Appendix_X_-_System_Description.docx

INSTRUCTIONS:

Prior to submission, remove all “example text” from the system description, as well as the Instructions page.

For each section, provide as much detail as possible. Insert diagrams where necessary to explain capabilities, workflows, etc. The more detailed information is when provided, the less rework, and clarifications will be required. Should you have any questions regarding the documentation, please contact your assigned analyst, and we will be more than happy to clarify/assist.

SAVE THE SYSTEM DESCRIPTION IN THE FOLLOWING FORMAT:

<<System Name>> System Description (CURRENT DATE).docx.

System Description:

Information provided should be in a format that someone with no knowledge of what the product/system does is able to walk away with a solid understanding how not only what it is, but what the workflows are, type of information stored/processed by the system.

Hardware/Software:

Detailed descriptions of what hardware/software is used on the system should be included in addition to the tables.

Information on Antivirus software approved should be provided. Additionally what vendor policies are for OS patching should be provided.

Provide detailed information on embedded databases, versions, if management tools are installed in addition to the software, if the tables can be accessed outside of the software. Does the DB present itself to the network? Is IIS installed, does it use FTP, etc.?

Interfaces:

Detailed descriptions of how the system communicates with the network should be provided. Does the system use DICOM, are there wireless capabilities. Is there a FIPS 140-2 certification if there are?

Workflow:

Indicate how patient demographics are loaded into the system. If the example text fits your particular system, modify only to indicate system name. IF IT DOES NOT, PLEASE INDICATE HOW THE SYSTEM WILL GATHER AND DISSEMINATE INFORMATION.

Do NOT modify the standard language other than to specify how the system operates.

Ports and Protocols:

The ports and protocols section is an extension of the Interfaces, and need to describe what is required for the system to operate.

Are all other ports turned off? Is there an onboard firewall that is turned on to only allow allows those specific ports? If so, what is the application and version?

PHI/PII

Do not modify standard language other than to state system name where applicable. Fill out form dd2930 that was sent as part of the initial package.

<SYSTEM NAME>

For US Air Force Information Assurance System Description Provide a system description of what the system is/does to include:

1. Capabilities summary (system is connected to patient to monitor vital signs, and sends to an accredited PACS)

a. Include a description of what the technology is/does.

i. I.E. “Computed axial tomography (CAT or CT scanning) is a medical imaging procedure that utilizes computer-processed X-rays to produce tomographic images or 'slices' of specific areas of the body. These cross-sectional images are used for diagnostic and therapeutic purposes in various medical disciplines. Digital geometry processing is used to generate a three-dimensional image of the inside of an object from a large series of two-dimensional X-ray images taken around a single axis of rotation”

2. INCLUDE FDA CERTIFICATION NUMBER AND CLASS OF DEVICE (i.e. This is an FDA Class II Medical device (510k number 12345).)

3. INCLUDE LINK TO THE PRODUCT IN THE DESCRIPTION

4. EMBED AN IMAGE OF THE SYSTEM

a. EMBED AN EXAMPLE OF THE TYPES OF IMAGES THAT IT TAKES EXAMPLE TEXT: The Digital Radiography (DR) system is a digital mammography system designed to perform screening examinations as well as diagnostic views by its imaging and analysis system. It eliminates the need for film cassettes and takes advantage of digital technology, including on-screen image display, networking, filming and archiving. Communication between the unit and other information providers takes the form of dataflows. Each dataflow defines the transfer of patient information and images from an input source to the unit, and from the unit to one of several output sources.Figure 1: Flux Capacitor 1.21 Jigiwatt v.3

Figure 2: Images captured by Flux Capacitor

Hardware/Software List all the hardware and software required for the system to operate:

EXAMPLE TEXT: The system consists of a controller PC with Windows 7, and the proprietary scanning software. A scanning gantry is attached to the controller PC via a RS-232 serial connection. Anti-virus software is permitted and is installed by the MTF upon arrival. Security patches are tested, approved and released by the vendor. An embedded database is utilized for temporary storage of patient data. Only the software has direct access to the database tables, and the tables are encrypted.

Hardware Hardware Minimum Requirements

Software (*******LIST ALL SOFTWARE. FAILURE TO DISCLOSE SPECIFICS MAY RESULT IN FAILED TESTING AND ADDITIONAL SECURITY REQUIREMENTS. ******) Software

System Usernames and Roles User Names and Roles

Patching Policy:

List what the patching policy is for the system, can it only be patched after vendor review?

Interfaces List connections

1. Wireless

2. DICOM Communications

3. Standalone

4. Sends to Accredited System

5. List any Firewall Information, or other Security Design considerations.

EXAMPLE TEXT: The system is DICOM compliant, allowing it to be connected to a network with other compliant devices for the exchange of images. Networking allows transmission of images acquired to other DICOM compatible review stations. A list of all patients ever imaged can be kept on the Radiology PACS making future retrievals fast and easy.

System connects to the network through an 802.11 wireless network card, running WPA-2, AES 256 bit encryption. The network interface only allows DICOM connections to specific clinical systems such as a Radiology PACS, console workstation image viewer, or printer. Patient demographic data will be received via DICOM, acquired images will be sent to the Radiology PACS or DICOM workstations via hardwired connection only for detailed viewing and long term storage.

Workflow (**** Make sure to note the exact workflows for the system, and the communication paths being used.).

EXAMPLE TEXT: <SYSTEM NAME> receives patient demographics and study details, PII, via the DICOM Modality Work list (DMWL) from an Accredited PACS system. The PACS and CHCS have an interconnection that provides the patient demographics to the PACS, which in turn provides the DMWL. When the <SYSTEM NAME> queries the PACS for Modality Worklist, the acquired images from <System Name> are sent to the PACS for subsequent archiving (<SYSTEM NAME> only stores the patient image temporally and then it is purged).

STANDARD LANGUAGE:

The <SYSTEM NAME> will be configured to be plugged into the Hospital network via an Ethernet/Fast Ethernet connection, configured within a VLAN to isolate network traffic to only those systems required for communication. It is the responsibility of the hospital or base network administrators to properly configure the VLAN and apply the correct Access Control Lists (ACL) for network traffic. The <SYSTEM NAME> will communicate and logically connect directly to an <DICOM SYSTEM IT CONNECTS TO> over DICOM communication on port 104. ALL OTHER CONNECTION MECHANISMS WILL NOT BE PERMITTED FOR USE WITHIN THE AIR FORCE, AND WILL BE DISABLED BY THE VENDOR.

Ports and Protocols Below is a table listing all Ports and Protocols used on the system. (IF a firewall exists: All other ports will be blocked by XXXXXXX Firewall.)

Protected Health Information/Personal Identifiable Information

STANDARD LANGUAGE:

Protected Health Information (PHI) is “Individually identifiable health information” that is transmitted or maintained by electronic media or is transmitted or maintained in any other form or medium. PHI is health information (including demographic information collected from an individual) that:

· Relates to the past, present or future physical or mental health or condition of an individual, the provision of health care to an individual; or the past, present or future payment for the provision of health care to an individual.

· Identifies the individual, or provides a reasonable basis to believe that the information could be used to identify the individual.

All reasonable measures must be taken to protect the confidentiality, integrity, and availability of any PHI within the system. Safeguards include defense in depth, tiered approaches, including personnel security screening, locked doors, network security safeguards, as well as techniques deployed on the system itself, including password protection, and where applicable, encryption techniques.

The individuals covered by <SYSTEM NAME> are persons treated in an Air Force Medical facility and active duty members for whom primary care is provided.

The purpose of collecting the patient information is used to coordinate the health care of patients; evaluate care rendered. The routine uses of records maintained are used and reviewed by health care providers in the performance of their duties. Health care providers include military and civilian providers assigned to the medical facility where care is being provided. Routine uses also contain individually identifiable health information.

<SYSTEM NAME> falls under F044 AF SG E Medical Records SORN.

Per M-03-22, OMB Guidance for Implementing the Privacy Provisions of the E-Government Act of 2002, please fill out form dd2930 (DoD PRIVACY IMPACT ASSESSMENT (PIA)) and send back immediately to your system analyst.

NOTE (DO NOT MODIFY LANGUAGE): The accreditation for this system is for this configuration only. Any deviation, or change to the configuration will invalidate the accreditation, and will result in the site assuming ALL security responsibilities for the system.

image2.jpeg image1.jpeg