S03 - Attachment 01 - SOW - 672-23-112 - Replace Air Handling Units Equipment Throughout San Juan Campus 5-25-20223.docx

VETERANS AFFAIRS CARIBBEAN HEALTHCARE SYSTEM

REPLACE AIR HANDLING UNITS EQUIPMENT THROUGHOUT SAN JUAN CAMPUS

672-23-112

STATEMENT OF WORK

PART I - DEFINITIONS AND ACRONYMS:

1. A/E: This term, as used herein, refers to the Architect Engineer firm(s) that are a part of the Design/Build team, also referred to as A/E.

2. Certified Independent Third-Party Safety Professional (CITP): Certified Independent Third-Party Safety Professional for the review of the design documents for compliance with national and local codes, standards, federal and state regulations.

3. Competent Person (CP): One who is capable of identifying existing and predictable hazards in the surroundings or working conditions which are unsanitary, hazardous, or dangerous to employees, and who has authorization to take prompt corrective measures to eliminate them.

4. Contracting Officer (CO): The services to be performed under this contract are subject to the general supervision, direction, control and approval of the Contracting Officer.

5. Contracting Officer Representative (COR): The Contracting Officer's authorized representative at the construction site. The COR is responsible for protecting the Government's interest in the execution of the construction contract work. Their duties include surveillance of all construction work to assure compliance with the contract documents, interpretation of the contract documents, approval of changed work, approval of all submittals, samples, shop drawings, etc. The COR may issue change orders to the Contractor within the limitations set forth in his delegation of authority from the Contracting Officer.

6. Contractor: This term, as used herein, refers to the Prime Construction Contractor or A/E Contractor Team under this contract.

7. Contractor’s Appearance and Badges: Contractor employees shall be required to maintain a professional appearance including a shirt bearing the company logo. All contractor employees will be required to acquire, and wear approved Medical Center Contractor badge. Per Medical Center policy, badge must be visible and located above the waist.

8. Facilities Condition Assessment (FCA): Is an industry term that describes the process of a qualified group of trained industry professionals performing an analysis of the condition of a group of facilities that may vary in terms of age, design, construction methods, and materials.

9. Interim Life Safety Measures (ILSM): Measures that are instituted to compensate for significant hazards posed by existing life safety (fire) code deficiencies or construction/renovation activities.

10. National Fire Protection Association (NFPA): The world's leading advocate of fire prevention and an authoritative source on public safety, NFPA develops, publishes, and disseminates codes and standards intended to minimize the possibility and effects of fire and other risks.

11. Project Manager (PM): The PM representative is responsible for administering contracts under the immediate direction of the Contracting Officer.

12. Request for Proposal (RFP): Is a solicitation made, often through a bidding process, by an agency or company interested in procurement of a commodity or service, to potential suppliers to submit proposals.

13. RFP/A/E: The firm(s) directly hired by the VA for the preparation of the RFP Documents and to provide other technical assistance to the PM/COR.

14. The Joint Commission (TJC): Formerly the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) and before that the Joint Commission on Accreditation of Hospitals (JCAH). The Joint Commission provides evaluation, accreditation and disease-specific certification programs for healthcare facilities.

PART II – SCOPE OF WORK

A. GENERAL REQUIREMENTS:

This project is to provide engineering design services to develop detailed schematic, design and construction bidding documents, construction cost estimates, construction phasing schedule, as-built drawings and all necessary construction period services for the project titled “Replace Air Handling Units Equipment throughout San Juan Campus”.

All submittals shall be in accordance with VA’s Program Guide PG-18-15, Volume C- A/E Design Submission Instructions for Minor and NRM Construction Program Medical Center Projects.

PROJECT OVERVIEW:

1. VA Caribbean Healthcare System strives to support both patients and staff in a healthcare setting. Protection of patient’s, visitor’s and staff’s health from risks associated with the environment and construction activities is the highest priority. The architecture and interior design embody the highest level of environmental stewardship. All designs shall incorporate all electrical, mechanical, plumbing, structural, and architectural components necessary to provide for a complete structure and functioning building.

Designs shall be in accordance with all applicable requirements of the NFPA, EPA, OSHA, National Plumbing Code, National Electric Code, ASHRA/E, National Safety Code, VA Specifications, VA Standard Details, VA Construction Standards (match existing site materials), VA Space Planning Criteria PG-18-9, and applicable local, state, and federal regulations.

Designs shall be in accordance with all applicable requirements of the NFPA, EPA, OSHA, National Plumbing Code, National Electric Code, ASHRA/E, National Safety Code.

VA Numbered Standards for Construction, listed below, as applicable:

PG-18-1 Master Construction Specifications PG-18-3 Design and Construction Procedures PG-18-4 Standard Details and CAD Standards PG-18-5 Equipment Guide List H-18-8 Seismic Design Handbook PG-18-9 Space Planning Criteria, and VA-Space & Equipment Planning System (VA-SEPS) PG-18-10 Design Manuals (by discipline) PG-18-12 Design Guides (graphical, by function) PG-18-13 Topic Specific Standards and Criteria PG-18-14 Room Finishes, Door, and Hardware Schedule Change Summary PG-18-15 Minimum Requirements for A/E Submissions PG-18-17 Environmental Guidance D-7545 Cultural Resource Management H-7545 Cultural Resource Management Procedures

Also, VHA Bariatric Guidebook, the VA barrier free Design Standard (ABAAS) of January 2017 rev 11/1/18 and the VA safety Patient and Mobility Design Criteria (February 2021) as well as VA Design Alerts, and applicable local, state, and federal regulations.

2. Existing as-built drawings can be made available to the CONTRACTOR; however, their accuracy along with survey, subsurface information and data is not guaranteed and shall be completed and verified by the CONTRACTOR as part of the investigative services.

3. The space will comply with the latest VA design standards located in the Technical Information Library (TIL) (http://www.cfm.va.gov/TIL/). While the Master Specification located in the Technical Information Library (TIL) at http://www.cfm.va.gov/til/spec.asp is considered the standard, it is important for the successful offeror to note that VA Caribbean Healthcare System has more stringent specifications. It is the vendor’s responsibility to familiarize themselves with VA Caribbean Healthcare System specifications.

4. This document contains information as specified for each submission, in the production of Construction Documents for this A/E project. It shall give VA Reviewers and the Contractor or A/E firm a clear understanding of what is required at each stage of design.

5. The goal of this SOW is to ensure the quality of VA facilities while controlling construction and operating costs. This document is not to be used as a standard design and does not limit or relieve the project A/E Team from their professional responsibilities to develop a complete and accurate project design that best meets the users' needs, VA design standard, VA master specifications, design manuals, other publications, and applicable code requirements or to conduct and produce a correct, complete and fully coordinated project. These Government guidelines, but are not limited to, should be obtained by the A/E Team or A/E firm to aid in the completion of this project at the following Internet addresses:

http://vaww.va.gov/facmgt/standard/accessibility.asp http://vaww.va.gov/facmgt/standard/d_alert.asp http://vaww.va.gov/facmgt/standard/fire.asp http://vaww.va.gov/facmgt/standard/specifications.asp http://vaww.va.gov/facmgt/standard/metr_idx.asp

B. SPECIFIC PROJECT REQUIREMENTS:

1. This A/E services project will furnish all necessary professional services, equipment, labor materials, supervision, tools, testing, and specialty services to perform design services for the NRM Project number 672‐23-112 Replace Air Handling Units Equipment throughout San Juan Campus at the VA Caribbean Healthcare System (VACHS), located at 10 Casia Street, San Juan Puerto Rico 00921‐3201. The A/E Service works include, but is not limited to site investigations, designing, and preparing drawings, phase planning, develop specifications, develop cost estimates, supporting the future construction project during the construction period services. This request is for a design services for the replacement of 14 Air Handling Units (AHUs), as shown on table below.

2. As-built drawings indicating the location of the existing HVAC System shall be provided to the contractor for reference.

3. The contractor shall perform a thorough field assessment to validate the HVAC system location shown on drawings.

4. Provide Electrical, Mechanical, Structural, Civil and Architectural disciplines for the design services Project to install the listed AHUs.

5. A new control system through the existing Building Automation System (BAS) shall be provided. Waterside and airside Testing and Balancing (TAB) services shall be provided. TAB reports shall be provided for existing and new conditions. Cooling / heating loads calculations, field measurements, etc., shall be performed by the contractor for proper sizing of the system if deemed necessary by the designer. All the calculation, field measurements and diagrams required for the correct sizing and selection of the equipment shall be provided.

6. Those systems shall be connected to the exiting piping distribution and its control system integrated on the new controls architecture. As built drawings of those systems shall be provided to the contractor.

7. Existing main chiller water piping should be used. The contractor shall perform a thorough assessment of those piping systems and can incorporate any required modification as part of the new design, if deemed appropriate by the designer. As-Built Drawings shall be generated and provided by the contractor.

8. System design shall be per VA HVAC Design Manual, latest edition, ASHRAE, VA Master Specifications, National Electric Code, latest editions and all applicable plumbing codes.

9. The A/E Contractor who prepares the design documents shall be a professional Architect or Engineer Licensed in Puerto Rico, in which the design services work is completed. The professional seal indicating such license by Commonwealth of Puerto Rico shall appear on the final construction documents. The Architect whose seal is shown in the drawings shall be known as the Architect of Record. The A/E Contractor shall certify compliance with the VA Solicitation Requirements, including all applicable codes.

10. COVID -19 Requirements: The selected contractor shall strictly follow the implemented hospital protocols to deal with the current COVID-19 situation as stated by the CDC, OSHA, VA authorities and Local Government. Verify the state requirements regarding flying into Puerto Rico as VA have no control over state restrictions: https://travelsafe.pr.gov/ .

They may change at any time and may (or may not be) more stringent than VA requirements. Contractor is responsible to monitor CDC website for notices and/or warnings: https://wwwnc.cdc.gov/travel/destinations/traveler/none/puerto-rico .

11. Cap and properly finish all utilities not to be reused under this project so as to maintain utilities outside of the project area operational. Coordinate this work with the COR.

12. All work to be conducted during regular business hours. The interruption of utilities by this project that affect surround active areas may require the work to be accomplished outside of normal working hours (Weekends, Holidays, Evenings and Nights) so as not to interfere with normal Hospital functions. However, project shall be accomplished to ensure minimal interruptions with daily hospital operations and patient care. Utility Outages, including disruption of fire alarms, must be requested by the Contractor at least 14 working days in advance.

13. Contractor period of performance shall be 270 calendar days after the Notice to Proceed (NTP).

PART III - COST ESTIMATE

1. The A/E shall develop a detailed Construction Cost Estimate in accordance with the “Manual for Preparation of Cost Estimates and Related Documents for VA Facilities”:

https://www.cfm.va.gov/cost/index.asp. It should include the various categories of work involved, the quantities and unit cost. Magnitude estimates are not acceptable.

2. An accurate, well-developed estimate by the A/E is a critical element and shall be thoroughly reviewed. The construction estimate shall be based on the anticipated start date of construction. It should include an inflation allowance, which is appropriate for the geographical area from the time that is prepared to the anticipated time of bidding.

It should take into account actual local market conditions to the extent possible for label and materials and allow for undefined cost anticipated during work drawings design.

3. Schematic phase shall include a cost estimate based on VA PG 18-3, and an updated cost estimate during each of the development, construction, and bidding submission packages based on the latest RS Means and VA Cost Manual versions.

4. Contractor period of performance shall be 270 calendar days after the Notice to Proceed (NTP), including A/E design and government review phases (see Submission Schedule).

PART IV - SUBMISSIONS (FOR EACH DESIGN PHASE):

The A/E shall coordinate with the COR and Contracting Officer and provide a verbal presentation with every submission.

A. SUBMITTALS

1. "SCHEMATIC DESIGN and DESIGN DEVELOPMENT " – FIRST SUBMISSION (35%)

a. Schematic Design for this construction project is a means of identifying alternative approaches to correcting physical and functional deficiencies on the conceptual plan.

b. The development of this Schematic Design is an interactive process between VAMC staff and the A/E Design Contractor in order to produce a narrative and graphical description of possible alternatives.

c. The Schematic Design shall provide a well-organized narrative and design schematic alternative approaches with respect of functional operation, demolition, maintenance and construction cost.

d. The Schematic Design shall contain, but not limited to, the following:

Plot Plans showing:

1. Location of the existing and the alternative locations of the new facility and related equipment. Architectural and structural design approach.

2. Coordination drawings showing all units and systems to be upgraded replaced and/or added.

3. Electrical design approach in a narrative form.

4. Ventilation and A/C design approach in a narrative form.

5. New controls schematic design approach in a narrative form.

2. "DESIGN DEVELOPMENT" – SECOND SUBMISSION (95%)

a. Submit Design Development plans in accordance with the applicable requirements of the design development submission of Handbook H-08-15, Vol. C and the review comments of the approved Schematic Design submission.

b. VA Master Specifications Sections may not cover some of the project elements. It is the responsibility of the A/E contractor to develop the final specific requirements for each unit of work introduced into the project. New technical specifications developed by the A/E contractor shall be in the same format as that used in VA Master Specifications.

c. Submit a Cost Estimate in accordance with Handbook H-08015 Vol. C.

d. The A/E contractor shall submit one (1) copy of the first submission for review and approval that includes the schematic and design development phases of the design. The A/E shall submit a copy to the Life Safety/Fire Prevention Third Party Evaluator for their evaluation. The A/E shall provide a verbal presentation of his work to the VA Staff during the review process.

3. "CONSTRUCTION DOCUMENTS" - THIRD SUBMISSION (100%)

a. Submit the 95% DESIGN DOCUMENTS in accordance with the applicable requirements of CONSTRUCTION DOCUMENTS submission of Handbook H-08-15 Vol. C and the REVIEW comments of the approved DD submission.

b. Plans, specifications, cost estimates, construction phasing and all related construction documents shall be completed, coordinated and ready for the FINAL REVIEW and approval.

c. The A/E contractor shall submit the 95% design documents in accordance with this contract (i.e. drawings, catalog cuts, equipment description, schedule of work, etc).

d. The A/E contractor shall submit one (1) copies of this design package for review and approval and provide the necessary verbal presentations. The A/E contractor shall submit a copy to the Life Safety/Fire Prevention Third Party Evaluator for their evaluation.

e. The A/E contractor shall prepare the construction's submittal list. It is A/E contractor responsibility to provide a quality set of documents. The A/E contractor shall perform a Quality Assurance of the complete set of documents.

f. The A/E contractor shall incorporate the corrections, adjustment, and change made by VA and third party evaluators during the final review and submits one (1) copy of the final approved 95 percent design submission. The A/E shall also submit a copy on electronic PDF format to the Life Safety/Fire Prevention Third Party Evaluator.

g. The A/E contractor shall submit 1 Full and 1 half hard copies of the corrected final set of construction documents for construction. In addition, two (2) copies on electronic format (2 CD’s on PDF and 2 CD’s on AutoCAD Version).

B. SUBMISSION SCHEDULES

DESIGN SCHEDULES: Approximate time frames are presented below. Actual timelines submitted for approval should reflect the project complexity and follow the format presented below:

a. Begin Schematic Design (Notice to Proceed): NTP

b. Submission of Iterations - NTP + 45 Days

c. First Submission – 35%: NTP + 75 Days

d. First Review Meeting and Return First Submission: NTP + 90 Days

e. Second Submission - 95%: NTP +150 Days.

f. Second Review Meeting and Return Second Submission: NTP + 180 Days.

g. Third Submission – 100%: NTP + 210 Days.

h. Third Review Meeting and Return Third Submission: NTP + 240 Days.

i. Complete Design and Final Bid Set Submission: NTP + 270 Days.

Provide to VA all originals and 2 copies on electronic format (PDF format) of the final set for bidding. Provide original CAD drawings and Specifications in hard copies two (2) copies 1 full and 1 half and 2 CD’s electronic format (PDF and MS Word each CD). If the final construction documents submission package is not complete a post submittal may be required, the cost of which will be borne by the A/E contractor.

C. SPECIAL OPERATION/CONSTRUCTION CONSIDERATIONS

1. Noise and Vibration: Contractor shall minimize noise and vibration that will disrupt patient care at each building. Please refer to Specs 01 57 19 TEMPORARY ENVIRONMENTAL CONTROLS.

2. Infection Control: Contractor will need to comply with VACHS’s Infection Control Guidelines on Construction and Renovation, Center Memo No. 11B-17-05.

3. Parking: VACHS will not provide parking to contractor.

D. CONSTRUCTION DOCUMENT PREPARATION

1. Design Review Submissions

a. The A/E shall prepare and submit complete construction documents for review and approval by the VA in accordance with standard professional practice, the Department of Veterans Affairs RFP (VA RFP), and prevailing standards and codes.

b. The documents may be divided into multiple review submission packages. The VA will review as many as six (6) package submissions (examples: demolition, architectural, mechanical, electrical, plumbing etc.) to facilitate the start of construction.

c. The design documents for each submission may include, but not limited to: assessment reports, drawings, technical specifications, design narrative/analysis, submittal list, cost opinion, material specifications, and finishes samples among others.

i. All submission packages will be reviewed at (35%), (95%) and (100%) completion stages. The (100%) review submission packages will incorporate the final review comments from the (95%) review. The final review submission packages will incorporate the final review comments from the (100%) review. If any package is not complete for the required stage a post review may be required, the cost of which will be borne by the A/E.

ii. For a better understanding of the proposed design by people without architectural or engineering background, the A/E shall submit a tridimensional rendering with each design submission (one rendering per design option). The renderings shall show the true colors of the materials and texture to be used in the construction of the project, proposed space, and the surroundings in enough detail to predict the final appearance of the project. Mount the rendering(s) on 457 mm high by 609 mm wide (18 in. by 24 in.) "Bristol board". Provide borders of 25 mm (1 in.) at the top and sides and 50 mm (2 in.) at the bottom.

2. Design Review Meetings

a. A review meeting to resolve design issues will be held for each design review package submitted. The meeting will include discussion of VA comments on functional relationships and technical peer review comments (by others).

b. Participants will include A/E, VA Staff and A/E members as appropriate for the specific package to be reviewed and others. The A/E members will each allow for (1) full day for each discipline/package design review meeting. A/E team management will be present at each review meeting.

c. The A/E shall allow time for review cycle. A cycle includes:

i. The VA’s receipt of the design review submission package (See submission schedule).

ii. The review meeting.

iii. A/E receipt of comments from the VA, either electronically, or by hard copy delivery.

iv. Coordination of the review meeting schedules will be the responsibility of the VA Project Manager for the VA and the A/E Project Manager for the A/E.

3. Electronic Media

a. The Contractor shall prepare written minutes of each meeting with the Government concerning contractual, design and construction matters. Copies of the minutes shall be furnished to the COR and Contracting Officer and within two (2) calendar days of the meetings. The Contractor shall prepare written records of phone conversations addressing major project issues and furnish a copy to the COR and Contracting Officer within two (2) calendar days of contract.

c. Existing as built/record drawings can be made available to the CONTRACTOR; however, their accuracy along with survey, subsurface information and data is not guaranteed and shall be completed and verified by the CONTRACTOR as part of the investigative services.

d. The construction record drawings shall be completed in AutoCAD (coordinate electronic software version requirements with VAMC Project Manager).

e. Construction shop drawings are not required to be completed in AutoCAD.

D. Approved Construction Documents

1. The final construction document submission package will be submitted by the A/E for approval by the VA after completion of the 100% review cycle for the final package to be submitted by the A/E. The VA will have 30 calendar days to take approval action.

2. The final construction documents submission package will include a full set of construction documents including all disciplines/packages.

3. The final construction documents submission package will incorporate all VA supplied comments from the earlier 35% and 65% submission package reviews and will comply with the VA RFP. If the final construction documents submission package is not complete a post submittal may be required, the cost of which will be borne by the A/E.

4. The approved final construction documents include such details that the project can be constructed and will be used for construction of the project.

5. See Construction Period Submittals for Approved Construction Document distribution.

I. Construction Drawing Preparation

1. The Construction Documents (CD) represent the submission of the hundred percent (100%) of the design progress. The submittal of the CD shall be in accordance with the applicable requirements of the construction documents submission of VA PG 18-15 and the review comments of the approved earlier submission package reviews. Submission requirements are detailed at the following internet address: http://www.cfm.va.gov/TIL/. Other requirements are detailed hereon.

2. The A/E shall submit the 100% design documents in accordance with this contract. Design narrative/analysis, construction drawings, renderings, technical specifications, construction phasing, submittal list, catalog cuts, equipment description, schedule of work and all related construction documents shall be completed, coordinated and ready for the final review and approval.

3. Mandatory material and equipment schedules and details may be indicated either on the drawings or in the specifications, at the option of the A/E. The drawing shall be coordinated using the VHA Program Guide PG-18-3, Topic 2, titled Drawings; a copy of this document is provided along with this RFP.

J . Construction Specifications

1. Project specifications shall include specifications for all products, materials, equipment, methods, and systems shown on the construction drawings in accordance with standard professional practice and the VA RFP. The specification submitted for review shall include:

a. The name of the manufacturer, the product name, model number, or other identification as appropriate to clearly identify the product that will be used in the construction of the project;

b. Other data as appropriate to clearly identify the product that will be used in the construction of the project i.e., shop drawings, product data, and samples as required by the VA RFP documents; and

c. The required stamp of the licensed architect or engineer of record will be considered as certification of compliance with the RFP requirements.

K. Compliance with Codes and Standards

1. Project design shall be in compliance with applicable VA standards and codes.

2. See Approved Construction Documents, above, for required inclusion of design review comments.

3. The A/E shall provide prompt, written notification to the Contracting Officer concerning conflicts with, or recommended deviations from codes, laws, regulations, standards, and opinions of review officials as described above. No work altering the scope of this contract shall be undertaken prior to receipt of written approval from the Contracting Officer.

4. The A/E shall advise the Contracting Officer of any variances with the applicable Department of Labor, Occupational Safety and Health Standards, for occupancy requirements.

L . Construction Period Services

1. The A/E contractor shall distribute a total of 4 sets of the approved construction documents prepared by the A/E Team to the VA and RFP AE, as directed by the VA Project Manager.

2. The A/E shall submit test results, certificates, manufacturer’s instructions, manufacturer’s field reports, etc. as required by the VA RFP specifications, to the VA Project Manager.

3. The A/E will maintain a set of construction documents (field as-built drawings) to record actual construction changes during the construction process as required by the RFP specifications. The project record drawings will be available for review by the VA Project Manager at all times.

4. The A/E shall check government furnished and/or the construction contractor's shop drawings, detail drawings, schedules, descriptive literature and samples, testing labor laboratory reports, field test data and review the color, texture, and suitability of materials for conformity with the RFP Documents and construction documents. The A/E shall recommend approval, disapproval, or other suitable disposition to the VA PM. The VA PM will have final approval authority. The A/E shall evaluate the submittals with reference to any companion submittals that constitute a system. When necessary, the A/E will request the Contractor to submit related components of a system before acting on a single component.

Should this procedure be inappropriate, the A/E shall review all prior submittals for related components of the system before acting on a single component. The A/E may be required to hold joint reviews with the VA technical staff and/or the RFP AE on complicated system submittals. The A/E shall notify the VA Project Manager (PM) in writing of all deviations from the requirements of the construction documents that he has found in the submittals.

5. Seven (7) site visits shall be included during CPS.

6. The A/E shall provide design clarifications as requested by the Contracting Officer or COR. The opinions and clarifications must be provided within ten (10) calendar days or less of receiving it from VA.

7. The A/E shall update the construction drawings at the end of the construction (as built construction drawings).

PART V OTHER REQUIREMENTS

A. PROFESSIONAL LICENSING

1. The A/E who prepares the construction documents shall be a professional architect or engineer licensed in the Commonwealth of Puerto Rico. The professional seal indicating such license shall appear on the final construction documents. The architect and/or engineer whose seal is shown in construction documents will be known as the Architect or Engineer of Record.

2. The A/E must have a proved experience of at least ten years (10 yrs.) in design and supervision of project of similar or major complexity to this one.

3. The A/E shall certify the design compliance with all latest design standards, design manuals and national codes used by the VA, as well as all Federal and local Requirements and Regulations. The required stamp on construction documents (e.g., drawings, technical specifications) of the licensed architect or engineer of record will be considered as certification of such compliance.

B. QUALITY ASSURANCE/QUALITY CONTROL (QA/QC)

1. The A/E shall develop, execute, and demonstrate that the project plans and specifications have gone through a rigorous review and coordination effort. The requirements are as follows:

2. The A/E shall provide an outline of the actions that your firm will take during the design process along with an associated fee.

3. Two weeks after receipt of the Notice to Proceed: Submit a detailed QA/QC Plan describing each step that will be taken during the development of the various phases of design. Each step should have an appropriate space where a senior member of the firm can initial and date when the action has been completed.

4. 100% Submittal: Submit the completed QA/QC Plan along with the latest marked-up documents (plans, specifications, etc.) necessary to ensure that a thorough review and coordination have been completed.

C. CONTRACTOR RULES OF BEHAVIOR

1. This User Agreement contains rights and authorizations regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the Department of Veterans Affairs (VA). This User Agreement covers my access to all VA data whether electronic or hard copy ("Data"), VA information systems and resources ("Systems"), and VA sites ("Sites"). This User Agreement incorporates Rules of Behavior for using VA, and other information systems and resources under the contract.

2. General Terms and Conditions for all Actions and Activities Under the Contract:

a. I understand and agree that I have no reasonable expectation of privacy in accessing or using any VA, or other Federal Government information systems.

b. I consent to reviews and actions by the Office of Information & Technology (OI&T) staff designated and authorized by the VA Chief Information Officer (CIO) and to the VA OIG regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA. These actions may include monitoring, recording, copying, inspecting, restricting access, blocking, tracking, and disclosing to all authorized OI&T, VA, and law enforcement personnel as directed by the VA CIO without my prior consent or notification.

c. I consent to reviews and actions by authorized VA systems administrators and Information Security Officers solely for protection of the VA infrastructure, including, but not limited to monitoring, recording, auditing, inspecting, investigating, restricting access, blocking, tracking, disclosing to authorized personnel, or any other authorized actions by all authorized OI&T, VA, and law enforcement personnel.

d. I understand and accept that unauthorized attempts or acts to access, upload, change, or delete information on Federal Government systems; modify Federal government systems; deny access to Federal government systems; accrue resources for unauthorized use on Federal government systems; or otherwise misuse Federal government systems or resources are prohibited.

e. I understand that such unauthorized attempts or acts are subject to action that may result in criminal, civil, or administrative penalties. This includes penalties for violations of Federal laws including, but not limited to, 18 U.S.C. §1030 (fraud and related activity in connection with computers) and 18 U.S.C. §2701 (unlawful access to stored communications).

f. I agree that OI&T staff, in the course of obtaining access to information or systems on my behalf for performance under the contract, may provide information about me including, but not limited to, appropriate unique personal identifiers such as date of birth and social security number to other system administrators, Information Security Officers (ISOs), or other authorized staff without further notifying me or obtaining additional written or verbal permission from me.

g. I understand I must comply with VA’s security and data privacy directives and handbooks. I understand that copies of those directives and handbooks can be obtained from the Contracting Officer’s Technical Representative (COTR). If the contractor believes the policies and guidance provided by the COTR is a material unilateral change to the contract, the contractor must elevate such concerns to the Contracting Officer for resolution.

h. I will report suspected or identified information security/privacy incidents to the COTR and to the local ISO or Privacy Officer as appropriate.

3. General Rules of Behavior

a. Rules of Behavior are part of a comprehensive program to provide complete information security. These rules establish standards of behavior in recognition of the fact that knowledgeable users are the foundation of a successful security program. Users must understand that taking personal responsibility for the security of their computer and the information it contains is an essential part of their job.

b. The following rules apply to all VA contractors. I agree to:

c. Follow established procedures for requesting, accessing, and closing user accounts and access. I will not request or obtain access beyond what is normally granted to users or by what is outlined in the contract.

d. Use only systems, software, databases, and data which I am authorized to use, including any copyright restrictions.

e. I will not use other equipment (OE) (non-contractor owned) for the storage, transfer, or processing of VA sensitive information without a VA CIO approved waiver, unless it has been reviewed and approved by local management and is included in the language of the contract. If authorized to use OE IT equipment, I must ensure that the system meets all applicable 6500 Handbook requirements for OE.

f. Not use my position of trust and access rights to exploit system controls or access information for any reason other than in the performance of the contract.

g. Not attempt to override or disable security, technical, or management controls unless expressly permitted to do so as an explicit requirement under the contract or at the direction of the COTR or ISO. If I am allowed or required to have a local administrator account on a government-owned computer, that local administrative account does not confer me unrestricted access or use, nor the authority to bypass security or other controls except as expressly permitted by the VA CIO or CIO's designee.

h. Contractors’ use of systems, information, or sites is strictly limited to fulfill the terms of the contract. I understand no personal use is authorized. I will only use other Federal government information systems as expressly authorized by the terms of those systems. I accept that the restrictions under ethics regulations and criminal law still apply.

i. Grant access to systems and information only to those who have an official need to know. J. . Protect passwords from access by other individuals.

j. Create and change passwords in accordance with VA Handbook 6500 on systems and any devices protecting VA information as well as the rules of behavior and security settings for the particular system in question.

k. Protect information and systems from unauthorized disclosure, use, modification, or destruction. I will only use encryption that is FIPS 140-2 validated to safeguard VA sensitive information, both safeguarding VA sensitive information in storage and in transit regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA.

l. .Follow VA Handbook 6500.1, Electronic Media Sanitization to protect VA information. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders.

m. Ensure that the COTR has previously approved VA information for public dissemination, including e-mail communications outside of the VA as appropriate. I will not make any unauthorized disclosure of any VA sensitive information through the use of any means of communication including but not limited to e-mail, instant messaging, online chat, and web bulletin boards or logs.

n. Not host, set up, administer, or run an Internet server related to my access to and use of any information assets or resources associated with my performance of services under the contract terms with the VA unless explicitly authorized under the contract or in writing by the COTR.

o. Protect government property from theft, destruction, or misuse. I will follow VA directives and handbooks on handling Federal government IT equipment, information, and systems. I will not take VA sensitive information from the workplace without authorization from the COTR.

p. Only use anti-virus software, antispyware, and firewall/intrusion detection software authorized by VA. I will contact the COTR for policies and guidance on complying with this requirement and will follow the COTR's orders regarding my access to and use of any information assets or resources associated with my performance of services under the contract terms with VA.

q. Not disable or degrade the standard anti-virus software, antispyware, and/or firewall/intrusion detection software on the computer I use to access and use information assets or resources associated with my performance of services under the contract terms with VA. I will report anti-virus, antispyware, firewall or intrusion detection software errors, or significant alert messages to the COTR.

r. Understand that restoration of service of any VA system is a concern of all users of the system.

s. Complete required information security and privacy training, and complete required training for the particular systems to which I require access.

4. Additional Conditions for Use of Non- VA Information Technology Resources

a. When required to complete work under the contract, I will directly connect to the VA network whenever possible. If a direct connection to the VA network is not possible, then I will use VA approved remote access software and services.

b. Remote access to non-public VA information technology resources is prohibited from publicly available IT computers, such as remotely connecting to the internal VA network from computers in a public library.

c. I will not have both a VA network line and any kind of non-VA network line including a wireless network card, modem with phone line, or other network device physically connected to my computer at the same time, unless the dual connection is explicitly authorized by the COTR.

d. I understand that I may not obviate or evade my responsibility to adhere to VA security requirements by subcontracting any work under any given contract or agreement with VA, and that any subcontractor(s) I engage shall likewise be bound by the same security requirements and penalties for violating the same.

5. Statement on Litigation

This User Agreement does not and should not be relied upon to create any other right or benefit, substantive or procedural, enforceable by law, by a party to litigation with the United States Government.

6. Acknowledgement and Acceptance

I acknowledge receipt of this User Agreement. I understand and accept all terms and conditions of this User Agreement, and I will comply with the terms and conditions of this agreement and any additional VA warning banners, directives, handbooks, notices, or directions regarding access to or use of information systems or information. The terms and conditions of this document do not supersede the terms and conditions of the signatory’s employer and VA.

Last 4 digits of SSN Date

Office Phone Position Title

Contractor’s Company Name

Please complete and return the original signed document to the COTR within the timeframe stated in the terms of the contract

D. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

VA INFORMATION CUSTODIAL LANGUAGE:

a. Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security.

b. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR).

c. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

d. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures.

SECURITY INCIDENT INVESTIGATION:

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access.

b. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant.

c. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement.

d. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident.

The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.

LIQUIDATED DAMAGES FOR DATA BREACH:

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide notice to VA of a “security incident” as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination.

E. SECURITY CONTROLS COMPLIANCE TESTING:

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days’ notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time.

F. TRAINING:

a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete VA Privacy and Information Security Awareness and Rules of Behavior Training before being granted access to VA information and its systems.

(1) Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Rules of Behavior before being granted access to VA information and its systems.

b. The contractor shall provide to the contracting officer and/or the COR a copy of the training certificates and certification of signing the Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required.

c. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete.

d. The Certification and Accreditation (C&A) requirements do not apply and a Security Accreditation Package is not required for this SOW.