6550.pdf

This is VA Directive 6550, issued June 3, 2019, which establishes technical Pre-Procurement Assessment (PPA) and implementation requirements for medical devices and systems connected to the VA network or that store sensitive patient information. The directive is managed by the Veterans Health Administration (VHA) Office of Healthcare Technology Management.

The directive details the comprehensive process for assessing and implementing medical devices/systems, requiring evaluation of factors including clinical features, human factors engineering, safety, security, and infrastructure requirements. It mandates that Biomedical Engineering lead the PPA process and requires specific documentation including a Manufacturer Disclosure Statement for Medical Device Security (MDS²), topology diagrams, hardware/software inventories, and Enterprise Risk Analysis (ERA) review. The directive assigns specific responsibilities to Network Directors, Facility Directors, Biomedical Engineering staff, Information Systems Security Officers, and other stakeholders. It includes detailed implementation procedures for connecting devices to the Medical Device Isolation Architecture (MDIA) and establishes requirements for operating system support, wireless networking standards, security controls, and data protection measures.