Exhibit B-Agency Specific Requirements.pdf

Exhibit B- RLP 36C24925R0019

Lessor_______ Government_____

Robley Rex VA Medical Center Agency Specific Requirements (ASR) Grayson County Outpatient Clinic Lease

A. The VA uses American National Standards Institute/Building Owners and Managers Association

(ANSI/BOMA) Office Area (ABOA) square feet as the measurement standard.

B. The lessor shall provide 3 design progress submittals for review by the VA, which include Design

Intent Drawings (DIDs), Design Development (DD, Approximately 60%), and Construction Documents (CD, Approximately 95%). The lessor shall also submit Final 100% CDs prior to construction and as-builts within 10 working days of construction completion.

C. The build-out of the leased space will be subject to the VA Master Construction Specifications (PG-18-1) located at - https://www.cfm.va.gov/TIL/spec.asp.

D. The leased space shall be in compliance with the Physical Security Design Manual for VA Life- Safety Protected Facilities, October 1, 2020 (Revised May 1, 2024), which can be downloaded at

- https://www.cfm.va.gov/til/PhysicalSecurity/dmPhySec.pdf.

E. The leased space shall be in compliance with the Telecom Data Center and Infrastructure Engineering Design Standards Service Catalog located at https://www.cfm.va.gov/til/telecom.asp.

F. The design, construction, and alteration of facilities shall comply with local codes and ordinances. In addition, all VA facilities must comply with the Architectural Barriers Act Accessibility Standards (ABA-AS) as adopted by GSA and VA Program Guide PG-18-13, "Barrier Free Design Standard”, which can be downloaded at - - https://vatilms.va.gov/vatilms/criteria-viewer/92829?type=application%2Fpdf&title=Barrier%20Free%20Design%20Standard&name=d sBarrFree-2025-05.pdf .

The ABA-AS consists of Appendices C and D to 36 CFR Part 1191 (ABA Chapters 1 and 2, and Chapters 3 to 10) and is available from United States Access Board https://www.access-board.gov/. The Offeror shall comply with the stricter of these standards for each requirement as determined by the Government. Offerors are cautioned that compliance with ADA does not assure compliance with PG-18-13. The more stringent requirement shall be followed.

G. Additional information concerning design and construction of VA facilities can be found online in the VA Technical Information Library (TIL): http://www.cfm.va.gov/til/index.asp

H. The space shall be designed to accommodate the attached Program for Design (PFD) for the Grayson Outpatient Clinic dated August 23, 2024.

I. The lease design and construction shall comply with the Notes and Sample Plan drawings dated October 7, 2024 for the project, file name is VA Sample Floor Plan Grayson OPC.pdf.

J. The lessor shall provide predictive design for a Wireless Local Area Network (WLAN) in conformance to TIA TSB-162-A, VA Telecommunications and Special Telecommunications Systems Design Manual. This system is for VA use only and is commonly referred to as the medical wireless system. The final design and requirements of this system will be developed by VA OI&T Central Office and provided to the Louisville VAMC. The final design cannot be completed by VA OI&T until the building design is complete. The lessor shall provide AutoCAD and pdf drawings of the final design to the Louisville VAMC and the VAMC will work with VA http://www.cfm.va.gov/TIL/spec.asp http://www.cfm.va.gov/til/PhysicalSecurity/dmPhySec.pdf http://www.cfm.va.gov/til/telecom.asp https://www.access-board.gov/ https://www.access-board.gov/ http://www.cfm.va.gov/til/index.asp

OI&T to finalize the WLAN design. For purposes of the Tenant Improvements Costs, the lessor shall provide and install all WLAN cabling and patch panels in accordance with VA Standards.

The VA will install the Wireless Access Points (WAPs) and controller. The lessor shall provide appropriate rack space and power for the system. Cables shall include approximately 25 feet extra cord length to the predicted locations to facilitate any necessary adjustments. The locations shall be marked clearly, and access provided for the separate VA Wireless installation contractors.

K. Separate from the VA network systems, the lessor shall provide patient/public internet service.

This service is separate from the VA medical wireless system but will use the same WAPs.

Additional cabling and other infrastructure shall be provided for the system by the lessor. This public system shall have the ability for access and content control, and monitoring by the VA, and meet VA requirements for the specific systems. The equipment, wiring, and ports for the public system shall be easily identifiable from the VA Network components.

L. DIVISION 08 Doors and Windows: Keying; All cylinders shall be keyed into the Louisville VA Medical Center’s existing Best Cormax™ SFIC Great Grand Master Key System. Provide removable core cylinders that are removable only with a special key or tool without disassembly of knob or lockset. Cylinders shall be 7 pin type. Keying information shall be furnished at a later date by the Contracting Officer Representative (COR).

M. DIVISION 27 Communications: The VA requires outside connectivity to each of its operating locations. The Circuit Port speed varies determined on the complexity and size of the location.

The local area telecommunications carrier must have sufficient telecommunications capabilities to support the Circuit Speed as defined by the VA. The Circuit Speed minimum is 50mb for smaller, less complex ( <15,000 sq. ft.) or 100mb for more complex sites (>= 15,000 sq. ft). The VA will assume responsibility of the reoccurring circuit monthly and circuit installation cost from the telecommunications carrier. The location must be able to accommodate the Circuit speed and provide the necessary conduits for the connection while meeting the requirements in the Physical Security Design Manual for VA Life-Safety Protected Facilities and the Office of Information & Technology Design Guide. The accommodation of this connection shall be included as tenant improvement.

N. DIVISION 27 Communications: All telecommunications cabling and components shall meet Category 6 requirements.

O. DIVISION 28 Electronic Safety and Security: The Security system for the leased space shall be fully integrated into the Louisville VAMC’s Electronic Security System by a certified technician.

All security system components shall be FIPS-201 and HSPD-12 compliant, and fully compatible with Louisville VAMC’s system. Monitoring of the space will be performed at the Security Command Center at the main VAMC campus at 800 Zorn Avenue, Louisville, Kentucky 40206.

The system currently utilizes the C Cure 9000 Access Control System, Version 2.30.1730.1101, Build730.1101. Card readers at the VAMC are Veridt Reader- Stealth Series although other card readers may be acceptable.

STATEMENT OF WORK

LEASE SPACE FOR GRAYSON COUNTY OUTPATIENT CLINIC

ROBLEY REX VA MEDICAL CENTER, LOUISVILLE, KENTUCKY

The Louisville VA Medical Center requires a fully serviced, turnkey Lease with rent that covers all Lessor costs, including all shell upgrades, operating costs, real estate taxes, and security upgrades. The Lessor shall be required to design and build Tenant Improvements (TI) and will be compensated for the TI costs based upon turnkey pricing established under the Lease. The cost for use of space will include the following services: utilities, landscaping, trash removal, cleaning maintenance, building management, alarm service, and building repairs. The lessor shall have a locally designated representative available to promptly correct any deficiencies.

The Lessor shall supply or comply with all of the following:

1. Provide from 19,500 ABOA square feet (SF) to a maximum of 19,900 ABOA SF of space meeting the requirements laid out in the solicitation documents, including the Agency Specific Requirements (ASR), Program for Design (PFD) dated August 23, 2024 and the Notes and Sample Plan drawings dated October 7, 2024.

2. The VA request space in Grayson County, Kentucky in an area bounded as follows:

North: US-62 East: KY-224 South: Western Kentucky Parkway / KY-1214 / Sulphur Well Rd / Grant Rd / Bloomington Rd /

Anneta Rd / Western Kentucky Parkway West: KY-79

3. The Space shall be located in a modern quality Building of sound and substantial construction with a facade of stone, marble, brick, stainless steel, aluminum or other permanent materials in good condition and acceptable to the VA. If not a new Building, the Space offered shall be in a Building that has undergone, or will complete by occupancy, modernization or adaptive reuse for the Space with modern conveniences.

4. The lease term shall be 20 Years, 10 Years Firm, with Government termination rights, in whole or in part, effective at any time after the Firm Term of the Lease by providing not less than 180 days’ prior written notice.

5. The VA’s normal hours of operations are established as 6 AM to 6 PM, Monday through Friday, with the exception of Federal holidays. Services, maintenance, and utilities shall be provided during these hours. The Government shall have access to the Premises and its Appurtenant Areas at all times without additional payment, including the use, during other than normal hours, of necessary services and utilities such as elevators, restrooms, lights, and electric power. Cleaning shall be performed between 8 AM and 4:30 PM during normal business days.

6. Provide the number of parking spaces required by local and state building codes or 130 parking space for the use by the VA, whichever is greater. Spaces must be secured and lit in accordance with the VA Security Requirements.

7. Not later than 14 days after the acceptance of the Space, the Lessor, at Lessor’s expense, shall furnish to the Government a complete set of Computer Aided Design (CAD) files of as-built floor plans showing the Space under Lease, as well as corridors, stairways, and core areas. The plans shall have been generated by a CAD program which is compatible with the latest release of AutoCAD. The required file extension is “.DWG.” Clean and purged files shall be submitted on CD-ROM. They shall be labeled with Building name, address, list of drawing(s), date of the drawing(s), and Lessor's architect and architect’s phone number. The Lessor’s operator shall demonstrate the submission on GSA equipment, if requested by the LCO.

8. Provide the following building services:

a. Lessor is responsible for providing the following utilities: Electricity, Water, Sewer, and Cable

Television services. All utilities necessary for operation are provided and all associated costs are included as part of the established rate;

b. Lessor shall provide snow removal services for the Government on all days for which this Lease has designated normal hours. Lessor shall clear parking lots if the accumulation of snow exceeds two inches. Lessor shall clear sidewalks, walkways and other entrances before accumulation exceeds 1.5 inches. The snow removal shall take place no later than 5:00 AM, without exception. Should accumulation continue throughout the day, the Lessor shall provide such additional snow removal services to prevent accumulation greater than the maximums specified in this paragraph. In addition to snow removal, the Lessor shall keep walkways, sidewalks and parking lots free of ice during the normal hours. The Lessor shall remove excess buildup of sand and/or ice melt to minimize slipping hazards. If the Building entrance(s) has a northern exposure, then Lessor shall take additional measures to protect the safety of pedestrians.

c. Landscape maintenance shall be performed during the growing season at not less than a weekly cycle and shall consist of watering, weeding, mowing, and policing the area to keep it free of debris. Pruning and fertilization shall be done on an as-needed basis. In addition, dead, dying, or damaged plants shall be replaced.

d. The Lessor is responsible for the total maintenance and repair of the leased Premises. Such maintenance and repairs include the site and private access roads. All equipment and systems shall be maintained to provide reliable, energy efficient service without unusual interruption, disturbing noises, exposure to fire or safety hazards, uncomfortable drafts, excessive air velocities, or unusual emissions of dirt. The Lessor's maintenance responsibility includes initial supply and replacement of all supplies, materials, and equipment necessary for such maintenance. Maintenance, testing, and inspection of appropriate equipment and systems shall be done in accordance with current applicable codes, and inspection certificates shall be displayed as appropriate. Copies of all records in this regard shall be forwarded to the Government’s designated representative.

e. Janitorial Services: Janitorial services for the leased space, public areas, entrances and all other common areas are to be provided by Lessor under the lease for the property. Janitorial services include all cleaning supplies, equipment and supervision to provide satisfactory cleaning procedures. Lessor will be responsible for regulations and guidelines of OSHA, VA and/or any other pertinent federal or state references. Lessor is responsible for supplying all soap dispensers and refilling those dispensers. Lessor is also responsible for supplying all gel hand sanitizer dispensers and refilling those dispensers. The Lessor is responsible for supplying all wall mounted paper towel dispensers, restocking all toiletry items, including toilet paper and paper towels. The Lessor is responsible for supplying all wastebaskets and wastebasket liners in the facility.

i. Daily. Empty trash receptacles. Sweep entrances, lobbies, and corridors. Spot sweep floors, and spot vacuum carpets. Clean drinking fountains. Sweep and damp mop or scrub restrooms.

Clean all restroom fixtures, and replenish restroom supplies. Dispose of all trash and garbage generated in or about the Building. Wash inside and out or steam clean cans used for collection of food remnants from snack bars and vending machines. Dust horizontal surfaces that are readily available and visibly require dusting. Spray buff resilient floors in main corridors, entrances, and lobbies. Clean elevators and escalators. Remove carpet stains. Police sidewalks, parking areas, and driveways. Sweep loading dock areas and platforms. Clean glass entry doors to the Space.

ii. Three times a week. Sweep or vacuum stairs.

iii. Weekly. Damp mop and spray buff all resilient floors in restrooms and health units. Sweep sidewalks, parking areas, and driveways (weather permitting).

iv. Every two weeks. Spray buff resilient floors in secondary corridors, entrance, and lobbies.

Damp mop and spray buff hard and resilient floors in office Space.

v. Monthly. Thoroughly dust furniture. Completely sweep and/or vacuum carpets. Sweep storage Space. Spot clean all wall surfaces within 70 inches of the floor.

vi. Every two months. Damp wipe restroom wastepaper receptacles, stall partitions, doors, window sills, and frames. Shampoo entrance and elevator carpets.

vii. Three times a year. Dust wall surfaces within 70 inches of the floor, vertical surfaces and under surfaces. Clean metal and marble surfaces in lobbies. Wet mop or scrub garages.

viii. Twice a year. Wash all interior and exterior windows and other glass surfaces. Strip and apply four coats of finish to resilient floors in restrooms. Strip and refinish main corridors and other heavy traffic areas.

ix. Annually. Wash all venetian blinds, and dust 6 months from washing. Vacuum or dust all surfaces in the Building more than 70 inches from the floor, including light fixtures. Vacuum all draperies in place. Strip and refinish floors in offices and secondary lobbies and corridors.

Shampoo carpets in corridors and lobbies. Clean balconies, ledges, courts, areaways, and flat roofs.

x. Every two years. Shampoo carpets in all offices and other non-public areas.

xi. Every five years. Dry clean or wash (as appropriate) all draperies.

xii. As required. Properly maintain plants and lawns. Provide initial supply, installation, and replacement of light bulbs, tubes, ballasts, and starters. Provide and empty exterior ash cans and clean area of any discarded cigarette butts.

xiii. Pest control. Control pests as appropriate, using Integrated Pest Management techniques, as specified in the GSA Environmental Management Integrated Pest Management Technique Guide (E402-1001).

9. Lessor will ensure the building is in compliance with all local and state building requirements at all times. If not, it shall be the Lessor’s sole responsibility to repair or remediate. Lessor is responsible for maintaining liability insurance for the duration of the contract and for following all pertinent federal and state regulations. Lessor shall provide certificate of occupancy and inspection prior to VA occupation.

10. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.

a. The Government shall receive unlimited rights to data/intellectual property first produced and delivered in the performance of this contract or order (hereinafter “contract”) unless expressly stated otherwise in this contract. This includes all rights to source code and all documentation created in support thereof. The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General. The primary clause used to define computer software license (not data/intellectual property first produced under this contractor or order) is FAR 52.227-19, Commercial Computer Software License.

b. Information made available to the contractor by VA for the performance or administration of this contract will be used only for the purposes specified in the service agreement, SOW, PWS, PD, and/or contract. The contractor shall not use VA information in any other manner without prior written approval from a VA Contracting Officer (CO). The primary clause used to define Government and Contractor data rights is FAR 52.227-14 Rights in Data – General.

c. VA information will not be co-mingled with any other data on the contractor’s information systems or media storage systems. The contractor shall ensure compliance with Federal and VA requirements related to data protection, data encryption, physical data segregation, logical data segregation, classification requirements and media sanitization.

d. VA reserves the right to conduct scheduled or unscheduled audits, assessments, or investigations of contractor Information Technology (IT) resources to ensure information security is compliant with Federal and VA requirements. The contractor shall provide all necessary access to records (including electronic and documentary materials related to the contracts and subcontracts) and support (including access to contractor and subcontractor staff associated with the contract) to VA, VA's Office Inspector General (OIG),

e. The contractor may only use VA information within the terms of the contract and applicable Federal law, regulations, and VA policies. If new Federal information security laws, regulations or VA policies become applicable after execution of the contract, the parties agree to negotiate contract modification and adjustment necessary to implement the new laws, regulations, and/or policies.

f. The contractor shall not make copies of VA information except as specifically authorized and necessary to perform the terms of the contract. If copies are made for restoration purposes, after the restoration is complete, the copies shall be destroyed in accordance with VA Directive 6500, VA Cybersecurity Program and VA Information Security Knowledge Service.

g. If a Veterans Health Administration (VHA) contract is terminated for default or cause with a business associate, the related local Business Associate Agreement (BAA) shall also be terminated and actions taken in accordance with VHA Directive 1605.05, Business Associate Agreements. If there is an executed national BAA associated with the contract, VA will determine what actions are appropriate and notify the contactor.

h. The contractor shall store and transmit VA sensitive information in an encrypted form, using VA-approved encryption tools which are, at a minimum, Federal Information Processing Standards (FIPS) 140-2, Security Requirements for Cryptographic Modules (or its successor) validated and in conformance with VA Information Security Knowledge Service requirements. The contractor shall transmit VA sensitive information using VA approved Transport Layer Security (TLS) configured with FIPS based cipher suites in conformance with National Institute of Standards and Technology (NIST) 800-52, Guidelines for the Selection, Configuration and Use of

Transport Layer Security (TLS) Implementations.

i. The contractor’s firewall and web services security controls, as applicable, shall meet or exceed

VA’s minimum requirements.

j. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor may use and disclose VA information only in two situations: (i) in response to a qualifying order of a court of competent jurisdiction after notification to VA CO

(ii) with written approval from the VA CO. The contractor shall refer all requests for, demands for production of or inquiries about, VA information and information systems to the VA CO for response.

k. Notwithstanding the provision above, the contractor shall not release VA records protected by Title 38 U.S.C. § 5705, Confidentiality of medical quality-assurance records and/or Title 38 U.S.C. § 7332, Confidentiality of certain medical records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse or infection with Human Immunodeficiency Virus (HIV). If the contractor is in receipt of a court order or other requests for the above-mentioned information, the contractor shall immediately refer such court order or other requests to the VA CO for response.

l. Information made available to the contractor by VA for the performance or administration of this contract or information developed by the contractor in performance or administration of the contract will be protected and secured in accordance with VA Directive 6500 and Identity and Access Management (IAM) Security processes specified in the VA Information Security Knowledge Service.

m. Any data destruction done on behalf of VA by a contractor shall be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management, VA Handbook 6300.1, Records Management Procedures, and applicable VA Records Control Schedules.

n. The contractor shall provide its plan for destruction of all VA data in its possession according to VA Directive 6500 and NIST 800-88, Guidelines for Media Sanitization prior to termination or completion of this contract. If directed by the COR/CO, the contractor shall return all Federal Records to VA for disposition.

o. Any media, such as paper, magnetic tape, magnetic disks, solid state devices or optical discs that is used to store, process, or access VA information that cannot be destroyed shall be returned to VA.The contractor shall hold the appropriate material until otherwise directed by the Contracting Officer’s Representative (COR) or CO. Items shall be returned securely via VA-approved methods. VA sensitive information must be transmitted utilizing VA-approved encryption tools which are validated under FIPS 140-2 (or its successor) and NIST 800-52. If mailed, the contractor shall send via a trackable method (USPS, UPS, FedEx, etc.) and immediately provide the COR/CO with the tracking information. Self-certification by the contractor that the data destruction requirements above have been met shall be sent to the COR/CO within 30 business days of termination of the contract.

p. All electronic storage media (hard drives, optical disks, CDs, back-up tapes, etc.) used to store, process or access VA information will not be returned to the contractor at the end of lease, loan, or trade-in. Exceptions to t

11. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any

Information Security and Privacy language.

a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.

b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:

(1) The date and time (or approximation of) the Security Incident occurred.

(2) The names of individuals involved (when applicable).

(3) The physical and logical (if applicable) location of the incident.

(4) Why the Security Incident took place (i.e., catalyst for the failure).

(5) The amount of data belonging to VA believed to have been compromised.

(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.

c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.

d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.

e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.

g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.

h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract;

the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.