GE Healthcare VA National MOU ISA 2021.03.22 - Fully Signed and Executed with Appendix A Addendum and Annual Reviews 2022 2023 2.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

FOR OFFICIAL USE ONLY

O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Appendix A: Points of Contact

List of Responsible Parties for Each System:

Name Company Title Office Phone Email VA Enterprise Security Operations, Business Requirements Division (BRD)

VA VA Information Systems Security Representative (ISSO)

OITITOPSSOESOMOUISARE

QUESTS@va.gov

Rodney Ingram GE Healthcare

Security & Privacy Compliance Manager

(814) 330-9350 Rodney.ingram@ge.com

Terri Duket GE

Commercial Support Manager

(414) 721-3175 Terri.duket@med.ge.com

GE Healthcare Services

GE

Service Support Line (800) 437-1171

Specialized Device Security Division

VA vafsshisd@va.gov

Helen Stewart GE

General Manager, Strategic Relationship Channel

(303) 859-8610 Helen.Stewart@med.ge.com

John Dunn GE

Executive Cyber Security

(414) 526-4516 John.Dunn@med.ge.com

Nestor Rivera

Chief Privacy Counsel (847) 521 6275 Nestor.Rivera@ge.com

Tanya L.

Gonzales

VA System Owner (214) 274-4551 Tanya.Gonzales@va.gov

List of Responsible Parties to Contact during a Security Incident:

Cybersecurity Operations Center*

VA CSOC Support Desk (855) 673-4357

Special Device

* Note: VA-CSOC should only be contacted by VA personnel.

mailto:Rodney.ingram@ge.com mailto:Terri.duket@med.ge.com mailto:vafsshisd@va.gov

Appendix A: Points of Contact i O F F I C E O F I N F O R M A T I O N S E C U R I T Y E - 7 4 2

MEMORANDUM OF UNDERSTANDING AND

INTERCONNECTION SECURITY AGREEMENT

Between Department of Veterans Affairs

And GE Healthcare

July 14, 2020 Version 3.0 i i O F F I C E O F I N F O R M A T I O N S E C U R I T Y

DOCUMENT CONTROL CHANGE SHEET

Date Filename/Version # Authors Revision Description

02/08/2010 Department of Veterans Affairs and GE Healthcare

ISA/MOU

Yackley / McCormick GE Healthcare content revisions

04/29/2013 Department of Veterans

ISA MOU Version 1.0

Yackley / McCormick 3-year renewal using separate MOU and

ISA

06/03/2016 Department of Veterans

ISA MOU Version 2.0

Crystal White (VA) Terri Duket (GE Healthcare)

Renewal created HISD Template

07/14/2020 GE Healthcare VA National MOU

ISA 3.0

Steven Hughes (VA) Terri Duket (GE Healthcare)

Renewal major updates per 2018 annual review i i i O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Table of Contents

EXECUTIVE SUMMARY

1 INTRODUCTION

1.1 Overview and Purpose

1.2 Authority

2 MEMORANDUM OF UNDERSTANDING

2.1 Background

2.2 Communications

2.2.1 Security Incidents

2.2.2 Disasters and Other Contingencies

2.2.3 Material Changes to System Configuration

2.2.4 New Interconnections

2.2.5 Personnel Changes

2.2.6 Security

2.2.7 Cost Considerations

3 INTERCONNECTION SECURITY AGREEMENT

3.1 Background

3.1.1 System Description

3.1.2 System Hardware and Software Requirements

3.2 System Security Considerations

3.2.1 System Security Documentation

3.2.2 General Information/Data Description

3.2.3 Services Offered

3.2.4 Information Systems Security Officer at Interconnection Site

3.2.5 Sensitivity Categorization

3.2.6 User Community

3.2.7 Information Exchange Security

3.2.8 Trusted Behavior Expectations

3.2.9 Formal Security Policy

3.2.10 Audit Trail Responsibilities

3.2.11 Security Parameters

3.2.12 Training and Awareness

3.3 TOPOLOGICAL DRAWING

4 DURATION

i v O F F I C E O F I N F O R M A T I O N S E C U R I T Y

5 SIGNATORY AUTHORITY

APPENDIX A: POINTS OF CONTACT

APPENDIX B: QUESTIONNAIRE – TRANSMISSION OF VA OWNED SENSITIVE INFORMATION

UTILIZING A SYSTEM INTERCONNECTION

APPENDIX C: VA ANNUAL REVIEW DOCUMENTATION

APPENDIX D: DEFINITIONS OF SENSITIVE INFORMATION TYPES

APPENDIX E: INTERCONNECTION PORTS AND PROTOCOLS

1 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

EXECUTIVE SUMMARY

The purpose of this agreement is to establish a management agreement between the Department of Veteran’s Affairs (VA) and GE Healthcare regarding the management, operation, and security of a connection between the GE Healthcare Systems, owned by the VA, and the GE Healthcare OnLine Center, owned by GE Healthcare. The purpose of the interconnection is to provide technical support services to include: software updates, maintenance, and troubleshooting of the GE Healthcare systems.

The Department of Veteran’s Affairs (VA) utilizes a Memorandum of Understanding (MOU) to document the terms and conditions for sharing data and information resources in a secure manner. The following supporting information within the MOU will define the purpose of the interconnection, identify relative authorities, specify the responsibilities of both organizations, and define the terms of the agreement. Additionally, the MOU provides details pertaining to apportionment of cost and timeline for terminating or reauthorizing the interconnection.

Technical details on how the interconnection is established or maintained are included within the Interconnection Security Agreement (ISA). A system interconnection is a direct connection between two or more information technology (IT) systems for the purpose of sharing data and other information resources. VA uses the ISA to formally document the reasons, methodology, and approvals for interconnecting IT systems; to identify the basic components of an interconnection; to identify methods and levels of interconnectivity; and to discuss potential security risks associated with the interconnections.

2 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

1 INTRODUCTION

1.1 Overview and Purpose

The ISA specifies the technical and security requirements of the interconnection and the MOU defines the responsibilities of the participating organizations.

This MOU/ISA between the organizations listed below supersedes all previous MOU/ISAs pertaining to the interconnection described below. The last MOU/ISA was authorized on April 29, 2013. This publication supersedes all previously published MOU/ISAs pertaining to the interconnection described below.

This document does not replace the existing contract(s) between VA and GE Healthcare. Key VA Personnel have reviewed the contract and determined it meets the necessary VA Requirements. This fully executed agreement will be documented in applicable security controls in the current Governance and Risk Compliance tool and will be maintained as evidence for the respective system(s).

The purpose of this agreement section is to establish a management agreement between VA and GE Healthcare regarding the development, management, operation, and security of a connection between GE Healthcare Systems, owned by VA, and GE Healthcare OnLine Center, owned by GE Healthcare.

This agreement will govern the relationship between VA and GE Healthcare, including designated managerial and technical staff, in the absence of a common management authority.

1.2 Authority

The authority for this interconnection is based on:

• Federal Information Security Modernization Act of 2014 (FISMA 2014)

• VA Directive 6500, Managing Information Security Risk: VA Cybersecurity Program, and Handbook 6500, Risk Management Framework for VA Information Systems: Tier 3 – VA Cybersecurity Program Health Insurance Portability and Accountability Act (HIPAA) Security Rule, 45 C.F.R. Part 160

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems

• 38 United States Code (U.S.C.) §§ 5721-5728, Veteran’s Benefits, Information Security

• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource

• 18 U.S.C. 641 Criminal Code: Public Money, Property or Records

• 18 U.S.C. 1905 Criminal Code: Disclosure of Confidential Information

The authority for VA to share data for the purpose outlined under this Agreement with the recipient is as follows:

• Privacy Act of 1974, 5 U.S.C. § 552a, Patient Medical Record- VA 24VA 10P2; Routine Use #29

• VA Claims Confidentiality Statute, 38 U.S.C § 5701

• HIPAA Privacy Rule, 45 C.F.R. Part 164

• Confidentiality of Certain Medical Records, 38 U.S.C. § 7332

3 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

• Confidentiality of Healthcare Quality Assurance Review Records, 38 U.S.C. § 5705

• Freedom of Information Act (FOIA), 5 U.S.C. § 552

2 MEMORANDUM OF UNDERSTANDING

2.1 Background

It is the intent of both parties to this agreement to interconnect the following IT systems in order to exchange data between the GE Healthcare Systems and the GE Healthcare OnLine Center. VA requires the use of the GE Healthcare OnLine Center, and GE Healthcare requires the use of the GE Healthcare Systems via an interconnection as approved and directed by the Office of Information and Technology (OIT) System Owner. The expected benefit of the interconnection is to expedite the processing of data associated with remote diagnostics, maintenance, monitoring, and repair for the GE Healthcare Systems within prescribed timelines.

Each IT system is described below:

• The GE Healthcare Systems

GE Healthcare Systems

– Function Broad range of healthcare functions to include the following:

o Diagnostic Imaging to include but not limited to: Magnetic Resonance Imaging (MRI), Computed Tomography (CT), Radiology (X-RAY), Mammography, Interventional and Radiography & Fluoroscopy (R&F), Nuclear Medicine, Positron Emissions Tomography (PET), and Ultrasound.

o Systems from other manufacturers which are serviced by GE Healthcare (also known as Multi-Vendor) to include but not limited to Diagnostic Imaging and Biomedical Services.

o Healthcare IT to include but not limited to Centricity (Picture Archiving Communication System (PACS)/Radiology Information System (RIS)/Central Visual Information System

(CVIS).

o Patient Monitoring to include but not limited to Life Care Solutions and Patient Care Solutions. (for example CARESCAPE Gateway) o Surgical Imaging

– Location Numerous VA Healthcare Centers located throughout the United States.

– Description of data to be transmitted from VA to GE Healthcare including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level:

• Information Type Transmitted: Limited data sets with specific protected health information

(PHI) elements depending on application, such as: patient name, date of birth (DOB), record ID, images, waveforms, and gender.

• Data Flow Description: Service-specific data to perform remote support will be transmitted from the GE Healthcare Systems on the VA network to GE Healthcare OnLine Support Center via VPN tunnel.

• The FIPS 199 Sensitivity Categorization Level is Moderate.

o Confidentiality – Moderate

4 O F F I C E O F I N F O R M A T I O N S E C U R I T Y o Integrity - Moderate o Availability – Low

• The GE Healthcare OnLine Center

– Name

• The GE Healthcare OnLine Center

– Function Remote support function

– Location GE Healthcare OnLine Center, 8200 West Tower Ave., Milwaukee WI 53223-3219

– Description of data to be transmitted from the GE Healthcare to VA including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level:

• Information Type Transmitted: GE currently utilizes the connection for providing software configuration changes and updates, maintenance, and troubleshooting of the GE Healthcare systems, so updates are tranmistted on an as-needed basis. Other data traversing the connection include system performance data and clinical information (both anonymized & identifiable).

• Data Flow Description: A remote operator employed by GE Healthcare will initiate an interconnection to GE Healthcare OnLine Center on VA network for technical and clinical application remote support using iLinq

• The FIPS 199 Sensitivity Categorization Level is Low o Confidentiality – Low o Integrity - Low o Availability - Low

2.2 Communications

Frequent formal communications are essential to ensure the successful management and operation of the interconnection agreement. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. Communications described herein must be conducted in writing (mail or email, excluding any sensitive VA information) unless otherwise noted.

The owners of GE Healthcare Systems and the GE Healthcare OnLine Center agree to designate and provide contact information for the technical lead(s) for their respective system, and to facilitate direct contact between technical leads to support the management and operation of the interconnection (See Appendix A). To safeguard the confidentiality, integrity, and availability of the connected systems and the data stored, processed, and transmitted, the parties agree to provide notice of specific events within the timeframes indicated below.

2.2.1 Security Incidents

VA Handbook 6500.2, Management of Data Breaches Involving Sensitive Personal Information (SPI) governs the reporting of incidents involving VA systems and information. If GE Healthcare’s employee, contractor, or agent becomes aware of the theft, loss or compromise of any device used to transport, access, or store VA sensitive information or data (See Appendix D); such employee, agent, or contractor must immediately report the incident to the VA Points of Contact (POC) listed within Appendix A, or in the Business Associate Agreement (BAA) or contract when applicable, so that the incident can be reported to the VA Cybersecurity Operations Center (VA-CSOC) for action. Should any security incident or event (or suspected incident or event) involve VA owned sensitive information (e.g. the theft, loss, 5 O F F I C E O F I N F O R M A T I O N S E C U R I T Y compromise, or destruction of any device used to transport, access, or store VA sensitive information/data) covered by this agreement, or the incident places VA sensitive information/data at risk of loss, unauthorized access, misuse or compromise, then GE Healthcare will notify the VA POC listed within Appendix A, or in the BAA or contract when applicable, by phone or in writing (mail or email) immediately upon detection. The VA POC will immediately notify VA’s Information Systems Security Officer (ISSO) or Privacy Officer (PO) who will contact VA-CSOC within one hour of notification (See Appendix A).

GE Healthcare will provide details of the security event, the potential risk to VA owned sensitive information, and the actions that have been or are being taken to remediate the issue. Activities that will be reported include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. GE Healthcare will also provide VA with a written closing action report once the security event or incident has been resolved. VA will follow this same notification process should a security event occur within the VA boundary involving GE Healthcare’s provided data. Designated POCs will follow established incident response and reporting procedures, determine whether the incident warrants escalation, and comply with established escalation requirement for responding to security incidents.

2.2.2 Disasters and Other Contingencies

Technical staff will immediately notify their designated counterparts listed within Appendix A by telephone or email in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

2.2.3 Material Changes to System Configuration

Planned technical changes to the system architecture will be reported to technical staff before such changes are implemented. Prior to implementing a change, the System Owner, with assistance from the ISSO and PO, will conduct a risk assessment (RA) based on the new system architecture and determine if the proposed change requires reauthorization of the interconnection. Formal reauthorization is required whenever a system undergoes a significant change and the MOU/ISA must be modified and re-signed within one (1) month of implementation. Points of Contact are listed in Appendix A.

A significant change to an information system may include changes to the system itself or to the environment of operation. Significant changes to the information system may include, but are not limited to: installation of a new or major upgrades to the operating system, middleware component, or application; modifications to system ports, protocols, or services (See Appendix E); installation of a new or upgraded hardware platform; modifications to cryptographic modules or services; or modifications to security controls. Significant changes to the environment of operation which must materially impact the interconnection to require reporting, may include, but are not limited to: moving to a new facility;

adding new core missions or business functions; acquiring specific and credible threat information that the organization is being targeted by a threat source; or establishing new or modified laws, policies or regulations. Major changes to the information collected or maintained are those changes that could result in greater disclosure of information or a change in the way personal information/data is used.

2.2.4 New Interconnections

The initiating party will notify the other party at least one (1) month before it connects its IT system, described in Section 2.1, with any other IT system that materially impacts the security of the interconnection covered by this MOU/ISA. This includes connecting the IT system with systems that are owned and operated by third parties.

6 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

2.2.5 Personnel Changes

The parties agree to provide notification of the separation or long-term absence of their respective system owner or technical lead. In addition, both parties will provide notification of any changes in POC information. With respect to the system owner and technical lead, both parties also will provide notification of changes to user profiles, including users who resign or change job responsibilities.

The responsible parties for each system are listed in Appendix A of this MOU/ISA. The appendix will be updated as necessary. Updating the appendix does not require the re-signing of this MOU/ISA by either party. It is the responsibility of each respective approving authority to ensure the timely updating of this appendix and for the notification of such changes to the alternate party within thirty (30) days of any personnel change.

2.2.6 Security

Both parties agree to work together to ensure the joint security of the connected systems and the information/data stored, processed, and transmitted, as specified in the ISA section of this document.

By signing this agreement each party certifies that its respective system is designed, managed, and operated in compliance with all relevant Federal laws, regulations, and policies including those stated in Section 1.2.

2.2.7 Cost Considerations

Both parties agree to share the costs of the interconnecting mechanisms and/or media. Percentage of cost assumed by each organization (e.g., 50/50, 40/60, etc.) must be agreed upon in advance, and no such expenditures or financial commitments shall be made without the written concurrence of both parties. Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system owner’s organization.

3 INTERCONNECTION SECURITY AGREEMENT

3.1 Background

The technical details of the interconnection are documented in this ISA section of the document. The parties agree to work together to develop the ISA, and the MOU/ISA must be signed by both parties before the interconnection is activated. Proposed changes to either system or the interconnecting medium will be reviewed and evaluated to determine the potential impact to the interconnection. The MOU/ISA will be renegotiated before changes (identified in Section 2.2.4) are implemented.

Signatories to the MOU/ISA shall be the System Owner, ISSO and PO for each system. The document should become an integral piece of the VA Assessment and Authorization (A&A) documentation and should be included in subsequent authorization requests.

3.1.1 System Description

The interconnection between GE Healthcare systems, owned by VA, and GE Healthcare’s Online Center, owned by GE Healthcare, is a two-way path. The purpose of the interconnection is to provide technical support services including software updates, maintenance, and troubleshooting of the GE Healthcare systems and systems from other manufacturers which are serviced by GE Healthcare thereby improving VA ability to provide quality healthcare to patients on a timely basis. Supported products include:

7 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

• Diagnostic Imaging to include but not limited to: Magnetic Resonance Imaging (MRI), Computed Tomography (CT), Radiology (X-Ray), Mammography, Interventional and R&F, Nuclear Medicine, PET, and Ultrasound.

• Systems from other manufacturers which are services by GE Healthcare (also known as Multi- Vendor) to include but not limited to Diagnostic Imaging and Biomedical Services.

• Healthcare IT to include but not limited to Centricity (PACS/RIS/CVIS).

• Patient Monitoring to include but not limited to Life Care Solutions and Patient Care Solutions.

• Surgical Imaging.

The following data types are stored, collected, or disseminated with GE Healthcare’s Online Center:

system performance data, clinical information (both anonymized & identifiable), and software configuration changes in accordance with data handling practices in the Business Associate Agreement between GE Healthcare and VA. GE Healthcare will endeavor to collect limited data sets, wherever possible, depending on specific application and troubleshooting. The data types are obtained through file transfers, command line interfaces, and remote desktop applications. The following security controls are implemented during the transmission and storage of data: technical, administrative, and physical safeguards on servers and network appliances, multi-level user authentication, connection audit trails, and security/privacy awareness training. This is not a system of records and therefore does not need a system of records notice.

3.1.2 System Hardware and Software Requirements

• InSite 1.0 o An Internet Service provider (ISP) with a minimum of 500k bandwidth available.

o A compatible Site to Site Virtual Private Network (VPN) router with IPsec Tunneling and 3DES encryption (e.g. Cisco, Nortel, Checkpoint, Redcreek, Symantec, or another Compatible router).

o Use of firewall (GE Healthcare utilizes Cisco ASR 1002-X FIPS Cert #2409 o Static IP Address required added to the VPN Tunnel

• InSite 2.0/InSite ExC/RSVP Legacy product InSite 1.0 Site to Site VPN Tunnel to Internet o Dynamic IP addresses per VA System Policy can switch to Static IP Address to InSite 1.0 o The Agent always connects to a known IP address o Secure data transmission 128-bit or higher Secure Socket Layer (SSL) protocol, Port 443 o Data is encrypted during entire transmission to GE Healthcare

• iLinq is a support agent (appearing as a button in the user browser interface for applicable medical devices) designed to enable the user to open a support ticket as needed.

The above interconnection hardware and software requirements are existing and already in place. No additional hardware and/or software needs to be obtained.

3.2 System Security Considerations

3.2.1 System Security Documentation

Different institutions assess and document system security through a variety of methods (e.g., risk assessment (RA), security control assessment (SCA), contractor security control assessment (CSCA), or system security plan (SSP)). For VA systems, the system interconnection/information sharing aspect is an essential part of the SSP. Two sections in the SSP require documentation of interconnections:

8 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

• System Identification: The VA facility must identify and document the types of system interconnections and information sharing that is allowed within the system.

• Security Assessment and Authorization (CA-3): The VA facility must identify and document whether connections are authorized between the system and other systems outside the authorization boundary. The VA facility must also identify, document, and list external connections outside VA, as well as indicate information concerning the MOU/ISA. The VA facility must identify and document the appropriate officials designated to approve the information system agreements.

VA’s Network: VA IT systems undergo a Security Control Assessment by the VA Certification Program Office in support of Federal Information Security Management Act compliance, and received an Authority to Operate (ATO), issued by the VA’s Area Manager for Office of Information and Technology.

The VA does continuous monitoring of security controls as identified in VA Directive 6500 and VA Handbook 6500. The date of the last review of System controls is detailed in each VA Healthcare Systems’ System Security Plan (SSP).

The GE Healthcare OnLine Center, owned by GE Healthcare, is audited annually by our corporate audit staff. The most recent audit was completed in February 2020. The basis for the controls tested during the annual audit is the Office of Civil Rights (OCR) HIPAA Audit Protocol. GE Healthcare’s obligations with respect to the security and protection of PHI is also outlined in the Business Associate Agreement entered into between the parties dated February 19, 2013, which is incorporated by reference. GE Healthcare shall make available documentation including MDS2, VA 6550, and other information as required to support the VA’s system product review of security controls and assessment for authorizing such devices.

3.2.2 General Information/Data Description

The interconnection between VA’s System and GE Healthcare Systems is a two-way path. For sensitive information, see Appendix B for a detailed data description. For non-sensitive data, see Section 2.1 of the accompanying Memorandum of Understanding. Refer to the Topological Drawing and Appendix E for more details for Interconnection Ports and Protocols.

3.2.3 Services Offered

No user services are offered. This connection only exchanges data between VA and GE Healthcare via a dedicated in-house (VPN) connection, SSL tunneling. Using the Site-to-Site VPN connection, GE Healthcare OnLine Center will connect to the GE Healthcare systems for software upgrades and support using InSite 1.0, InSite 2.0, or InSite ExC. Listed in Appendix E. Where technically feasible the iLinq agent constitutes a button within the browser to assist users in opening support tickets.

3.2.4 Information Systems Security Officer at Interconnection Site There must be an established ISSO (or business partner equivalent) at all interconnection sites described herein, who can provide oversight through the duration of the system development lifecycle (SDLC) phases (development, deployment, operations, and disposal) of the interconnection and who can ensure that the systems maintain appropriate security controls. ISSO contact information is listed in Appendix A.

3.2.5 Sensitivity Categorization

The sensitivity categorization of information/data exchanged between VA and GE Healthcare is moderate, based on FIPS 199, Sensitivity Categorization of Federal Systems, and the guidance in

9 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

National Institute of Standards and Technology Special Publication (NIST SP) 800-60, Guide for Mapping Types of Information and Information Systems to Security Categories.

3.2.6 User Community

The minimum requirements for employees to work in support of this interconnection, to include background investigations and security clearances, will be determined by the contract(s) governing the support services provided by the vendor. GE Healthcare will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts and for continuously monitoring and tracking the status of all GE Healthcare employees relevant to this interconnection.

The GE Healthcare community authorized individuals are responsible for support during service events. Users include but are not limited to GE Healthcare approved Subcontractor and authorized agent who will access, exchange, and/or receive data across the interconnection as described in section 2.1.

3.2.7 Information Exchange Security

The security of the information being passed on this connection is protected through the use of FIPS 140-2 validated encryption implemented according to the specifications in the validated modules certificate, and if a successor FIPS encryption is adopted then GE Healthcare will move to that successor encryption within a reasonable timeframe. The connections at each end are located within controlled access facilities using physical access devices and/or guards. Individual users will not have access to the data except through the system security software inherent to the interconnection. All access is controlled by authentication methods to validate the approved users. The device manufactures FIPS 140-2 certificate number for the GE Healthcare’s gateway cryptographic module for establishing the VPN tunnel is cert#2409.

3.2.8 Trusted Behavior Expectations

VA's system and users are expected to protect the GE Healthcare OnLine Center, and GE Healthcare's system and users are expected to protect GE Healthcare Systems, in accordance with the Privacy Act and Trade Secrets Act (18 U.S.C. 1905), the Unauthorized Access Act (18 U.S.C. 2701 and 2710), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

3.2.9 Formal Security Policy

Directives or policies that govern the protection of the information/data include but are not limited to NIST documents; VA Directive 6500; VA Handbook 6500 (or successors); and the various GE Healthcare Policies that are available upon request.

3.2.10 Audit Trail Responsibilities

Both parties are responsible for auditing application processes and user activities involving the interconnection with sufficient granularity to allow successful investigation and possible prosecution of wrongdoers. Activities that will be recorded include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. Audit logs will be retained for a minimum of one (1) year or as documented in the National Archives and Records Administration (NARA) retention periods, HIPAA legislation (for Veterans Health Administration (VHA)), or whichever is greater. Audit logs which describe a security breach must be maintained for six (6) years. Those responsible for maintaining audit logs must ensure that audit logs are successfully stored for the required duration.

10 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

3.2.11 Security Parameters

VA implements the following security measures and controls:

• Patch management policy - VA utilizes automated patch management to keep VA IT equipment patched with the latest operating system and application updates. Reports are run regularly, and remediation is implemented for devices missing patches.

• Malware prevention policy (virus, spyware, etc.) - VA managed-internal systems have antivirus and antispyware software installed and is monitored for new infections. Management is centralized. Updates are done daily, or more frequently, if necessary.

• Audit policy - VA regularly audits the security controls (continuous monitoring) and compliancy towards VA policies. Plan of Action and Milestones are used to track deficiencies and remediation.

• Incident response / security breach notification policy - VA maintains a Computer Emergency Response Team and the VA Cybersecurity Operations Center (VA-CSOC monitors the VA network twenty-four hours a day seven days a week (24x7).

• User certification and authentication policy - User Access control is managed by strong authentication method and must be assigned on the "Least Privilege" principal. VA utilizes two

(2) factor authentication for all general users. A separate token and non-mail enabled account is required for users who requires elevated privileges on IT systems.

• Password Policy - VA requires a strong password with a minimum of 14 characters and users must change their password every sixty (60) days.

• Account Management - VA accounts are separated into domains and the system administrators only manage those accounts within their domain. Accounts are audited every ninety (90) days.

VA policy requires account termination within twenty-four (24) hour of an employee/contractor departure. Accounts are terminated immediately in the event of a hostile termination.

• Physical and environmental security policy - Physical and environmental controls are maintained at each VA facility. Badges are required for all employees and contract staff. OIT networking closets and computer room require authorization from the facility Area Manager and a log is maintained. VA computer rooms are environmentally controlled for operation of the equipment is contains. This includes power, network, heating, ventilation, and air conditioning (HVAC), and fire suppression.

• Firewall, IDS, and encryption policy- Intrusion detection systems (IDS) are in place at all gateways and throughout the VA network. The VA’s Cybersecurity Operations Center monitors the VA network twenty-four hours a day seven days a week (24x7). Suspicious activity is reviewed, and as needed recommendations are formulated and assigned to the system administrators. FIPS 140-2 encryption is required for transmission of sensitive information.

• Contingency Plans - A contingency and disaster recovery plan is in place for every VA IT system.

The plans are tested annually.

11 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

GE Healthcare OnLine Center and GE Healthcare Network implement the following security measures and controls:

• Patch management policy - identifies security configurations that are essential to creating a secure Windows, Linux, Mac client platform including enterprise asset inventory requirements, patching requirements, patch testing, patch criticality, patch deployment and reporting. GE Healthcare employs regular patching of service computing resources.

• Malware prevention / Virus Scanning policy - GE Healthcare employs hard-drive level encryption, virus scanning, software firewalls, active network monitoring and intrusion detection systems of service computing resources.

• Audit policy - Ensures that the implementation and operation of information security is assessed and monitored in accordance with organization policy documents including; operating systems, databases, applications, networks, and end-points for supporting critical IT systems, and externally-facing IT systems.

• Incident response / security breach notification policy - Sets the minimum baseline requirements for incident and problem management processes. Managing incidents and problems related to IT information systems is one of the primary ways GE mitigates risk to availability, integrity, and confidentiality of GE data. This includes an incident management process, workflow tools, incident escalation, incident resolution and notification, business response teams and responsibilities.

• User certification, identification and authentication policy - These controls consist of multi-level user authentication before access to customer systems, role-based access rights, and the granting of minimum necessary privileges for job requirements. Regular auditing of user accounts takes place, and all accounts are terminated immediately upon user departure from the organization and are reviewed upon role changes.

• Password policy - GEHC follows password policies consistent with NIST standards for controlling access by GEHC personnel to VA devices via remote service connectivity. Passwords are minimum 8 characters and are changed every 365 days.

• Account Management policy - Defines standard security control requirements for account management in order to secure GE resources and data against malicious or accidental misuse of accounts including; Identity Management Process and Procedures, Account Lifecycle Management Controls, Password Controls and emergency termination procedures.

• Physical and environmental security policy - Establishes a minimum baseline and general guidelines for the protection of Customer Connection Centers, including, people, facilities, data and systems therein as well as connections made to a GE Healthcare supported device from a GE computing device while connected to a non-GE network. The GE Healthcare Online Center provides a secure connection to VA networks through a logically separated environment. OLC computer and networking equipment are securely locked in an access-controlled Data Center which provides a secure badge reader access control system. The GE Security and Crisis Management Guidelines provide information for establishing a basic Security and Crisis Management (SCM) program for General Electric businesses in accordance with the GE Security and Crisis Management Policy of the Spirit & Letter http://www.gesustainability.com/how-ge-works/integrity-compliance/thespirit-the-letter/. GE Healthcare facilities require

12 O F F I C E O F I N F O R M A T I O N S E C U R I T Y authentication for access, and servers are located in data centers with reduced access and 24x7 monitoring. GE Healthcare holds an Uptime Institute Tier III Design Certification.

• Firewall, IDS, and encryption policy - Provides a set of minimum controls for secure configuration and management of firewall devices in order to protect GE’s information systems from intentional or accidental misuse including; minimal firewall policy requirements, inventory, enterprise management, logging, review, and administrative access requirements.

“Skybox” Enterprise Firewall Assurance is used to collect an aggregate view of all enterprise firewalls and assess firewall policy defined in this document. All interconnection two-way traffic is via site-to-site VPN tunnel which utilizes FIPS 140-2 certified encryption packages. Active monitoring of remote service traffic & usage is used to ensure security is not compromised.

• Contingency Plans - Sets the minimum baseline of requirements for application recovery processes as part of a broader disaster recovery strategy, not for operational recovery (e.g.

corrupt file). Managing application recovery related to IT information systems is one of the primary ways GE mitigates risk to availability and integrity of GE data including; critical system recovery, application level recovery, testing requirements, roles and responsibilities, and system backup requirements.

3.2.12 Training and Awareness

The training and rules of behavior requirements for employees to work in support of this interconnection will be determined by the contract(s) governing the support services provided by the vendor. GE Healthcare will be responsible for ensuring that their employees meet the standards set forth in all applicable contracts and for continuously monitoring and tracking the status of all GE Healthcare employees relevant to this interconnection.

13 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

3.3 TOPOLOGICAL DRAWING

14 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

4 Duration

This agreement will expire when one or both parties determine that the interconnection is no longer necessary or if there is no longer a business or contractual justification. If there is no longer a business justification and/or one or both parties determine that the interconnection is no longer necessary, then the interconnection will be decommissioned.

Annually the VA ISSO, along with the VA Business Owner, will review the agreement to ascertain 1) if the interconnection is deemed still necessary and 2) if there are any significant changes to the interconnection (see section 2.3.3 Material Changes to System Configuration). The outcome of the review will be documented in the review section, Appendix C: VA Annual Review. If there are significant changes to the interconnection at any time or if major changes were noted during the annual review, the agreement must be updated and re-signed.

If one or both of the parties wish to terminate this agreement prematurely, they may do so upon thirty

(30) days advanced notice or in the event of a security incident that necessitates an immediate response. Approval to decommission to must come from the VA Business Owner.

5 SIGNATORY AUTHORITY

We, the undersigned, mutually agree to the terms of thjs agreement.

VA System. Owner:

VA orr Attthorizing Official

Date ____ _

V , Information System Security Officer� Enterprise Security Operations Specialized Devfoe Security Division (SDSD) or System Security Support - Business Requirements Division

x. ____________ _ Date ____ _

As the Privacy Officer (PO) for this VA MOU/ISA I have determined that the legal authodties for sharing the data covered by this agreement exist and are appropriately addressed and the uses and disclosures of the data covered by this agreement are in accordance with VA and VHA directives. I concur with the privacy practices outlined in this VA MOU /ISA.

VHA Privacy Officer:

Veterans Health Administnttion, Privacy Office Mmagu

X _____________ Date ____ _ og Healthcare System Owner;

Helen Stewart General Man.ager, Sttategfo 11tt::!JAt1:.cH1tH.a1;y;, ·-;,,,,.I,,.,,,""'"""""'·"

GE Healthcare 1nti:Jrrn:at1<m Se,'\F"'i" .JohuDo:nn Executive Cyb{?;r Security x rJA1 £�,k:� 1/iy kq Zo

GE Healthcare Privacy Officer:

Chief Privacy Officer

15 OFFtCE OF !NFORiV1ATiON SECURITY

=- ZJWML rm I&

16 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Appendix A: Points of Contact

List of Responsible Parties for Each System:

VA Enterprise Security Operations, Business Requirements Division (BRD)

VA VA Information Systems Security Representative (ISSO)

OITITOPSSOESOMOUISARE

QUESTS@va.gov

Terri Duket GE

Commercial Support Manager

(414) 721-3175 Terri.duket@med.ge.com

Specialized Device Security

Helen Stewart GE

General Manager, Strategic Relationship Channel

(303) 859-8610 Helen.Stewart@med.ge.com

John Dunn GE

Executive Cyber

(414) 526-4516 John.Dunn@med.ge.com

Chief Privacy Counsel (847) 521 6275 Nestor.Rivera@ge.com

List of Responsible Parties to Contact during a Security Incident:

Cybersecurity Operations Center*

VA CSOC Support Desk (855) 673-4357

Special Device

* Note: VA-CSOC should only be contacted by VA personnel.

mailto:Rodney.ingram@ge.com mailto:Terri.duket@med.ge.com mailto:vafsshisd@va.gov

17 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Appendix B: Questionnaire – Transmission of VA Owned Sensitive Information Utilizing a System Interconnection

1. Description of Data: The following data types transmitted to GE Healthcare’s OnLine Center include system performance data, clinical information (both anonymized & identifiable), and software configuration changes. Service specific data to perform remote support, limited data sets with specific PHI elements depending on application such as patient name, DOB, record ID, images, waveforms, and gender will be transmitted from the GE Healthcare systems on the VA network to GE Healthcare OnLine Center.

This includes but is not limited to Protected Health Information (PHI), De-identified Information, Patient Identifiers and/or Unique Identifiers as defined in Appendix D.

2. Purpose for Data Transfer: For required services conducted as approved by the VA to expedite the processing of data associated with onsite and remote diagnostics, maintenance, monitoring, and repair by GE Healthcare’s OnLine Center for the VA.

3. Non-VA Storage Location of the Transmitted Information: GE Healthcare OnLine Center, 8200 West Tower

Ave., Milwaukee WI 53223-3219

4. Supporting Document(s) Describing the Transfer of the Data to the Recipient: Numerous VA – GE contracts

5. Provisions for Destruction or Return of the Data (if applicable): Provisions for securely destroying data include at a minimum, one or more of the following techniques, single or multiple pass overwrite of entire disk, physical destruction, or degaussing of drive, depending upon specific system and usage.

VA Directive 6500, January 23, 2019 NIST 800-88 (Revision 1) OIT/OIS SOP MP-6 Electronic Media Sanitization V 4.0 VA Media Sanitization Users Guide VA Hard Drive Destruction Portal Computer, server and/or peripheral equipment (i.e., printers, copiers, and multi-function devices (MFDs)) containing hard drives must be removed or sanitized before leaving VA control. For mobile devices, see the Mobile Device Disposal and Reuse Bulletin

VA Point of Contact: Steven Hughes, Contracting Officer Representative

X__________________________ Date __________

VA Information Systems Security Officer: Shaunna Ford, SDSD Information Systems Security Officer

X__________________________ Date __________ i O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Appendix C: VA Annual Review Documentation

VA ISSO signature is required for each annual review. During the annual review of this document, the ISSO should consult key stakeholders.

Fill in Change Status Column with following (Select all that apply)

1. No Change Required

2. Minor Change Required

3. Major Change Required

4. New Agreement

5. Change in POC

6. Other (please specify)

When a page is full, the ISSO should add another page.

Date of Review Change Status (Select all that apply)

Additional Comments

Signature(s)

19 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Appendix D: Definitions of Sensitive Information Types

The following discussion defines the various types of personal information collected, maintained, and used within VA and provides an overview of how they inter-relate. Every type is subject to VA security statutes (38 U.S.C. §§ 5721-28), as long as it identifies or could reasonably be used to identify an individual. Depending on the type of information, it may also be protected by the Privacy Act (5 U.S.C. § 552a), the VA confidentiality statutes (38 U.S.C. §§ 5701, 5705, and 7332), and the HIPAA Privacy and Security Rules (45 C.F.R. Parts 160, 164).

VA Sensitive Information/Data - All Department information and/or data on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information. The term includes not only information that identifies an individual but also other information whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary information, and records about individuals requiring protection under applicable confidentiality provisions. SOURCE: 38 U.S.C. § 5727.

Personally Identifiable Information (PII) - Any information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc. Information does not have to be retrieved by any specific individual or unique identifier (i.e., covered by the Privacy Act) to be personally identifiable information. SOURCE: Office of Management and Budget (OMB) Memorandum 07-16, Safeguarding Against and Responding to Breaches of Personally Identifiable Information (May 22, 2007)

NOTE: The term “Personally Identifiable Information” is synonymous and interchangeable with “Sensitive Personal Information.”

Sensitive Personal Information (SPI) - The term, with respect to an individual, means any information about the individual maintained by VA, including the following: (i) education, financial transactions, medical history, and criminal or employment history; and (ii) information that can be used to distinguish or trace the individual’s identity, including name, social security number, date and place of birth, mother’s maiden name, or biometric records. SPI is a subset of VA Sensitive Information/Data. SOURCE: 38 U.S.C. § 5727.

NOTE: The term “Sensitive Personal Information” is synonymous and interchangeable with “Personally Identifiable Information.”

Health Information - Health Information is any information, whether oral or recorded in any form or medium, created or received by a health care provider, health plan, public health authority, employer, life insurers, school or university, or health care clearinghouse or health plan that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or payment for the provision of health care to an individual. This encompasses information pertaining to examination, medical history, diagnosis, and findings or treatment, including laboratory examinations, X-rays, microscopic slides, photographs, and prescriptions. SOURCE: 45 C.F.R. § 160.103

Individually Identifiable Information (III) - Individually Identifiable Information is any information pertaining to an individual that is retrieved by the individual’s name or other unique identifier, as well as Individually Identifiable Health Information regardless of how it is retrieved.

20 O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Individually Identifiable Information is a subset of Personally Identifiable Information and is protected by the Privacy Act.

Individually Identifiable Health Information (IIHI) - Individually Identifiable Health Information is a subset of Health Information, including demographic information collected from an individual, that: (1) is created or received by a health care provider, health plan, or health care clearinghouse (e.g., a HIPAA-covered entity, such as VHA); (2) relates to the past, present, or future physical or mental condition of an individual, or provision of or payment for health care to an individual; and (3) identifies the individual or where a reasonable basis exists to believe the…