Page 1 of This request for A-E firm qualifications packages is a 100% set-aside for Service-Disabled Veteran Owned Small Business (SDVOSB) concerns under VAAR 852.219-73, VA Notice of Total Service-Disabled Veteran-Owned Small Business Set-Aside/ VA NOTICE OF TOTAL SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS SET-ASIDE (NOVEMBER 2020) (DEVIATION). THIS IS NOT A REQUEST FOR PROPOSAL. THIS IS A REQUEST FOR SF 330'S ARCHITECT/ENGINEER QUALIFICATION PACKAGES ONLY. ALL INFORMATION NEEDED TO SUBMIT SF 330 DOCUMENTS IS CONTAINED HEREIN. NO SOLICITATION PACKAGE, TECHNICAL INFORMATION, OR BIDDER/PLAN HOLDER LIST WILL BE ISSUED. THERE WILL BE NO SITE VISITS ARRANGED DURING THIS PHASE OF THE REQUIREMENT. PUBLIC ANNOUNCEMENT FOR PROCUREMENT OF ARCHITECT-ENGINEERING (A/E) SERVICES: This is a request for Standard Form 330, Architect-Engineer Qualifications only. A-E Services are being procured in accordance with the Selection of Architects and Engineers Statute (Public Law 92-582), formerly known as the Brooks Act, and implemented in Federal Acquisition Regulation (FAR) subpart 36.6. All submissions will be evaluated in accordance with the below selection criteria. Please submit SF 330 packages to the point of contact(s) listed below. The Government will not pay, nor reimburse, any costs associated with responding to this request. The Government is under no obligation to award a contract as a result of this announcement. Firms will be selected based on demonstrated competence and qualifications for the required work. Any resulting award for the proposed A/E services will be procured under a negotiated Firm-Fixed Price contract in accordance with (IAW) FAR Part 15. GENERAL INFORMATION: Design shall comply with VA guidelines and specifications. Design manuals and specifications can be found at http://www.cfm.va.gov/TIL/. Proposed work is located at Central VA Health Care System (CVVHS), Richmond, Virginia, 23667. The Estimated Construction Magnitude in accordance with Federal Acquisition Regulation (FAR) 36.204 (b) is between $500,000 and $1,000,000. The A/E Services listed herein is being procured in accordance with the Federal Acquisition Regulation (FAR) 36.6 and VAAR 836.6. All offerors are advised that in accordance with VAAR 836.606-71 the total cost of the architect or engineer services to produce and deliver designs, plans, drawings, and specification must not exceed the application of the six percent (6%) architect-engineering fee limitation of the estimated cost of the construction. Potential contractors must provide credentials that confirm registration of Architects or Engineers registered to practice in this particular professional field involved in Virginia, must be registered in SAM (www.sam.gov) and Veteran Small Business Certification (VetCert): http://veterans.cerify.sba.gov at time of submission of their qualifications in order to be considered for an award. As a prospective offeror for this Service-Disabled Veteran-Owned Small Business (SDVOSB) set aside, you are verifying your company meets the status requirements of a SDVOSB concern as established by VAAR 852.219-73. NOTE - Offerors are referred to 852.219-73 (d)(1) Services. In the case of a contract for services (except construction), it will not pay more than 50% of the amount paid by the government to it to firms that are not VetCert-listed SDVOSBs. In order to assure compliance with this clause, all firms submitting a SF330 for this Special Notice are required to indicate what percentage of the cost of contract performance will be expended by the concerns employees and in which discipline(s) and percentage of cost of contract performance to be expended (and in what disciplines) by any other subcontracted or otherwise used small or large business entity(s). Any subcontracted or otherwise business entity(s) used must be identified by name, office location and size/type of business (i.e. SDVOSB, VOSB, 8(a), large, etc.). All submissions will be evaluated in accordance with the evaluation selection criteria as specified herein. The Central VA Health Care System is a working facility and phasing plans for minimizing downtime, and provisions for continuation of service during outages is critical to this project. Past Performance Questionnaire and SF 330 are due Thursday December 22, 2023 by 2:00 PM EST. Complete package page limit is 45 pages. Page limitation does not include past performance data (i.e CPARS, PPQs). Points of Contact: Moses Deng, Contract Specialist at
[email protected] will be the primary contact. Please cc: Contracting Officer: Madeline Lucena Pulst at
[email protected] on all time sensitive submissions. PROJECT INFORMATION: Project No: 652-23-108 Project Title: Architect - Engineer Design Renovate Mental Health and Polytrauma Courtyard Central VA Health Care System (CVVHS) 1201 Broad Rock Blvd Richmond, Virginia 23249 The NAICS Code for this procurement is 541330, Engineering Services and the applicable Small Business Size Standard is $25.5 million annual revenue. The projected award date for the anticipated A/E contract is on or before February 21, 2024. The anticipated period of performance for completion of Architectural Design service to include final report with recommendations and renovation processes is 280 Calendar Days after the Notice to Proceed (NTP). Procurement time frame is 180 Calendar Days after completion of design completion. Construction Period Services (CPS) for the project is 365 Calendar Days after Notice to Proceed. Therefore, the ultimate completion time frame for this project is: 825 Calendar Days. An Architect & Engineer (A/E) contract will be negotiated. The A/E shall provide a cost estimate of future repairs. Cost estimates detailing quantities of materials, labor, profit, overhead, insurance, taxes, etc. in the format found at https://www.cfm.va.gov/til/aeDesSubReq.asp for Minor and NRM Projects. ARCHITECT-ENGINEER DESIGN SCOPE OF WORK RENOVATE MENTAL HEALTH AND POLYTRAUMA COURTYARDS CENTRAL VA HEALTH CARE SYSTEM (CVVHS) PROJECT NO: 652-23-108 PROJECT NAME: Renovate Mental Health and Polytrauma Courtyards ESTIMATED CONSTRUCTION MAGNITUDE: Between $500,000 and $1,000,000 1. SUMMARY OF SERVICES Provide professional Architect/Engineer (AE) and healthcare planning services necessary to create an acceptable and within budget design to renovate approximately 7400 square feet of existing courtyard space (3200 sf for Mental Health and 4200 sf for Polytrauma). The intent of this design is to renovate the courtyards to provide a visually attractive area for patients to meditate and heal. Services required of this A/E contract shall include, but are not limited to: Part I Preparation of Existing Conditions and Conceptual Design Investigative Services: Preparation of existing conditions plan and schematic design SD (15%) which includes site investigation for existing architectural, landscape design, equipment/ furnishings, mechanical, plumbing, electrical, security, and telecommunication. Perform project site investigation in accordance with the Site Investigations section of this scope of work. Part II Preparation Drawings and Specifications Design Development: Preparation and submission for VA review interim design development document packages DD1, and DD2. Design development packages shall be submitted in accordance with the terms of the Design Package Submission Schedule section of the Scope of Work. Packages shall contain a complete set of documents as specified in the Design Requirements/Submissions section of this scope of work. The A/E shall develop a design necessary to meet the requirements listed in the Project Scope section. Design services shall include the following disciplines: architectural, landscape design, equipment/ furnishings, mechanical, plumbing, electrical, security, and telecommunication. Part III Preparation of Drawings and Specifications - Construction Documents Preparation of construction bid documents, CD1 (95%), CD2 (100%) and BD (Final Bid Documents) at the completion of the design development process in accordance with the Design Package Submission Schedule section. Final construction document packages shall contain a complete set of documents as specified in the Design Requirements/Submissions section of this scope of work. The AE shall finalize the design that meets the requirements in the Project Scope section of this scope of work and the construction budget. Design shall include the following engineering services: architectural, landscape design, equipment/ furnishings, mechanical, plumbing, electrical, security, and telecommunication. Part IV - Construction Period Services: Review and provide concise direction on all submittals, shop drawings, product data, samples, RFI s, change order proposals, etc. in accordance with Construction Period Services section of this statement of work. Services shall also include: Construction Laboratory Testing services as required by design specifications Providing record drawings based on finalized contractor red-line as-builts. Part V - Site Visits: Visit the site at the request of the VA in accordance with section Site Visits in this scope of work. The AE shall respond on site within a two-hour period when requested. A total of five (5) site visits during construction shall be included. Each site visit shall be documented through a field report denoting the purpose and results of the site visit. 2. PROJECT SCOPE 2.1 General Requirements AE is responsible for providing all services necessary for design of this project i.e. architectural, landscape design, equipment/ furnishings, mechanical, plumbing, fire protection, electrical, security, and telecommunication. AE will review needs identified by the Integrated Project Team for the area under consideration for design and provide recommendations. A minimum of two conceptual layout options that address the identified needs will be presented to the VA for review. Prior to submission of Schematic Design material, the AE shall meet with the VAMC s COR to discuss any proposed phasing requirements for the project. These phasing requirements shall describe the general sequence of the project work, estimated project duration, and what Government constraints will exist that will influence the Contractor's approach to the construction project. The AE shall be responsible for documenting the phasing requirements. The AE shall provide an evaluation, cost estimate, and conceptual plans to determine the feasibility of completing the project within project budget for each of the three options submitted. Disadvantages and advantages will be provided including impacts to patient care/medical center operations and order of magnitude cost estimates (with cost of patient care factored into the economy/feasibility). Design will have modern finishes selected in coordination with VA. Finishes shall incorporate recycled materials. AE shall provide finish boards at the DD2 (65%) and CD1 (95%) submissions with samples, manufacturer names, series, colors, etc. for easy clarification. Project design will require the construction contractor to recycle demolished materials to the greatest extent possible. Documented quantities, disposal method and final certified documents noting that demolition materials have properly been recycled. At the CD1 (95%) design submission, the AE shall finalize a construction plan showing any temporary conditions for construction, per phase, to ensure general conditions, life safety and infection control requirements are designed, identified and specified including: identify contractor laydown area, trash, delivery, and pedestrian/construction routes. identify temporary utilities for contractors use as necessary identify utilities/systems passing through construction space or that require bypass during construction to be maintained/bypassed to ensure continuity of services in adjacent areas The following items shall be addressed with the design: All spaces shall be ADA compliant and meet VA Barrier Free Design Standard Patient and Hospital Wi-Fi in all areas Always minimize impacts to continuity of care. Phase construction as required to minimize impacts to continuity of care as the work is being completed. 2.2 Specific Requirements Provide professional engineering services for the design and construction administration to renovate approximately 7400 square feet of existing exterior courtyard space located as part of the Mental Health Unit in Building 500 and the courtyard for the Polytrauma Clinic at Building 514. The renovation shall involve all the space indicated in Attachment G, Project Location Plan. The project design will outline and specify (but is not limited to) the following construction activities: Demolition of the existing exterior features, landscaping and finishes. Installation of any new utilities and structures in the courtyard areas. Installation of new landscaping, plantings, features, improvements, equipment, furniture and all items necessary to have a pleasant and inviting courtyard areas for veteran patients. The courtyard for the inpatient mental health unit must be designed in accordance with VA Inpatient Mental Health and Residential Rehabilitation Treatment Program Facilities design guide. The courtyard for the Polytrauma Clinic must be designed in accordance with the VA Architectural Design Guide and the VA Healing Environment Design Guidelines. This renovation project must also functionally mesh with the surrounding functional spaces. The A/E shall take into consideration the functions of surrounding areas in determining placement features within the renovation. The estimated cost of construction for this project must always be within the programmed construction budget of between $500,000 and $1,000,000. If during the design process the estimated cost of construction exceeds the budget, the A/E is to immediately notify the VA and work with the Integrated Project Team (IPT) to reduce the scope of the design to bring the project within the construction budget. Once measures to reduce the estimated cost are finalized the A/E shall provide a summary of the changes to the design scope for VAMC and VISN 6 approval. 3.0 SITE INVESTIGATIONS 3.1 As-Built Investigations The AE will make site visits as necessary to survey and document all existing conditions. The AE shall make site visits, as required, to determine the existing as-built conditions of areas contained in this project. Information, including drawings and other documentation, provided to the AE shall be used as reference only. Original as-built and historical drawings are available upon request. The AE shall verify all as-built condition related to this project despite the presence of as-built drawings. The AE shall coordinate visits with the COR as assigned at the NTP. The AE shall arrange for and oversee the performance of such investigations necessary for the proper design of the project. AutoCAD background drawings may be provided by the VA upon request and shall be used as reference only. The AE shall field verify every physical aspect that relates to the project using onsite investigation methods. 4.0 DESIGN PACKAGE SUBMISSION SCHEDULE The AE shall submit review packages, so they are received on the day noted in the schedule below. Attachment Tasks/Submissions Schedule Duration Calendar Days Completion Date - Calendar Days after NTP Initial Investigation - Integrated Project Team (IPT) meeting 1 day 14 days A Generate/Submit Schematic Design SD (15%) (2 options) 35 days 49 days IPT Review 28 days 77 days B Design Development DD1 (35%) design submission 28 days 105 days IPT Review 21 days 126 days C Design Development DD2 (65%) design submission 28 days 154 days IPT Review 21 days 175 days D Construction Documents CD1 (95%) design submission 28 days 203 days IPT Review 21 days 224 days E Construction Documents CD2 (100%) design submission 28 days 252 days IPT Review 14 days 266 days F FINAL Construction Bid Documents BD submission 14 days 280 days The issuance of the NTP may be performed virtually and will be an introduction of the AE team to the IPT. The IPT will consist of at a minimum, the following members: Impacted clinical services Impacted administrative services Engineering (safety, biomed and M&O) OIT Infection Control Quality Management Patient Safety Physical Medicine and Rehabilitation Service Mental Health Service Other members of the medical center who have vested interests in the design, compliance and accreditation for the medical center. The period between the NTP and the initial IPT meeting shall be used for the AE to gather data/information to be well prepared to discuss their design intent and to ensure project requirement/restraints are understood to make a highly productive meeting at the initial IPT meeting. This time shall also be used to gather as-builts and begin investigative services. AE will be required to attend and take minutes at each IPT meeting. Minutes will be submitted electronically to the COR and Contracting Officer within five (5) calendar days of each meeting. AE is responsible for documenting through meeting minutes all comments received at the IPT on-site reviews including but not limited to written, typed, drawing mark-ups, verbal etc. The first five working days of the IPT review time will be for the VA to determine minimum acceptability of the design submission. If the VA finds the design submission to be unacceptable, the AE will be required to resubmit the submission. The VA review time will not be impacted and shall remain the same number of allotted days with the first five working days for the VA to determine acceptability of the design submission. The AE will be responsible for maintaining the overall design completion date and is responsible for making up lost time due to unacceptable design submissions. An incomplete submission is defined as a submission lacking any piece of information outlined in Attachments A F of this SOW, or failure of submission to include a required item as outlined by PG-18-15, Volume C. All documents submitted shall comply with the CAD standards contained in the VA Building Information Model Standards. 5.0 DESIGN REQUIREMENTS/SUBMISSIONS 5.1 General Requirements The AE shall submit complete review package in accordance with the following requirements and guidelines outlined in PG 18-15 A/E Submission Requirements, Vol. C and in accordance with this scope of work. Please pay specific attention to the schematic, design and construction submission requirements. As appropriate depending upon the complexity of the design, the AE may elect to delete individual submissions where not required (i.e. Do not address A. Site Development, Landscaping for interior renovation projects) Deliver all design packages in person directly to the COR on the established dates to allow the VA IPT to meet as scheduled. A transmittal letter is required to go to the Contracting Officer on the same day as delivery. Include all information required for each submittal as outlined in Program Guide PG-18-15, Volume C and as modified in the Attachments A F, with the attachments taking precedence. AE shall provide a checklist of all submittals, certifications, tests, and inspections required per drawing and specification section. All designs shall be accomplished in accordance with VA guidelines and specifications, which are available on the Internet at the Office of Construction and Facilities Management, Technical Information Library. As a minimum, design shall comply with the applicable sections from the following VA standards and guidelines found at the web site above: PG-18-1 Master Construction Specifications PG-18-3 Design & Construction Procedures PG-18-4 Standard Details and CAD Standards PG-18-5 Equipment Guide List H-18-8 Seismic Design Handbook (Seismicity = Low, Risk Category = IV, Site Class = D, Seismic Design Category = C, Component Importance Factor, Ip = 1.5) PG-18-9 Space Planning Criteria, and VA-Space & Equipment Planning System (VA-SEPS) PG-18-10 Design Manuals PG 18-12 Design Guides PG-18-13 Barrier Free Design Guide PG-18-15 Minimum Requirements for AE Submissions PG-18-17 Environmental Planning Guide Infrastructure Standards for Telecommunication Spaces, v3.1 Special Design Requirements (includes asbestos, fire/life safety and physical security) Sustainable Design Requirements Cost Estimating Requirements AE Quality Alerts AE Design Alerts VA Inpatient Mental Health and Residential Rehabilitation Treatment Program Facilities Design Guide VA Healing Environment Design Guidelines 5.2 Cost Estimating The AE shall manage the execution of the project within the VA programmed construction budget. The entire AE design team will take ownership of the project construction budget and be an advocate for successful execution of the project within the available funding. The cost estimator s role must be viewed as a critical element of project cost management. Rather than limiting responsibilities to simply reporting costs, the estimator must be an integral part of the design team, continually interacting and providing input to design decisions at every stage of development. 5.2.1 Cost Estimate Objective Cost estimates for the base bid shall be within the VA programed construction budget. If the cost estimate is outside of the construction budget, the AE is responsible for notifying the VA of potential budget issues, providing non-scope impacting recommendations to get estimate within the budgeted construction cost and providing design documents that correspond accordingly. Design submissions with cost estimates outside of the construction budget are grounds for rejecting a design submission. The final construction document submission estimate shall not be greater than the VA programed construction budget and not less the 90% of the VA programed construction budget. All cost estimates costs shall be escalated to the midpoint of the expected construction period. 5.2.2 Recapitulation The AE shall provide a recapitulation sheet of the total project (phase by phase as appropriate) listing site work, each new building, each new building addition and each renovated building separately. This document shall precede the summary sheets. A recapitulation sheet will be required for each bid packages (deductive alternates). 5.2.3 Level of Detail The level of detail of the estimate shall be consistent with the degree of completeness of the drawings being submitted. If a construction element is shown, it must be priced; if it is shown in detail, it must be priced in detail. For detailed elements, "lump sum" or "allowance" figures will not be acceptable. Project estimates will include all elements within the contractor s bid such as insurance, bonds, hazardous abatement and any other such items. 5.2.4 Timing of Submission Responsible decisions cannot be made without knowing the associated cost. Cost documentation must be delivered at the same time as other design submissions. The AE is responsible for managing workflow and communications to ensure that this can be accomplished. It is understood that some details may change in the final days preceding a submission. Cost data shall be submitted on the most up to date design information possible, with a narrative of any late developments that will affect cost. 5.3 Deductive Alternates The AE shall provide a design identifying a minimum of 10% of the construction budget as deductive alternates. The project must remain within the construction budget with all deduct alternatives in place. Each alternate shall be progressively deductive in nature and shall be non-scope impacting. The VA and AE shall work collaboratively to ensure project remains viable for medical center operations within the allotted budget. The VA will have the final determination on the AE recommended bid deducts. Items removed as bid deducts shall be evaluated to determine impacts to the remainder of the design. Certain bid deducts could require a separate design to keep the design intent viable. Items identified as yes in question 1 of the below decision tree shall not be removed as bid deductive alternates. Items identified as yes in question 2, 3, or 4 of the below decision tree shall not be removed as bid deductive alternates without explicit consent from the Contracting Officer through the facility Chief Engineer. Items identified as no in question 4 shall not be included as part of the construction project, however, utilities and site prep for such equipment (or future equipment) is permissible. 5.3.1 Decision Tree Is the item necessary to meet requirements for an occupied building? This includes all governing code required items, such as fire alarm. If yes, the item is to be funded within the construction project. If no, proceed to question 2. Is the item covered by OCFM's Master Construction Specifications PG-18-1, Divisions 1 through 10, 13 through 26, or 28 through 48? If yes, the item is to be funded within the construction project. If no, proceed to question 3. Is the item covered in OCFM's Master Construction Specifications PG-18-1, Division 27 and not IT equipment*? If yes, the item is to be funded within the construction project. If no, proceed to question 4. Is the item covered in OCFM's Master Construction Specifications PG-18-1, Number 12 31 00, 12 32 00, 12 34 00, or 12 36 00? If yes, the item is to be funded within the construction project. If no, then the equipment must be funded by the facility s respective equipment fund from medical care appropriations. *IT equipment includes: computers, monitors, keyboards, docking stations, phones, printers, scanners, etc. Cabling and raceways for IT equipment is not included as part of IT equipment. Other Non-IT equipment includes: physical access control systems, data closet racks, WI-FI (both patient and medical), temp track, testing and punch down of the information systems etc. 5.4 VA Information Security Requirements 5.4.1 GENERAL Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. 5.4.2 ACCESS TO VA INFORMATION AND VA INFORMATION SYSTEMS A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor s employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. 5.4.3 VA INFORMATION CUSTODIAL LANGUAGE Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor s information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA s information is returned to the VA or destroyed in accordance with VA s sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. Prior to termination or completion of this contract, contractor/subcontractor must not destroy information received from VA, or gathered/created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. The contractor/subcontractor s firewall and Web services security controls, if applicable, shall meet or exceed VA s minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA s prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above-mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COTR. 5.4.4 5.4.5 NOT USED 5.4.6 SECURITY INCIDENT INVESTIGATION The term security incident means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensitive information, or an action that breaches VA security procedures. The contractor/subcontractor shall immediately notify the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensitive information, including that contained in system(s) to which the contractor/subcontractor has access. To the extent known by the contractor/subcontractor, the contractor/subcontractor s notice to VA shall identify the information involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA information or assets were placed at risk or compromised), and any other information that the contractor/subcontractor considers relevant. With respect to unsecured protected health information, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such information. Upon discovery, the business associate must notify the covered entity of the breach. Notifications need to be made in accordance with the executed business associate agreement. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident. 5.4.7 LIQUIDATED DAMAGES FOR DATA BREACH a.Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensitive personal information. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract. b.The contractor/subcontractor shall provide notice to VA of a security incident as set forth in the Security Incident Investigation section above. Upon such notification, VA must secure from a non-Department entity or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the potential misuse of any sensitive personal information involved in the data breach. The term 'data breach' means the loss, theft, or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data. Contractor shall fully cooperate with the entity performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termination. Each risk analysis shall address all relevant information concerning the data breach, including the following: Nature of the event (loss, theft, unauthorized access); Description of the event, including: date of occurrence; data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code; Number of individuals affected or potentially affected; Names of individuals or groups affected or potentially affected; Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protection for the data, e.g., unencrypted, plain text; Amount of time the data has been out of VA control; The likelihood that the sensitive personal information will or has been compromised (made accessible to and usable by unauthorized persons); Known misuses of data containing sensitive personal information, if any; Assessment of the potential harm to the affected individuals; Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate: and Whether credit protection services may assist record subjects in avoiding or mitigating the results of identity theft based on the sensitive personal information that may have been compromised. Based on the determinations of the independent risk analysis; the contractor shall be responsible for paying to the VA liquidated damages in the amount of $ per affected individual to cover the cost of providing credit protection services to affected individuals consisting of the following: Notification; One year of credit monitoring services consisting of automatic daily monitoring of at least 3 relevant credit bureau reports; Data breach analysis; Fraud resolution services, including writing dispute letters, initiating fraud alerts and credit freezes, to assist affected individuals to bring matters to resolution; One year of identity theft insurance with $20,000.00 coverage at $0 deductible; and Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs. 5.4.8 SECURITY CONTROLS COMPLIANCE TESTING On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by the contractor under the clauses contained within the contract. With 10 working-days notice, at the request of the government, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice (to include unannounced assessments) as determined by VA in the event of a security incident or at any other time. TRAINING a. All contractor employees and subcontractor employees requiring access to VA information and VA information systems shall complete the following before being granted access to VA information and its systems: Sign and acknowledge (either manually or electronically) understanding of and responsibilities for compliance with the Contractor Rules of Behavior, Appendix E relating to access to VA information and information systems. Successfully complete the VA Cyber Security Awareness and Rules of Behavior training and annually complete required security training. Successfully complete the appropriate VA privacy training and annually complete required privacy training; and Successfully complete any additional cyber security or privacy training, as required for VA personnel with equivalent information system access [to be defined by the VA program official and provided to the contracting officer for inclusion in the solicitation document e.g., any role-based information security training required in accordance with NIST Special Publication 800-16, Information Technology Security Training Requirements. The contractor shall provide to the contracting officer and/or the COTR a copy of the training certificates and certification of signing the Contractor Rules of Behavior for each applicable employee within 1 week of the initiation of the contract and annually thereafter, as required. Failure to complete the mandatory annual training and sign the Rules of Behavior annually, within the timeframe required, is grounds for suspension or termination of all physical or electronic access privileges and removal from work on the contract until such time as the training and documents are complete 5.5 FRAUD, WASTE, AND ABUSE The vendor has responsibility for Duty to Report any fraud, waste and abuse witnessed while on VA premises to the Integrity and Compliance Officer. 6.0 CONSTRUCTION PERIOD SERVICES The AE shall provide the following services during the period of project construction: Assist in answering bid questions during solicitation process by issuing any addendums, drawings, etc. necessary to address questions. Assist the VA to determine whether the construction contractor or subcontractor meets technical qualification requirements. Assist the VA in the review of contractor proposals for technical acceptability and provide written recommendations of any problems or litigations encountered with the proposing contractor in the past based on first-hand knowledge. Review all submissions and provide concise direction to the VA. Provide direction within 7 calendar days upon request for review of submittals (shop drawings, product data, installation instructions, samples, etc.) Provide direction within 7 calendar days for RFI s and change order proposals. Changes to contract documents based on errors and omissions in design will be executed at no cost to the VA, including cost estimates for the change. Contracting officer shall make final determination on what is or is not an error or omission. Provide Construction Laboratory Testing services in lieu of a VA retained Construction Laboratory. Prepare record drawings based on contractor red-line as-built drawings with correspondence performed during construction. The AE shall provide a set of updated drawings and specifications on CD within 30 calendar days of construction contract completion to the COR. The AE fee shall include all costs for printing and miscellaneous reimbursable costs. Invoice payments for construction period services shall be correlated to the construction project progress in the following manner. The contractor shall bill monthly for work accomplished up to and including 50% of the CPS line item value. The remaining 50% will be billed in direct correlation to the completion of construction and will be coordinated with the COR (i.e., if the construction is 20% complete, 20% of the remaining construction period services shall be billed). 7.0 SITE VISITS The AE shall make site visits at the request of the VA and prepare documented field reports denoting the purpose and results of the site visit to include agreed upon changes in design as determined necessary during the construction. Visits resulting from errors and omissions in design will be at no cost to the VA. Attend the pre-bid and pre-construction conference to review and confirm project scope. Participate in partial/final acceptance inspections (in-wall, above ceiling and final) as scheduled and generate punch list items for completion. Inspections shall cover quality of installations and locations/placement of items in accordance with the contract documents. The punch list shall reference the contract documents for specific deficiencies (i.e., specification section, drawing detail, etc.). During construction, allow for a minimum of 5 site visits as directed and scheduled by the COR. Site visits related to Commissioning and Construction Laboratory Testing Services do not count towards the 5 site visits. 8.0 PERIOD OF PERFORMANCE Contract Period of Performance shall be as follows: Design Completion: 280 calendar days from design notice to proceed; includes VA design reviews in accordance with section 4.0 Procurement Timeframe: 180 calendar days from the completion of the design. Designer shall answer pre-bid RFIs and provide updated construction documents to capture any changes made through the procurement process during this period. Construction Period Services: 365 calendar days from construction Notice to Proceed. Total contract period of performance: 825 calendar day