Designer (RCDD) for all projects.

11. SUBMITTAL REQUIREMENTS: Design submittals shall follow the requirements of Program Guide, PG- 18-15, Volume C - A/E Submission Instructions for Minor and NRM Construction Program dated November 2008. This document is included as SOW Attachment 6. Submittal documents shall be prominently marked “For Official Use Only (FOUO)” if they contain qualifying data as defined in VHA Memorandum 2019-11-13 Sensitive Infrastructure Data Classification – For Official Use Only (FOUO).

This memo is included as SOW Attachment 4, as it is hosted on a non-public VHA site (https://vaww.va.gov/vhapublications/ViewPublication.asp?pub_ID=8949).

The A/E shall deliver design submittal documents that follow the iterative phase breakdown for design work in PG-18-15 and as additionally specified below. Specific requirements for each discipline/work product listed under each phase can be found in PG-18-15; it is expected for the phase of design that each of the checked items in the SD/DD/CD columns will be completed for the submittal. The A/E shall attend a review meeting following each design submittal as indicated under the Project Schedule section of this Scope of Work. Each new submittal will incorporate all VA comments from the previous submittal. The Asbestos Abatement requirements in PG-18-15 are applicable at Central Virginia VA Health Care System due to the continued use of certain asbestos containing products for the 1982 completed building construction.

The following submittals will be required for this project:

Quality Assurance/Quality Control (QA/QC) Plan Basis of Design (BD) - 10% - In addition to the requirements in PG-18-15, a Basis of Design is required. Basis of Design is a narrative presentation of facts (based from VA-A/E Design Charrettes), sufficiently complete, to demonstrate that the project concept is fully understood, and that subsequent design details, and their ultimate presentation in the final drawings and specifications, will be based on sound architectural and engineering decisions. Conceptual drawings of the planned design and the initial cost estimate will additionally be included.

Schematic Design (SD) – 15% Design Development One (DD1) – 35% Design Development Two (DD2) – 65% Construction Documents (CD1) – 95% Construction Documents (CD2) – 100% Final Bid Documents (Bid)

12. DRAWING FORMAT: All drawings shall adhere to VA project software requirements for Building Information Modeling (BIM) and Computer Aided Design (CAD) available at http://www.cfm.va.gov/til/projReq.asp. BIM software shall be Revit 2020 or the latest version available to Central Virginia Health Care System.

The project BIM model minimum requirements shall be developed to include the systems described below as they would be built, the processes of installing them and to reflect record drawing conditions.

The deliverable model at the SD, DD and CD design phases shall be developed to include as many of the systems described below (but not limited to) as are necessary and appropriate at that design phase.

Facility Electrical/Telecommunications Facility HVAC & HVAC Controls

Facility Plumbing Facility Sprinkler & Fire protection

Facility Architecture Facility Structural

13. SUBMITTAL FORMATS: Submittals shall be submitted in electronic format and hard copy formats as listed below. Portable Document Format (.pdf), Microsoft Office Suite formats (.doc, .xls, and .ppt), and AutoCAD (.dwg) files are acceptable. Submittals shall additionally be compliant with Section 508 of the Rehabilitation Act (29 U.S.C. '794 d); information on the requirements for accessible media can be found at http://www.section508.gov/. The A/E shall be responsible for providing:

Meeting/Conference Minutes Meeting minutes for all formal meetings and conferences held with the VA, including weekly construction meetings. Meeting minutes shall be submitted within seven (7) calendar days of the meeting or conference. All documents in any of the electronic formats listed above.

Minimum meeting minutes requirements Project name, number, meeting host, Meeting Name Date, Time, meeting ID, call in number, Duration, and consecutive number of total related meetings Participant list (Name, Title, Phone number (office and Mobile), Email, Attended Meeting

(yes/no Check box) Meeting purpose, Roll call, and Additional Items Agenda items (Decisions, action items, and fixes or next steps) Next meeting date and time Detailed attachment list

Construction Cost Estimates Construction cost estimates shall comply with Manual for Preparation of Cost Estimates & Related Documents for VA Facilities (latest version). This document is available on the TIL at http://www.cfm.va.gov/cost/index.asp. All estimates in any of the electronic formats listed above.

Quality Assurance/Quality Control (QA/QC) Plan All documents in electronic format.

Basis of Design (BD) All documents in electronic format.

Two (2) half-size paper bond sets of drawings – 2 to VA

Schematic Design (SD) All documents in electronic format.

Two (2) half-size paper bond sets of drawings – 2 to VA Two (2) paper bond sets of specifications – 2 to VA Two (2) paper bond sets of investigation reports, design calculations, space planning data, and cost estimate – 2 to VA

Design Development (DD), and Construction Documents (CD) All documents in electronic format.

Memo annotating what was not upgraded and corresponding justifications.

One (1) full size paper bond sets of drawings – 1 to VA Two (2) half-size paper bond sets of drawings – 2 to VA Two (2) paper bond sets of specifications – 2 to VA Two (2) paper bond sets of investigation reports, design calculations, space planning data, construction schedule, construction SOW, and updated cost estimate – 2 to VA

Final Bid Documents (Bid) PDF files of drawings, specifications, and any miscellaneous design analysis documents such as submittal log and physical security compliance report.

Certified memo annotating what areas/times were not upgraded and the corresponding justifications.

Certified memo that the A/E design is independent of future projects and includes all equipment required for the project to be activated/full functional.

Word files of specifications.

AutoCAD files of drawings.

One (1) full size paper bond sets of drawings – 1 to VA Two (2) half-size paper bond sets of drawings – 2 to VA Two (2) paper bond sets of specifications – 2 to VA One (1) paper bond sets of investigation reports, design calculations, space planning data, construction schedule, construction SOW, and updated cost estimate – 1 to VA

14. OPTION ITEM REQUIREMENTS

Construction Period Services (CPS)

Requests for Information (RFI)

Requests for Information shall be submitted within three calendar days of submittal to the A/E.

Submittal Reviews

Submittal reviews shall be submitted within seven calendar days of submittal to the A/E

Site Visit Reports

Site visit reports shall be submitted within seven calendar days of the visit. All documents in any of the electronic formats listed above.

Modification/Change Order Requests

Modification requests shall be submitted within seven calendar days (check all against Dan’s email) of submittal to the A/E. This includes the review of the contractor’s change order/modification proposal for construction change orders, as well as the formulation of an IGCE for the modification, as requested. The A/E's reply regarding their review of cost proposals and their recommendations shall include an independent breakdown of costs in detail, quantities, and unit prices and shall cover both additions and deductions of labor, materials, and equipment. The A/E shall also supply cost estimates as requested by the COR for Requests for Proposals for anticipated changes. All documents in any of the electronic formats listed above. Note: If major modification, VA will provide additional time and document format guidance.

Punch List

Punch list shall be submitted within seven calendar days of the final acceptance inspection. All documents in any of the electronic formats listed above.

Record Drawings

Record drawings shall be delivered to the VA within 30 calendar days after VA acceptance of the construction project. Autodesk Revit Project (.rvt) format and AutoCAD (.dwg) format.

Third-Party Commissioning

The A/E shall provide Commissioning and Commissioning Agent services and deliverables in accordance with the reference document, OCFM Whole Building Commissioning Process Manual located on the TIL (https://www.cfm.va.gov/til/Cx-RCx/CxManual.PDF). See “Commissioning Agent Tasks” in each section of the reference document. The Commissioning Agent shall be involved in all phases of the project, including both design and construction. It is anticipated that the Commissioning Agent will participate in the following: design reviews, owner’s requirements updates, design phase commissioning planning (facilitate), commissioning specification reviews (facilitate), construction project meetings, construction observation visits, equipment startup and testing, Testing Adjusting and Balancing (TAB) verification, and project commissioning (facilitate in coordination with General Contractor). The commissioning process shall be adapted to the size and complexity of the project. Deliverables shall be as described in the reference document.

Additionally, the A/E shall develop the commissioning plan, pre-functional checklists, systems functional performance test checklists, integrated system test checklists, and edited master specification templates to serve as a starting point for the commissioning process on all projects based on the following Systems to be Commissioned.

General Commissioning Requirements (VA Master Specification 01 91 00) Facility Exterior Closure (VA Master Specification Section 07 08 00) Fire Suppression (VA Master Specification Section 21 08 00) Plumbing (VA Master Specification Section 22 08 00) HVAC (VA Master Specification Section 23 08 00) Electrical (VA Master Specification Section 26 08 00) Communications (VA Master Specification Section 27 08 00) Electronic Safety and Security (VA Master Specification Section 28 08 00)

15. PROJECT SCHEDULE/PERIOD OF PERFORMANCE: The A/E shall perform Part One Services/Design Phase work according to the schedule shown below. The A/E is also responsible for following specification SOW Attachment 04 - 01 32 16.01 Architectural and Engineering CPM Schedule. If a due date on the timeline below falls on a Holiday or Weekend, the submittal shall be due the following business day. The remaining timeline will not be shifted to accommodate Holidays or Weekends.

Initial Investigation IPT-A/E Design Charrette

14 calendar days after receipt of Notice of Award (NOA)

Design Program (DP) 10% Submittal & QA/QC Submittal

14 calendar days after Design Charrette

DP 10% Submittal & QA/QC Submittal Review Meeting

14 calendar days after VA receipt of DP 10% & QA/QC Submittals

15% Schematic Design (SD) Submittal 14 calendar days after acceptance of DP 10% & QA/QC Submittals 15% SD Review Meeting 14 calendar days after VA receipt of 15% SD Submittal 35% Design Development One (DD1) Submittal

28 calendar days after VA acceptance of 15% SD Submittal

35% DD1 Submittal Review Meeting

14 calendar days after VA receipt of 35% DD1 Submittal

65% Design Development Two (DD2) Submittal

28 calendar days after VA acceptance of 35% DD1 Submittal

65% DD2 Submittal Review Meeting 28 calendar days after VA receipt of 65% DD2 Submittal 95% CD1 Submittal

28 calendar days after VA acceptance of 65% DD2 Submittal

95% CD1 Submittal Review Meeting

42 calendar days after VA receipt of 95% CD1 Submittal

100% CD2 Submittal 28 calendar days after VA acceptance of 95% CD1 Submittal 100% CD2 Submittal Review Meeting 28 calendar days after VA receipt of 100% CD2 Submittal Final Bid Documents Submittal 14 calendar days after VA acceptance of 100% CD2 Submittal Final Bid Documents Acceptance Meeting

14 calendar days after VA receipt of Final Bid Document Submittal

Total Part One Services/Design Phase Schedule

322 calendar days

The 322 days listed in part one project schedule may fluctuate based on when submittals meet all VA guidelines and acceptance is issued. If submittals are not accepted due to insufficient design requirements throughout the design period and additional time is deemed necessary. It is the responsibility of the A/E firm to cover all costs associated with such delays.

Part Two Services/Construction Period Services (optional Line Items) shall be performed for the length of time between the time the option(s) are exercised and acceptance of Construction Completion. The VA has 365 calendar days from final acceptance of the design to exercise the option(s) for Construction Period Services.

16. CONTRACT OVERSIGHT: All contracts for this project shall be awarded by the Program Contracting Activity Central (PCAC); only a warranted VA Contracting Officer shall have authority to change the terms and conditions of a contract. These changes may involve the contract award amount, contract period of performance, issuance of stop work orders and changes to the statement of work.

PCAC shall designate a Contracting Officer’s Representative (COR) to monitor and manage the A/E’s performance under the design project contract. The COR shall be a representative of the Central Virginia VA Health Care System Engineering Service Project Section and have the technical knowledge required to monitor and oversee the project.

A COR from the Central Virginia VA Health Care System Engineering Service Project Section shall also be designated for the construction project contract to monitor and manage the construction contractor’s performance under the construction project contract. This designation under the construction contract shall be considered equivalent to the industry standard of “Owner’s Representative” and does not supersede or eliminate the A/E’s responsibility for Part Two Services/Construction Period Services. The A/E ultimately shall be responsible for any errors and omissions with the design discovered during and after the construction phase.

17. REPORTING REQUIREMENTS:

The Contractor shall report Engineering Project Section, BLDG. 500 RM 2K-137 to check in with the COR during normal working hours. This check-in is mandatory. When the service is completed, the Contractor shall document services rendered on a legible field service report. The Contractor shall return to the same service and building to submit the field service report to the COR for signature during normal working hours.

18. SECURITY REQUIREMENTS:

GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS:

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

c. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness.

d. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non- U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor.

e. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE:

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements.

VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations, and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations, and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response.

k. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response.

l. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non- Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

c. Each risk analysis shall address all relevant information concerning the data breach, including the following:

1. Nature of the event (loss, theft, unauthorized access).

2. Description of the event, including:

a. Date of occurrence.

b. Data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code.

3. Number of individuals affected or potentially affected.

4. Names of individuals or groups affected or potentially affected.

5. Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text.

6. Amount of time the data has been out of VA control.

7. The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons)

8. Known misuses of data containing sensitive personal information, if any.

9. Assessment of the potential harm to the affected individuals.

10. Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy

Incidents, as appropriate: and

11. Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised.

d. Based on the determinations of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following:

1. Notification.

2. One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports.

3. Data breach analysis.

4. Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution.

5. One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and

6. Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

SECURITY CONTROLS COMPLIANCE TESTING:

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

TRAINING:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems:

1. Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems.

2. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training.

3. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and

4. Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document – e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements.

b. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete

FRAUD, WASTE, AND ABUSE:

The vendor has responsibility for “Duty to Report” any fraud, waste and abuse witnessed while on VA premises to the Integrity and Compliance Officer.

19. SOW and ATTACHMENTS:

The following list of documents are attached to this SOW for A/E use and incorporation into the project documents:

VHA Required Div 01 Specification Sections (See SOW Attachment 01) VHA Directive 1061 Prevention of Healthcare Associated Legionella Disease (See SOW Attachment 02) Sensitive Infrastructure Data Classification FOUO (See SOW Attachment 03) 01 32 16.01 Architecture and Engineering CPM Schedule (See SOW Attachment 04) Program guide, PG-18-15 Volume C – A/E Submission Instructions for Minor and NRM Construction program dates November 2008 (See SOW Attachment 05) Seasonal influenza with vaccines (See SOW Attachment 06) Campus Map & General Project Location (See SOW Attachment 07)

End of SOW