IT Interconnection Agreement - SAS_Template_Final.pdf

IHS Security Agreement Summary

Purpose What is the business or medical purpose for entering into this agreement?

The purpose of this security agreement summary is to establish procedures for mutual cooperation and coordination between the Indian Health Service (IHS), an agency of the United States Department of Health and Human Services (HHS), and (hereinafter known as “both parties”). These procedures identify and prescribe information security safeguards and responsibilities required to establish:

A network interconnection security agreement (ISA) between the IHS and

A data exchange agreement (DEA) between the IHS and

This SAS is intended to minimize security risks and ensure the confidentiality, integrity, and availability (CIA) of information owned by either IHS or that is shared or transmitted through the network interconnection.

Services Describe the nature of the information services (e.g. Email, Secure File Transfer Protocol (FTPS), database query, file query, general computational services, etc.) offered over the interconnected system by each participating organization.

Contract # Official Use Only – Sensitive

Classification of Data What types of data are being transmitted or exchanged as part of the agreement?

System or Data Flow Diagram(s) Use the IDEAS ticket Attach File function to attach the appropriate diagram for the agreement.

For an ISA: At a minimum, attach a diagram with an explanation of each directly connected interface, including the classification of the data, the protocol used, the direction (in-bound, outbound, or both) and hosting network/environment when applicable. Identify the exterior boundary/gateway for each system. An external interface is any data path between a point within the security boundary and a point outside the security boundary. Cross-domain solutions require additional documentation. Note the direction of data flows within the boundary.

For a DEA: Attach a data flow diagram with an explanation of how the information is shared and stored, and procedures for handling federally protected data, such as PHI/PII.

Proposed Standard Configuration Provide answers to help determine the overall technical risk and suggested security controls to mitigate risk to IHS.

Data Type IHS Host

Connection Type (ISA Only)

Data Exchange Medium (DEA only)

Data Categorization

System Categorization

FIPS-Compliant Encryption Type (Minimum AES-128) FIPS-Compliant Hash Type (Minimum SHA-256)

Will PHI/PII be transmitted or shared between IHS and ? YES NO

IHS HQ Architecture & Engineering Team

A&E Team Reviewer Name:

A&E Team Reviewer Signature:

IHS HQ Security Agreement Team

SA Team Reviewer Name:

SA Team Reviewer Signature:

Contract # Official Use Only - Sensitive

Area/Site Connections Which Area offices and sites will be connected/sharing data as part of this agreement?

Attach an addendum if more rows are needed.

IHS Area/Site Connected IHS Device Connected Date Connected

Currently Connected?

IP Addresses, Ports, and Protocols If this agreement includes a persistent connection, what IP addresses, ports, and protocols will it use? Attach an addendum if more rows are needed.

*Note: IP addresses are not applicable to a Data Exchange Agreements*

Official Use Only – Sensitive

Source IP Address Destination IP Address Ports Protocols

Contract #

Contact Information Who are the contract Points of Contact associated with this agreement?

Contract No.

IHS Management Contacts

Contact Information Contract Officer’s Representative Information

Name

Email

Phone Number

Contact Information Project Manager Information

Name

Email

Phone Number

Contact Information Backup Project Manager Information

Name

Email

Phone Number

Contact Information Area ISSO Information

Name

Email

Phone Number

Contact Information IHS HQ Security Information

Name

Email

Phone Number

Contact Information IHS Network Security Contact Information

Name

Email

Phone Number

Contact Information Business Associate Program Manager Information

Name

Email

Phone Number

Contact Information Business Associate Back-up Program Manager Information

Name Email Phone Number

Contact Information Business Associate Technical Contact #1 Information

Name

Email

Phone Number

Contact Information Business Associate Technical Contact #2 Information

Name

Email

Phone Number

Signatures IHS Management

Name:

Title:

Date:

Signature:

IHS Information Security

Name:

Title:

Date:

Signature:

Name:

Title:

Date:

Signature:

Name:

Title:

Date:

Signature:

{Sample: Acme MedWidgets will use a virtual private network (VPN) interconnection to provide remote support, updates, and patch installations. Acme MedWidgets will also provide IHS Clinic A software updates and technical support to the endoscopy workstations and servers.} Classification of Data: Replace the sample below with narrative description of the data that will be transmitted or shared.

Sample: Acme MedWidgets will access IHS RPMS or EHR data, which may contain personally identifiable information (PII) or protected health information (PHI). This data is classified as High.