Attachment 1: VA Directive 6550 Appendix A

VA Directive 6550
Appendix A

June 3, 2019

VA DIRECTIVE 6550 Appendix A – To be completed for all procurements of network-connected medical devices and non-network-connected medical devices that store sensitive information. For client/server systems, a separate 6550 Appendix A is required for each the client and the medical server. 1.1
1.2
1.3
1.4
1.5
1.6
1.7
1.8
1.9
1.10
1.11

1.12
1.13

1.14

Equipment Category (VA-MDNS)
Manufacturer
Model
NSI Number (if known)
Application Name and Software Version #
Requesting Service

VISN

Facility Name
Facility Number
Manufacturer Point of Contact
Phone Number
E-mail address
Biomedical Engineering Point of Contact
Phone Number
E-mail address
Responsible Service if Biomedical Engineering is NOT the Primary System Manager for system maintenance, support and lifecycle management
Medical Device Type

‫ ܆‬Discrete device
‫ ܆‬Software
‫ ܆‬Client
‫ ܆‬Application server

Device Description (i.e. equipment function and systems it communicates with)

1.15
1.16

MDIA VLAN Number for installation (if known)
Device Operating System (OS)
Please include OS build level.
Review support status for Windows OS versions here.
Procurement of devices with unsupported operating systems is prohibited. Unsupported operating systems are OSs that are not supported by the manufacturer and have reached the end of the OS lifecycle as published by the OS manufacturer (i.e. no further security patches will be released for the OS by the manufacturer after the OS end-of-life nor will be available by other methods such as extended warranty purchases from the OS manufacturer). 1.17
Does the device support wireless network connection?
տ Yes
տ No
If yes, what is the FIPS 140-2 or 140-3 certification number? If no, does the vendor support the installation of FIPS 140-2 or տ Yes
տ No
140-3 wireless cards?
Procurement of devices using 802.11 wireless networking that are not FIPS 140-2 or 140-3 compliant is prohibited. 1.18
Does the device have an existing, active Enterprise Risk տ Yes
տ No
Analysis (ERA)?
If yes, what is the ERA number?
If the device has a direct connection to Cerner or EHRM տ Yes
տ No
interface, does the device have an existing MedMod ERA? If yes, what is the MedMod ERA number?
**Note that the ERA must be for the same make, model, and application software version to apply to the requested device. A new ERA is required for major software or operating system updates (e.g. version 2.0 to 3.0) but is not