6550 Appendix A - Pre-procurement Assessment Questionnaire_Fillable.pdf

6550 Appendix A: Pre-Procurement Assessment Questionnaire

To be completed for all procurements of network-connected medical devices/systems and stand-alone (non-networked) medical devices/systems that store sensitive information. For client/server systems, a 6550 Appendix

A is required for the client system, and a separate one is also required for the medical server.

Medical Device/System (MD/S) is a non-information technology (IT) device or system that meets all criteria outlined below. MD/S in

VA encompass both clinical systems and medical devices. The purpose of this definition is to identify which MD/S fall under VA management responsibilities.

1. The medical device/system can connect to the network and/or store electronic Protected Health Information (ePHI) locally.

2. The device/system meets one or more of the following conditions:

a. Is used in patient healthcare for diagnosis, treatment, or physiological monitoring of patients *

b. Has gone through the Food and Drug Administration (FDA) Premarket Review or 510(k) Process.

c. Is incorporated into a medical device/system such that, if modified, the device/ system component could negatively impact the functionality or safety of the main medical device/system**

*Includes, but is not limited to, server-based medical equipment and clinical systems that directly connect to a patient, process human and other biologic specimens, create medical images, display electrophysiological waveforms, obtain physiologic measurements, and/or directly provide therapeutic-support to the patient. An exhaustive list of medical devices can be found in the VA Medical Device Nomenclature System (MDNS).

**Includes on-premises and/or cloud-based software validated, installed, or authorized by the sponsor as a device or in a device.

Part 1

If an active ERA already exists for the requested device, only Part 1 needs to be completed.

Part 2 is NOT required.

Number Question Response

1.1 VISN

1.2 Facility Name

1.3 Manufacturer

1.4 Model

1.5 Application Name

1.6 Application Version #

1.7 Operating System (OS)

1.8 Operating System (OS) Build Level

1.9 A. Does an active, approved Enterprise Risk Assessment (ERA) exist for the device/ system?

NOTE: If No: Part 1 is complete. Proceed to App A Part 2.

☐ Yes ☐ No

B. If Yes: Is the ERA designated for a FED EHR device/system?

**Please answer Yes if it is for FED EHR Oracle OpenLink, DAS SPOE, VDIF, FDSS connected systems only

If Yes to A or B, provide the ERA number.

1.10 Does the device/system match exactly with the device make, model, operating system version, and application sof tware version documented in the approved ERA?

NOTE: A new ERA is required for major sof tware or operating system updates (e.g., version 2.0 to 3.0) but is not required for minor updates (e.g., version 2.0 to 2.1). A new ERA is also required if any major hardware, sof tware, or conf iguration dif fers f rom what is currently approved.

If No: Part 1 is complete. Proceed to App A Part 2

Part 2

Device Identification

1.1 Is this request an upgrade to a device or system that already has a current, active ERA (Enterprise Risk Assessment)?

If Yes: Enter the ERA number for the existing, active ERA.

If No: Why is a new ERA required?

1.2 Manufacturer

1.3 Model

1.4 Application Name

1.5 Application Version #

1.6 Is the system FDA classif ied as a medical device/ system? ☐ Yes ☐ No

If Yes: Does it have FDA 510(k) clearance (or is it exempt)? ☐ 510(k) cleared ☐ Exempt f rom 510(k)

(e.g., Class I device)

☐ Not FDA regulated If it is 510(k) cleared, provide the clearance number.

1.7 Device Operating System (OS) and feature update/version

(e.g., Windows 11 version 23H2/ Ubuntu 22.04 LTS) Review support status for Windows OS versions here.

Review support status for Ubuntu OS versions here.

NOTE: Procurement of devices with Unsupported OSs is prohibited.

Unsupported OSs are those no longer supported by the manufacturer and have reached end-of-life, meaning no further security patches or extended warranties are available.

Operating System (OS) Build Level (e.g. Build 22631.3737 or Kernel 5.15.0-101-generic)

Network Connectivity

2.1 Is the device deployed with wireless network capability?

If Yes: Provide FIPS 140-2/3 certification numbers for all cryptographic modules?

If No: Does the vendor support the installation of a FIPS 140-2/3 validated wireless card as an alternative?

2.2 What type of IP addressing does the device use?

NOTE: Devices should be deployed with static IPs unless DHCP is required.

☐ Static IP

☐ DHCP

2.3 Is IPv6 supported? ☐ Yes ☐ No

If Yes: List any limitations.

2.4 Is connectivity external to VA required for device operation? ☐ Yes ☐ No https://www.fda.gov/medical-devices/classify-your-medical-device/how-determine-if-your-product-medical-device https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfPMN/pmn.cfm https://learn.microsoft.com/en-us/lifecycle/products/ https://ubuntu.com/about/release-cycle https://learn.microsoft.com/en-us/windows/release-health/windows11-release-information https://ubuntu.com/kernel https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules/search

If yes, describe why external connectivity is necessary for the device/system to function (e.g., what specific operational purpose it serves).

2.5

Is connectivity external to VA required for device support (remote access)?

☐ Yes ☐ No

If Yes: Select the approved remote access method: ☐ VA S2S VPN

☐ VA Citrix

☐ VA Azure Virtual Desktop

☐ Other If VA S2S VPN is selected, what is the active MOU/ISA number?

If Other: Describe the remote access method.

2.6 Does the device utilize Bluetooth? ☐ Yes ☐ No

If Yes: Which version of Bluetooth is used? (Only check one) ☐ Version 2.0 or older

☐ Version 2.1– 4.0

☐ Version 4.1 or newer If Yes: Is PII/PHI transmitted via Bluetooth? ☐ Yes ☐ No

Patching and Configuration Management

3.1 Can the OS be automatically patched?

Note: Devices that do not support automated patching via the VHA MD Update Server (MDUS) or via vendor channels impose a signif icantly higher risk to VA’s network.

☐ Yes ☐ No

If patching is not automated, what is the patching process and/or limitations?

3.2 How is the application and sub-application patching managed for this device/system (e.g., Java, Apache, and other third-party components)?

3.3 Can existing OS services be enabled to communicate with a system inventory tool such as the VHA SMAK-AM server?

☐ Yes

☐ No

☐ Non-Windows based system

If No: Has the vendor agreed to provide a complete software and application inventory for all system components per FISMA requirements?

Note: Devices that do not support communication with the SMAK-AM server or for which the vendor does not agree to provide a complete software inventory impose a significantly higher risk to VA's network.

☐ Yes ☐ No

3.4 Is a device hardening guide available? (If yes, provide guide) ☐ Yes ☐ No If No: Provide how you are to secure the system?

Authentication and Access Control

4.1 Does the device support the use of multi-factor authentication

(MFA)?

Note: Devices that do not support two-factor authentication impose a signif icantly higher risk to VA’s network.

Does the device support Single Sign-On (SSO)? ☐ Yes ☐ No

Does the device require interactive login service accounts?

Note: Devices that require interactive login service accounts impose signif icantly higher risk to VA’s network.

If service accounts are used, can they be conf igured as Group Managed Service Accounts (gMSA)?

☐ Yes ☐ No ☐ N/A

4.2 Medical devices/systems are required to be joined to VA's domain. Is there any reason it cannot?

Note: Devices that are not joined to the domain impose a significantly higher risk to VA's network.

☐ Yes ☐ No

If Yes: Provide the manufacturer-documented reason domain enrollment is not supported.

Antivirus, Scanning, and Security Monitoring

5.1 Does the device support anti-virus or anti-malware tools?

If Yes: What type and version?

If the device does not support antivirus (AV) sof tware, what alternative security measures are in place to protect the system, and what are the limitations of these measures?

5.2 Does the device support Endpoint Detection and Response (EDR) tools (e.g., CrowdStrike).

If Yes: What type and version?

If no, what alternative security measures are in place to detect and respond to advanced threats, and what are the limitations of these measures?

5.3 What type of vulnerability scanning is allowed on the device? ☐ Active

☐ Passive

☐ Both If active scanning is supported, is credentialed (authenticated) scanning allowed?

Note: Credentialed scanning provides signif icantly more complete vulnerability assessment results and is strongly preferred.

☐ Yes ☐ No

If passive scanning is only supported, explain why.

If scanning is allowed, can the device/system be scanned while in use?

☐ Yes ☐ No

5.4 Does the device support a logging capability? ☐ Yes ☐ No

If Yes: What type of logging methods are allowed?

(Examples: Dynatrace, SolarWinds, CrowdStrike)

If Yes: Will the logging methods be enabled before implementation? ☐ Yes ☐ No

If Yes: Can these logs be exported to a syslog or similar server? ☐ Yes ☐ No

If No: describe the available method(s) for extracting, accessing, and reviewing log data in a format that is human-readable and suitable for security analysis and audit purposes?

Encryption and Data Protection

6.1 Does the device allow for encryption of the data drive or OS drives? ☐ Yes ☐ No

What type of encryption is allowed?

6.2 What method of encryption is used for data in transit?

(Only TLS 1.2 and above are permitted)

Note: The use of TLS 1.1 is prohibited.

☐ TLS 1.2

☐ TLS 1.3

☐ SFTP

☐ SSH

☐ SSL

☐ Other

☐ N/A

If Other: Please specify what encryption method is used.

6.3 Does the device support or have a roadmap for NIST-approved post-quantum cryptography (PQC) algorithms?

Note: Post-quantum cryptography (PQC) is a new generation of encryption designed to remain secure against quantum computers, which will eventually be capable of breaking the encryption standards most systems rely on today, including RSA and Elliptic Curve

Cryptography (ECC). PQC replaces these vulnerable standards with new mathematical approaches that cannot be efficiently broken by either traditional or quantum computers.

☐ Yes ☐ No

6.4 Is sensitive data stored at rest on the device? ☐ Yes ☐ No

If Yes: Does the device support on demand purging of data f rom the local hard drive?

☐ Yes ☐ No

6.5 Will sensitive data be stored outside of VA’s network (e.g. cloud -based service provider – excludes Electronic Medical Record connection and VAEC)?

Note: If the answer is yes, there needs to be an active MOU/ISA in place.

☐ Yes ☐ No

Certificates

7.1 Does this system require a certif icate? (If no, skip to 8.1) ☐ Yes ☐ No

7.2 If Yes: What type of certif icate(s) are used? ☐ DigiCert

☐ Microsof t ☐ Venaf i (VA Enterprise)

☐ Other

7.3 If Other: Please specify.

Cloud and External Services

8.1 Does the device require an external vendor-managed cloud platform to operate?

https://dvagov.sharepoint.com/sites/vaoitpki?xsdata=MDV8MDJ8fDRiYTRiNmVkNWIxZDQwZjdhMGQzMDhkZTZiMWRiMDhjfGU5NWYxYjIzYWJhZjQ1ZWU4MjFkYjdhYjI1MWFiM2JmfDB8MHw2MzkwNjU5NzI0NzM3MTQ3OTF8VW5rbm93bnxUV0ZwYkdac2IzZDhleUpGYlhCMGVVMWhjR2tpT25SeWRXVXNJbFlpT2lJd0xqQXVNREF3TUNJc0lsQWlPaUpYYVc0ek1pSXNJa0ZPSWpvaVRXRnBiQ0lzSWxkVUlqb3lmUT09fDB8fHw%3d&sdata=Ym5XelpRU1NIQUVaRUNZVlNMY3hrdlczdDRaZWI3OFRJVnlhbEFrMzJzRT0%3d&clickparams=eyAiWC1BcHBOYW1lIiA6ICJNaWNyb3NvZnQgT3V0bG9vayIsICJYLUFwcFZlcnNpb24iIDogIjE2LjAuMjAyMjguMjAxODgiLCAiT1MiIDogIldpbmRvd3MiIH0%3D

If yes, has the cloud platform been approved by VA Digital Transformation Center (DTC)?

To determine approval status, please visit the Digital VA Product Marketplace.

If Yes: What cloud type has VA DTC designated? ☐ Sof tware as a Service (SaaS)

☐ Managed Service

8.2 If SaaS, is it FedRAMP authorized? ☐ Yes ☐ No

If SaaS, what is the FedRAMP package ID?

8.3 Does the system require a VAEC submission? ☐ Yes ☐ No

If Yes: Is there an approved VA ATO for the VAEC platform?

Note: Sites utilizing the VAEC must acknowledge and accept financial responsibility for the recurring monthly costs associated with managing and maintaining the cloud platform.

☐ Yes ☐ No

Artificial Intelligence and Machine Learning

9.1 Does the device utilize Artificial intelligence/Machine learning (AI/ML)? ☐ Yes ☐ No

If Yes: Describe the AI/ML functionality and confirm whether it has been evaluated and approved by the FDA.

If Yes: Verify that the AI systems are documented in the VA’s AI Use Case Inventory

Note: Any operational use of AI at VA is prohibited unless the tool is documented in the VA AI Use Case inventory and has an active AI Use Case ID.

If the system has been documented in the VA AI Use Case Inventory, provide the AI Use Case ID.

If Yes: Has your system been designated as high-impact by VA Chief AI Office?

Note: High-impact systems must be approved by the CAIO prior to the deployment of the system.

☐ Yes ☐ No

Interoperability and Interfaces - Non-Federal EHR *Do not fill this section out if the system will integrate with FED EHR

10.1 Does the device use DICOM to communicate to the patient record? ☐ Yes ☐ No

If Yes: Has the device been validated with VA's DICOM validation program?

Note: A device will not be able to be connected to the patient record without approval f rom the DICOM validation program.

☐ Yes ☐ No

10.2 Does this device include an HL7 interface? ☐ Yes ☐ No

If Yes: What will the HL7 interface be used for? ☐ Orders

☐ Results

☐ Billing (DFT)

☐ ADT

☐ Other

If Other: Please specify.

https://digital.va.gov/marketplace/ https://digital.va.gov/marketplace/ https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices https://department.va.gov/ai/ai-use-case-inventory/ https://department.va.gov/ai/ai-use-case-inventory/ https://dvagov.sharepoint.com/sites/oitchiefaiofficerteam/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2Foitchiefaiofficerteam%2FShared%20Documents%2FIdentification%20%26%20Review%20of%20High%20Impact%20Use%20Cases%20at%20VA%5FFinal%2Epdf&parent=%2Fsites%2Foitchiefaiofficerteam%2FShared%20Documents https://dvagov.sharepoint.com/:w:/r/sites/Collaboration-AIGovernance/_layouts/15/Doc.aspx?sourcedoc=%7B776E4E07-F7AB-421E-97B0-5C580E5E996C%7D&file=2025VA_AI_ImpactAssessment_RiskMitigationPlan_Word.docx&action=default&mobileredirect=true), https://www.va.gov/health/imaging/dicom.asp https://www.va.gov/health/imaging/dicom.asp

If yes, has the device been validated with VA's Clinical Procedure Package?

☐ Yes ☐ No

Interoperability and Interfaces - Federal EHR **Only fill out this section if you are currently live with the Federal EHR, or within T-24 months from go-live**

11.1 Is this request for a FED EHR device/system?

**Please only answer Yes if it is for FED EHR Oracle OpenLink, DAS SPOE, VDIF, FDSS connected systems

☐ Yes ☐ No

If Yes: Is this system on the FED EHR VA Baseline? ☐ Yes ☐ No If No: Has an SBAR intake form been submitted for the device/system?

Note: If the system is not on the FED EHR VA baseline, the following needs to be completed:

1. Determine clinical need

2. Evaluate previous NSR submissions,

3. Submit an SBAR intake form via email to the EHRM IO

Federal Baseline team <EHRMIOFederalEHRVABaseline@va.gov>.

For additional guidance, please contact the EHRM IO HTM team at EHRMIOHTM@va.gov and/or visit the Federal EHR VA Baseline SharePoint Page..

☐ Yes ☐ No

11.2 Will this system require a different means of integration to the Federal EHR (i.e. DICOM/Non-DICOM, BMDI/LMDI, etc.)

For additional guidance, please contact the EHRM IO HTM team at EHRMIOHTM@va.gov and/or visit the EHRM-IO HTM SharePoint Page. In addition, please review the EHRM-IO VA Validated HTM Devices Power BI.

☐ Compass Router (DICOM)

☐ Federal EHR Gateway

(Non-DICOM Image Routing)

☐ Biomedical Device

Integration (CareAware/iBus)

☐ Laboratory Medical Device

Integration (CareAware/iBus)

☐ Mobile Vitals Collection

☐ Other If Other: Pease specify.

https://dvagov.sharepoint.com/sites/oitspmhspcsclinproc https://dvagov.sharepoint.com/sites/oitspmhspcsclinproc https://apps.gov.powerapps.us/play/e/cf02c434-0621-e94f-9de9-a16f02034332/a/4658cdb9-484c-4eb7-9e19-306be983f2c3?tenantId=e95f1b23-abaf-45ee-821d-b7ab251ab3bf mailto:%3cEHRMIOFederalEHRVABaseline@va.gov mailto:EHRMIOHTM@va.gov https://dvagov.sharepoint.com/sites/vafederalehrresourcecenter/SitePages/EHRVABaseline.aspx https://dvagov.sharepoint.com/sites/vafederalehrresourcecenter/SitePages/EHRVABaseline.aspx https://dvagov.sharepoint.com/sites/OEHRMCMIOCNIOHTMBiomed2/SitePages/Medical%20Devices.aspx mailto:EHRMIOHTM@va.gov https://dvagov.sharepoint.com/sites/OEHRMCMIOCNIOHTMBiomed2/SitePages/EHRM-IO-HTM-Homepage.aspx https://dvagov.sharepoint.com/sites/OEHRMCMIOCNIOHTMBiomed2/SitePages/EHRM-IO-HTM-Homepage.aspx https://app.powerbigov.us/groups/4f62e489-ab20-42b8-ac1f-d8d544db1c75/reports/1a0afe4d-b749-4b74-8621-01320691f7ef/0dccf269faea34f608d2?ctid=e95f1b23-abaf-45ee-821d-b7ab251ab3bf https://app.powerbigov.us/groups/4f62e489-ab20-42b8-ac1f-d8d544db1c75/reports/1a0afe4d-b749-4b74-8621-01320691f7ef/0dccf269faea34f608d2?ctid=e95f1b23-abaf-45ee-821d-b7ab251ab3bf