Draft Performance Work Statement.pdf

PERFORMANCE WORK STATEMENT

Metasys Modernization and AI-Enabled Facility Intelligence Platform

Las Vegas VA Medical Center

1. OVERVIEW

The Las Vegas VA Medical Center (LVVAMC) is an approximately 1,000,000+ square foot multi-building medical campus anchored by a ~790,000 square foot acute care hospital and supported by central utility plant infrastructure, outpatient facilities, and administrative buildings.

The campus operates a complex HVAC environment control system including chilled water production, steam generation, cooling towers, hydronic distribution networks, and 64 air handling units (AHUs) of varying which reinforces the scale and complexity of analytics deployment.

The facility operates a Metasys Building Automation System (BAS). Lifecycle modernization is required to transition from reactive monitoring to predictive, analytics-driven infrastructure intelligence technology while maintaining uninterrupted clinical operations.

2. SCOPE OF WORK

The Contractor shall provide all labor, materials, engineering, software, hardware, commissioning, training, and documentation required to modernize the BAS infrastructure and deploy a fully integrated operational intelligence platform.

ITEM DESCRIPTIONS

1 Head End, User Interface and BMS Infrastructure

2 DDC Field Controls for equipment listed

3 Installation, Programming, and Training

4 Open Blue – Central Utility Plant Optimizer – Project Development Agreement

5 Open Blue – Enterprise Management – Project Development Agreement

Scope includes

- BAS supervisory modernization

- Full graphics and database reconstruction

- AI-enabled analytics deployment

- Instrumentation and metering integration

- Predictive maintenance enablement

- Energy and water accountability analytics

- Cybersecurity alignment

- Long-term infrastructure intelligence development

A. AI-Enabled Analytics Platform

Deploy an analytics platform capable of continuous commissioning, anomaly detection, degradation modeling, and engineering-grade dashboards without degrading BAS supervisory performance.

B. Instrumentation and Data Acquisition The Contractor shall evaluate existing BAS instrumentation and deploy additional metering or sensing devices where necessary to support analytics outcomes. Instrumentation will include BTU meters, ultrasonic flow meters, differential pressure transmitters, electrical submeters, steam and condensate monitoring devices, and cooling tower water instrumentation.

PERFORMANCE WORK STATEMENT

All installed instrumentation shall be calibrated, validated, cybersecurity compliant, fully integrated into the BAS/analytics environment, and shall become Government property.

Instrumentation Cost Responsibility (Firm Requirement) All instrumentation required to achieve analytics functionality defined in this PWS shall be included in the Contractor’s base proposal. No additional costs shall be passed to the Government for instrumentation necessary to enable analytics, metering, or operational intelligence capabilities.

Instrumentation shall be considered inherent to solution delivery and not separately compensable. Future claims, change orders, or pricing adjustments based on instrumentation needs shall not be considered valid grounds for additional compensation.

C. Comprehensive Energy and Water Intelligence The analytics platform shall provide deep utility intelligence across energy and water systems including:

Steam and Boiler Analytics:

• Steam-to-condensate mass balance analysis

• Condensate return efficiency tracking

• Makeup water anomaly detection

• Steam loss modeling and degradation trends

Cooling Tower Analytics:

• Evaporation and blowdown modeling

• Cycles of concentration estimation

• Tower water efficiency degradation detection

Chilled Water Plant Analytics:

• Real-time kW per ton calculations

• Chilled water tonnage modeling

• Partial-load degradation identification

• Hydraulic instability detection

Hydronic Analytics:

• Low delta-T detection

• Branch flow imbalance identification

• Pump staging inefficiency detection

Water Accountability:

• Facility-level water balance modeling

• Makeup water baselining

• Infrastructure leak indicators

Cross-System Intelligence:

• Water-energy nexus analysis

• Simultaneous heating/cooling detection

• Control loop conflict identification

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

D. Analytics Performance Requirement The Contractor shall demonstrate measurable operational value during commissioning. Analytics shall identify real or simulated anomalies and provide actionable engineering solutions. Analytics lacking operational usefulness shall not be considered complete.

E. Vendor Independence and Data Portability All data shall be exportable in non-proprietary formats. The Contractor shall not implement controls that restrict future platform migration, integration, or interoperability.

F. Knowledge Transfer and Engineering Enablement The Contractor shall ensure Engineering Service is fully enabled to interpret analytics outputs independently. Training shall emphasize operational autonomy and long-term sustainability.

G. Scalability and Future Expansion Architecture shall support future expansion including additional instrumentation, enterprise analytics, and integration with emerging facility intelligence technologies without requiring platform replacement.

H. Infrastructure Risk Reduction Intent This modernization is intended to reduce lifecycle infrastructure risk by improving visibility into degradation trends, hidden inefficiencies, and resource losses that traditionally remain undetected until failure.

I. Acceptance Criteria Acceptance shall be based on demonstrated analytics performance, engineering usability, documentation completeness, and system stability as determined by the COR.

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

FACILITY PROFILE

Campus Size: ~1,000,000+ square feet Primary Hospital: ~790,000 square feet Estimated AHU Count: 60+ units Central Utility Plant: Dedicated chilled water and steam infrastructure Controls Platform: Metasys BAS architecture

GRAPHICS AND ANALYTICS VISUALIZATION

Graphics shall support engineering dashboards including kW/ton visualization, steam-condensate analytics, cooling tower water intelligence, and infrastructure anomaly detection views.

Dual-Fuel Boilers, Fuel Storage, and Generator Fuel Analytics The facility operates three York Shipley boilers capable of dual fuel operation utilizing both natural gas and fuel for resiliency and emergency preparedness. The modernization shall ensure the Metasys and analytics platform tracks fuel usage across both fuel types, providing visibility into consumption trends, energy equivalency, and potential efficiency deficiencies between fuel modes.

The analytics platform shall provide fuel tracking and correlation against steam production to support energy accountability and operational optimization during both normal and contingency operations.

The facility maintains underground fuel storage infrastructure consisting of multiple diesel and fuel oil storage tanks. Engineering estimates indicate approximately nine underground storage tanks supporting emergency generation and dual-fuel boiler operation. The modernization shall enable monitoring and analytics of fuel inventory, usage rates, replenishment cycles, and environmental compliance indicators associated with underground fuel storage systems.

Fuel analytics shall support:

• Consumption trending and anomaly detection

• Environmental compliance monitoring support

• Fuel reconciliation and accountability

• Early identification of abnormal draw patterns

Additionally, the campus operates six Cummins emergency generators rated at approximately 2.5 kV class output (25 kV distribution integration). These generators are exercised through required monthly testing and periodic three-year dark start exercises requiring sustained diesel fuel usage.

The modernization shall ensure the BAS and analytics environment tracks generator fuel consumption associated with monthly testing and triennial black-start validation. Analytics shall support lifecycle fuel planning, testing verification, and fuel consumption accountability across emergency power validation events.

All fuel analytics capabilities shall integrate into the broader operational intelligence framework to ensure visibility into combustion-based energy sources alongside electric and thermal infrastructure analytics.

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

FACILITY VISUALIZATION AND SYSTEM CONTEXT

This appendix provides visual context for the Las Vegas VA Medical Center (LVVAMC) infrastructure and the operational systems addressed by this modernization effort. The graphics included are intended to support understanding of facility scale, utility interdependencies, and the breadth of infrastructure covered by the Building Automation System (BAS) modernization and analytics deployment.

The LVVAMC located at 6900 North Pecos Road North Las Vegas is a large, multi-utility medical campus consisting of central chilled water, steam, cooling tower, emergency power, and combustion-based fuel systems integrated through a Metasys BAS architecture. The modernization introduces advanced analytics spanning thermal, electrical, hydronic, and fuel-based infrastructure.

The figures below provide high-level conceptual visualization of the campus layout, central utility relationships, and analytics coverage domains. These visuals are illustrative and enhance understanding of system complexity and modernization scope without introducing proprietary design detail.

Figure C‐1 — LVVAMC Campus Infrastructure Overview This figure illustrates the general campus layout and major infrastructure zones relevant to the modernization effort.

Figure C‐2 — Central Utility System Relationships This diagram depicts the interconnected nature of chilled water, steam, cooling tower, and fuel-supported systems monitored under the analytics platform.

Figure C‐3 — Operational Intelligence Coverage Domains This visualization highlights the breadth of infrastructure addressed by the modernization, including thermal, electrical, combustion, and water-dependent systems.

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

Figure C-1

Central Utility Plant

Main Hospital, (Building 1)

Building 5

PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

APPENDIX D

Contractor will provide the following proposal per the documents listed above.

JCI-METASYS BUILDING MANAGEMENT SYSTEM COMPONENTS:

BID COMPONENT DESCRIPTION

Item #1 Metasys Server Upgrade Item #2 Field Level DDC Controls Item #3 Central Utility Plant Metering Item #4 Open Blue – CUP Optimizer/Enterprise

Management PDA

ITEM 1: Metasys Server Upgrade

(1) Metasys Network Architecture:

Upgrade existing Metasys software from version 13.0 to 15.0 o Includes SQL core licenses – (4) 4-core in total

Furnish and install (1) ADX25 split server o Server specifications:

Dell PowerEdge R7725 Server Dual AMD EPYC 9175F 4.2 GHz CPUs with (16) Cores each 128 GB of RDIMM RAM at 6400

(3) 3.2 TB Data Center Solid State Drives 1500 W power supply

ADX25 split server will compartmentalize Metasys trending data, reducing processing power required to trend while maintaining speed and stability to operate Metasys functions

Reuse and reprogram existing JCI ADX25 to serve as a redundant, backup server

ITEM 2: Field Level DDC Controls

Building 1, Level 3: Clean Core and Operating Rooms

(16) Room Pressure Monitors:

Furnish and install (1) Room Pressure Monitor with (1) remote sensor and (1) magnetic door switch; located at the following room junctions:

o Corridor C3-76 to Clean Core (3D427) o Clean Core (3D427) to OR #1 (3D386) o Clean Core (3D427) to OR #2 (3D382) o Clean Core (3D427) to OR #3 (3D436) o Clean Core (3D427) to OR #4 (3D430) o Clean Core (3D427) to OR #5 (3D417) o Clean Core (3D427) to OR #6 (3D411) o Clean Core (3D427) to OR #7 (3D395) o Clean Core (3D427) to OR #8 (3D392) o Clean Core (3D427) to Sub Sterile OPT (3D383) o Sub Sterile OPT (3D383) to Scrub (3D384)

PERFORMANCE WORK STATEMENT

o Clean Core (3D427) to Sub Sterile (3D390) o Sub Sterile (3D390) to Corridor C3-77 o Clean Core (3D427) to Sub Sterile (3D434) o Sub Sterile (3D434) to Scrub (3D432) o Corridor C3-76 to Soiled Holding (3D416)

Room Pressure Monitors wired to nearest VAV controller via BACnet communication trunk

Remote Sensor mounted above door, wired to RPM Door Switch installed at the top of door, wired to RPM Provide controls technician labor for programming of RPM, associated devices, alarms, and zone pressure relationships Electrical installation and controls labor priced for OVERTIME (Monday through

Saturday, afterhours)

(8) Critical Environment Controllers:

Furnish and install (1) Critical Environment Controller; located at the following room junctions:

o Clean Core (3D427) to OR #1 (3D386) o Clean Core (3D427) to OR #2 (3D382) o Clean Core (3D427) to OR #3 (3D436) o Clean Core (3D427) to OR #4 (3D430) o Clean Core (3D427) to OR #5 (3D417) o Clean Core (3D427) to OR #6 (3D411) o Clean Core (3D427) to OR #7 (3D395) o Clean Core (3D427) to OR #8 (3D392)

CEC wired to nearest VAV controller via BACnet communication trunk Provide controls technician labor for programming of CEC, associated devices, alarms, and OR temperature/humidity/CO2/pressure values. CEC displays OR temperature, humidity, CO2, pressure, and air changes per hour on graphical display.

(9) Operating Room Thermostats:

Remove existing thermostat, give to VAMC personnel for reuse Furnish and install (1) zone temperature/humidity/CO2 sensor with setpoint adjust and occupancy sensor; located in the following ORs:

o OR #1 (3D386) o OR #2 (3D382) o OR #3 (3D436) o OR #4 (3D430) o OR #5 (3D417) o OR #6 (3D411) o OR #7 (3D395) o OR #8 (3D392)

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

ITEM 3: CENTRAL UTILITY PLANT METERING

Building 2 – Metering Schedule and Details

(1) Condensate Return (Steam System):

Furnish and install (1) 4” Onicon, BACnet capable flow meter o Provide (1) BACnet integration to FM o 300 LB Flange style o Furnish and install piping insulation to match existing o Wired to nearest JCI control panel (DDC-B2-FTHL) in rigid EMT conduit

Contractor to provide scissor lift for work performed over 15ft in height Contractor to provide all labor to program, start up, and build Metasys graphics for FM Contractor to provide all required materials and consumptions to complete SOW

(2) Steam Recovery (Steam System):

Furnish and install (1) 2.5” Onicon, BACnet capable flow meter o Provide (1) BACnet integration to FM o Furnish and install piping insulation to match existing o Wired to nearest JCI control panel (DDC-B2-FTHL) in rigid EMT conduit

Contractor to provide scissor lift for work performed over 15ft in height

(3) Natural Gas (Hot Water System):

Furnish and install (1) 6” Onicon, BACnet capable flow meter o Provide (1) BACnet integration to FM o Hot Tap Permit o Furnish and install piping insulation to match existing o Wired to nearest JCI control panel (DDC-B2-FTHL) in rigid EMT conduit

Contractor to provide scissor lift for work performed over 15ft in height

(4) Industrial Water System:

Provide (1) BACnet integration to existing Potable Water meter o Wired to JCI control panel (DHWS Control Panel) in rigid EMT conduit

Provide (1) BACnet integration to existing Industrial Water Meter o Wired to JCI control panel (DHWS Control Panel) in rigid EMT conduit

(5) Cooling Tower Blow Down:

Furnish and install (1) 5” Onicon, BACnet capable flow meter (totalization) o Provide (1) BACnet integration to FM o Wired to nearest JCI control panel in rigid EMT conduit

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

Installation Services:

Provide electrical control wiring, conduit, and installation of the controls listed above as noted.

Provide all required project management, engineering, programming, and check out labor As-built drawings to be generated at completion of the job

(1) Condensate Return (Steam System):

o Furnish and install (1) 4” Onicon, BACnet capable flow meter o Provide (1) BACnet integration to FM 300 LB Flange style o Furnish and install piping insulation to match existing o Wired to nearest JCI control panel (DDC-B2-FTHL) in rigid EMT conduit o Contractor to provide scissor lift for work performed over 15ft in height o Contractor to provide all labor to program, start up, and build Metasys graphics for FM o Contractor to provide all required materials and consumptions to complete SOW

(2) Steam Recovery (Steam System):

o Furnish and install (1) 2.5” Onicon, BACnet capable flow meter o Provide (1) BACnet integration to FM o Furnish and install piping insulation to match existing o Wired to nearest JCI control panel (DDC-B2-FTHL) in rigid EMT conduit o Contractor to provide scissor lift for work performed over 15ft in height

(3) Natural Gas (Hot Water System):

o Furnish and install (1) 6” Onicon, BACnet capable flow meter o Provide (1) BACnet integration to FM o Hot Tap Permit o Furnish and install piping insulation to match existing o Wired to nearest JCI control panel (DDC-B2-FTHL) in rigid EMT conduit o Contractor to provide scissor lift for work performed over 15ft in height

(4) Industrial Water System:

o Provide (1) BACnet integration to existing Potable Water meter o Wired to JCI control panel (DHWS Control Panel) in rigid EMT conduit o Provide (1) BACnet integration to existing Industrial Water Meter o Wired to JCI control panel (DHWS Control Panel) in rigid EMT conduit

PERFORMANCE WORK STATEMENT

(5) Cooling Tower Blow Down:

o Furnish and install (1) 5” Onicon, BACnet capable flow meter (totalization) o Provide (1) BACnet integration to FM o Wired to nearest JCI control panel in rigid EMT conduit

Installation Services:

o Provide electrical control wiring, conduit, and installation of the controls listed above as noted.

o Provide all required project management, engineering, programming, and check out labor.

o As-built drawings to be generated and submitted to the Government/COR/CO at completion of the job.

o One-year parts and labor warranty from substantial completion of the job o Exclusions:

Wiring of sensors, and actuators internal to the packaged equipment Exclude all work associated with fire and smoke system including dampers and detectors Energy Conservation Measures (Advanced Metering and Analytics) Line voltage power to all DDC control panels Installation of any/all control valves, dampers, and temperature wells Anything not explicitly mentioned above.

ITEM 4: OPEN BLUE CUP OPTIMAIZATION/ENTERPRISE MANAGEMENT

PROJECT DEVELOPMENT AGREEMENT

The purpose of this Project Development Agreement (“PDA”) is to confirm the intent of the Customer and Contractor (collectively, the “Parties”) to develop an Open Blue Central Utility Plant Optimizer and Facility Enterprise maintenance management software solution project at Customer’s central plant facilities and hospital facilities – Las Vegas (the “Project”). This PDA will establish among other things the technical scope of the project, the obligations of both parties, the financial metrics to be met for a viable project, the intended outcomes, and project timeline.

Overall Customer Objectives – It is Customer’s desire to:

- Create utility cost savings

- Maximize local utility incentives in support of energy savings projects

- Deliver best in class tools for plant operators to deliver reliable mission critical systems and services without miscalculated cost to the Government and the protection of Veterans.

Industrial HVAC Equipment:

EQPT QTY Capacity / Piping / notes Chillers 5 Trane Centrifugal 1,200 tons each

PERFORMANCE WORK STATEMENT

Chilled Water Pumps

5 Variable Speed Primary, Headered

Cooling Towers 5 Variable Speed Primary, Headered CWP 5 Variable Speed Primary, Headered HX 1 Free-Cooling, parallel

This section is provided to clarify contractor responsibilities that extend beyond technical installation requirements. Due to the complexity of integrating new systems within an active healthcare environment, additional safeguards are necessary to protect Government assets, ensure existing systems are properly evaluated prior to modification, and preserve continuity of patient care operations. The following requirements establish clear expectations regarding contractor accountability for installation-related damage, pre-installation system condition verification, and operational flexibility required when working within an occupied medical facility.

Contractor Responsibility, System Condition Verification, and Patient Care Protection

This section establishes contractor accountability for installation-related damages, pre-installation system verification requirements, and operational expectations within an active healthcare environment where patient care takes precedence over project execution.

Contractor Liability for Installation Damages The Contractor shall be fully responsible for any damages caused to Government-owned property, infrastructure, systems, or adjacent equipment resulting from installation activities, whether direct or indirect.

This includes but is not limited to: Mechanical systems (HVAC, piping, rotating equipment); Electrical systems and controls; Building finishes and structural components;

Medical equipment affected by contractor activities; Existing Building Automation System components.

Any damage identified during or after installation shall be reported immediately to the Contracting Officer’s Representative (COR), documented with written findings and photographs, and repaired or replaced at no additional cost to the Government. Repairs must restore the affected asset to equal or better conditions than existed prior to contractor involvement. The Government reserves the right to determine adequacy of repair.

Failure to disclose damage or delays in corrective action may be considered non-compliance with contract performance standards.

Verification of Existing System Condition Prior to Modification Prior to performing any modification, demolition, integration, or upgrading activities, the Contractor shall verify that all affected systems are in acceptable operational condition.

This verification shall include Functional assessment of equipment being modified or interfaced; Confirmation that upstream and downstream systems are stable; BAS point validation (where controls are involved); Identification of degraded components that may impact installation success; Documentation of deficiencies that may affect system performance post-upgrade.

PERFORMANCE WORK STATEMENT

The Contractor shall notify the COR in writing of any pre-existing deficiencies that could impact system performance, prevent successful installation, cause post-installation failures, or create operational risks.

Failure to identify pre-existing issues prior to modification may result in the Contractor assuming responsibility for post-installation performance impacts that could have been reasonably identified during pre-installation verification. No work shall proceed until any significant system concerns are reviewed with the Government and direction is provided.

Healthcare Environment and Patient Care Priority The Contractor acknowledges that work will be performed within an active healthcare facility where patient care and life safety take precedence over all project activities.

Patient care operations shall take precedence over installation schedules.

The Government reserves the right to pause, reschedule, or modify work activities at any time to protect patient care, infection control requirements, or critical hospital operations.

The Contractor acknowledges that delays, interruptions, or resequencing caused by patient care requirements shall not be considered Government-caused delays for the purpose of equitable adjustments, delay claims, or additional compensation.

The Contractor shall plan and execute work in a manner that minimizes clinical disruptions, noise and vibration impacts, utility interruptions, environmental comfort deviations, and infection control risks.

The Government, through the COR or authorized medical center leadership, may immediately stop working if installation activities are determined to negatively affect patient care, clinical operations, or life safety systems.

The Government shall not be held financially liable for installation delays, inefficiencies, or extended durations resulting from operational constraints inherent to a healthcare environment. The Contractor shall incorporate healthcare operational constraints into project planning, staffing, sequencing, and scheduling.

Acknowledgement of Healthcare Installation Conditions By accepting this contract, the Contractor affirms understanding that work is being performed in an occupied medical facility, conditions may change rapidly due to clinical priorities, flexibility and coordination are mandatory performance requirements, and installation timelines must remain adaptable. Failure to accommodate the operational realities of a healthcare environment may be considered a performance deficiency.

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

3. HOURS OF WORK AND SCHEDULING: Work shall be scheduled accordingly with the Plant Supervisor during normal hours (Monday to Friday, from 7:30am to 4pm). Work in Building #2 Central Energy Plant and the VA Hospital after duty hours will be coordinated with the Energy Plant Utility Operators after 4pm daily, 7 days a week. The contact number for the Energy Plant Utility Operators is (702) 791-9000 ext. 16900. An operator is on duty 24 hours a day, 7 days a week.

Place of Performance:

Department of Veteran Affairs Medical Center 6900 North Pecos Road North Las Vegas, NV 89086

4. QUALIFICATIONS: All work for the duration of the contract shall be performed by qualified, certified, and licensed personnel on the system.

5. CONFIRMATION OF INSTALLATION: All services will be confirmed and approved by the Engineering Chief of Operations or the Utilities Systems Supervisor. When service is completed, the certified technician must indicate on the service ticket the equipment serviced, specific action taken, and all parts replaced. The component installed must be identified clearly by name, serial number, and location.

6. COMPLIANCE: The contractor shall be fully responsible for compliance with all VA, local, state, and Federal environmental/occupational safety laws, rules, and regulations. The contractor shall follow life and safety codes and take necessary actions to avoid conditions that may be hazardous to the health and safety of hospital personnel and patients. The contractor is responsible for meeting all applicable OSHA and VA guidelines for safe working processes;

example: lock-out/tag-out. All work for the duration of the contract shall be performed by certified trained technicians.

7. CONTRACTOR EMPLOYEES: The Contractor shall assign a Point of Contact (POC) for the purpose of ensuring compliance with all provisions of this contract. The Contractor POC shall be available on site and have the ability to address performance issues. All employees should be able to read and speak English.

The parties agree that Contractor personnel working under this contract shall not be considered VA employees for any purpose and shall be considered employees of the Contractor. All Contractor personnel assigned to the performance of this contract shall wear a Contractor-provided uniform or ID that clearly identifies the individual as a Contractor. All Contractor personnel are required to wear identification (I.D.) badges during the entire time they are on the VA Healthcare System grounds. I.D. badges must have picture identification, name of the individual, and the represented company depicted on it.

Contractor personnel shall present a neat appearance and be easily recognized as contractor employees. Example: wearing of distinctive clothing such as uniform, badges, patches, etc.

Contractor personnel shall not wear sandals, flip-flop style footwear, or open-toe shoes and shall follow VA dress guidelines. A copy of this will be provided upon request.

PERFORMANCE WORK STATEMENT

The Contractor shall ensure that the staff assigned shall be cognizant of the VA’s sexual harassment and drug-free workplace policies. The Contractor may obtain a copy of this information from the COR or Contracting Officer.

8. ESCORT AND VETERAN’S HOSPITAL SECURITY POLICE CHECK-IN: All contractor personnel working onsite at the VA facility shall check in and out with VA Police dispatch located in the Administrative building #6 south entrance. Access to work areas, and performance monitoring, will be provided by VA Engineering Service personnel. After-hours work will be monitored by VA Central Energy Plant Operators, 702-791-9000 Ext 16900. In all cases, the VA Central Energy Plant Operator shall be notified of any changes which may affect the response time of vital equipment.

9. AUTHORIZED SERVICE: Only those services specified within are authorized under this contract. Before permitting any service or repairs of a non-contract nature, the Contracting Officer must be advised of the reasons for this additional work. The Contractor is cautioned that only the Contracting Officer or his/her designee may authorize additional service or repairs that are outside of the scope of this contract and that reimbursement shall not be made unless prior authorization is obtained.

10. TEST EQUIPMENT: The VA shall not furnish parts and/or test equipment for the performance of this contract. It is the responsibility of the contractor to have/bring the appropriate equipment and/or supplies necessary to complete the work.

11. CONTRACTING OFFICER REPRESENTATIVE (COR): The Contractor shall not accept any instructions issued by any other person(s) other than the Contracting Officer. The Government may appoint a COR. If so, a Delegation of Authority letter shall be forwarded to the using service and the Contractor after the contract has been signed, identifying the individual(s) as the COR(s).

13. CHANGES: The Contractor is advised that only the Contracting Officer, acting within the scope of the contract has the authority to make changes which affect the contract in terms of quality, quantity, price, or delivery. In the event the Contractor effects any such change at the direction of any person other than the Contracting Officer, the change shall be considered to have been made without authority and no adjustment shall be made in the contract price to cover any increase in costs incurred as a result thereof.

14. PERSONNEL REQUIREMENTS: The Government reserves the right to accept or reject Contractor’s staff for the rendering of services. Complaints concerning Contract Personnel performance or conduct shall be dealt with by the Contractor, and/or the COR with the final decision made by the Contracting Officer.

15. PERSONNEL QUALIFICATIONS/EXPERIENCE CRITERIA: Contractor personnel shall have the following qualifications, but not limited to:

The contractor shall provide a Lead Technician to oversee all contract personnel with documented experience implementing large scale projects equal to, or greater than, the scope of this project.

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center

16. CONTRACTOR’S RESPONSIBILITIES: The Contractor shall maintain personal liability and property damage insurance prescribed by the laws of the Federal Government. He/she shall take all precautions necessary to protect persons and property from injury or damage during the performance of this contract. He/she shall be responsible for any injury to himself/herself, his/her employees, or others, as well as for any damage to personal or public property that occurs during the performance of this contract that is caused by him/her or his/her employees’ fault or negligence. Contractor shall comply with all VA safety standards, manufacturers/industry standards, FDA, OSHA, JCAHO, and the latest edition of NFPA-99.

17. CONTRACTOR SUBMITTALS/INSURANCE REQUIREMENTS: The Contractor is required to comply with Federal and State Workers Compensation and liability insurance (Reference FAR clause 52.228-5-Insurance and Subpart 28.307-2-Liability). The Government shall be held harmless against any or all loss, cost, damage, claim expense or liability whatsoever, because of accident or injury to persons or property of others occurring in the performance of this contract. The Contractor shall be responsible for all damages to property, which may be done by him/her, or any employee engaged in the performance of this contract.

The parties agree that the Contractor’s personnel working as a result of this contract shall not be considered VA employees for any purpose and shall be considered employees of the Contractor.

The Contractor shall be responsible for providing:

a. Workers Compensation.

b. Professional liability insurance.

c. Health examinations.

d. Income tax withholding, and,

e. Social Security payments.

18. SMOKING POLICY: Smoking is not permitted within or around the VA, except in designated areas.

19. SAFETY AND FIRE PREVENTION: In the performance of this contact, the Contractor shall take such safety precautions as necessary to protect the lives and health of the occupants of the building. Fire and safety deficiencies, which exist and are part of the responsibility of the Contractor, shall be immediately corrected. If the Contractor fails or refuses to correct deficiencies promptly, the COR may issue an order stopping all, or any part, of the work. The Contractor shall comply with applicable Federal, State, and local safety and fire regulations and codes, which are in effect during the performance period of the contract. The Contractor personnel shall follow applicable facility policies concerning fire/disaster programs.

20. VA POLICY: Possession of weapons is prohibited. Enclosed containers, including tool kits, are subject to search. Violations of VA regulations may result in citations answerable in the United States (Federal) District Court.

21. BADGES AND PARKING: It is the responsibility of Contractor personnel to park only in designated parking areas. Parking information is available from the VA Police. The VA will not validate or make reimbursement for parking violations of the Contractor’s personnel under any circumstances.

22. HOURS OF SERVICES: The Contractor shall perform the onsite services Monday through Friday with the exception of National Holidays (see below) between the hours of 7:30am to 4pm.

PERFORMANCE WORK STATEMENT

23. OVERTIME AND HOLIDAYS: Any overtime and/or holiday pay that the Contractor’s employees may be entitled to, shall be the sole responsibility of the Contractor and shall not be billed to nor reimbursed by the Government.

24. NATIONAL HOLIDAYS

The contractor is not required to provide service on the following National holidays, nor will the Contractor be paid for these holidays. The following national holidays are observed by the Federal Government:

New Year’s Day 1 January Martin Luther King’s Birthday Third Monday in January President’s Day Third Monday in February Memorial Day Last Monday in May Juneteenth 19 June Independence Day 4 July Labor Day First Monday in September Columbus Day Second Monday in October Veterans Day 11 November Thanksgiving Day 4th Thursday in November Christmas Day 25 December

25. PAYMENTS: Payments will be made in arrears upon receipt of an invoice prepared in accordance with FAR 52.212-4. Invoices should be electronically submitted at the OB10 website (http://www.ob10.com). For OB10 system registration please call 877-752-0900, chose option #2, and use promotion code VAPC7Y18. This makes the service free to VA vendors.

26. RECORD MANAGEMENT: Contractor will ensure Record(s) Management compliance with all the applicable records management laws and regulations in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1.

27. SECURITY REQUIREMENTS: UNCLASSIFED INFORMATION TECHNOLOGY

SECURITY RESOURCES

a. The contractor and their personnel shall be subject to the same Federal laws, regulations, standards and VA polices as VA personnel, regarding information and information system security. These include, but are not limited to, Federal Information Security Management Act (FISMA), Appendix III of OMB Circular A-130, and guidance and standards, available from the Department of Commerce’s National Institute of Standards and Technology (NIST). This also includes the use of common security configuration available from NIST’s Web site at:

http://checklists.nist.gov.

b. To ensure that appropriate security controls are in place, contractors must follow the procedures set forth in “VA Information and Information System Security/Privacy Requirements for IT Contractors” located at the following site: http://www.iprm.oit.va.gov.

PERFORMANCE WORK STATEMENT

c. These provisions shall apply to all contracts in which VA sensitive information is stored, generated, transmitted, or exchanged by VA, a contractor, subcontractor or a third-party, or on behalf of any of these entities regardless of format or whether it resides on a VA system or contractor/subcontractor’s electronic information system(s) operating for or on the VA behalf.

ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

e. The contractor or subcontractor must notify the COR immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor’s employ. The COR must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination.

VA INFORMATION CUSTODIAL LANGUAGE

a. Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor’s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA’s information is returned to the VA or destroyed in accordance with VA’s sanitization requirements. VA reserves the right to conduct on-site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements.

c. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the COR within 30 days of termination of the contract.

d. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies.

If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract.

e. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/ subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed.

f. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12.

g. In accordance with 45 CFR 164.502(e), the Privacy Rule includes exceptions to the Business Associate Standard. This requirement meets the exception and does not require a Business Associate agreement in order for Covered Entity to disclose Protected Healthcare Information to the contractor for treatment.

h. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated.

i. The contractor/subcontractor’s firewall and Web services security controls, if applicable, shall meet or exceed VA’s minimum requirements. VA Configuration Guidelines are available upon request.

j. The records created in accordance with this contract belong to the VASNHS and should be returned to the VASNHS and/or destroyed in accordance with VHA RCS 10-1. Destruction should only occur with advance notice and guidance from the Records Management Officer at the VASNHS. Records shall be safeguarded in accordance with the Privacy Act, Health Insurance Portability and Accountability Act (HIPAA) and the VASNHS Release of Information Unit.

Patient Medical information is considered privileged and shall not be disclosed or revealed in any way without prior written permission from the VA Chief, Health Information Management Section.

k. The Contractor shall only release medical information obtained during the course of this contract to those VA staff members involved in the necessary management and treatment of that individual patient. Patient list and name of patients are considered privileged information and shall not be disclosed or revealed in any way for use outside the Contractor without prior written

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center permission from the referring VA Chief of Staff. Veterans requesting copies of medical information generated by the contractor will be referred to the VASNHS Release of Information Unit.

l. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA’s prior written approval. The contractor/ subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VASNHS Release of Information Unit for response.

m. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus.

If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/ subcontractor shall immediately refer such court orders or other requests to the VASNHS Release of Information Unit for response.

n. All electronic storage media used on non-VA leased or non-VA owned IT equipment that is used to store, process, or access VA information must be handled in adherence with VA Handbook 6500.1, Electronic Media Sanitization upon: (i) completion or termination of the contract or (ii) disposal or return of the IT equipment by the contractor/subcontractor or any person acting on behalf of the contractor/subcontractor, whichever is earlier. Media (hard drives, optical disks, CDs, back-up tapes, etc.) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction, or the contractor/subcontractor must self-certify that the media has been disposed of per 6500.1requirements. This must be completed within 30 days of termination of the contract.

The C&A requirements do not apply, and that a Security Accreditation Package is not required.

Ensure that a Contractor Security Control Assessment (CSCA) is completed within 30 days of contract approval and yearly on the renewal date of the contract.

Ensure that the CSCA is sent to the ISO and the OCS Certification Program Office for review to ensure that appropriate security controls are being implemented in service contracts.

Ensure a copy of the CSCA is maintained in the Security Management and Reporting Tool (SMART) database. COR will provide a copy of the completed CSCA to ISO for uploading into SMART database.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA):

Contractor shall take reasonable measures to ensure patient privacy and confidentiality. The contractor agrees to take all reasonable precautions to safeguard patient information from unauthorized access or modification, in both electronic and hard-copy formats. This includes not only electronic security measures such as “strong” user passwords on computer systems, but also physical barriers to prevent unauthorized use of computer workstations; that hard copy patient files are in secured lockable areas, that files are in lockable cabinets, that the cabinets can in fact

PERFORMANCE WORK STATEMENT

Las Vegas VA Medical Center be locked, i.e., keys are available, and the locking mechanisms work properly. This precaution also includes the proper transfer of patient information via electronic means, such as faxing or system to system transmission.

That only the minimum necessary patient information is used to provide appropriate service to the correct patient.

That the undersigned understands that all parties are bound by the requirements of the “Health Insurance Portability and Accountability Act of 1996” which provide guidance on the protection of patient privacy and confidentiality. This Act mandates that all government agencies, and those bodies with whom they contract, must be in compliance with the directives of the Act.

SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/ subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident.