36C10G20R0014-011.docx

FOR OFFICIAL USE ONLY

MEMORANDUM OF UNDERSTANDING AND INTERCONNECTION SECURITY AGREEMENT

Black text: boilerplate text that has been approved by VA management and must remain in document (flag/ comment on any areas of concern to discuss with the VA) [Blue text]: replace with appropriate text and change to black once done Green text: this is informational/instructional text that should be removed from final draft [Organization 2]: Replace with name of Organization 2 / company name (can be performed by a find and replace all (CTRL+H) [VLER DAS]: Replace with correct name (can be performed by a find and replace all (CTRL+H) [Organization 2’s System Name]: Replace with correct name (can be performed by a find and replace all (CTRL+H)

[July 10, 2017] – Enter today’s date in this format [Version 1.0] Fill in based on Change Log or set as 1.0 if this is a new agreement

DOCUMENT CONTROL CHANGE SHEET

Option A: If you are completing a renewal or revision for an existing MOU/ISA, include the change log history of the older MOU/ISA agreement in the format of the example in the chart above.

Option B: If you are completing a brand new template for a new interconnection, you will list only one entry above. It must include today’s date in Column 1, “[Organization 2] VA Memorandum of Understanding and Interconnection Security Agreement V 1.0” in column 2, and “Drafted New VA MOU ISA Agreement” in Column 4.

Table of Contents

FOR OFFICIAL USE ONLY

OFFICE OF INFORMATION SECURITY

i OFFICE OF INFORMATION SECURITY

EXECUTIVE SUMMARY

The Department of VA, VHA, OIT, Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) is a VA enterprise-level system that provides centralized proxy/gateway/interconnection services to facilitate the sharing of data between both VA and non-VA entities. [Organization 2’s System Name]Describe the basic purpose of the requested connection and provide a high level overview of what systems are being connected. The description should specify what system/application is involved, which devices are used for the transfer of information, and what kind of information is transferred. The data flows and data transfers described in this agreement should pertain to the actual connection (i.e. Site-to-Site (S2S) VPN tunnel) and not the product in use. This means you should only include things relevant to the connection, not what occurs within the VA or the company.

Note: The first use of an Acronym must be spelled out, even if it sounds like common knowledge. After that you may use the acronym through the rest of the document.

The Department of Veterans Affairs (VA) Veterans Health Administration (VHA) Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) utilizes a Memorandum of Understanding (MOU) to document the terms and conditions for sharing data and information resources in a secure manner. The following supporting information within the MOU will define the purpose of the interconnection, identify relative authorities, specify the responsibilities of both organizations, and define the terms of the agreement. Additionally, the MOU provides details pertaining to apportionment of cost and timeline for terminating or reauthorizing the interconnection.

Technical details on how the interconnection is established or maintained are included within the Interconnection Security Agreement (ISA). A system interconnection is a direct connection between two or more information technology (IT) systems for the purpose of sharing data and other information resources. The Department of Veterans Affairs (VA) Veterans Health Administration (VHA) Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) uses the ISA to formally document the reasons, methodology, and approvals for interconnecting IT systems; to identify the basic components of an interconnection; to identify methods and levels of interconnectivity; and to discuss potential security risks associated with the interconnections.

INTRODUCTION

Overview and Purpose The ISA specifies the technical and security requirements of the interconnection and the MOU defines the responsibilities of the participating organizations.

This MOU/ISA between the organizations listed below is a new MOU / ISA and therefore does not supersede any previous MOU/ISAs. This MOU/ISA’s authorization date is the last signature date in the Signatory Section (Section 5).

The purpose of this agreement section is to establish a management agreement between Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) and [Organization 2] regarding the development, management, operation, and security of a connection between Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) , owned by John Tirrell, and [Organization 2’s System Name], owned by [Organization 2]. This agreement will govern the relationship between Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) and [Organization 2], including designated managerial and technical staff, in the absence of a common management authority.

Authority The authority governing VA VHA for this interconnection is based on:

· Federal Information Security Management Act (FISMA)

· VA Directive 6500, Managing Information Security Risk: VA Information Security Program, and Handbook 6500, Risk Management Framework for VA Information Systems: Tier 3 – VA Information Security Program

· Health Insurance Portability and Accountability Act (HIPAA) Security Rule, 45 C.F.R. Part 160

· 38 United States Code (U.S.C.) §§ 5721-5728, Veteran’s Benefits, Information Security

· Office of Management and Budget (OMB) Circular A-130, Appendix III, Security of Federal Automated Information Systems

· 18 U.S.C. 641 Criminal Code: Public Money, Property or Records

· 18 U.S.C. 1905 Criminal Code: Disclosure of Confidential Information Authority for Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) to share data for the purpose outlined under this Agreement with the recipient is as follows:

· HIPAA Privacy Rule, 45 C.F.R. Part 164, Standards for Privacy of Individually Identifiable Health Information

· Privacy Act of 1974, 5 U.S.C. § 552a, as amended

· Department of Veterans Affairs (VA) ‘‘Virtual Lifetime Electronic Record (VLER)–VA’’ (168VA10P2). https://www.gpo.gov/fdsys/pkg/FR-2012-05-11/pdf/2012-11485.pdf

· VA Claims Confidentiality Statute, 38 U.S.C § 5701

· Confidentiality of Certain Medical Records, 38 U.S.C. § 7332

MEMORANDUM OF UNDERSTANDING

Background It is the intent of both parties to this agreement to interconnect the following IT systems in order to exchange data between Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) and [Organization 2’s System Name]. Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) requires the use of [Organization 2’s System Name], and [Organization 2] requires the use of Department of Veterans Affairs (VA) Veterans Health Administration (VHA) and Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) , as approved and directed by John Tirrell from OI&T in within the authority contained in VA Directive & Handbook 6500. The expected benefit of the interconnection is to provide connectivity to [Organization 2] which [add appropriate text here.] Each IT system is described below:

· The VLER DAS

– Name Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS)

– Function VLER DAS delivers a wide range of integrally linked, complementary capabilities and services that enable the transmission of Veteran and Service Member medical, benefit, personnel and personal/administrative information (DAS data). These capabilities will cut across the entire VA enterprise, including VHA, Veterans Benefit Administration (VBA), National Cemetery Administration (NCA), Office of Policy and Planning (OPP) and OI&T, program offices, and external partners.

– Location Austin Information Technology Center (AITC), 1615 Woodward Street, Austin, TX 78741.

– Description of information/data to be transmitted from VLER DAS to [Organization 2] including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level This system contains Veteran medical records that contain both Protected Health Information (PHI) and Personally Identifiable Information (PII) data. The system interconnection described in this MOU/ISA may enable the transmittal of both VA owned sensitive information and non-VA owned sensitive information as well as non-sensitive information, depending on the business needs described in this document. Sensitive information types are discussed in Appendix D. Regardless of which entity owns the information, if VA transmits sensitive information to [Organization 2] through the system interconnection, the transmission must be protected through the use of FIPS 140-2 (or successor) validated encryption.

The FIPS 199 Sensitivity Categorization Level is High.

Confidentiality – High Integrity - High Availability -High

· The [Organization 2’s System Name].

– Name [Add full name of [Organization 2’s System Name] here]

– Function [Add function of [Organization 2’s System Name] here]

– Location [Add location of [Organization 2’s System Name] here] (Include street, city, and zip)

– Description of information/data to be transmitted from [Organization 2] to VLER DAS including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level [Add appropriate text here] Describe how information/data will be handled from [Organization 2] to VLER DAS . Describe if it is collected and/or stored. Describe what information/data will be handled from [Organization 2] to VLER DAS . Include data type, sensitivity, and description. Be sure to cover any Financial Data, PII, PHI, VA Sensitive information, etc. Also list the relevant fields of data collected (ex. If you are collecting PII, state fields like Name, DOB, SSN, etc.). If you are not transmitting any of these data types please include a statement to the effect of “No PII, PHI, VA Sensitive Information is transmitted.” (Refer to Appendix D for a listing of the data types).

The FIPS 199 Sensitivity Categorization Level is [Low/Moderate/High]. Note: FIPS Level to be filled out by Sponsoring Facility’s VA Staff (ISO/COR/etc.). Please review definitions of low, moderate, and high in the publically available FIPS 199 document (once open, search for “Potential Impact on Organizations and Individuals”). This cannot be listed as N/A.

Confidentiality – [Low/Moderate/High] Integrity - [Low/Moderate/High] Availability - [Low/Moderate/High]

Communications Frequent formal communications are essential to ensure the successful management and operation of the interconnection agreement. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. Communications described herein must be conducted in writing (mail or email, excluding any sensitive VA information) unless otherwise noted.

The owners of VLER DAS and [Organization 2’s System Name] agree to designate and provide contact information for the technical lead(s) for their respective system, and to facilitate direct contact between technical leads to support the management and operation of the interconnection (See Appendix A). To safeguard the confidentiality, integrity, and availability of the connected systems and the data stored, processed, and transmitted, the parties agree to provide notice of specific events within the timeframes indicated below.

Security Incidents VA Handbook 6500.2, Management of Data Breaches Involving Sensitive Personal Information (SPI) governs the reporting of incidents involving VA systems and information. If [Organization 2]’s employee, contractor, or agent becomes aware of the theft, loss or compromise of any device used to transport, access, or store VA sensitive information or data (Discussed in Appendix D), such employee, agent, or contractor must immediately report the incident to the VA POC listed within Appendix A, or in the Business Associate Agreement (BAA) or contract when applicable, so that the incident can be reported to the VA Network Security Operations Center (VA-NSOC) for action. Should any security incident or event (or suspected incident or event) involve VA owned sensitive information (e.g. the theft, loss, compromise, or destruction of any device used to transport, access, or store VA sensitive information/data) covered by this agreement, or the incident places VA sensitive information/data at risk of loss, unauthorized access, misuse or compromise, then [Organization 2] will notify the VA POC listed within Appendix A, or in the BAA or contract when applicable, by phone or in writing (mail or email) immediately upon detection. The VA POC will immediately notify VLER DAS ’s ISO or PO who will contact VA-NSOC within one hour of notification (contacts in Appendix A).

[Organization 2] will provide details of the security event, the potential risk to VA owned sensitive information, and the actions that have been or are being taken to remediate the issue. Activities that will be reported include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. [Organization 2] will also provide VA with a written closing action report once the security event or incident has been resolved. VA will follow this same notification process should a security event occur within the VA boundary involving [Organization 2]’s provided data. Designated POCs will follow established incident response and reporting procedures, determine whether the incident warrants escalation, and comply with established escalation requirement for responding to security incidents.

Disasters and Other Contingencies Technical staff will immediately notify their designated counterparts listed within Appendix A by telephone or email in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

Material Changes to System Configuration Planned technical changes to the system architecture will be reported to technical staff before such changes are implemented. Prior to implementing a change, the System Owner, with assistance from the ISO and PO, will conduct a risk assessment (RA) based on the new system architecture and determine if the proposed change requires reauthorization of the interconnection. Formal reauthorization is required whenever a system undergoes a significant change and the MOU/ISA must be modified and re-signed within one (1) month of implementation. Points of Contact are listed in Appendix A.

A significant change to an information system may include changes to the system itself or to the environment of operation. Significant changes to the information system may include, but are not limited to: installation of a new or major upgrades to the operating system, middleware component, or application; modifications to system ports, protocols, or services (Listed in Appendix E); installation of a new or upgraded hardware platform; modifications to cryptographic modules or services; or modifications to security controls. Significant changes to the environment of operation which must materially impact the interconnection to require reporting, may include, but are not limited to: moving to a new facility; adding new core missions or business functions; acquiring specific and credible threat information that the organization is being targeted by a threat source; or establishing new or modified laws, policies or regulations. Major changes to the information collected or maintained are those changes that could result in greater disclosure of information or a change in the way personal information/data is used.

New Interconnections The initiating party will notify the other party at least one (1) month before it connects its IT system, described in Section 2.1, with any other IT system that materially impacts the security of the interconnection covered by this MOU/ISA. This includes connecting the IT system with systems that are owned and operated by third parties.

Personnel Changes The parties agree to provide notification of the separation or long-term absence of their respective system owner or technical lead. In addition, both parties will provide notification of any changes in POC information With respect to the system owner and technical lead, both parties also will provide notification of changes to user profiles, including users who resign or change job responsibilities.

The responsible parties for each system are listed in Appendix A of this MOU/ISA. The appendix will be updated as necessary. Updating the appendix does not require the re-signing of this MOU/ISA by either party. It is the responsibility of each respective approving authority to ensure the timely updating of this appendix and for the notification of such changes to the alternate party within thirty (30) days of any personnel change.

Security Both parties agree to work together to ensure the joint security of the connected systems and the information/data stored, processed, and transmitted, as specified in the ISA section of this document. By signing this agreement each party certifies that its respective system is designed, managed, and operated in compliance with all relevant Federal laws, regulations, and policies including those stated in Section 1.2.

Cost Considerations Both parties agree to share the costs of the interconnecting mechanisms and/or media. Percentage of cost assumed by each organization (e.g., 50/50, 40/60, etc.) must be agreed upon in advance, and no such expenditures or financial commitments shall be made without the written concurrence of both parties. Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system owner’s organization.

INTERCONNECTION SECURITY AGREEMENT

Background The technical details of the interconnection are documented in this ISA section of the document. The parties agree to work together to develop the ISA, and the MOU/ISA must be signed by both parties before the interconnection is activated. Proposed changes to either system or the interconnecting medium will be reviewed and evaluated to determine the potential impact to the interconnection. The MOU/ISA will be renegotiated before changes (identified in Section 2.2.4) are implemented. Signatories to the MOU/ISA shall be the System Owner, ISO and PO for each system. The document should become an integral piece of the VA Assessment and Authorization (A&A) documentation and should be included in subsequent authorization requests.

System Description VLER DAS delivers a wide range of integrally linked, complementary capabilities and services that enable the transmission of Veteran and Service Member medical, benefit, personnel and personal/administrative information (Data). These capabilities will cut across the entire VA enterprise, including VHA, VBA, NCA, OPP and OI&T program offices, [Organization 2’s System or Informational Asset] and other external partners.

For Production, VLER DAS does not have any partners that use a VPN tunnel connection. VLER DAS has site-to-site connections to DoD in the test environments. All vendor traffic goes over the Internet through the TIC gateway on port 443. The only VPN type connections VLER DAS has are business partner extranets, unless otherwise stated. [Describe [Organization 2’s System Name], and describe how the interconnection is setup] System Hardware and Software Requirements [Organization 2] transfers Veteran data to VA using a FIPS 140-2 compliant web services call (https) supported with SSL certificates.

DAS Architecture complies with the VA Enterprise Architecture, security and standard data and messaging requirements. DAS Architecture allows for site identification mechanisms, audit logging of all messages transmitted and received. Audit service in DAS meets Archival & Regulation Compliance. An intricate protocol of message acknowledgements is also in place at the application layer.

DAS Java/J2EE based Services are deployed on several WebLogic servers with RHEL Operating System (OS) and WebLogic installed as the Web container.

Node.js is used to provide non-blocking, event driven platform for DAS Services. Redis in DAS is used as a caching mechanism and queue to send messages from Node.js to Java. The data sent to Redis is encrypted using AES 256-bit encryption standards which is approved by FIPS standards and considered secure. The DAS implementation of Redis follows the recommendations made in the VA Enterprise Security Solutions Service Initial Product Review (IPR) and meets the necessary PHI/PII/VA Sensitive Data security requirements. DAS also uses MongoDB as a Data Store with an OpenSSL library configured with the FIPS 140-2 module to comply with security requirements for data at rest. Encryption is done at disk level for Mongo DB hosted disks to protect the data at rest and to be FIPS 140-2 compliant.

All hardware and software is currently in place for the interconnection.

System Security Considerations System Security Documentation Different institutions assess and document system security through a variety of methods (e.g., risk assessment (RA), security control assessment (SCA), contractor security control assessment (CSCA), or system security plan (SSP)). For VA systems, the system interconnection/information sharing aspect is an essential part of the SSP. Two sections in the SSP require documentation of interconnections:

· System Identification: The VA facility must identify and document the types of system interconnections and information sharing that is allowed within the system.

· Security Assessment and Authorization (CA-3): The VA facility must identify and document whether connections are authorized between the system and other systems outside the authorization boundary. The VA facility must also identify, document, and list external connections outside VA, as well as indicate information concerning the MOU/ISA. The VA facility must identify and document the appropriate officials designated to approve the information system agreements.

The VLER DAS, owned by Department of VA, VHA, and OIT was granted an Authority to Operate Conditional (ATOC) on May 30, 2017, based on successful adherence to all of the NIST 800-53 Security Control Families - this also complies with the same requirements in VA Directive & Handbook 6500. System controls are detailed in the SSP, dated 05/04/2017, signed by the Department of VA, VHA, OIT, DAS CIO and ISO. VLER DAS has undergone several information systems audits, Web Application Security Assessments (WASA), Penetration Testing, and VA Secure Code Reviews.

The [Organization 2’s System Name], owned by [Organization 2] [Describe any outside assessments or self-assessments or security control reviews (e.g., RA or VA SCA, who they were conducted by, the date(s), the expiration date(s) and frequency of which the assessments are performed. Describe any documentation, dates, and signatory (ies).] [Organization 2] will fill out this section in order to provide both organizations with an acceptable level of comfort that security controls are assessed and remedial actions are taken. Reference any [Organization 2] process documents that address these issues. For example, “underwent a SCA by the VA Certification Program Office (CPO) in support of FISMA compliance, and received Authority to Operate (ATO), dated XX/XX/XXXX. System controls are detailed in the SSP, dated XX/XX/XXXX, and signed by the CIO, ISO, [additional].]” This section should show that [Organization 2] is reviewing their security controls regularly.

General Information/Data Description The interconnection between VLER DAS and [Organization 2’s System Name] is a [one-way or two-way path]. For sensitive information, refer to Appendix B for a detailed data description. For non-sensitive data, refer to section 2.1 of the accompanying Memorandum of Understanding. Refer to the Topological Drawing and Appendix E for more details on the path.

Services Offered The services offered are over HTTPS and other appropriate pharmacy port, protocols and services. The Interconnection Ports and Protocols are listed in Appendix E.

Information Security Officer at Interconnection Site There must be an established ISO (or business partner equivalent) at all interconnection sites described herein, who can provide oversight through the duration of the system development lifecycle (SDLC) phases (development, deployment, operations, and disposal) of the interconnection and who can ensure that the systems maintain appropriate security controls. ISO contact information is listed in Appendix A.

Sensitivity Categorization The sensitivity categorization of information/data exchanged between VLER DAS and [Organization 2] is High, based on FIPS 199, Sensitivity Categorization of Federal Systems, and the guidance in NIST SP 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories.

User Community The minimum requirements for employees to work in support of this interconnection, to include background investigations and security clearances, will be governed by the contract(s) governing the support services provided by the vendor. [Organization 2] will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts and for continuously monitoring and tracking the status of all [Organization 2] employees relevant to this interconnection.

[Define the community of users who will access, exchange, and/or receive data across the interconnection as described in section 2.1]

Information Exchange Security The security of the information being passed on this connection must be protected through the use of FIPS 140-2 (or successor) validated encryption implemented according to the specifications in the validated modules certificate. The connections at each end are located within controlled access facilities using physical access devices and/or guards. Individual users will not have access to the data except through the system security software inherent to the operating system. Access is controlled by authentication methods to validate the approved users. All vendor traffic goes over the Internet through the TIC gateway on port 443. [Organization 2] transfers the Veteran data to VA using a FIPS 140-2 compliant web services call (https) supported with SSL certificates, also conveyed in section 3.1.2.

Trusted Behavior Expectations The Department of Veterans Affairs (VA), Veterans Health Administration (VHA), Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) 's system and users are expected to protect [Organization 2’s System Name], and [Organization 2]'s system and users are expected to protect VLER DAS , in accordance with the Privacy Act and Trade Secrets Act (18 U.S.C. 1905), the Unauthorized Access Act (18 U.S.C. 2701 and 2710), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Formal Security Policy Directives or policies that govern the protection of the information/data include but are not limited to NIST documents; VA Directive 6500 and VA Handbook 6500 (or successors); and [Organization 2]'s [Policy Name and Identifier]. These documents should be shared and there may also be system specific security policies as well. If both systems are owned by VA and have the same Administrative Officer (AO), an ISA is not required. Instead, the interface characteristics between the interconnecting information systems are described in the security plans for the respective systems (VA Handbook 6500 Security Control CA-3).]

Audit Trail Responsibilities Both parties are responsible for auditing application processes and user activities involving the interconnection with sufficient granularity to allow successful investigation and possible prosecution of wrongdoers. Activities that will be recorded include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. Audit logs will be retained for a minimum of 1 year or as documented in the NARA retention periods, HIPAA legislation (for VHA), or whichever is greater. Audit logs which describe a security breach must be maintained for six (6) years. Those responsible for maintaining audit logs must ensure that audit logs are successfully stored for the required duration.

Security Parameters Both parties agree to maintain a formal security program, maintain security plans, and conduct risk assessments and periodic independent security inspections according to a formal approved security program. Directives or policies that govern the protection of the data and information transmission are as follows:

· National Institute of Science and Technology (NIST)

· Federal Information Security Management Act of 2002 (FISMA)

· Office of Management and Budget (OMB)

· [Organization 2]’s Security Policies and Procedures Manual

· VA Directive and Handbook 6500

· Risk Management Framework for VA Information Systems-Tier

· VA Information Security Program.

These laws, directives, and regulations include requirements for safeguarding Federal information systems and PII used in Federal agency business process as well as related reporting requirements. [Organization 2] recognizes and will implement, if mandated, the laws, regulations, NIST standards, and OMB directives including subsequent publications to the effective date relating to the subject of this agreement.

FISMA requirements apply to all Federal contractors, organizations, or sources that possess or use Federal information, or that operate, use, or have access to Federal information systems on behalf of an agency. VA VLER DAS is responsible for oversight and compliance of its contractors and agents.

VLER DAS is considered a Web Service, with the actual connection interfacing with the VA WAN hosted at VA NSOC. Veteran data is transported to VA using a FIPS 140-2 compliant web services call (https) supported with SSL certificates. The transport outputs are Uniform Claims Documents along with their Attachments. As a Web Service, data is transmitted using a standardized and secure protocol that supports service capabilities and constraints at both the transport and application layers. VA VLER DAS PHI/PII must not be transmitted by remote access unless VA VLER DAS approved protection mechanisms are used. Only approved encryption solutions using validated modules may be used when protecting data during transmission. All VA VLER DAS data must be stored in an encrypted partition on the hard drive and must be encrypted with FIPS 140-2 validated software. The application must be capable of key recovery and a copy of the encryption key(s) must be stored in multiple secure locations.

The connections at each end are located within controlled access facilities, secured 24 hours a day. [Organization 2] will ensure that VA VLER DAS data transmitted, processed, and stored on the [Organization 2]’s network/servers and interconnections will only be accessible to authorized employees and administrators. [Organization 2]’s employees will not have access to the data except through their system’s security software inherent to the operating system, portals, and firewalls. All access is limited and controlled by authentication methods, which validates approved users. VA VLER DAS data may only be stored and accessible from within the continental United States at a [Organization 2] facility and must be segregated from all other data. VA VLER DAS data must reside on a FIPS 140-2 encrypted hard disk and must be disposed of following VA Handbook 6500.1 Electronic Media Sanitization. [Organization 2] Systems will have access to the VA network.

The Department of Veterans Affairs (VA) Veterans Health Administration (VHA) Virtual Lifetime Electronic Record (VLER) Data Access Services (DAS) implements the following security measures and controls:

· Patch management policy - VA utilizes automated patch management to keep VA IT equipment patched with the latest operating system and application updates. Reports are run regularly and remediation is implemented for devices missing patches.

· Malware prevention policy (virus, spyware, etc.) - VA managed internal systems have antivirus and antispyware software installed, and is monitored 24x7 for new infections. Management is centralized. Updates are done daily, or more frequently, if necessary.

· Audit policy - VA regularly audits the security controls (continuous monitoring) and compliancy towards VA policies. Plan of Action and Milestones are used to track deficiencies and remediation.

· Incident response / security breach notification policy - VA maintains a Computer Emergency Response Team and the VA’s Network Security Operations Center monitors the VA network 24x7.

· User certification and authentication policy - User Access control is managed by strong authentication method and must be assigned on the "Least Privilege" Principal. VA utilizes 2 factor authentications for general users. A separate token and non-mail enabled account is required for users who require elevated privileges on IT systems.

· Password Policy - VA requires a strong password and users must change their password every 90 days.

· Account Management - VA accounts are separated into domains and the system administrators only manage those accounts within their domain. Accounts are audited every 90 days. VA policy requires account termination within 24 hour of an employee/contractor departure. Accounts are terminated immediately in the event of a hostile termination.

· Physical and environmental security policy - Physical and environmental controls are maintained at VA facilities. Badges are required for employees and contract staff. Access to networking closets and computer rooms require authorization from the facility Chief Information Officer and a log is maintained. VA computer rooms are environmentally controlled for operation of the equipment is contains. This includes power, network, HVAC, and fire suppression.

· Firewall, IDS, and encryption policy - Intrusion detection systems (IDS) are in place at gateways and throughout the VA network. The VA’s Network Security Operations Center monitors the VA network 24x7. Suspicious activity is reviewed and as needed recommendations are formulated and assigned to the system administrators. FIPS 140-2 validated encryption is required for transmission of sensitive information.

· Contingency Plans - A contingency and disaster recovery plan is in place for VA IT systems. The plans are tested annually.

[Organization 2] implements the following security measures and controls should be filled out by [Organization 2]

· Patch management policy - [Detailed description of policy]

· Malware prevention / Virus Scanning policy - [Detailed description of policy]

· Audit policy - [Detailed description of policy]

· Incident response / security breach notification policy - [Detailed description of policy]

· User certification, identification and authentication policy - [Detailed description of policy]

· Password policy - [Detailed description of policy]

· Account Management policy - [Detailed description of policy]

· Physical and environmental security policy - [Detailed description of policy]

· Firewall, IDS, and encryption policy - [Detailed description of policy as well as confirmation of properly configured firewalls.]

· Contingency Plans - [Detailed description of plans] Training and Awareness The training and rules of behavior requirements for employees to work in support of this interconnection will be determined by the contract(s) governing the support services provided by the vendor. [Organization 2] will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts and for continuously monitoring and tracking the status of all [Organization 2] employees relevant to this interconnection.

TOPOLOGICAL DRAWING

Figures provided in this section depict the interconnectivity from VLER DAS to [Organization 2]. [Organization 2, please add or update this diagram to highlight the 2 items from 2.1. VLER DAS and [Organization 2] and how data flows between them. Please make very visible on diagram.] Figure 1; DAS Network Diagram

This Topological drawing illustrates the systems described in section 2.1, including all communications paths, circuits, and other components used for the interconnection, from VLER DAS to [Organization 2].

VLER DAS provides a highly reliable and scalable infrastructure for developing and deploying Producer and Consumer wrappers to facilitate data transmission with minimal support, administration costs, and more flexibility than your own infrastructure. It includes a variety of foundational services to facilitate data transmission through RESTDesc – Semantic Descriptions. The services are completely decoupled components, load balanced and asynchronous systems. Requests are processed in parallel; results are retrieved in parallel. The services are thread safe with multiple asynchronous nodes working through a load balancer. VLER DAS also provides Redis-based, fast and reliable caching mechanisms to keep static data closer to Consumers and dynamic data closer to computing components. Secure data in transit and confidential data is encrypted and is integrated with IAM services at every layer (as services are available). Services are developed in Node.js and Java.

Duration This agreement will expire when one or both parties determine that the interconnection is no longer necessary or if there is no longer a business or contractual justification. If there is no longer a business justification and/or one or both parties determine that the interconnection is no longer necessary, then the interconnection will be decommissioned.

Annually the VA ISO, along with the VA business owner, will review the agreement to ascertain 1) if the interconnection is deemed still necessary and 2) if there are any significant changes to the interconnection (see section 2.3.3 Material Changes to System Configuration). The outcome of the review will be documented in the review section, Appendix C: VA Annual Review. If there are significant changes to the interconnection at any time or if major changes were noted during the annual review, the agreement must be updated and re-signed.

If one or both of the parties wish to terminate this agreement prematurely, they may do so upon thirty (30) days advanced notice or in the event of a security incident that necessitates an immediate response. Approval to decommission must come from the Business Owner.

SIGNATORY AUTHORITY

We, the undersigned, mutually agree to the terms of this agreement.

VLER DAS System Owner:

John Tirrell, Director Interagency Services of Department of Veterans Affairs (VA) DAS

X__________________________ Date __________

VLER DAS Information Security Officer:

Edward Merica Information Security Officer of Department of Veterans Affairs (VA) VLER DAS

As the Privacy Officer (PO) for this VA MOU/ISA I have determined that the legal authorities for sharing the data covered by this agreement exist and are appropriately addressed and the uses and disclosures of the data covered by this agreement are in accordance with VA and VHA directives. I concur with the privacy practices outlined in this VA MOU/ISA.

VLER DAS Privacy Officer Artur Tocilla VA OI&T Privacy Officer of Department of Veterans Affairs (VA) VLER DAS

[Organization 2] System Owner:

[Name of [Organization 2]’s System Owner] [Job Title of [Organization 2]’s System Owner]

[Organization 2] Information Security Officer:

[Name of [Organization 2]’s Information Security Officer] [Job Title of [Organization 2]’s Information Security Officer]

[Organization 2] Privacy Officer:

[Name of [Organization 2]’s Privacy Officer] [Job Title of [Organization 2]’s Privacy Officer]

Appendix A: Points of Contact List of Responsible Parties for Each System:

(Include all [Organization 2] Signatories from Section 5 to include System Owner, ISO, and Privacy Officer. Also include any key Technical staff) Table 1: Parties Responsible for Each System

[Organization 2]

[Organization 2]

[Organization 2]

List of Responsible Parties to Contact during a Security Incident:

(E.g. Primary ISO, Backup ISO, 24/7 Support Desk, and any key Technical staff including the Network Security Operations Center (if not already in matrix below)) Table 2: Parties to Contact During a Security Incident

vafsshisd@va.gov

* Note: VA-NSOC should only be contacted by VA personnel.

Appendix B: Questionnaire – Transmission of VA Sensitive Information Utilizing a System Interconnection Complete as many Questionnaires as needed where VA sensitive information is transmitted.

If no VA sensitive information is used, list “N/A: No VA sensitive information/data is transmitted via this interconnection” right above question 1 and leave rest of section here blank as placeholder. This means also removing all blue instructions.

Note: This does not have to be signed if this is listed as N/A.

1. MOU/ISA for Interconnection: Memorandum of Understanding and Interconnection Security Agreement Between Department of Veteran Affairs (VA), Veterans Health Administration (VHA), Office of Information Technology (OIT), Data Access Services (DAS) and [Organization 2]

2. VA Point of Contact: Edward Merica DCSD ISO

3. Description of Data: [Specify the data elements being transmitted and provide a description of the sensitive information to be transferred: e.g., clinical images with protected health information; financial information with names and social security numbers; individually identifiable data collected for research]

4. Purpose for Data Transfer: [Describe the purpose of the data transfer: e.g., access to clinical images by off-site radiologists; financial information used to generate billing information; subject data to be analyzed under a VA or a non-VA research protocol]

5. Non-VA Storage Location of the Transmitted Information: [E.g., Medical Center *name* Department of Radiology servers, *Name* Financial Institution servers]

6. Supporting Document(s) Describing the Transfer of the Data to the Recipient: [E.g., Contract#, Protocol#, MOU, HIPAA authorization, Data Use Agreement, etc.].

7. Provisions for Destruction or Return of the Data (if applicable): [Describe the provisions for the return or destruction of the sensitive information to VA at the completion of the contract, project, clinical application/evaluation, etc., if applicable]

VA Point of Contact: : John Tirrell, Director, Interagency Services, Data Access Services (DAS) Signature:

Date:

VA Information Security Officer: Edward Merica AITC DCSD ISO Signature:

Date:

Appendix C: VA Annual Review Documentation VA ISO signature is required for each annual review. During the annual review of this document, the ISO should consult key stakeholders.

Fill in Change Status Column with following (Select all that apply)

1. No Change

2. Minor Change

3. Major Change

4. New Agreement

5. Change in POC

6. Other (please specify)

When a page is full, the ISO should add another page.

Table 3: Annual Documentation Review

(Select all that apply)

Appendix D: Definitions of Sensitive Information Types The following discussion defines the various types of personal information collected, maintained, and used within VA and provides an overview of how they inter-relate. Every type is subject to VA security statutes (38 U.S.C. §§ 5721-28), as long as it identifies or could reasonably be used to identify an individual. Depending on the type of information, it may also be protected by the Privacy Act (5 U.S.C. § 552a), the VA confidentiality statutes (38 U.S.C. §§ 5701, 5705, and 7332), and the HIPAA Privacy and Security Rules (45 C.F.R. Parts 160, 164).

VA Sensitive Information/Data - All Department information and/or data on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes not only information that identifies an individual but also other information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, and records about individuals requiring protection under applicable confidentiality provisions. SOURCE: 38 U.S.C. § 5727.

Personally Identifiable Information (PII) - Any information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. Information does not have to be retrieved by any specific individual or unique identifier (i.e., covered by the Privacy Act) to be personally identifiable information. SOURCE: Office of Management and Budget (OMB) Memorandum 07-16, Safeguarding Against and Responding to Breaches of Personally Identifiable Information (May 22, 2007)

NOTE: The term “Personally Identifiable Information” is synonymous and interchangeable with “Sensitive Personal Information.”

Sensitive Personal Information (SPI) - The term, with respect to an individual, means any information about the individual maintained by VA, including the following: (i) education, financial transactions, medical history, and criminal or employment history; and (ii) information that can be used to distinguish or trace the individual’s identity, including name, social security number, date and place of birth, mother’s maiden name, or biometric records. SPI is a subset of VA Sensitive Information/Data. SOURCE: 38 U.S.C. § 5727.

NOTE: The term “Sensitive Personal Information” is synonymous and interchangeable with “Personally Identifiable Information.”

Health Information - Health Information is any information, whether oral or recorded in any form or medium, created or received by a health care provider, health plan, public health authority, employer, life insurers, school or university, or health care clearinghouse or health plan that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or payment for the provision of health care to an individual. This encompasses information pertaining to examination, medical history, diagnosis, and findings or treatment, including laboratory examinations, X-rays, microscopic slides, photographs, and prescriptions. SOURCE: 45 C.F.R. § 160.103

Individually Identifiable Information (III) - Individually Identifiable Information is any information pertaining to an individual that is retrieved by the individual’s name or other unique identifier, as well as Individually Identifiable Health Information regardless of how it is retrieved.