36C10G19R0013-085.pdf

VA DIRECTIVE

6550 APPENDIX A

A-1

VA Medical Equipment Pre-Procurement Assessment

(*Indicates field is completed by Biomedical Engineering)

*Equipment Category (VA-MDNS): *Vendor:

*Requesting Service: *Model:

*Requestor: Vendor Contact (name, phone number, email):

*Installation Location: (Room- Bldg- Division):

If server based, specify rack space and power requirements:

*Biomedical Engineering Point of Contact:

*MDIA VLAN Number for Installation:

*Equipment Description (laymans description of equipment function and systems it communicates with)

*If Biomedical Engineering is NOT the Primary System Manager for system management and maintenance, please note the responsible department below.

Instructions: Please use the Comment Balloon feature in Adobe© to annotate text that cannot fit inside the provided area.

1) 2)

3) 4)

5) 6)

7) 8)

9) 10)

11)

12)

Nov. 2017

Medical Device /System Configuration

What OS version and Service Pack does the system utilize (e.g. Win7SP1, Win Svr 2008, Linux)?

Is the OS version supported by its vendor, i.e., updates, patches, etc.? Yes No

Does the system use a database application to operate? Yes No

If yes, specify which application/version:

Is the database encrypted? Yes No

Membership in the facility’s Windows Domain is: Required Not Recommended Is a desktop web browser required to access the medical system/application? Yes No

If yes, specify which browsers and versions are supported:

If yes, does it require the use of https: and the VA SSL certificates – explain below:

If a browser is required, does it require a specific version of Java? Yes No If yes, specify the version and indicated if it is the most current version:

If yes, specify configuration requirements:

If Windows based, can the system use the National Medical Device Update Server for OS patches? Yes No

If no, specify how OS patching will be accomplished:

Can critical and routine OS and system security patches be applied as they become available without prior vendor approval? Yes No

If no, specify how approval notification to VA will be accomplished:

Is Active X required for client operation? Yes No

A-2

13)

14)

15)

16)

17)

18)

19)

20)

21)

22)

23)

24)

25)

26)

27)

28)

29)

VA DIRECTIVE

A-3

*Can the device support the use of McAfee Anti-Virus (AV) software?

If no, what AV packages and versions are supported and describe the mechanism to provide updates.

*Can USB ports be disabled on the device without compromising operation? Yes No

*Can auto run be disabled for portable media? Yes No *Can VA install host-based security components such as a firewall, host intrusion prevention system (HIPS), anti-malware software, and/ or any other security suite software required to operate on the VA production network?

Yes No

If yes, which of the above components may be installed and managed by VA?

*If “No” is the response to any of the above questions regarding updates and anti-virus software, please explain further for each item in the space below.

Authentication and User Account

Is an administrator account required to operate the device? Yes No Is a power user account required to operate the device? Yes No

Can the device be made to require individual user authentication? Yes No

Does the device support strong user password accounts? Yes No

Does the device support password aging? Yes No

Does the device support auto logoff? Yes No

Does the device support session lock? Yes No Does the system support the use of Active Directory for user authentication? Yes No

If yes, specify configuration requirements, LDAP etc.:

Does the system support the use of PIV/Smart Card only authentication? Yes No

30)

31)

32)

33)

34)

35)

36)

37)

38)

39)

40)

41)

42)

43)

44)

45)

Yes No

N/A

VA DIRECTIVE 6550

APPENDIX A

A-4

Data Handling

Specify which Electronic Protected Health Information ePHI data elements are stored on the device (e.g., last name, SSN, DOB):

How many sensitive records can be stored on the device?

How long will they be retained?

Is ePHI encrypted prior to transmission? Yes No If yes, what is the encryption mechanism(s)?

What is the media used for long term storage?

How is data transmitted to the storage repository (e.g. LAN, DVD, USB, etc.)?

Is ePHI stored only on a drive partition or a separate drive to assist with end-of-life media sanitization? Yes No

Will the medical device require data backups? Yes No If yes, specify how the system and data are backed up and what media is used:

Where will backups be stored and secured?

Does the device have the ability to assign unique ID numbers (accession numbers) instead of using patient identifying information, e.g., Social Security Number?

Yes No

If yes, how is it generated?

Does the device utilize a laptop for system operation? Yes No If so, can the laptop be encrypted without impacting clinical functionality? Yes No

If yes, what encryption software can be used?

0 1-100 100-500 500-1000 1000+

Per Transaction <1 Week <1 Month <1 Quarter <1 Year Indefinitely

Describe backup process:

46)

47)

48)

49)

50)

51)

52)

53)

54)

55)

56)

57)

58)

59)

60)

61)

62)

N/A

ISOBLATH

Typewritten Text

ISOBLATH

Typewritten Text

A-5

Networking

What are the LAN bandwidth requirements for full connectivity/performance?

Provide a comprehensive list of all TCP and UDP ports that are required for operation:

How many fixed IP addresses does the device require?

Is the device compatible with IPv6? Yes No Vendors’ products should be designed such that only IP ports required for the intended operation of the device are active.

Are unused IP ports closed or disabled?

Yes No

Can this be accomplished without impacting system operation? Yes No Vendors’ products should be designed such that only services required for the intended operation of the device are active.

Are unused services (e.g., Telnet, IIS, etc.) disabled?

Yes No

Can this be accomplished without impacting system operation? Yes No Provide a comprehensive list of all services that are required for system operation:

Can the device be serviced remotely? Yes No Does the vendor have an existing Site to Site (S2S) VPN tunnel? Yes No Does the vendor have an existing individual user VPN account(s)? Yes No What remote access software does the system utilize (e.g. DameWare, PC Anywhere, etc.)?

Does the device require connection to the Internet to operate? Yes No If yes, please justify and provide connection info (IP, port, protocol and traffic direction):

63)

64)

65)

66)

67)

68)

69)

70)

71)

72)

73)

74)

75)

76)

77)

78)

What are the WAN bandwidth requirements for full connectivity/performance?

Wireless

Does the device utilize wireless communication? Yes No If yes, what protocols are used?

Does the device utilize a wireless encryption protocol? Yes No

If yes, which protocol is used?

Are any ePHI data elements transmitted via the wireless link? Yes No

Integration with VA Healthcare Information Systems (if applicable) *Has the device been validated with VA’s Clinical Procedures package? Yes No

*Has the device been validated with VA’s Vista Imaging? Yes No

*Does the device have bi-directional HL7 interface? Yes No List all other systems that the device will communicate with in order to operate properly, e.g. VistA, domain controllers, vendor’s support network, etc.:

Additional Risk Factors:

If yes, list each element, e.g. last name, DOB, SSN, etc.

A-6

79)

80)

81)

82)

83)

84)

85)

86)

87)

88)

89)

90)

The encryption module must have FIPS 140-2 certification. Provide certificate number:

Signature Page

Equipment Category (VA-MDNS): Vendor:

Requesting Service: Model:

Chief, Biomedical Engineering Date

Concur

Area Manager Date

Information Security Officer Date

Territory 1 Director of IT Operations Date

Additional Comments

Non-Concur

Concur

Non-Concur

Concur

Non-Concur

Concur

Non-Concur

A-7

A ut om at ic al ly fi lle d