6550 Appendix A - Pre-procurement Assessment Questionnaire Fillable

6550 Appendix A: Pre-Procurement Assessment Questionnaire To be completed for all procurements of network-connected medical devices/systems and stand -alone (nonnetworked) medical devices/systems that store sensitive information. For client/server systems, a 6550 Appendix A is required for the client system, and a separate one is also required for the medical server. Medical Device/System (MD/S) is a non-information technology (IT) device or system that meets all criteria outlined below. MD/S in VA encompass both clinical systems and medical devices. The purpose of this definition is to identify which MD/S fall under VA management responsibilities.
1.
2.

The medical device/system can connect to the network and/or store electronic Protected Health Information (ePHI) locally. The device/system meets one or more of the following conditions: a. Is used in patient healthcare for diagnosis, treatment, or physiological monitoring of patients * b. Has gone through the Food and Drug Administration (FDA) Premarket Review or 510(k) Process. c. Is incorporated into a medical device/system such that, if modified, the device/ system component could negatively impact the functionality or safety of the main medical device/system** *Includes, but is not limited to, server-based medical equipment and clinical systems that directly connect to a patient, process human and other biologic specimens, create medical images, display electrophysiological waveforms, obtain physiologic measurements, and/or directly provide therapeutic-support to the patient. An exhaustive list of medical devices can be found in the VA Medical Device Nomenclature System (MDNS).
**Includes on-premises and/or cloud-based software validated, installed, or authorized by the sponsor as a device or in a device.

Part 1
If an active ERA already exists for the requested device, only Part 1 needs to be completed. Part 2 is NOT required.
Number
1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9

Question
Response

VISN

Facility Name
Manuf acturer
Model
Application Name
Application Version #
Operating System (OS)
Operating System (OS) Build Level
A. Does an active, approved Enterprise Risk Assessment (ERA) ☐ Yes ☐ No exist f or the device/ system?
NOTE: If No: Part 1 is complete. Proceed to App A Part 2. B. If Yes: Is the ERA designated f or a FED EHR device/system? ☐ Yes ☐ No **Please answer Yes if it is f or FED EHR Oracle OpenLink, DAS SPOE, VDIF, FDSS connected systems only