VA Directive 6550 - New Appendix A - published Jun. 2023.docx

VA DIRECTIVE 6550 Appendix A – To be completed for all procurements of network-connected medical devices and non-network-connected medical devices that store sensitive information. For client/server systems, a separate 6550 Appendix A is required for each the client and the medical server.

Phone Number

E-mail address

Phone Number

E-mail address

☐ Software ☐ Client ☐ Application server

Please include OS build level.

Review support status for Windows OS versions here.

Procurement of devices with unsupported operating systems is prohibited. Unsupported operating systems are OSs that are not supported by the manufacturer and have reached the end of the OS lifecycle as published by the OS manufacturer (i.e. no further security patches will be released for the OS by the manufacturer after the OS end-of-life nor will be available by other methods such as extended warranty purchases from the OS manufacturer).

If yes, what is the FIPS 140-2 or 140-3 certification number?

Procurement of devices using 802.11 wireless networking that are not FIPS 140-2 or 140-3 compliant is prohibited.

If yes, what is the ERA number?

**Note that the ERA must be for the same make, model, and application software version to apply to the requested device. A new ERA is required for major software or operating system updates (e.g. version 2.0 to 3.0) but is not required for minor updates (e.g. version 2.0 to version 2.1).

If an ERA exists for the requested device, completion of the 6550 Appendix A is not required beyond this point. Please sign to certify that an existing ERA is available for the requested device and forward the document to either the Area Manager or ISSO for signature, as appropriate. Please note that if the device is an EHRM device, a MedMod ERA is required.

**Note that devices that do not support automated patching via the VHA MD Update Server (MDUS) or via vendor channels impose a significantly higher risk to the VA network.

If patching is not automated, what is the patching process and/or limitations?

**Note that devices that do not support automated patching impose a significantly higher risk to the VA network.

If patching is not automated, what is the patching process and/or limitations?

If yes, can these logs be exported to a syslog or similar server?

If yes, what is the database version and type (e.g., SQL, Oracle)?

**Note that procuring and deploying devices with unsupported database versions imposes a significantly higher risk to the VA network.

**Note that devices that do not support VA-approved antivirus scanning or an antivirus scanning solution managed by the vendor impose a significantly higher risk to the VA network.

If antivirus is not supported, what are the AV processes and/or the limitations?

If so, which one(s)?

☐ Non-Windows-based system

**Note that devices that do not support communication with the SMAK-AM server or for which the vendor does not agree to provide a complete software inventory impose a significantly higher risk to the VA network.

**Note that devices that do not support two-factor authentication impose a significantly higher risk to the VA network. Please review the VA’s requirements for two-factor authentication here.

Does the device require interactive login service accounts?

**Note that devices that require interactive login service accounts impose a significantly higher risk to the VA network.

**Note that devices that are not joined to the domain impose a significantly higher risk to the VA network.

What level of encryption is allowed?

☐ HTTPS

☐ TLS (version: ______________________)

☐ SFTP

☐ None ☐ Other:

**Note that use of SSL is prohibited and that TLS versions 1.0/1.1 impose a significantly higher risk to the VA network.

If yes, has the cloud platform been approved by the VA Digital Transformation Center (DTC)?

To determine approval status, please visit the Digital VA Product Marketplace.

☐ Yes ☐ No

☐ Managed Service

If SaaS, what is the FedRAMP package ID?

☐ Yes - VA S2S VPN ☐ Yes - VA Citrix ☐ Yes – VA Azure Virtual Desktop ☐ Yes – Other

If other, describe the remote access method.

What is the MOU/ISA number?

**Devices should be deployed with static IPs unless DHCP is required.

If yes, please list any limitations.

☐ VHA-provided ☐ Other - describe ☐ Physical server ☐ Virtual host ☐ Cloud virtual host

Attach additional documentation, as needed.

☐ Results ☐ Billing (DFT)

☐ ADT

☐ Other: ________________________

If the requested device does not have an EHRM approved connection or interface to Cerner, completion of the 6550 Appendix A is not required beyond this point. Please sign this document and route it for signature, as appropriate.

For more information, please reference the approved EHRM interface list and the EHRM IO HTM SharePoint site ☐ Yes ☐ No

NSR Number:

If no, to which security authorization boundary will this device/system be added?

For more information on MedMod zones and MD-LITE, please reference the EHRM IO HTM SharePoint site or contact the EHRM IO HTM team at EHRMIOHTM@va.gov.

☐ MedMod Zone 6A ☐ MedMod Zone 6B

☐ MD-LITE

☐ Other _______________________________

If no, what is the proposed EHR connection(s)/integration(s) type(s)?

For additional guidance, please contact the EHRM IO HTM team at EHRMIOHTM@va.gov.

☐ Openlink (HL7) ☐ Compass Router (DICOM) ☐ EHR Gateway (Non-DICOM Image Routing) ☐ Cerner Connectivity Engine (CCE) ☐ CCE Terminal Server (CCE-TS) ☐ Separate HL7 Interface/Middleware Server ☐ None ☐ Other: _______________________

Submittal/Approval

Biomedical Engineering Date

Area Manager* Date

*Area manager signature only required for client/server medical systems. Please sign within 10 business days of receipt.

Information Systems Security Officer** Date

** Please sign within 5 business days of receipt and return the document to Biomedical Engineering and the Area Manager. If an ERA is required, please submit this form with the ERA package to the Specialized Device Cybersecurity Department (SDSD) to initiate the ERA process.