Attachment 7 - VA Updated Security Requirement for Network Connected Medical Devices and Systems_7566605.pdf

This memorandum from the Department of Veterans Affairs establishes updated security requirements for network-connected medical devices and systems. Issued February 13, 2015, by the Deputy Assistant Secretary for Information Security, the memorandum applies to all VA offices and personnel responsible for acquisition, implementation, operation, and maintenance of network-connected medical devices and systems.

The memorandum establishes nine primary security requirements: (1) medical devices must comply with VA information security requirements and be included in the General Support System security authorization at their deployment facility; (2) network-connected medical devices must be segregated within a Medical Device Isolation Architecture (MDIA) Virtual Local Area Network (VLAN) with restricted access; (3) procurement must follow VA Directive 6550 and Contract Security requirements with adequate staff training; (4) medical device inventory must be collected, updated, and maintained at least every 90 days for enterprise reporting; (5) MDIA implementation must follow standardized guidelines with devices running supported Microsoft Windows operating systems capable of joining Active Directory and receiving Group Policy settings; (6) configuration management and change control processes must be standardized with a National MDIA Approval Board reviewing all access control list changes; (7) medical device security training must be provided to Biomedical Engineers, Information Security Officers, and IT personnel; (8) incident response procedures must expedite reporting and response for compromised medical devices to prevent alteration or loss of functionality; and (9) the MDIA Work Group is responsible for developing and maintaining standardized processes. A May 2014 prior memorandum on "Certification of Medical Devices in MDIA" required audit sites to certify compliance within 14 days and non-audit sites within 90 days of that memo.