Interqual VA System DAS Cloud Assessing MOU ISA 2021.03.26 - Fully Signed and Executed with Annual Review 2022 2023.02.10.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

FOR OFFICIAL USE ONLY

1 O F F I C E O F I N F O R M A T I O N S E C U R I T Y E - 2 2 7 7

Xpiren

MEMORANDUM OF UNDERSTANDING AND

INTERCONNECTION SECURITY AGREEMENT

Between Department of Veterans Affairs, Data Access

Services (DAS Cloud) Assessing

And Change Healthcare Technologies, LLC.

March 26, 2021 Version 1.0

2 O F F I C E O F I N F O R M A T I O N

DOCUMENT CONTROL CHANGE SHEET

Date Filename/Version # Authors Revision Description

09/09/2020 Template 2.0 Joseph Decoteau/Leigh Zirbel/Crystal White/James Mark McGee

Update VA Template and release new version to the field.

03/26/2021 Change Healthcare Technologies, LLC. System DAS Cloud - MOU

ISA 1.0

David Scott (VA) Karen Herard (Change Healthcare) David Brown (Change Healthcare) William Riggs (Change Healthcare)

New Agreement

3 O F F I C E O F I N F O R M A T I O N

Table of Contents

INTRODUCTION ____________________________________________________________________ 4

1 SUPERSEDES: ___________________________________________________________________ 5

1.1 Authority ___________________________________________________________________________ 5

2 MEMORANDUM OF UNDERSTANDING ______________________________________________ 6

2.1 Background _________________________________________________________________________ 6

2.2 Communications _____________________________________________________________________ 6

2.2.1 Security Incidents _________________________________________________________________________ 7

2.2.2 Disasters and Other Contingencies ____________________________________________________________ 7

2.2.3 Material Changes to System Configuration _____________________________________________________ 7

2.2.4 New Interconnections ______________________________________________________________________ 8

2.2.5 Personnel Changes ________________________________________________________________________ 8

2.2.6 Security _________________________________________________________________________________ 8

2.2.7 Cost Considerations _______________________________________________________________________ 8

3 INTERCONNECTION SECURITY REQUIREMENTS ________________________________________ 9

3.1 Background _________________________________________________________________________ 9

3.1.1 System Description ________________________________________________________________________ 9

3.1.2 System Hardware and Software Requirements __________________________________________________ 9

3.2 System Security Considerations ________________________________________________________ 9

3.2.1 General Information/Data Description _________________________________________________________ 9

3.2.2 Security Assessment ______________________________________________________________________ 11

3.2.3 Services Offered _________________________________________________________________________ 11

3.2.4 Information System Security Officer at Interconnection Site ______________________________________ 11

3.2.5 Sensitivity Categorization __________________________________________________________________ 11

3.2.6 User Community _________________________________________________________________________ 12

3.2.7 Information Exchange Security ______________________________________________________________ 12

3.2.8 Trusted Behavior Expectations ______________________________________________________________ 12

3.2.9 Formal Security Policy _____________________________________________________________________ 12

3.2.10 Audit Trail Responsibilities _______________________________________________________________ 12

3.2.11 Security Parameters ____________________________________________________________________ 13

3.2.12 Training and Awareness _________________________________________________________________ 14

3.3 TOPOLOGICAL DRAWING _____________________________________________________________ 15

4 Duration _____________________________________________________________________ 16

5 SIGNATORY AUTHORITY _________________________________________________________ 17

Appendix A: Points of Contact ________________________________________________________ 18

Appendix B: Definitions of Sensitive Information Types ____________________________________ 19

Appendix C: Interconnection Ports and Protocols _________________________________________ 23

4 O F F I C E O F I N F O R M A T I O N

INTRODUCTION

The purpose of this document is to establish a management agreement between Department of Veterans Affairs (VA) and Change Healthcare Technologies, Limited Liability Corporation (LLC.)

regarding the development, management, operation, and security of a system interconnection between Data Access Services (DAS Cloud) Assessing, owned or leased by Department of Veterans Affairs, and InterQual Connect, owned or leased by Change Healthcare Technologies, LLC. This agreement will govern the relationship between Department of Veterans Affairs and Change Healthcare Technologies, LLC., including designated managerial and technical staff, in the absence of a common management authority for the sharing of data and information resources in a secure manner.

Department of Veterans Affairs utilizes a Memorandum of Understanding (MOU) to document the terms and conditions for sharing data and information resources in a secure manner. The following supporting information within the MOU will define the purpose of the interconnection, identify relative authorities, specify the responsibilities of both organizations, and define the terms of the agreement.

Additionally, the MOU provides details pertaining to apportionment of cost and timeline for terminating or reauthorizing the interconnection.

Technical details on how the interconnection is established or maintained are included within the Interconnection Security Agreement (ISA). A system interconnection is a direct connection between two or more information technology (IT) systems for sharing data and other information resources.

Department of Veterans Affairs uses the ISA to formally document the reasons, methodology, and approvals for: interconnecting IT systems; to identify the basic components of an interconnection; to identify methods and levels of interconnectivity; and to discuss potential security risks associated with the interconnections.

This document does not replace any existing contract(s) between Department of Veterans Affairs and Change Healthcare Technologies, LLC. This fully executed agreement will be documented in applicable security controls in the current Governance and Risk Compliance tool and will be maintained as evidence for the respective system(s).

5 O F F I C E O F I N F O R M A T I O N

1 SUPERSEDES:

This is a new agreement.

1.1 Authority

The authority for this interconnection is based on:

• Federal Information Security Modernization Act (FISMA)

• NIST 800-47, Security Guide for Interconnecting Information Technology Systems

• VA Directive and Handbook 6513, Secure External Connections

• VA Directive 6500, VA Directive 6500: VA Cybersecurity Program, and Handbook 6500, Risk Management Framework for VA Information Systems: Tier 3 – VA Information Security Program

• Health Insurance Portability and Accountability Act (HIPAA) Security Rule, 45 C.F.R. Part 160

• 38 United States Code (U.S.C.) §§ 5721-5728, Veteran’s Benefits, Information Security

• OMB Circular A-130, Managing Information as a Strategic Resource

• 18 U.S.C. 641 Criminal Code: Public Money, Property or Records

• 18 U.S.C. 1905 Criminal Code: Disclosure of Confidential Information

The authority for Department of Veterans Affairs to share data for the purpose outlined under this Agreement with Change Healthcare Technologies, LLC. is as follows:

• HIPAA Privacy Rule, 45 Code of Federal Regulations (C.F.R.) Part 164, Standards for Privacy of Individually Identifiable Health Information

• Privacy Act of 1974, 5 U.S.C. § 552a, as amended

• VA SORN 168VA10P2

• VA Claims Confidentiality Statute, 38 U.S.C § 5701

6 O F F I C E O F I N F O R M A T I O N

2 MEMORANDUM OF UNDERSTANDING

2.1 Background

It is the intent of both parties to this agreement to interconnect the following IT systems to exchange data between DAS Cloud and InterQual Connect. The Department of Veterans Affairs requires the use of or access to InterQual Connect, and Change Healthcare Technologies, LLC. requires the use of or access to DAS Cloud, via an interconnection as approved by the VA Office of Information Technology (OIT) System Owner. The expected benefit of the interconnection is to expedite the processing of data associated with the Department of Veterans Affairs and Change Healthcare Technologies, LLC.

Each IT system is described below:

Department of Veterans Affairs System

– Name Data Access Services (DAS Cloud)

– Function DAS Cloud delivers a wide range of integrally linked, complementary capabilities and services that enable the transmission of Veteran and Service Member medical, benefit, personnel and personal/administrative information (DAS data).

– Location Amazon Web Service, AWS 410 Terry Ave North Seattle, WA 98109-5210

Change Healthcare Technologies, LLC. System

– Name InterQual Connect

– Function InterQual Connect enables payers to automate all medical necessity reviews, within their existing systems.

– Location

InterQual Connect Drohan Data Center (DDC), 11000 Trade Center Drive, Rancho Cordova, CA 95670

2.2 Communications

Frequent formal communications are essential to ensure the successful management and operation of the interconnection. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. Communications described herein must be conducted in writing (mail or email, excluding any sensitive VA information) unless otherwise noted.

7 O F F I C E O F I N F O R M A T I O N

The owners of DAS Cloud and InterQual Connect agree to designate and provide contact information for the technical lead(s) for their respective system and to facilitate direct contact between technical leads to support the management and operation of the interconnection (see Appendix A). To safeguard the confidentiality, integrity, and availability of the connected systems and the data stored, processed, and transmitted, the parties agree to provide notice of specific events within the timeframes indicated below.

2.2.1 Security Incidents

If Change Healthcare Technologies, LLC. employee, contractor, or agent becomes aware of the theft, loss or compromise of any device used to transport, access, or store VA data, Change Healthcare Technologies, LLC. shall notify Department of Veterans Affairs POCs listed in Appendix A by telephone or email within one hour upon discovery of a security as defined by 45 CFR § 164.304.

Change Healthcare Technologies, LLC. will provide details of the security incident, the potential risk to VA data, and all actions taken to remediate the issue. Reportable items include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. VA Information System Security Officers (ISSO) or Privacy Officers (PO) will contact VA-Cybersecurity Operations Center (CSOC) within one hour of notification.

Change Healthcare Technologies, LLC. will also provide VA with a written closing action report once the security event or incident has been resolved. VA will follow this same notification process should a security event occur within the VA boundary involving Change Healthcare Technologies, LLC.’s provided data. Designated POCs will follow established incident response and reporting procedures, determine whether the incident warrants escalation, and comply with established escalation requirements for responding to security incidents.

Department of Veterans Affairs will report security incidents to the Change Healthcare Technologies, LLC. POCs listed in Appendix A.

2.2.2 Disasters and Other Contingencies

Technical staff will immediately notify their designated counterparts listed within Appendix A by telephone or email in the event of a disaster or other incident that disrupts the normal operation of one or both connected systems.

2.2.3 Material Changes to System Configuration

A significant change to an information system may include changes to the system itself or to the environment of operation. Significant changes to the information system may include but are not limited to: installation of new or major upgrades to the operating system, middleware component, or application; modifications to system ports, protocols, or services (see Appendix C); installation of a new or upgraded hardware platform; modifications to cryptographic modules or services; or modifications to security controls. Significant changes to the environment of operation which materially impact the interconnection to require reporting, may include, but are not limited to: moving to a new facility;

adding new core missions or business functions; acquiring specific and credible threat information that the organization is being targeted by a threat source; or establishing new or modified laws, policies or

8 O F F I C E O F I N F O R M A T I O N regulations. Major changes to the information collected or maintained are those changes that could result in greater disclosure of information or a change in the way personal information/data is used.

Planned technical changes to the system architecture concerning the Interconnect will be coordinated with the appropriate security and technical staff. All changes to the Interconnect must be submitted, approved, and implemented as a modification to the existing connection through the appropriate change management process. Prior to requesting or implementing a change to the interconnection, the System Owner will conduct a risk assessment based on the new system architecture and determine if the proposed change requires reauthorization of the interconnection. Formal reauthorization is required whenever a system undergoes a significant change. The MOU/ISA must be updated and re-signed within 30 calendar days of implementation. The POCs listed in Appendix A are responsible for updating and reauthorizing this document.

2.2.4 New Interconnections

The initiating party will notify the other party at least 30 calendar days before it connects its IT system, described in Section 2.1, with any other IT system that materially impacts the security of the interconnection covered by this MOU/ISA. This includes connecting the IT system with systems that are owned and operated by third parties.

2.2.5 Personnel Changes

The responsible parties for each system are listed in Appendix A. The parties agree to provide notification of the separation, long-term absence or any other significant status changes in user profiles or personnel listed in Appendix A. The appendix will be updated as necessary to ensure accuracy.

Updating Appendix A does not require the re-signing of this MOU/ISA by either party. It is the responsibility of each respective approving authority to ensure the timely updating of this appendix and for the notification of such changes to the alternate party within thirty (30) days of any personnel change.

2.2.6 Security

Both parties agree to work together to ensure the joint security of the connected systems and the information/data stored, processed, and transmitted, as specified in the ISA section of this document.

2.2.7 Cost Considerations

Both parties agree to share the costs of the interconnecting mechanisms and/or media. Percentage of cost assumed by each organization (e.g., 50/50, 40/60, etc.) must be agreed upon in advance, and no such expenditures or financial commitments shall be made without the written concurrence of both parties. Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system owner’s organization.

9 O F F I C E O F I N F O R M A T I O N

3 INTERCONNECTION SECURITY REQUIREMENTS

3.1 Background

The technical details of the interconnection are detailed in this ISA section of the document. The parties agree to work together to develop the ISA section. The MOU/ISA must be signed by both parties before the interconnection is activated. Proposed changes to either system or the interconnecting medium will be reviewed and evaluated as outlined in Section 2.2.3 Material Changes to System Configuration and

2.2.4 New Interconnections. The MOU/ISA must be updated and re-signed within 30 calendar days before changes (as described in Section 2.2.3 and 2.2.4) are implemented. Signatories to the MOU/ISA shall be the Department of Veterans Affairs System Owner, ISSO and PO and at least one (1) Change Healthcare Technologies, LLC. System Owner. The document will become an integral piece of the VA Assessment and Authorization (A&A) documentation and will be included in subsequent authorization requests.

3.1.1 System Description

DAS Cloud and InterQual Connect system descriptions are listed in Section 2.1 of this document.

3.1.2 System Hardware and Software Requirements

DAS Cloud Architecture complies with the VA Enterprise Architecture, security and standard data and messaging requirements. DAS Architecture allows for site identification mechanisms, audit logging of all messages transmitted and received. Audit service in DAS meets Archival & Regulation Compliance.

An intricate protocol of message acknowledgements is also in place at the application layer.

DAS Java/J2EE based Services are deployed on several servers with Red Hat Enterprise Linux (RHEL) Operating System (OS) and node.js is used to provide non-blocking, event driven platform for DAS Services.

DAS also uses MongoDB as a Data Store with an OpenSSL (Secure Socket Layer) library configured with the FIPS 140-2 module to comply with security requirements for data at rest. Encryption is done at disk level for Mongo DB hosted disks to protect the data at rest and to be FIPS 140-2 compliant.

All hardware and software are currently in place for the interconnection and documented in the Enterprise Mission Assurance Support Service (eMASS) hardware and software inventories. Due to continuous improvement (upgrades, patches, etc.) please refer to the DAS Cloud hardware and software inventories in eMASS for the most up to date information.

3.2 System Security Considerations

3.2.1 General Information/Data Description

Data Access Services (DAS Cloud)

The following is a description of information/data to be transmitted from Department of Veterans Affairs to Change Healthcare Technologies, LLC. including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level.

10 O F F I C E O F I N F O R M A T I O N

• Information Type Transmitted: The information/data type transmitted from Department of Veterans Affairs to Change Healthcare Technologies, LLC. is non-VA Sensitive Information. It is generic treatment information that is selected during a clinical review of a patient. Only the selected information, not specific or identified to any patient, is transmitted to InterQual, no PII or PHI is documented, in order for the VA to receive a level of care determination based on their Criterion review of the selections made during the clinical review.

• Data Flow Description: InterQual Connect, is a third-party application embedded within the Cerner’s Acute Case Management (ACM). DAS/Department of Veterans Affairs receives data from Cerner and transmits that data to Change Healthcare Technologies, LLC. via Application Programming Interface (API) calls emanating from DAS and VA Demilitarized Zone (DMZ) on a Transport Layer Security (TLS) 1.2 encrypted Transmission Control Protocol (TCP) connection.

The data is transmitted from InterQual based on a connection initiated by DAS. All vendor traffic goes over the Internet through the TIC gateway on port 443. Change Healthcare Technologies, LLC. transfers the Veteran data to VA using a FIPS 140-2 compliant web services call (https) supported with SSL certificates, also conveyed in section 3.1.2. FIPS certificate 3139.

• The FIPS 199 Sensitivity Categorization Level is Low.

o Confidentiality - Low o Integrity - Low o Availability - Low

InterQual Connect

The following is a description of information/data to be transmitted from Change Healthcare Technologies, LLC. to the Department of Veterans Affairs including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level.

• Information Type Transmitted: Medical necessity determinations or level of care determination (whose data type is commercial Non-identifiable Information) based on InterQual Criterion’s review of the non-VA Sensitive Information will be returned to Department of Veterans Affairs from Change Healthcare Technologies, LLC. Using the connection initiated by Department of Veterans Affairs.

• Data Flow Description: Department of Veterans Affairs initiates an API connection via TLS encrypted TCP connection. Upon successful connection creation Change Healthcare Technologies, LLC. processes the treatment details provided to return the medical necessity determinations.

• The FIPS 199 Sensitivity Categorization Level: this is a commercial service without a FIPS 199 categorization and the data is commercial non-identifiable. As directed by the VA, Change Healthcare Technologies, LLC. concede if FIPS 199 categorization is required the minimum level of categorization is LOW:

o Confidentiality - Low o Integrity - Low o Availability - Low

The interconnection between DAS Cloud and InterQual Connect is a two-way path initiated by VA.

11 O F F I C E O F I N F O R M A T I O N

Purpose for Data Transfer: to establish medical necessity or level of care determinations via InterQual Criterion. Medical necessity or level of care determinations are the “next steps” in the treatment process.

VA-owned data transmitted to Change Healthcare Technologies, LLC. via this interconnection is physically stored at Drohan Data Center (DDC), 11000 Trade Center Drive, Rancho Cordova, CA 95670.

Provisions for Destruction or Return of the Data (if applicable): Data will be destroyed in accordance with National Institute for Standards and Technology (NIST) SP 800-88 approved standards.

If return or destruction of Information is not feasible, Change Healthcare Technologies, LLC. will extend the protections in this agreement for as long as Change Healthcare Technologies, LLC. retains such data.

3.2.2 Security Assessment

Department of Veterans Affairs

The DAS Cloud system, owned by the Department of Veterans Affairs, Office of Information and Technology, was granted an Authority to Operate (ATO) on April 11, 2019, based on successful adherence to all of the NIST 800-53 Security Control Families - this also complies with the same requirements in VA Directive & Handbook 6500. System controls are detailed in the SSP, dated February 2, 2019, signed by the Department of VA, OIT, DAS System Owner and ISSO. DAS has undergone several information systems audits, Web Application Security Assessments (WASA), Penetration Testing, and VA Secure Code Reviews. A Security Controls Assessment (SCA) is scheduled for May 2021.

Change Healthcare Technologies, LLC.

The InterQual service is Health Information Trust Alliance (HITRUST) Common Security Framework (CSF) certified as of October 2019, under a validated assessment by an Authorized HITRUST External Assessor. The InterQual HITRUST certification has since been incorporated into the Change Healthcare Enterprise Omnibus HITRUST certification. The next re-certification is scheduled for April 2022.

3.2.3 Services Offered

Medical necessity determinations based on InterQual Criterion.

3.2.4 Information System Security Officer at Interconnection Site There must be an established ISSO (or business partner equivalent) at all interconnection sites described herein, to provide oversight through the duration of the system development lifecycle (SDLC) phases (development, deployment, operations, and disposal) of the interconnection and to ensure that the systems maintain appropriate security controls. ISSO (or business partner equivalent) contact information is listed in Appendix A.

3.2.5 Sensitivity Categorization

Refer to Section 3.2.1 of this document.

12 O F F I C E O F I N F O R M A T I O N

3.2.6 User Community

The minimum requirements for employees to work in support of this interconnection, to include background investigations and security clearances, will be determined by the contract(s) or requirements governing the support services provided by the vendor. Change Healthcare Technologies, LLC. will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts or requirements and for continuously monitoring and tracking the status of all Change Healthcare Technologies, LLC. employees relevant to this interconnection.

Department of VA Utilization Management staff and Change Healthcare Technologies, LLC. operations staff will access the InterQual application infrastructure as necessary for maintenance of efficient and security operations. This is to help Utilization Managers (UM) and Case Managers (CM) to determine if a Veteran is meeting the correct level of care.

3.2.7 Information Exchange Security

The security of VA sensitive information (see Appendix B for definition of sensitive information) being transmitted, processed, or stored over any system and interconnection in support of this agreement must be FIPS 140-2 (or successor) compliant. The FIPS 140-2 compliance is not required if no VA sensitive data is transmitted. No VA sensitive information, as defined in Appendix B will be transmitted.

The FIPS 140-2 certificate number of Change Healthcare Technologies, LLC.'s gateway cryptographic module for establishing the Virtual Private Network (VPN) tunnel is FIPS# 3139. FIPS compliance will be validated by the Department of Veterans Affairs.

The connections at each end must be located within controlled access facilities using physical access control devices and/or guards. Individual users will not have access to the data except through the system security software inherent to the operating system. Access is controlled by authentication methods to validate the approved users.

3.2.8 Trusted Behavior Expectations

The Department of Veterans Affairs system and users are expected to protect InterQual Connect, and Change Healthcare Technologies, LLC.’s system and users are expected to protect the DAS Cloud in accordance with the Privacy Act and Trade Secrets Act (18 U.S.C. 1905), the Unauthorized Access Act (18 U.S.C. 2701 and 2710), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and other applicable laws and policies referenced in Section 1.1 of this document.

3.2.9 Formal Security Policy

Policies that govern the protection of the information/data for Department of Veterans Affairs include but are not limited to VA Directive and Handbook 6500 (or successors). Policies that govern the protection of the information/data for Change Healthcare Technologies, LLC. include but are not limited to HITRUST Certified policy guidance. All documents are available upon request.

3.2.10 Audit Trail Responsibilities

Both parties are responsible for auditing application processes and user activities involving the interconnection with enough granularity to allow successful investigation of any breaches and security incidents. Activities that will be recorded include event type, date and time of event, user identification, 13 O F F I C E O F I N F O R M A T I O N workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. Audit logs will be retained for a minimum of one (1) year or as documented in the National Archives and Records Administration (NARA) retention periods, HIPAA legislation or whichever is greater. Audit logs which describe a security breach must be maintained for six (6) years. Those responsible for maintaining audit logs must ensure that audit logs are successfully stored for the required duration.

3.2.11 Security Parameters

The following detailed security measures and controls implemented by each organization to protect the confidentiality, integrity, and availability of the connected systems and the information/data that will pass between them are outlined below;

Department of Veterans Affairs implements the following security measures and controls:

• Identification and Authentication - User Access control is managed by strong authentication method and must be assigned on the "Least Privilege" Principal. VA utilizes “two-factor authentication” for general users. A separate token and non-mail enabled account is required for users who require elevated privileges on IT systems.

• Logical Access Controls - VA accounts are separated into domains and the system administrators only manage those accounts within their domain. Accounts are audited every ninety (90) days. VA policy requires account termination within twenty-four (24) hours of an employee/contractor departure. Accounts are terminated immediately in the event of a hostile termination.

• Physical and Environmental Security - Physical and environmental controls are maintained at VA facilities. Badges are required for employees and contract staff. Access to networking closets and computer rooms require authorization from the facility Chief Information Officer (CIO) and a log is maintained. VA computer rooms are environmentally controlled for operation of the equipment is contains. This includes power; network; heating, ventilation, and air conditioning (HVAC); and fire suppression.

• Firewall, IDS, and Encryption - Intrusion detection systems (IDS) are in place at gateways and throughout the VA network. The VA’s Cybersecurity Operations Center monitors the VA network 24x7. Suspicious activity is reviewed and determined recommendations are formulated and assigned to the system administrators. FIPS 140-2 validated encryption is required for transmission of sensitive information.

Change Healthcare Technologies, LLC. implements the following security measures and controls:

The following is our Enterprise Information Security Policies Executive Summary of the hierarchy and topics covered by the enterprise information security policies and accompanying standards. This pertains to the set of security policies and accompanying standards that apply enterprise-wide to the Company.

14 O F F I C E O F I N F O R M A T I O N

POLICY SUMMARY:

The hierarchy of the enterprise information security policies and standards aligns with the 19-domain model of the Health Information Trust Alliance (HITRUST) CSF. There are 19 policy/standard pairs (38 documents total) in addition to the Rules of Behavior for Access to Information Resources (RoB), which is an acceptable use agreement. Each policy contains high-level (mostly static) statements; and the standard contains additional detail to support the corresponding policy. Policies are available by in camera review.

• Identification and Authentication Access Control- logical access (versus physical access), granting/modifying/revoking logical access, privilege management, access reviews, clear desk and clear screen requirements, session timeouts, and authentication from external networks.

• Logical Access Controls -logical access (versus physical access), granting/modifying/revoking logical access, privilege management, access reviews, clear desk and clear screen requirements, session timeouts, and authentication from external networks Audit Logging and Monitoring:

security event logging (types of events and data elements captured), how such logs are protected, and tying event logging to the incident management process. Rules of Behavior for Access To Information Resources (RoB): addresses the appropriate use of Company information assets.

• Physical and Environmental Security- Physical and Environmental Protection: facility access controls, perimeter security controls, protecting against environmental threats, working in secure areas, public access and delivery areas, cabling security, equipment maintenance, and the disposal and reuse of equipment and media.

• Firewall, IDS, and Encryption- Endpoint Protection: controls against malicious code, controls against mobile code, and prohibited categories of software. Network Protection: network segregation, network controls, and the protection of network services. Password Management:

password requirements for the different types of information system accounts and protecting one’s passwords. Data Protection and Privacy: protection of different types of company data, use of encryption, the use of non-disclosure agreements when dealing with third parties, and intellectual property rights. Transmission Protection: information exchange policies, electronic email, and protecting data in transit.

3.2.12 Training and Awareness

The training and rules of behavior requirements for employees who work in support of this interconnection will be determined by the contract(s) or requirements governing the support services provided. Change Healthcare Technologies, LLC. will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts and for continuously monitoring and tracking the status of all Change Healthcare Technologies, LLC. employees relevant to this interconnection.

15 O F F I C E O F I N F O R M A T I O N

3.3 TOPOLOGICAL DRAWING

Change HealthCare LLC Drohan Data Center (DDC)

Multi-Tenant FISMA High Account (VAEC AWS) DAS Authorization Boundary

Application Servers

AWS

VA TIC (VA Firewall) External Partner – InterQual Connect

AWS Load Balancer

Public Internet

(HTTPS 443)

Prod Cust

Single Entry for Cerner to VA Cloud based systems ehrm.das.va.gov HTTPS (443) FIPS VPN Cert #3139

Traffic Flow: VAEC/DAS -> VA TIC-> Internet/Change HealthCare LLC

VAEC Router FW

16 O F F I C E O F I N F O R M A T I O N

4 Duration

This agreement will expire when one or both parties determine the interconnection is no longer necessary or if there is no longer a business or contractual justification for it. If the interconnection is no longer necessary or justified, the interconnection will be decommissioned.

Annually, the VA ISSO, along with the System Owner, will review the agreement to ascertain 1) if the interconnection is still necessary and 2) if there are any significant changes to the interconnection (see section 2.2.3 Material Changes to System Configuration). The outcome of the review will be documented in the MOU/ISA Review Form. If there are significant changes to the interconnection at any time or if major changes were noted during the annual review, the agreement must be updated and re-signed.

If one or both of the parties wish to terminate this agreement prematurely, they may do so upon thirty

(30) days advanced notice or in the event of a security incident that necessitates an immediate response. Approval to decommission an interconnection must come from the VA Authorizing Official/System Owner.

17 O F F I C E O F I N F O R M A T I O N

5 SIGNATORY AUTHORITY

We, the undersigned, mutually agree to the terms of this MOU/ISA.

VA System Owner

DAS Cloud System Owner:

John Tirrell, Director, Interagency Services, Department of Veterans Affairs DAS Cloud System Owner

X__________________________ Date __________

Change Healthcare Technologies, LLC. Authorizing Official/System Owner Keith Andelman VP, Sales & Business Development

X__________________________ Date __________

18 O F F I C E O F I N F O R M A T I O N

Appendix A: Points of Contact

List of Responsible Parties for Each System:

Name Organization Title Office Phone Email John Tirrell VA System Owner –

DAS

732-440-9617 john.tirrell@va.gov

Andre Davis VA ISSO –DAS 512-326-7422 andre.davis2@va.gov IO Privacy Officer VA Privacy Officer (215) 842-

2000 x4724 OITITOPSSOIOPrivacyMgtAll Staff@va.gov

Keith Andelman Change Healthcare Technologies, LLC.

VP, Sales & Business Development

(857) 231-1224 keith.andelman@changehealth care.com

Michael Swyt Change

CISO (615) 231-4142 MSwyt@changehealthcare.co m

Allen Saunders Change

Product Manager (617) 756-8635 allen.saunders@changehealthc are.com

Karen Herard Change

Account Executive

(781) 985-0125 karen.herard@changehealthca re.com

List of Responsible Parties to Contact during a Security Incident:

Name Organization Title Office Phone Email Cybersecurity Operations Center*

VA CSOC Support Desk 855-673-4357

Andre Davis VA ISSO –DAS 512-326-77422 andre.davis2@va.gov Mike Salvucci

Change

Technical Support Manager

(617) 640-7601 michael.salvucci@changehealt hcare.com

* Note: VA-CSOC should only be contacted by VA personnel.

19 O F F I C E O F I N F O R M A T I O N

Appendix B: Definitions of Sensitive Information Types

The following discussion defines the various types of personal information collected, maintained, and used within VA and provides an overview of how they inter-relate. Every type is subject to VA security statutes (38 U.S.C. §§ 5721-28), as long as it identifies or could reasonably be used to identify an individual. Depending on the type of information, it may also be protected by the Privacy Act (5 U.S.C. § 552a), the VA confidentiality statutes (38 U.S.C. §§ 5701, 5705, and 7332), and the HIPAA Privacy and Security Rules (45 C.F.R. Parts 160, 164).

VA Sensitive Information/Data - All Department information and/or data on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes not only information that identifies an individual but also other information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, and records about individuals requiring protection under applicable confidentiality provisions. SOURCE: 38 U.S.C. § 5727.

Personally Identifiable Information (PII) - Any information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. Information does not have to be retrieved by any specific individual or unique identifier (i.e., covered by the Privacy Act) to be personally identifiable information. SOURCE: Office of Management and Budget (OMB) Memorandum 07-16, Safeguarding Against and Responding to Breaches of Personally Identifiable Information (May 22, 2007)

NOTE: The term “Personally Identifiable Information” is synonymous and interchangeable with “Sensitive Personal Information.”

Sensitive Personal Information (SPI) - The term, with respect to an individual, means any information about the individual maintained by VA, including the following: (i) education, financial transactions, medical history, and criminal or employment history; and (ii) information that can be used to distinguish or trace the individual’s identity, including name, social security number, date and place of birth, mother’s maiden name, or biometric records. SPI is a subset of VA Sensitive Information/Data. SOURCE: 38 U.S.C. § 5727.

NOTE: The term “Sensitive Personal Information” is synonymous and interchangeable with “Personally Identifiable Information.”

Health Information - Health Information is any information, whether oral or recorded in any form or medium, created or received by a health care provider, health plan, public health authority, employer, life insurers, school or university, or health care clearinghouse or health plan that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or payment for the provision of health care to an individual. This encompasses information pertaining to examination, medical history, diagnosis, and findings or treatment, including laboratory examinations, X-rays, microscopic slides, photographs, and prescriptions. SOURCE: 45 C.F.R. § 160.103

20 O F F I C E O F I N F O R M A T I O N

Individually Identifiable Information (III) - Individually Identifiable Information is any information pertaining to an individual that is retrieved by the individual’s name or other unique identifier, as well as Individually Identifiable Health Information regardless of how it is retrieved.

Individually Identifiable Information is a subset of Personally Identifiable Information and is protected by the Privacy Act.

Individually Identifiable Health Information (IIHI) - Individually Identifiable Health Information is a subset of Health Information, including demographic information collected from an individual, that: (1) is created or received by a health care provider, health plan, or health care clearinghouse (e.g., a HIPAA-covered entity, such as VHA); (2) relates to the past, present, or future physical or mental condition of an individual, or provision of or payment for health care to an individual; and (3) identifies the individual or where a reasonable basis exists to believe the information can be used to identify the individual.

NOTE: VHA uses the term individually identifiable health information to define information covered by the Privacy Act and the Title 38 confidentiality statutes in addition to HIPAA.

Protected Health Information (PHI) - The HIPAA Privacy Rule defines PHI as Individually Identifiable Health Information transmitted or maintained in any form or medium by a covered entity, such as VHA.

NOTE: VHA uses the term protected health information to define information that is covered by HIPAA but, unlike individually identifiable health information, may or may not be covered by the Privacy Act or Title 38 confidentiality statutes. In addition, PHI excludes employment records held by VHA in its role as an employer.

Non-identifiable Information - Non-identifiable Information is information from which all Unique Identifiers have been removed so that the information is no longer protected under the Privacy Act, 38 U.S.C. §5701, or 38 U.S.C. § 7332. However, Non-identifiable Information has not necessarily been de-identified and may still be covered by the HIPAA Privacy Rule unless all 18 Patient Identifiers listed in the Rule’s de-identification standards are removed.

Limited Data Set - A Limited Data Set is protected health information from which certain specified direct identifiers of the individuals and their relatives, household members, and employers have been removed. These identifiers include name, address (other than town or city, state, or zip code), phone number, fax number, e-mail address, Social Security Number (SSN), medical record number, health plan number, account number, certificate and/or license numbers, vehicle identification, device identifiers, web universal resource locators (URL), internet protocol (IP) address numbers, biometric identifiers, and full-face photographic images. The two patient identifiers that can be used are dates and postal address information that is limited to town or city, State or zip code. Thus, a Limited Data Set is not De-identified Information, and it is covered by the HIPAA Privacy Rule. A Limited Data Set may be used and disclosed for research, health care operations, and public health purposes pursuant to a Data Use Agreement. SOURCE: 45 C.F.R. § 164.514(e) (2)

De-identified Information - De-identified Information is health information that is presumed not to identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual because the 18 Patient Identifiers described in the

21 O F F I C E O F I N F O R M A T I O N

HIPAA Privacy Rule have been removed. De-identified information is no longer covered by the Privacy Act, 38 U.S.C. § 5701, 38 U.S.C. § 7332, or the HIPAA Privacy Rule. SOURCE: 45 C.F.R. § 164.514(b) (2) (i)

Patient Identifiers - Patient identifiers are the 18 data elements attributed to an individual under the HIPAA Privacy Rule that must be removed from health information for it to be de-identified and no longer covered by the HIPAA Privacy Rule. Please see VHA Handbook 1605.1, Privacy and Release of Information, Appendix B, De-identification of Data, for more detail.

Unique Identifier - A Unique Identifier is an individual’s name, address, social security number, or some other identifying number, symbol, or code assigned only to that individual (e.g., medical record number and claim number). If these identifiers are removed, then the information is no longer Individually Identifiable Information and is no longer covered by the Privacy Act, 38 U.S.C. § 5701, or 38 U.S.C. § 7332. However, if the information was originally Individually Identifiable Health Information, then it would still be covered by the HIPAA Privacy Rule unless all 18 Patient Identifiers listed in the de-identification standard have been removed.

NOTE: The VA Office of General Counsel has indicated that the first initial of last name and last four of the social security number (e.g., A2222) is not a unique identifier; therefore, inclusion of this number by itself does not make the information identifiable or sensitive.

Relations among Different Types of Information

VA Sensitive Information/Data is the broadest term and generally encompasses all of the other terms with the exception of de-identified data.

Sensitive Personal Information and Personally Identifiable Information are synonymous and encompass Individually Identifiable Information, Individually Identifiable Health Information and Protected Health Information.

Individually Identifiable Information encompasses Individually identifiable Health Information. It may or may not be Protected Health Information.

Health Information encompasses Individually Identifiable Health Information. It may or may not be Protected Health Information.

Individually Identified Health Information is maintained by VHA and is protected by the HIPAA Privacy Rule, as well as the Privacy Act and the Title 38 confidentiality statutes.

Non-identifiable Information is no longer protected by the Privacy Act, 38 U.S.C. § 5701, or 38 U.S.C. § 7332, but is covered by the HIPAA Privacy Rule unless it has been de-identified in accordance with the Rule.

De-identified Information may include VA Sensitive Information/Data, but it will not include any of the other types of data defined herein. De-identified Information is not Protected Health Information.

Patient Identifiers encompass Unique Identifiers. Patient Identifiers are the eighteen (18) data elements attributed to an individual under the HIPAA Privacy Rule. Unique Identifiers are those Patient Identifiers that identify or could be used to identify only one individual, such as name, address, or some

22 O F F I C E O F I N F O R M A T I O N other number, symbol, or code assigned only to that individual. Unique Identifiers can be used to retrieve information about an individual from a Privacy Act system of records.

Protected Health Information may consist of any of the other types of data defined herein except for De-identified Information. Protected Health Information includes Limited Data Sets and Non-identifiable Information.

23 O F F I C E O F I N F O R M A T I O N

Appendix C: Interconnection Ports and Protocols

Direction Protocol Port Purpose

Acute Case Management (module of PowerChart) out to CHC

TCP 443 API call

1 SUPERSEDES:

1.1 Authority

2 MEMORANDUM OF UNDERSTANDING

2.1 Background

2.2 Communications

2.2.1 Security Incidents

2.2.2 Disasters and Other Contingencies

2.2.3 Material Changes to System Configuration

2.2.4 New Interconnections

2.2.5 Personnel Changes

2.2.6 Security

2.2.7 Cost Considerations

3 INTERCONNECTION SECURITY REQUIREMENTS

3.1 Background

3.1.1 System Description

3.1.2 System Hardware and Software Requirements

3.2 System Security Considerations

3.2.1 General Information/Data Description

3.2.2 Security Assessment

3.2.3 Services Offered

3.2.4 Information System Security Officer at Interconnection Site

3.2.5 Sensitivity Categorization

3.2.6 User Community

3.2.7 Information Exchange Security

3.2.8 Trusted Behavior Expectations

3.2.9 Formal Security Policy

3.2.10 Audit Trail Responsibilities

3.2.11 Security Parameters

3.2.12 Training and Awareness

3.3 TOPOLOGICAL DRAWING

4 Duration

5 SIGNATORY AUTHORITY

Appendix A: Points of Contact

Appendix B: Definitions of Sensitive Information Types

Appendix C: Interconnection Ports and Protocols

Date:

FilenameVersion:

Authors:

Revision Description:

09092020:

Template 20:

03262021Row1:

Change Healthcare Technologies LLC System DAS Cloud MOU ISA 10Row1:

David Scott VA Karen Herard Change Healthcare David Brown Change Healthcare William Riggs Change HealthcareRow1:

New AgreementRow1:

03262021Row2:

Change Healthcare Technologies LLC System DAS Cloud MOU ISA 10Row2:

David Scott VA Karen Herard Change Healthcare David Brown Change Healthcare William Riggs Change HealthcareRow2:

New AgreementRow2:

03262021Row3:

Change Healthcare Technologies LLC System DAS Cloud MOU ISA 10Row3:

David Scott VA Karen Herard Change Healthcare David Brown Change Healthcare William Riggs Change HealthcareRow3:

New AgreementRow3:

03262021Row4:

Change Healthcare Technologies LLC System DAS Cloud MOU ISA 10Row4:

David Scott VA Karen Herard Change Healthcare David Brown Change Healthcare William Riggs Change HealthcareRow4:

New AgreementRow4:

INTRODUCTION:

SUPERSEDES:

Authority:

MEMORANDUM OF UNDERSTANDING:

Background:

Communications:

Security Incidents:

Disasters and Other Contingencies:

Material Changes to System Configuration:

New Interconnections:

Personnel Changes:

Security:

Cost Considerations:

INTERCONNECTION SECURITY REQUIREMENTS:

Background_2:

System Description:

System Hardware and Software Requirements:

System Security Considerations:

General InformationData Description:

Security Assessment:

Services Offered:

Information System Security Officer at Interconnection Site:

Sensitivity…