J and A.pdf

Contract Opportunity

Justification and Approval Notice

PRODUCT SERVICE CODE *

SUBJECT *

CONTRACTING OFFICE'S *

ZIP-CODE

SOLICITATION NUMBER

DELIVERY/TASK ORDER NUMBER

(Required when using Statutory Authority FAR 6.302-1(c))

BASE NOTICE TYPE

ARCHIVE DAYS AFTER THE POSTING DATE

RECOVERY ACT FUNDS

NAICS CODE *

CONTRACTING OFFICE

ADDRESS

DESCRIPTION See Attachment

POINT OF CONTACT *

(POC Information Automatically Filled from User Profile Unless Entered)

STATUTORY AUTHORITY *

AWARD NUMBER *

(Not required when using Statutory Authority FAR 6.302-1(c))

MODIFICATION NUMBER

AWARD AMOUNT *

LINE ITEM NUMBER

AWARD DATE (MM-DD-YYYY) *

(Not required when using Statutory Authority FAR 6.302-1(c))

AWARDEE NAME *

AWARDEE ADDRESS LINE 1 *

AWARDEE ADDRESS LINE 2 *

AWARDEE ADDRESS LINE 3 *

AWARDEE ADDRESS LINE 4 *

AWARDEE CITY

AWARDEE STATE

AWARDEE ZIP CODE

AGENCY'S URL

URL DESCRIPTION

AGENCY CONTACT'S EMAIL

ADDRESS

EMAIL DESCRIPTION

AWARD INFORMATION

ADDITIONAL INFORMATION

GENERAL INFORMATION

* = Required Field Contract Opportunity Justification and Approval Notice

D319

691-21-1-188-0003|NEW Reqmnt| Labor-Mgt Software from GSA

(VA-21-00002950)

90815

36C26221F0030

N

541519

Department of Veterans Affairs Network Contracting Office 22 4811 Airport Plaza Drive Suite 600 Long Beach CA 90815

GS35F0408X

$70,200.00

10-21-2020

ACUSTAF DEVELOPMENT CORP

7601 FRANCE AVE

MINNEAPOLIS

MN

55435

VHAPM Part 808.405-6 Limiting Sources Justification for Limiting Sources for Micro-Purchase Threshold up to the SAT

VHAPM Part 808.405-6 Limiting Sources Page 1 of 3 Original Date: 08/30/2017 Revision 02 Eff Date: 02/21/2020

DEPARTMENT OF VETERANS AFFAIRS

FAR 8 – Justification for Limiting Sources (LSJ) For

Limiting Sources (<SAT)

Acquisition Plan Action ID:___36C262-20-AP-6186_______________

1. Contracting Activity: Department of Veterans Affairs, VISN 22, Long Beach 600 Medical

Center VA Long Beach 600. PR 691-21-1-188-0003.

2. Description of Action: This requirement is for the continuation of the scheduling/staffing computer software application services.

Period of Performance: 10/21/2020- 10/20/2021

Order against: FSS Contract Number: ______ GS35F0408X_________________

Name of Proposed Contractor: ACUSTAF DEVELOPMENT CORP Street Address: 7601 FRANCE AVE City, State, Zip: MINNEAPOLIS MN 55435 Phone: 952-456-6708

3. Description of Supplies or Services:

The estimated value of the proposed action is $ 70,200

This requirement is for the scheduling/staffing computer software Application, which is a solution to automate scheduling and staffing processes; provides decision support for staff assignments based on the objective and variable data supposed to the best estimates. This system gives Nurse Executives the tools to manage their workforce. Multiple standardized reports are needed as well as the ability to create ADHOC reports. Failure to purchase this scheduling/staffing software will cause a negative impact to the care of the veteran patients.

The end user conducted market research by researching GSA, Internet search and inquiry through the VA Organizations throughout the US. 70 VA Organizations currently use the staffing software. The proposed procurement for the AcuStaf services were found to be available from only one source at this time. It is critical that the organization have a continuity to their scheduling/staffing as procuring a different software would not be cost effective. Other vendors are averaging approximately $200,000 more than our current

VHAPM Part 808.405-6 Limiting Sources Page 2 of 3

Revision 02 Eff Date: 02/21/2020 contract. In addition to this there would be the additional cost of training approximately 2,000+ end users on a new staffing software.

Additionally, the Contract Specialist published a Request For Information (RFI) in Contract Opportunities on 10/05/2020, 4 responses were received but only one vendor (AcuStaf Development Corporation) met all the Salient Characteristics in the Statement of Work and provided all the required documentation to meet this requirement.

4. Authority:

Order Against FSS: Authority of the Multiple Award Schedule Program, Title III of the Federal Property and Administrative Services Act of 1949 (41 USC 251, et seq.); Title 40 USC 501, Services for Executive Agencies; and Section 803 of the National Defense Authorization Act of 2002 (PL 107-107) and implemented by FAR 8.405-6. Mark the applicable exception:

An urgent and compelling need exists, and following the procedures would result in unacceptable delays(FAR 8.405-6(a)(1)(i)(A);

Only one source is capable of providing the supplies or services required at the level of quality required because the supplies or services are unique or highly specialized;

(FAR 8.405-6(a)(1)(i)(B));

In the interest of economy and efficiency, the new work is a logical follow-on to an original Federal Supply Schedule order and the original order was placed in accordance with the applicable Federal Supply Schedule ordering procedures. The original order was not previously issued under sole-source or limited-sources procedures (FAR 8.405- 6(a)(1)(i)(C)); or

Items peculiar to one manufacturer. An item peculiar to one manufacturer can be a particular brand name, product, or a feature of a product, peculiar to one manufacturer). A brand name item, whether available on one or more schedule contracts, is an item peculiar to one manufacturer (FAR 8.405-6(b)).

5. Rationale/explanation to support cited authority: The Nursing & Patient Care Services of the VA Greater Los Angeles (VAGLA) requests to continue services form AcuStaf Scheduling/Computer Software Program through limited source procurement citing it provides a custom product to Veterans Health Administration, capable of responding due to the unique and specialized product, (FAR 8.405-6(a)(1)(i)(B)). AcuStaf is the Original equipment Manufacturer (OEM) and sole distributor of the AcuStaf Software Application and provided a Proprietary Letter on 10/05/2020. This requirement will be firm fixed price order for services under contract GS-35F-0408X. This requirement will provide the necessary comprehensive and systematic counting of nursing workload. Staffing requirements and scheduling needs to meet federal law and other regulatory requirements.

https://www.acquisition.gov/content/part-8-required-sources-supplies-and-services https://www.acquisition.gov/content/part-8-required-sources-supplies-and-services https://www.acquisition.gov/content/part-8-required-sources-supplies-and-services https://www.acquisition.gov/content/part-8-required-sources-supplies-and-services https://www.acquisition.gov/content/part-8-required-sources-supplies-and-services

VHAPM Part 808.405-6 Limiting Sources Page 3 of 3

Revision 02 Eff Date: 02/21/2020

The AcuStaf Software Application has an approved VA Memorandum of Understanding and Interconnection Security Agreement between the Department of Veterans Affairs and AcuStaf Development Corporation (MOU & ISA). The MOU & ISA gives authority to disclose VA data per this agreement must comply with disclosure authority under each of the below applicable statutes:

Privacy Act of 1974, 5 U.S.C. § 552a VA Claims Confidentiality Statute, 38 U.S.C § 5701 HIPAA Privacy Rule, 45 C.F.R. Part 164 Confidentiality of Certain Medical Records, 38 U.S.C. § 7332 Confidentiality of Healthcare Quality Assurance Review Records, 38 U.S.C. § 5705 Freedom of Information Act (FOIA), 5 U.S.C. § 552

Also, the AcuStaf Software Application meets the requirements of VA Directive 1351 Staffing Methodology and VA Directive 6500, Managing Information Security Risk: VA Information Security Program, and Handbook 6500, Risk Management Framework for VA Information Systems: Tier 3 – VA Information Security Program.

6. Note that this determination satisfies the requirements of FAR 8.405-6. The requirement to prepare a written justification IAW FAR 6.303 does not apply to Federal Supply Schedules.

MAYRA BARBOSA ADRIANA ARCIA

Contract Specialist Contracting Officer/Designee

Date: _______________ Date: _______________ https://www.acquisition.gov/content/part-6-competition-requirements

AcuStaf Development Corporation | 7900 International Drive Suite 710 | Bloomington MN, 55425 Phone: 952-831-4122

October 1, 2020

Marchell Garner

Health System Specialist

Nursing Education & Informatics (118E)

VA Greater Los Angeles Healthcare System

11301 Wilshire Blvd., Los Angeles, CA 90073

Hello, This letter is to provide notification that AcuStaf Development Corporation (“AcuStaf”), a VA verified

Veteran-Owned Small Business, sells directly to the VA via our GSA contract, GS35F0408X. AcuStaf’s labor management software, licensing and support are proprietary, and no other company is authorized to provide such services. AcuStaf is the sole source provider of AcuStaf’s Labor Management Software product numbers 3001-1, 3001-2, 3001-3 and 5001-1. AcuStaf offers a comprehensive, enterprise-wide

Labor Management Solution that includes staff scheduling, real-time staffing, workload integration, time and attendance, budget management, employee certification tracking, timekeeper validation, extensive reporting, and business analytics. Our solution supports Veterans Health Administration Directive 2010-

034 to secure an evidence-based system to support its National process to measure the impact of staff levels on patient care outcomes. AcuStaf is the only company who can train on our software. Our software is hosted by AcuStaf on the Amazon Web Services GovCloud.

As a result of our dedication to provide a custom product to the Veterans Health Administration, AcuStaf has developed a portfolio of unique custom software features to include:

• VistA to AcuStaf Human Resources SFTP (secure file transfer protocol)

• VistA to AcuStaf HL7 (patient admit, discharge, transfer information)

• AcuStaf VistA Pay Schedule module to allow for enhanced communication between management and timekeeping to ensure accurate pay

• Report 2001: Direct Hours Per Patient Day Reporting

• Report 2007: VHA NHPPD Shift Compliance Reporting

• Report 2022: Device Days of Care Compliance Reporting for Joint Commission

• Report 2046: DSS/MCA Labor Mapping Automation

• Report 2051: Morning Report to provide information such as daily OT, daily call-ins, daily staffing with NHPPD variance, and important patient care information.

• AcuStaf Proficiency Tracking Module to allow for alerts and tracking of proficiency due dates

AcuStaf Development Corporation is the only organization to customize a Labor Management software product to fit the unique needs of the Department of Veterans Affairs.

Sincerely, Lora Holland

Chief Operating Officer

Direct: (952) 456-6708

Mobile: (952) 228-9147

Office: (952) 831-4122

O F F I C E O F I N F O R M A T I O N S E C U R I T Y

MEMORANDUM OF UNDERSTANDING AND

INTERCONNECTION SECURITY AGREEMENT

Between Department of Veterans Affairs And AcuStaf Development Corporation (AcuStaf)

July 11, 2016 Version 2.0

FOR OFFICIAL USE ONLY

i i O F F I C E O F I N F O R M A T I O N S E C U R I T Y

DOCUMENT CONTROL CHANGE SHEET

Date Filename/Version # Author Revision Description

05/03/2013 AcuStaf MOU.docx Version 1.0 John DelTognoArmanasco / C.

Swinteck

Establish National AcuStaf S2S

VPN

05/03/2013 AcuStaf ISA.docx Version 1.0 John DelTognoArmanasco / C.

Swinteck

Establish National AcuStaf S2S

VPN

07/11/2016 AcuStaf VA MOU ISA 2016.07.11 Version 2.0

NCAP HISD Team Updated to new format i i i O F F I C E O F I N F O R M A T I O N S E C U R I T Y

Table of Contents

EXECUTIVE SUMMARY

1 INTRODUCTION

1.1 Overview and Purpose

1.2 Authority

2 MEMORANDUM OF UNDERSTANDING

2.1 Background

2.2 Communications

2.2.1 Security Incidents

2.2.2 Disasters and Other Contingencies

2.2.3 Material Changes to System Configuration

2.2.4 New Interconnections

2.2.5 Personnel Changes

2.2.6 Security

2.2.7 Cost Considerations

3 INTERCONNECTION SECURITY AGREEMENT

3.1 Background

3.1.1 System Description

3.1.2 System Hardware and Software Requirements

3.2 System Security Considerations

3.2.1 System Security Documentation

3.2.2 General Information/Data Description

3.2.3 Services Offered

3.2.4 Information Security Officer at Interconnection Site

3.2.5 Sensitivity Categorization

3.2.6 User Community

3.2.7 Information Exchange Security

3.2.8 Trusted Behavior Expectations

3.2.9 Formal Security Policy

3.2.10 Audit Trail Responsibilities

3.2.11 Security Parameters

3.2.12 Training and Awareness

3.3 TOPOLOGICAL DRAWING

4 DURATION

5 SIGNATORY AUTHORITY

i v O F F I C E O F I N F O R M A T I O N S E C U R I T Y

APPENDIX A: POINTS OF CONTACT

APPENDIX B: QUESTIONNAIRE – TRANSMISSION OF VA SENSITIVE INFORMATION

UTILIZING A SYSTEM INTERCONNECTION

APPENDIX C: VA ANNUAL REVIEW DOCUMENTATION

APPENDIX D: DEFINITIONS OF SENSITIVE INFORMATION TYPES

APPENDIX E: INTERCONNECTION PORTS AND PROTOCOLS

EXECUTIVE SUMMARY

AcuStaf’s Amazon Web Services Virtual Private Cloud employs VPNCubed software with OpenSSL FIPS Object Module to create a Site to Site Virtual Private Network (VPN) tunnel between the AcuStaf LMS and VA Network Workstations. Personal Identifiable Information (PII), HIPAA and other sensitive data will be shared between AcuStaf Labor Management Software (LMS) and Department of Veterans’ Affairs VistA Systems and VA Network Workstations, owned by Department of Veterans Affairs.

The Department of Veterans Affairs utilizes a Memorandum of Understanding (MOU) to document the terms and conditions for sharing data and information resources in a secure manner. The following supporting information within the MOU will define the purpose of the interconnection, identify relative authorities, specify the responsibilities of both organizations, and define the terms of the agreement.

Additionally, the MOU provides details pertaining to apportionment of cost and timeline for terminating or reauthorizing the interconnection.

Technical details on how the interconnection is established or maintained are included within the Interconnection Security Agreement (ISA). A system interconnection is a direct connection between two or more information technology (IT) systems for the purpose of sharing data and other information resources. The Department of Veterans Affairs uses the ISA to formally document the reasons, methodology, and approvals for interconnecting IT systems; to identify the basic components of an interconnection; to identify methods and levels of interconnectivity; and to discuss potential security risks associated with the interconnections.

1 INTRODUCTION

1.1 Overview and Purpose

The ISA specifies the technical and security requirements of the interconnection and the MOU defines the responsibilities of the participating organizations.

This Agreement supersedes all previous Agreements; This is a new agreement.

The purpose of this agreement section is to establish a management agreement between Department of Veterans Affairs and AcuStaf regarding the development, management, operation, and security of a connection between VA VistA Systems and VA Network Workstations, owned by Department of Veterans Affairs, and The AcuStaf Labor Management System (LMS), owned by AcuStaf. This agreement will govern the relationship between Department of Veterans Affairs and AcuStaf, including designated managerial and technical staff, in the absence of a common management authority.

1.2 Authority

The authority for this interconnection is based on:

• Federal Information Security Management Act (FISMA)

• VA Directive 6500, Managing Information Security Risk: VA Information Security Program, and Handbook 6500, Risk Management Framework for VA Information Systems: Tier 3 – VA Information Security Program

• Health Insurance Portability and Accountability Act (HIPAA) Security Rule, 45 C.F.R. Part 160

• National Institute of Standards and Technology (NIST) Special Publication (SP) 800-47, Security Guide for Interconnecting Information Technology Systems

• 38 United States Code (U.S.C.) §§ 5721-5728, Veteran’s Benefits, Information Security

• Office of Management and Budget (OMB) Circular A-130, Appendix III, Security of Federal Automated Information Systems

• 18 U.S.C. 641 Criminal Code: Public Money, Property or Records

• 18 U.S.C. 1905 Criminal Code: Disclosure of Confidential Information

The authority to disclose VA data per this agreement must comply with disclosure authority under each of the below applicable statutes:

• Privacy Act of 1974, 5 U.S.C. § 552a

• VA Claims Confidentiality Statute, 38 U.S.C § 5701

• HIPAA Privacy Rule, 45 C.F.R. Part 164

• Confidentiality of Certain Medical Records, 38 U.S.C. § 7332

• Confidentiality of Healthcare Quality Assurance Review Records, 38 U.S.C. § 5705

• Freedom of Information Act (FOIA), 5 U.S.C. § 552

2 MEMORANDUM OF UNDERSTANDING

2.1 Background

It is the intent of both parties to this agreement to interconnect the following IT systems in order to exchange data between VA VistA Systems and VA Network Workstations and The AcuStaf Labor Management System (LMS). Department of Veterans Affairs requires the use of The AcuStaf Labor Management System (LMS), and AcuStaf requires the use of VA VistA Systems and VA Network Workstations, as approved and directed by the Office of Information and Technology of The Department of Veterans Affairs. The expected benefit of the interconnection is to expedite the processing of data associated with remote diagnostics, maintenance, monitoring, and repair for VA VistA Systems and VA Network Workstations within prescribed timelines.

Each IT system is described below:

• The VA VistA Systems and VA Network Workstations

– Name VA VistA and VA Workstations

– Function Interface with the AcuStaf Labor Management System (LMS) for scheduling appropriate staffing for patient workload.

– Location Numerous VA Healthcare Centers located throughout the United States

– Description of data to be transmitted from Department of Veterans Affairs to AcuStaf including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level VA’s VistA transmits patient and staff data to AcuStaf LMS through the Site-to-Site VPN Tunnel.

AcuStaf LMS web-based client application is run from VA workstations to access scheduling data.

Data will be encrypted from the Amazon Web Services VPN Concentrator to the VA ECSIP Gateways. Once inside the VA network, data could include, but is not limited to, a variety of software for services and/or the possibility of patient sensitive data.

The FIPS 199 sensitivity categorization is: Confidentiality – High, Integrity – High, and Availability

– High.

• The AcuStaf Labor Management System (LMS).

– Name AcuStaf Labor Management Software (LMS)

– Function The AcuStaf Labor Management System (LMS) is used by VA facilities to schedule and budget clinical staff assignments. The AcuStaf LMS allows AcuStaf to work with clients to improve safety and outcomes, while reducing labor costs, through the application of AcuStaf LMS scheduling and expert consultation by AcuStaf personnel. AcuStaf provides VA managers with the information they need to schedule appropriate staffing for patient workload in real-time.

– Location Amazon Web Services, Inc.

410 Terry Ave N Seattle, WA 98109-5210

– Description of data to be transmitted from AcuStaf to Department of Veterans Affairs including Federal Information Processing Standard (FIPS) 199 sensitivity categorization level The AcuStaf LMS web portal, database, and dashboard modules reside on Acustaf’s Amazon Web Services Virtual Private Cloud. AcuStaf LMS collects, stores, and disseminates the following data, including, but not limited to: Patient Name, Date of Birth, SSN, bed assignment, admitting diagnosis code, admission/discharge date, and other patient information as well as VA Staff names and other VA staff information. The data types are obtained via HL7 transfers of Patient admissions/dicharges and bed assignments and also SFTP bulk file transfers of patient and employee information. The PHI data is provided by the patient’s electronic medical health record in VistA. Schedules are interactively created, monitored, and printed out via interactive web-based connections to AcuStaf LMS by VA workstations. Printouts are made by VA workstations sending print jobs to VA facility printers. Once inside the Amazon Web Services Virtual Private Cloud, data could include, but is not limited to, a variety of software for services and/or the possibility of patient sensitive data.

The FIPS 199 sensitivity categorization is: Confidentiality – Moderate, Integrity – High, and Availability – High.

2.2 Communications

Frequent formal communications are essential to ensure the successful management and operation of the interconnection agreement. The parties agree to maintain open lines of communication between designated staff at both the managerial and technical levels. All communications described herein must be conducted in writing (mail or email, excluding any sensitive VA information) unless otherwise noted.

The owners of VA VistA Systems and VA Network Workstations and The AcuStaf Labor Management System (LMS) agree to designate and provide contact information for the technical lead(s) for their respective system, and to facilitate direct contact between technical leads to support the management and operation of the interconnection. (See Appendix A) To safeguard the confidentiality, integrity, and availability of the connected systems and the data stored, processed, and transmitted, the parties agree to provide notice of specific events within the timeframes indicated below.

2.2.1 Security Incidents

VA Handbook 6500.2, Management of Data Breaches Involving Sensitive Personal Information (SPI) governs the reporting of incidents involving VA systems and information. If AcuStaf’s employee, contractor, or agent becomes aware of the theft, loss or compromise of any device used to transport, access or store VA sensitive information or data (Discussed in Appendix D), such employee, agent, or contractor must immediately report the incident to the VA POC listed within Appendix A, or in the Business Associate Agreement (BAA) or contract when applicable, so that the incident can be reported to the VA Network Security Operations Center (VA-NSOC) for action. Should any security incident or event (or suspected incident or event) involve VA owned sensitive data (e.g. the theft, loss, compromise, or destruction of any device used to transport, access, or store VA data) covered by this agreement, or the incident places VA data at risk of loss, unauthorized access, misuse or compromise, then AcuStaf will notify the VA POC listed within Appendix A, or in the BAA or contract when applicable, by phone or in writing (mail or email) immediately upon detection. The VA POC will immediately notify Department of Veterans Affairs’ ISO or PO who will contact VA-NSOC within one hour of notification (contacts in Appendix A).

AcuStaf will provide details of the security event, the potential risk to VA owned sensitive information, and the actions that have been or are being taken to remediate the issue. Activities that will be reported include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. AcuStaf will also provide VA with a written closing action report once the security event or incident has been resolved. VA will follow this same notification process should a security event occur within the VA boundary involving AcuStaf’s provided data. Designated POCs will follow established incident response and reporting procedures, determine whether the incident warrants escalation, and comply with established escalation requirement for responding to security incidents.

2.2.2 Disasters and Other Contingencies

Technical staff will immediately notify their designated counterparts listed within Appendix A by telephone or email in the event of a disaster or other contingency that disrupts the normal operation of one or both of the connected systems.

2.2.3 Material Changes to System Configuration

Planned technical changes to the system architecture will be reported to technical staff before such changes are implemented. Prior to implementing a change, the System Owner, with assistance from the ISO and PO, will conduct a risk assessment (RA) based on the new system architecture and determine if the proposed change requires reauthorization of the interconnection. Formal reauthorization is required whenever a system undergoes a significant change and the MOU/ISA must be modified and re-signed within [one (1) month] of implementation. Points of Contact are listed in Appendix A.

A significant change to an information system may include changes to the system itself or to the environment of operation. Significant changes to the information system may include, but are not limited to: installation of a new or upgraded operating system, middleware component, or application;

modifications to system ports, protocols, or services (Listed in Appendix E); installation of a new or upgraded hardware platform; modifications to cryptographic modules or services; or modifications to security controls. Significant changes to the environment of operation may include, but are not limited to: moving to a new facility; adding new core missions or business functions; acquiring specific and credible threat information that the organization is being targeted by a threat source; or establishing new or modified laws, policies or regulations. Major changes to the information collected or maintained are those changes that could result in greater disclosure of information or a change in the way personal data is used.

2.2.4 New Interconnections

The initiating party will notify the other party at least one (1) month before it connects its IT system, described in Section 2.1, with any other IT system that materially impacts the security of the interconnection covered by this MOU/ISA. This includes connecting the IT system with systems that are owned and operated by third parties.

2.2.5 Personnel Changes

The parties agree to provide notification of the separation or long-term absence of their respective system owner or technical lead. In addition, both parties will provide notification of any changes in POC information with respect to the system owner and technical lead, both parties also will provide notification of changes to user profiles, including users who resign or change job responsibilities.

The responsible parties for each system are listed in Appendix A of this MOU/ISA. The appendix will be updated as necessary. Updating the appendix does not require the re-signing of this MOU/ISA by either party. It is the responsibility of each respective approving authority to ensure the timely updating of this appendix and for the notification of such changes to the alternate party within thirty (30) days of any personnel change.

2.2.6 Security

Both parties agree to work together to ensure the joint security of the connected systems and the data stored, processed, and transmitted, as specified in the ISA section of this document. By signing this agreement each party certifies that its respective system is designed, managed, and operated in compliance with all relevant Federal laws, regulations, and policies including those stated in Section 1.2.

2.2.7 Cost Considerations

Both parties agree to share the costs of the interconnecting mechanisms and/or media. Percentage of cost assumed by each organization (e.g., 50/50, 40/60, etc.) must be agreed upon in advance, and no such expenditures or financial commitments shall be made without the written concurrence of both parties. Modifications to either system that are necessary to support the interconnection are the responsibility of the respective system owner’s organization.

3 INTERCONNECTION SECURITY AGREEMENT

3.1 Background

The technical details of the interconnection are documented in this ISA section of the document. The parties agree to work together to develop the ISA, and the MOU/ISA must be signed by both parties before the interconnection is activated. Proposed changes to either system or the interconnecting medium will be reviewed and evaluated to determine the potential impact to the interconnection. The MOU/ISA will be renegotiated before changes are implemented. Signatories to the MOU/ISA shall be the System Owner, ISO and PO for each system. The document should become an integral piece of the VA Assessment and Authorization (A&A) documentation and should be included in subsequent authorization requests.

3.1.1 System Description

AcuStaf Labor Management System (LMS) is used by VA facilities to schedule and budget clinical staff assignments. The AcuStaf LMS allows AcuStaf to work with clients to improve safety and outcomes, while reducing labor costs, through the application of AcuStaf LMS scheduling and expert consultation by AcuStaf staff. AcuStaf provides VA managers with the information they need to schedule appropriate staffing for patient workload in real-time. AcuStaf LMS web-based application is installed on VA workstations. The AcuStaf LMS web portal, database, and dashboard modules reside in AcuStaf’s Amazon Web Services Virtual Private Cloud.

This interconnection will occur over the Internet by establishing a Virtual Private Network (VPN) between VA and AcuStaf which is encrypted by using FIPS-140-2 validated modules operating in the method listed in the FIPS-140-2 validation. The connections at each end are located within controlled access facilities, guarded 24 hours a day. All access is controlled by authentication methods to validate the approved users.

3.1.2 System Hardware and Software Requirements

All required computer workstation hardware is existing and in place.

AcuStaf’s Amazon Web Services Virtual Private Cloud employs VPNCubed software with OpenSSL FIPS Object Module to create a Site to Site Virtual Private Network (VPN) tunnel between the two entities.

The FIPS-140-2 certificate number of OpenSSL FIPS Object Module is #1051.

For bulk transfers of patient and employee information from VistA, AcuStaf employs SFTP bulk file transfers using OpenSSH software configured in FIPS Operational Mode. The FIPS-140-2 certificate number of Red Hat Enterprise Linux OpenSSH is #1791. All required software is “existing and in place.

3.2 System Security Considerations

3.2.1 System Security Documentation

Different institutions assess and document system security through a variety of methods (e.g., risk assessment (RA), security control assessment (SCA), contractor security control assessment (CSCA), or system security plan (SSP)). For VA systems, the system interconnection/information sharing aspect is an essential part of the SSP. Two sections in the SSP require documentation of interconnections:

• System Identification: The VA facility must identify and document the types of system interconnections and information sharing that is allowed within the system.

• Security Assessment and Authorization (CA-3): The VA facility must identify and document whether all connections are authorized between the system and other systems outside the authorization boundary. The VA facility must also identify, document, and list external connections outside VA, as well as indicate information concerning the MOU/ISA. The VA facility must identify and document the appropriate officials designated to approve the information system agreements.

VA’s Network: All VA IT systems undergo a Security Control Assessment by the VA Certification Program Office in support of Federal Information Security Management Act compliance, and received an Authority to Operate (ATO), issued by the VA’s Chief Information Officer for Office of Information Technology. The VA does Continuous Monitoring of security controls as identified in VA Directive 6500 and VA Handbook 6500. The date of the last review of System controls are detailed in each VA Healthcare Systems’ System Security Plan (SSP).

The AcuStaf Labor Management System (LMS) , owned by AcuStaf , is hosted by Amazon Web Services (AWS). AWS provides a data center and network architecture built to satisfy the requirements of the most security-sensitive organizations such as government and healthcare. Many different tools and features are offered to help meet security objectives around visibility, auditability, controllability and agility. Some of the major features and tools include AWS Identity and Access Management (IAM), AWS Certificate Manager, AWS CloudHSM, AWS Key Management Service, AWS Directory Service, Amazon Inspector, and AWS Web Application Firewall (WAF) among many others. To help meet specific government, industry, and company security standards and regulations, AWS provides certification reports that describe how the AWS Cloud infrastructure meets the requirements of an extensive list of global security standards, including: ISO 27001, SOC, the PCI Data Security Standard, FedRAMP, the Australian Signals Directorate (ASD) Information Security Manual, and the Singapore Multi-Tier Cloud Security Standard (MTCS SS584). Along with the above tools, features, and accreditations, AWS’s Partner Competency Program offers many different solutions in areas of advanced security that include but are not limited to infrastructure security, policy management, identity management, security monitoring, vulnerability management, and data protection.

AcuStaf conducts security penetration testing with Amazon Web Services semi-annually. The last date of penetration testing occurred in March 2016.

3.2.2 General Information/Data Description

The interconnection between VA VistA Systems and VA Network Workstations and The AcuStaf Labor Management System (LMS) is a one-way path. For sensitive Data, refer to Appendix B for a detailed data description. For non-sensitive data, refer to section 2.1 of the accompanying Memorandum of Understanding.

3.2.3 Services Offered

No user services are offered. This connection only exchanges data between VA and AcuStaf via a dedicated in-house (VPN) connection.

3.2.4 Information Security Officer at Interconnection Site

There must be an established ISO (or business partner equivalent) at all interconnection sites described herein, who can provide oversight through the duration of the system development lifecycle (SDLC) phases (development, deployment, operations, and disposal) of the interconnection and who can ensure that the systems maintain appropriate security controls. Reference Appendix A for ISO contact information.

3.2.5 Sensitivity Categorization

The sensitivity categorization of data exchanged between Department of Veterans Affairs and AcuStaf is based on FIPS 199, Sensitivity Categorization of Federal Systems, and the guidance in NIST SP 800- 60, Guide for Mapping Types of Information and Information Systems to Security Categories. The sensitivity categorization is High.

3.2.6 User Community

All Department of Veterans Affairs users with access to the data received from AcuStaf have a current Department of Veterans Affairs VA personnel clearance. All AcuStaf users with access to the data received from Department of Veterans Affairs have a current Department of Veterans Affairs background investigation or a mutually agreed upon U.S. Government or Department of Defense (DoD) level background clearance or other reciprocal agreement verified to be at Low or above. FIPS 201, Personal Identity Verification (PIV) of Federal Employees and Contractors, describes the details of a National Agency Check (NAC) and a National Agency Check with Inquiries (NACI). The NAC is part of every NACI. Standard NACs are the Security/Suitability Investigations Index (SII), Defense Clearance and Investigation Index (DCII), Federal Bureau of Investigation (FBI) Name Check, and FBI National Criminal History Fingerprint Check. The NACI is the basic and minimum investigation required on all new Federal employees consisting of a NAC with written inquiries and searches of records covering specific areas of an individual’s background during the past five years (inquiries sent to current and past employers, schools attended, references, and local law enforcement authorities). Coverage includes:

– Employment, 5 years

– Education, 5 years and highest degree verified

– Residence, 3 years

– References

– Law Enforcement, 5 years

– NAC

3.2.7 Information Exchange Security

The security of the information being passed on this connection is protected through the use of FIPS 140-2 (or successor) validated encryption implemented according to the specifications in the validated modules certificate. The connections at each end are located within controlled access facilities using physical access devices and/or guards. Individual users will not have access to the data except through the system security software inherent to the operating system. All access is controlled by authentication methods to validate the approved users. The FIPS 140-2 certificate number of AcuStaf's gateway cryptographic module for establishing the VPN tunnel is FIPS# 1051. The FIPS-140-2 certificate number of OpenSSL FIPS Object Module is #1051. The FIPS-140-2 certificate number of Red Hat Enterprise Linux OpenSSH is #1791.

3.2.8 Trusted Behavior Expectations

Department of Veterans Affairs’ system and users are expected to protect The AcuStaf Labor Management System (LMS) , and AcuStaf's system and users are expected to protect VA VistA Systems and VA Network Workstations, in accordance with the Privacy Act and Trade Secrets Act (18 U.S.C.

1905), the Unauthorized Access Act (18 U.S.C. 2701 and 2710), and the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

3.2.9 Formal Security Policy

Directives or policies that govern the protection of the data include but are not limited to NIST documents; VA Directive 6500 and VA Handbook 6500 (or successors); and AcuStaf's 2090.1.2:

Employee Handbook, VA Customer Relationship Credentialing and Confidentiality.

3.2.10 Audit Trail Responsibilities

Both parties are responsible for auditing application processes and user activities involving the interconnection with sufficient granularity to allow successful investigation and possible prosecution of wrongdoers. Activities that will be recorded include event type, date and time of event, user identification, workstation identification, success or failure of access attempts, and security actions taken by system administrators or security officers. Audit logs will be retained for a minimum of 1 year or as documented in the NARA retention periods, HIPAA legislation (for VHA), or whichever is greater.

Audit logs which describe a security breach must be maintained for 6 years. Those responsible for maintaining audit logs must ensure that audit logs are successfully stored for the required duration.

3.2.11 Security Parameters

Department of Veterans Affairs implements the following security measures and controls:

• Patch management policy. VA utilizes automated patch management to keep all VA IT equipment patched with the latest operating system and application updates. Reports are run regularly and remediation is implemented for devices missing patches.

• Malware prevention policy (virus, spyware, etc). Every VA managed internal system has antivirus and antispyware software installed, and is monitored 24x7 for new infections.

Management is centralized. Updates are done daily, or more frequently, if necessary.

• Audit policy. VA regularly audits the security controls (continuous monitoring) and compliancy towards VA policies. Plan of Action and Milestones are used to track deficiencies and remediation.

• Incident response / security breach notification policy. VA maintains a Computer Emergency Response Team and the VA’s Network Security Operations Center monitors the VA network 24x7.

• User certification and authentication policy. User Access control is managed by strong authentication method and must be assigned on the "Least Privilege" Principal. VA utilizes 2 factor authentication for all general users. A separate token and non-mail enabled account is required for users who requires elevated privileges on IT systems.

• Password Policy. VA requires a strong password and users must change their password every 90 days.

• Account Management. VA accounts are separated into domains and the system administrators only manage those accounts within their domain. Accounts are audited every 90 days. VA policy requires account termination within 24 hour of an employee/contractor departure.

Accounts are terminated immediately in the event of a hostile termination.

• Physical and environmental security policy. Physical and environmental controls are maintained at each VA facility. Badges are required for all employees and contract staff. OIT networking closets and computer room require authorization from the facility Chief Information Officer and a log is maintained. VA computer rooms are environmentally controlled for operation of the equipment is contains. This includes power, network, HVAC, and fire suppression.

• Firewall, IDS, and encryption policy. Intrusion detection systems (IDS). IDS are in place at all gateways and throughout the VA network. The VA’s Network Security Operations Center monitors the VA network 24x7. Suspicious activity is reviewed and as needed recommendations are formulated and assigned to the system administrators. FIPS 140-2 encryption is required for transmission of sensitive information.

• Contingency Plans. A contingency and disaster recovery plan is in place for every VA IT system.

The plans are tested annually.

AcuStaf implements the following security measures and controls:

• Patch management policy: AcuStaf utilizes automated patch management to keep all VA IT equipment patched with the latest operating system and application updates. Reports are run regularly and remediation is implemented for servers missing patches.

• Malware prevention / Virus Scanning policy: AcuStaf utilizes a unix server to ensure malware and virus scanning/prevention. Every server has appropriate antivirus and antispyware software installed, and is monitored 24x7 for new infections. Management is centralized and updates are implemented as necessary

• Audit policy. This includes review and examination of records, activities, and system parameters to assess the adequacy of maintaining, managing, and controlling events that may degrade the security posture of the application. AcuStaf utilizes logging and reporting features for access and activities.

• Incident response / security breach notification policy AcuStaf maintains an Application Emergency Response Team to monitor the application 24x7.

• User certification, identification and authentication policy: AcuStaf allows VA System Administrators to control user access to the application. Currently, users are identified and authorized through a two-step verification process and passwords are not recoverable by email accounts.

• Password policy: AcuStaf requires a strong password and users must change their password every 90 days in accordance with VA standards

• Account Management policy: VA System Administrators are required to maintain account access. Account access is linked to employment status. If employment status is terminated, immediate account termination is automatically implemented by AcuStaf.

• Physical and environmental security policy. The AcuStaf LMS servers are located in AcuStaf’s Amazon Web Services Virtual Private Cloud which is a controlled space.

• Firewall, IDS, and encryption policy. Network Controls, routers, and firewalls are managed by VA and Amazon Web Services in accordance with required configuration and best practice standards.

• Contingency Plans: A contingency plan is in place and tested annually with Amazon Web Services.

• Hardware and Software relation specifications: Access to the VA Network is required to fully support LMS applications. Please see description of ports needed in Appendix C.

3.2.12 Training and Awareness

All VA employees as well as non-VA employees seeking access to VA information systems or VA sensitive information must annually complete the VA Privacy and Information Security Awareness Training and Rules of Behavior (VA #10176) and annually acknowledge VA’s Rules of Behavior (RoB) before VA access is granted to such information or information systems. Additionally, individuals seeking access to health information must also annually complete Privacy and HIPAA Focused Training (VA #10203).

a. A requirement for annual security/privacy awareness training: Before being granted access to VA information or information systems, all AcuStaf employees and subcontractor employees requiring such access shall complete on an annual basis either: (i) the VA Privacy and Information Security Awareness Training and Rules of Behavior (VA #10176) and Privacy and HIPAA Training (VA #10203) within 1 week of the initiation of the contract, or (ii) security awareness training provided or arranged by the contractor that conforms to VA's security/privacy requirements as delineated in the hard copy of the VA security awareness training provided to the contractor. If the contractor provides their own training that conforms to VA's requirements, AcuStaf will provide the COR or CO, a yearly report (due annually on the date of the contract initiation) stating that all applicable employees involved in VA's contract have received their annual security/privacy training that meets VA's requirements and the total number of employees trained. See VA Handbook 6500.6, Appendix C, paragraph 9.

b. A requirement to sign VA's Rules of Behavior: Before being granted access to VA information or information systems, all AcuStaf employees and subcontractor employees requiring such access shall sign on an annual basis an acknowledgment that they have read, understand, and agree to abide by VA's Contractor Rules of Behavior. See VA Handbook 6500.6, Appendix C, paragraph 9, and VA Handbook 6500 Appendix D. Note: If AcuStaf anticipates that the services under the contract will be performed by 10 or more individuals, the Contractor Rules of Behavior may be signed by AcuStaf's designated representative. The contract must reflect by signing the Rules of Behavior on behalf of the vendor that the designated representative agrees to ensure that all such individuals review and understand the Contractor Rules of Behavior when accessing VA's 'information and information systems.

3.3 TOPOLOGICAL DRAWING

4 Duration

If the interconnection is deemed still necessary and there are no significant changes to the interconnection (see section 2.3.3 Material Changes to System Configuration), then the agreement will remain in effect and the Department of Veterans Affairs ISO will document the annual review in Appendix C Annual Review.

If there are significant changes to the interconnection or the Department of Veterans Affairs ISO finds that a review has been completed and major changes were noted during the review, the signatories must update and reauthorize the agreement.

If one or both of the parties wish to terminate this agreement prematurely, they may do so upon [thirty

(30) days] advanced notice or in the event of a security incident that necessitates an immediate response. Approval to decommission the VPN must come from the Business Owner.

5 SIGNATORY AUTHORITY

We, the undersigned, mutually agree to the terms of this agreement.

Name of Department of Veterans Affairs System Owner:

Ronald Thompson Acting DAS for OIS

X__________________________ Date __________

Name of Department of Veterans Affairs Information Security Officer:

Lynette Sherrill Field Security Service Health Information Security Division

Name of Department of VHA Privacy Officer:

Andrea Wilson Veterans Health Administration, Privacy Office Manager

Name of AcuStaf System Owner:

Terry Suby vacolabred Typewritten Text (Reviewed by the Privacy Office for informational purposes only) vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text vacolabred Typewritten Text

Name of AcuStaf Information Security Officer and AcuStaf Privacy Officer:

Kate Shahan

Appendix A: Points of Contact

List of Responsible Parties for Each System:

Name Company Title Office Phone Email VA FSS Health Information Security Division

VA VA Information Security Representative vafsshisd@va.gov

Crystal White VA Primary POC 813-972-2000 x7007

Crystal.white5@va.gov

VA National Help Desk

VA VA National Help Desk

(888) 596-tuscaloosaUSD.nationalserv icedesk@va.gov

Terry Suby AcuStaf System Owner (952)831-4122 terry@acustaf.com Kate Shahan AcuStaf Secondary POC (952)831-4122 k.shahan@acustaf.com AcuStaf Support Center

AcuStaf Security Operations

POC

(952)831-4122 support@acustaf.com

List of Responsible Parties to Contact during a Security Incident:

Name Company Title Office Phone Email Network Security Operations Center*

VA NSOC Support Desk 855-673-4357

VA FSS Health Information Security Division

VA VA Information Security Representative vafsshisd@va.gov

* Note: VA-NSOC should only be contacted by VA personnel.

mailto:vafsshisd@va.gov mailto:vafsshisd@va.gov

Appendix B: Questionnaire – Transmission of VA Sensitive Information Utilizing a System Interconnection

1. MOU/ISA for Interconnection: Memorandum of Understanding and Interconnection Security Agreement between Department of Veterans Affairs’ and AcuStaf Development Corporation (AcuStaf)

2. VA Point of Contact: Kasey Sayama

3. Description of Data: AcuStaf LMS collects, stores, and disseminates the following data, including, but not limited to: Patient Name, Date of Birth, SSN, bed assignment, admitting diagnosis code, admission/discharge date, and other patient information as well as VA Staff names and other VA staff information.

4. Purpose for Data Transfer: It is the intent of both parties to this agreement to interconnect the following IT systems in order to exchange data between VA VistA Systems and VA Network Workstations and The AcuStaf Labor Management…