Attach 4 - IHS BusinessPartnerISA2022_PHXAO.pdf

INDIAN HEALTH SERVICES

Business Partner Interconnection Security

Agreement Summary

The purpose of this security agreement summary is to establish procedures for mutual cooperation and coordination between the Indian Health Service (IHS), an agency of the United States Department of Health and Human Services (HHS), and (hereinafter known as “both parties”). These procedures identify and prescribe information security safeguards and responsibilities required to establish:

A network interconnection security agreement (ISA) between the IHS and

A data exchange agreement (DEA) between the IHS and

This SAS is intended to minimize security risks and ensure the confidentiality, integrity, and availability (CIA) of information owned by either IHS or that is shared or transmitted through the network interconnection.

Contract # Official Use Only – Sensitive

CONTROLLED

UNCLASSIFIED

INFORMATION

(CUI)

Controlled with

Standard

Dissemination For

Authorized

Use

Only

This information is intended for

IHS

use only.

Disclosure may cause harm to

IHS.

Access provided by request only and not available via the organization's

Intranet.

This document contains information that may be exempt from public release under

Freedom of

Information

Act

(FOIA)

(5

U.S.C.

552).

DIS-Template-10-01 Version 1.0

JUNE 2022

Record of Changes

Version Date Name Description Section

1.0

JUN22

ISA and DOC Terms

First Draft ALL

CONTENTS ...iii

Document Information ..........................................................................................................................................i

Record of Changes ..............................................................................................................................................ii

1. Purpose

1.1 Authority

1.2 Scope

2.

Statement

Requirements

System

Description

2.1

General

Data

Description

2.2

Services

Offered

3.

Network

Descriptions

3.1

IHS

3.2

Partner

Organization

3.3

Diagram(s)

3.4

Area/Site

Connections

4.

Security

Responsibilities

4.1

User

Community

4.2

Commitment

Protect

Personally

Identifiable

(PII)

Protected

Health

(PHI)

4.3

Rules

Behavior

4.4

Training

Awareness

4.5

Security

Documentation

4.6

Personnel

Access

Changes

4.7

Incident

Response

Reporting

4.8

Disasters

Other

Contingencies

5.

Agreement

Considerations

5.1

New

Interconnections

Modifications

5.2

Compliance

5.3

Cost

Considerations

5.4

Timelines

5.5

Limitation

Liability

3.5

IP

Adresses, Ports, Protocols

6. Signatures and Contact Information

7. Glossary

Appendix A: References

1. Purpose

1.1

Authority

The purpose of this interconnection security agreement (ISA) is to establish procedures for mutual cooperation and coordination between the Indian Health Service (IHS), an agency of the United States Department of Health and Human Services (HHS), and (hereinafter known as “both parties”). These procedures identify and implement information security safeguards and responsibilities required to establish an interconnection between the IHS network and ’s network. This ISA is intended to minimize security risks and ensure the confidentiality, integrity, and availability (CIA) of both IHS information that is shared or transmitted through the network interconnection.

This ISA documents interconnection arrangements and information technology (IT) security responsibilities for both parties, outlines security safeguards, provides technical and operational security requirements, and specifies the business and legal requirements for the information systems and networks being interconnected.

This ISA authorizes mutual permission to connect both parties and establishes a commitment to protect data that is exchanged between the networks or processed and stored on systems that reside on the IHS network.

Through this ISA, both parties will minimize the susceptibility of their connected systems and networks to IT security risks and aid in mitigating and recovering from IT security incidents.

IHS is responsible for implementing and administering an information security program, which includes the use of this ISA, to protect its information resources in compliance with applicable public laws, federal regulations, and

Executive Orders. Such directives include, but are not limited to: the Federal Information Security Modernization

Act of 2014(FISMA); the Office of Management and Budget (OMB) Circular A-130 revised, Management of

Federal Information Resources, dated JULY 2016; the Health Information Technology for Economic and Clinical

Health Act (HITECH); the Health Insurance Portability and Accountability Act (HIPAA) revised MARCH 2021;

HSPD-7; HSPD-12; All laws, directives, standards, guidelines, circulars, and memos listed and provided on the

IHS DIS website location provided : https://home.ihs.gov/security/index.cfm?module=dsp_dis_sec_laws. IHS will comply with the security requirements of the Federal Acquisition Regulation (FAR), clause 52.239-1, “Privacy or

Security Safeguards.”

The ISA will be governed and construed in accordance with federal law. In the event of a conflict between the ISA and applicable federal law, federal law will prevail. Furthermore, nothing in this ISA will be construed to authorize to act outside of the scope of any federal law. If any term or condition of this ISA becomes invalid or unenforceable, such term or provision will in no way affect the validity or enforceability of any other term or provision contained herein.

1.2 Scope

• Interconnection between the IHS information system(s) or network and .

• Existing and future users, including employees from both parties, contractors and subcontractors at any tier, and other federally and non-federally funded users managing, engineering, accessing, or utilizing the network.

• Related network components belonging to both parties, such as hosts, routers, and switches; IT devices that assist in managing security, such as firewalls, intrusion detection systems, and vulnerability scanning tools;

desktop workstations; servers; and major applications that are associated with the network connection.

The scope of this ISA is based on, but not limited to, the following:

What types data are being transmitted or exchanged as part agreement?

General InformationandDataDescription

2. Statement of Requirements and System Description

Describe the nature of the information services (Email, Secure File transfer Protocol (FTPS), database query, file query, general computational services, etc.) offered ove r the interconnected system by each participating organization.f the agreement?

ServicesOffered

Provide answers help determine overall technical risk suggested security controls mitigate risk

IHS.

Data Type IHS Host

Connection Type (ISA Only)

Data Exchange Medium (DEA only)

Data Categorization

System Categorization

FIPS-Compliant Encryption Type (Minimum AES-128) FIPS-Compliant Hash Type (Minimum SHA-256)

Will PHI/PII be transmitted or shared between IHS and ? YES NO

IHS HQ Architecture & Engineering Team

A&E Team Reviewer Name:

A&E Team Reviewer Signature:

IHS HQ Security Agreement Team

SA Team Reviewer Name:

SA Team Reviewer Signature:

Contract # Official Use Only - Sensitive

IHS Network and Partner Organization Network

3. Information and Network Descriptions

Area/Site Connections Which Area offices and sites will be connected/sharing data as part of this agreement?

Attach an addendum if more rows are needed.

IHS Area/Site Connected IHS Device Connected Date Connected

Currently Connected?

IP Addresses, Ports, and Protocols If this agreement includes a persistent connection, what IP addresses, ports, and protocols will it use? Attach an addendum if more rows are needed.

*Note: IP addresses are not applicable to a Data Exchange Agreements*

Official Use Only – Sensitive

Source IP Address Destination IP Address Ports Protocols

Contract #

4. Security Responsibilities

The following sections describe the responsibilities of each party as they relate to ensuring the security of applicable systems, networks, and personnel affected by this interconnection.

Both parties will:

1. Maintain a level of security that is commensurate with the risk of, and magnitude of harm that could result from, the loss, misuse, disclosure, or modification of the information contained on the system.

2. Subject to applicable statutes and regulations including the Freedom of Information Act, agree that the terms and conditions (and any proprietary information) of this ISA will not be disclosed to any third party outside of the

Government without the prior written consent of the other party.

3. Adhere to all HHS and IHS IT security policies, procedures, and guidelines in the execution of this interconnection, to the extent that such policies apply to . The IHS Information

Systems Security Officer (ISSO) or ISA Coordinator will provide appropriate IHS security policies to the partner at the onset of this agreement. IHS policy is located at: https://home.ihs.gov/security/index.cfm?module=dsp_dis_sec

_laws.

4. Designate a technical lead for their respective network, and provide point of contact (POC) information to facilitate direct contacts between technical leads, to support the management and operation of the interconnection.

5. Maintain open lines of communication between POCs at both the managerial and technical levels, to ensure the successful management and operation of the interconnection.

6. Inform their counterpart of any change in technical POC or interconnection.

7. Submit to managerial POCs any proposed changes to either the network or the interconnecting medium, accompanied by a business justification for the change.

8. Report through the designated POCs, as appropriate, any planned technical changes to the network architecture that affect the interconnection.

9. Conduct a risk assessment for any new network architecture affecting this ISA, test, verify, modify and re-sign the ISA within one month prior to the implementation.

10. Where feasible, ensure this interconnection is isolated from all other customer/business processes.

11. Notify the respective POC(s) when a user’s access and/or this interconnection are no longer required.

Security Responsibilities Continued

IHS Will:

Will:

User Community

Both parties will:

• Ensure that all employees, contractors, and other authorized users with access to IHS or partner networks, systems, or data related to this interconnection are not security risks, and that they meet the security and privacy requirements of the applicable public laws, federal regulations, and Executive Orders listed in the 1.1 Authority

Section of this ISA. For more information, contact the Federal Contract Officer or Project Officer assigned to this interconnection.

• Enforce the following IT security best practices:

Commitment to Protect Personally Identifiable Information (PII ) and Protected Health Information

1. Least Privilege: Granting each entity the minimum system resources and authorizations that the entity needs to perform its function.

2. Separation of Duties: Dividing roles and responsibilities so that a single individual cannot subvert or control the entirety of a critical process.

3. Role-Based Security: Controlling access by assigning certain operations and appropriate permissions to specific roles.

• Not release, publish, or disclose information to unauthorized personnel and will protect such information in accordance with provisions of the laws cited in Section 1.1: Authority and Appendix A: References, as well as any other pertinent laws and regulations governing the adequate safeguard of federal information and information systems.

• Ensure that information used, stored, or transmitted is protected commensurate with the risk of, and magnitude of the harm that could result from, the unauthorized access, use, disclosure, disruption, modification, or destruction of the information in accordance with any applicable laws and in accordance with the BAA between and IHS.FIPS Publication 200 and associated NIST SPs, including NIST SP 800-53, Rev 4, will be used to determine required controls according to the information categorization defined in Section 3.

Where applicable, FIPS 140-2 validated cryptographic modules will be used when such controls are required.

will ensure that each of its employees and subcontractors who may have access to

IHS information and information systems comply with the security required by FAR clause 52.239-1, “Privacy or

Security Safeguards” and with all IHS IT security policies, standards, and procedures. to the extent that such policies apply to . IHS IT policy is referenced in Attachment A and in the 1.1

Authority section of this ISA.

Rules of Behavior

Training and Awareness

Security Documentation

Both parties will ensure that all users with access to IHS networks, information, and information systems, the

. interconnected systems/networks, and any data received as part of this interconnection will adhere to all current IHS Rules of Behavior (RoB) as signed between IHS and

All users that access the IHS network must provide the IHS ISSO with a signed ROB before authorization to access will be granted.

IHS shall have all employees, contractors, subcontractors, and other authorized users complete the IHS Information

Systems Security Awareness (ISSA) training upon enactment of this ISA and again annually thereafter. The ISSA training can be found at www.ihs.gov/issa.

shall have all users, including employees, contractors, subcontractors, and other authorized users complete IHS privacy and security training upon enactment of this ISA and annually thereafter.

Copies of the completed training must be provided to the IHS ISSO annually.

will, upon request, provide the IHS Project Officer or designee with the name of each user and the date each user completes initial and annual privacy and security training.

Both parties will ensure that security is planned for, documented, and integrated into the system life cycle, from the IT system’s initiation to the system’s disposal, for any systems that are part of this interconnection agreement.

See NIST SP 800-37, Rev 1, Guide for Applying the Risk Management Framework to Federal Information

Systems: A Security Life Cycle Approach.

IHS will review the IHS System Security Plans (SSPs) for its systems annually and update them as required by

NIST SP 800-18, Rev 1, Guide for Developing Security Plans for Federal Information Systems.

will maintain an SSP on the systems affected by this interconnection agreement and update them whenever there is a major modification to those systems.

Personnel Access Changes will notify IHS ISSO and the ISA Coordinator when any changes occur regarding user access. This will ensure access is removed or maintained accurately on IHS systems and is in accordance with federal guidelines.

IHS will provide similar notification to the partner if IHS users access the partner’s systems as part of this interconnection.

Incident Response and Reporting

• Handle and report any security incident4 on the networks or subnets within the scope of this ISA that could have an impact on the other as part of this interconnection. The Incident Response Team (IRT) will assist IHS and its partners with all incidents and breaches of PHI. Reporting incidents and breaches will allow each party to determine whether its network is at risk or has been compromised, and to take appropriate security actions.

Both Parties Will:

• Report security incidents within 30 minutes of being reported to Vendor’s Incident Response Team. Network users will report incidents via the on-line Incident Reporting Form located at "https://disirf.ihs.gov/". For non-network users, a paper form is available in Appendix C: IHS Incident Reporting Form and on-line at.

"https://www.ihs.gov/employeeresources/includes/themes/newihstheme/display_o bjects/documents/F07-02b_IRF.

doc"

• Block inbound and outbound access for any IHS or partner information systems on the subnets within the scope of this ISA that are sources of unauthorized access attempts or the subject of any security event (such as malware

), until the risk is remediated.

• Disseminate critical intrusion detection alerts to respective counterparts for all subnets within the scope of this

ISA.

• Share information system event or audit records/logs to enable the monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or inappropriate information system activity, to the extent that inappropriate use may be uniquely traced to the source for potential accountability and legal purposes.

Disasters and Other Contingencies

Both parties will immediately notify their designated counterparts, as defined in this ISA, in the event of a disaster or other contingency that disrupts normal operation of one or both of the connected networks. The IHS POC will notify appropriate personnel on the IHS side of the connection.

IHS will maintain appropriate system contingency plans in accordance with federal regulations.

This section describes the general considerations for implementing this Interconnection Security Agreement.

5. Agreement Considerations

New Interconnections and Modifications

New interconnections between IHS and are prohibited unless expressly agreed upon in a modification to this ISA, signed by both parties.

If any personnel changes involving the POCs listed in this ISA occur, the terms of this ISA will remain in full force and effect unless formally modified by both parties. Any modifications that change the security posture of systems or networks including; connectivity method, ports, protocols or security settings related to this agreement must be formally documented and agreed to as a modification or addendum to this ISA.

Compliance

Non-compliance with the terms of this ISA by may lead to termination of the interconnection. IHS may block network access by if does not implement reasonable precautions to prevent security incidents from spreading to the IHS network. IHS is authorized to audit the security of ’s network periodically by requesting that

. provide documentation of compliance with the security requirements of this ISA.

will provide IHS access to the IT resources pertinent to this ISA, for the purpose of audits.

Cost Cosiderations

Both parties agree to be responsible for their own systems and costs of the interconnecting mechanisms and/or media. No financial commitments to reimburse the other party will be made without the written concurrence of both parties.

Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system/network owner’s organization. This ISA does not authorize, require, or preclude any transfer of funds without the written agreement of both parties.

Timelines

This ISA will become effective upon the signatures of the parties involved and remains in effect until it expires or is terminated by either party. This ISA is subject to annual review in accordance with federal directives and must be reauthorized when there is a modification to the security posture or, at a minimum, every three years. If one or both parties wish to terminate this agreement, they may do so upon 30 days’ written notice. In the event of a security incident or suspected incident, IHS has the right to immediately terminate the connection and will provide notification of such to the partner POC prior to termination, or within 24 hours after disconnection if emergency warrants the delay.

Limitation of Liabilities

Except to the extent covered by the Federal Tort Claims Act, Neither party shall be liable to the other party, or any other person for any indirect, special, incidental, or consequential damages of any character, including, without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses, even if such party was informed of the possibility of such damages.

Signatures IHS Management

Name:

Title:

Date:

Signature:

IHS Information Security

Name:

Title:

Date:

Signature:

Name:

Title:

Date:

Signature:

Name:

Title:

Date:

Signature:

Contact Information Who are the contract Points of Contact associated with this agreement?

Contract No.

IHS Management Contacts

Contact Information Contract Officer’s Representative Information

Name

Email

Phone Number

Contact Information Project Manager Information

Name

Email

Phone Number

Contact Information Backup Project Manager Information

Name

Email

Phone Number

Contact Information Area ISSO Information

Name

Email

Phone Number

Contact Information IHS HQ Security Information

Name

Email

Phone Number

Contact Information IHS Network Security Contact Information

Name

Email

Phone Number

Contact Information Business Associate Program Manager Information

Name

Email

Phone Number

Contact Information Business Associate Back-up Program Manager Information

Name Email Phone Number

Contact Information Business Associate Technical Contact #1 Information

Name

Email

Phone Number

Contact Information Business Associate Technical Contact #2 Information

Name

Email

Phone Number

7. Glossary

1 Information is defined as “any knowledge that can be communicated or documentary material, regardless of its physical form or characteristics, that is owned by, produced by or for, or is under the control of the United States Government.” (Executive Order 12958)

2 Network Interconnection is defined as “the direct connection of two or more IT [networks] for the purpose of sharing data and other information resources.” (This is based on the definition of system interconnection in NIST SP 800-47, Security Guide for Interconnecting Information Technology

Systems.)

3 Protected Health Information is defined as individually identifiable health information that is transmitted or maintained in any form or medium, including electronic information. (45 CFR 160.103)

4 Incident is defined as “” an occurrence that (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.”

See the on-line glossary on the IHS OIT Security website at http://security.ihs.gov/SecGlos.cfm.

Appendix A: References This ISA was developed in accordance with, but is not limited to, all relevant laws, policies, and regulations, including:

• Indian Health Manual (IHM) Part 8, Chapter 12 (http://www.ihs.gov/ihm/index.cfm?module=dsp_ ihm_pc_p8c12)

• IHM Part 8, Chapter 15 (https://www.ihs.gov/ihm/index.cfm?module=dsp_ihm_pc_p8c15)

• Indian Health Service Information Security Program SOPs (https://home.ihs.gov/ITSC-CIO/oit_tfs/)

• HHS information security policies and procedures (http://www.hhs.gov/ocio/policy/index.html# Security)

• Health Information Technology for Economic and Clinical Health Act (HITECH Act), Title XIII, Subtitle D of the American Reinvestment and Recovery Act (ARRA) of 2009, Pub. L. No. 111-5, 123 Stat. 115

• Office of Management and Budget Memoranda (https://www.whitehouse.gov/omb/memoranda_ default/):

1. 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information (https://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoran da/fy 2007/m07-16.pdf)

2. 09-29, Reporting Instructions for FISMA and Agency Privacy Management (https://www.

whitehouse.gov/sites/default/files/omb/assets/memoranda_fy 2009/m09-29.pdf)

• Federal Information Processing Standards (FIPS) Publications

• National Institute of Standards and Technology (NIST) Special Publications (SPs) and Draft SPs ( http://csrc.nist.gov/publications/PubsSPs.html)

• Federal Continuity Directive (FCD), FCD 1, Federal Executive Branch Continuity of Operations, October 2012 (http://www.fema.gov/media-library- data/1386609058779-b084a7230663249ab1d6 da4b6472e691/2012-Federal- Continuity-Directive1.pdf.)

• Presidential Decision Directives (PDD) (http://www.loc.gov/rr/news/directives.html):

1. PDD 67, Enduring Constitutional Government and Continuity of Government Operations, October 21, 1998.

2. Homeland Security Presidential Directive/HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection, December 17, 2003.

• The Privacy Act of 1974

• FOIA Update, Vol. XX, No. 1

• The Computer Fraud and Abuse Act 2020

• Health Insurance Portability and Accountability Act (HIPAA) / Privacy Rule

• Health Insurance Portability and Accountability Act (HIPAA) / Security Rule

Appendix A: References Continued

• NIST SP 800-12, An Introduction to Computer Security: The NIST Handbook

• NIST SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems

• NIST SP 800-16, Information Technology Security Training Requirements: A Role- and Performance- Based Model

• NIST SP 800-18 Rev 1, Guide for Developing Security Plans for Federal Information Systems

• NIST SP 800-30 Rev 1, Guide for Conducting Risk Assessments

• NIST SP 800-34 Rev 1, Contingency Planning Guide for Federal Information Systems

• NIST SP 800-37 Rev 2, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach

• NIST SP 800-53 Rev 5, Security and Privacy Controls for Information Systems and Organizations

• NIST SP 800-53A Rev 5, Assessing Security and Privacy Controls in Information Systems and Organizations

• NIST SP 800-60, Volume I: Guide for Mapping Types of Information and Information Systems to Security Categories

• NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities

• NIST SP 800-92, Guide to Computer Security Log Management

• FIPS Pub 140-3, Security Requirements for Cryptographic Modules

• FIPS Pub 199, Standards for Security Categorization of Federal Information and Information Systems

• FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems

• HSPD-7, Critical Infrastructure Identification, Prioritization, and Protection

• HSPD-12, Common Identification Standard for Federal Employees and Contractors

• Federal Preparedness Circular: Federal Executive Branch Continuity of Operations (COOP)

• The Paperwork Reduction Act of 1995

• Federal Information Security Modernization Act

• Health Information Technology for Economic and Clinical Health (HITECH) Act Enforcement Interim Final Rule

• NARA Regulations

Storage and Display of Imaging Examinations: All interpretations shall be performed on FDA, TJC, CMS and HIPAA compliant equipment operating FDA, TJC, CMS and HIPAA compliant software. All equipment and software shall be calibrated and maintained to FDA, TJC, CMS and HIPAA compliant standards.

Required Communications and Information Systems Agreements: Business Associate shall work with NAIHS and facility Information Technology (IT) Departments to complete all IHS required Information Systems Agreements.

Business Associate's network must have established firewalls and procedures to ensure patient confidentiality and security consistent with HIPAA regulations and American College of Radiology (ACR) guidelines.

Business Associate shall transmit reports to NAIHS facilities by electronic means in format acceptable to referring facility.

Business Associate shall upon request work with NAIHS and referring facilities to develop: a) direct HL-7 interface with IHS database to allow direct communications of patient demographic and clinical information, imaging examination information and work orders from NAIHS referring facilities' database to Business Associate's information system and b) direct HL - 7 interface for transmission of imaging examination reports from contractor's information system back to NAIHS referring facilities' database.

Business Associate's server and telecommunications network must have built in redundancy to allow for 100% receipt and processing of all NAIHS data.