> **Research Data Security Assessment Checklist**
>
> **January 8, 2009**

+----------------------------+---+---+---+-----------------+--------------+
| **Element**                | * | * | * | > **Regulation  | **           |
|                            | * | * | * | > & Policies**  | Documentatio |
|                            | Y | N | N |                 | n/Evidence** |
|                            | e | o | / |                 |              |
|                            | s | * | A |                 |              |
|                            | * | * | * |                 |              |
|                            | * |   | * |                 |              |
+============================+===+===+===+=================+==============+
| A.  **VHA Handbook 1200.5  |   |   |   |                 |              |
|     *"Requirements for the |   |   |   |                 |              |
|     Protection of Human    |   |   |   |                 |              |
|     Subjects in Research"* |   |   |   |                 |              |
|     (July 15, 2003)**      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 1.  Adequate provisions    |   |   |   | VHA Handbook    |              |
|     are in place to        |   |   |   | 1200.5 §7.a(7)  |              |
|     protect the privacy of |   |   |   |                 |              |
|     subjects and to        |   |   |   |                 |              |
|     maintain the           |   |   |   |                 |              |
|     confidentiality of     |   |   |   |                 |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     data (see Footnote 1). |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2.  Institutional Review   |   |   |   | VHA Handbook    |              |
|     Board (IRB) has        |   |   |   | 1200.5          |              |
|     established written    |   |   |   | §7.d(12);       |              |
|     procedures that        |   |   |   |                 |              |
|     accurately reflect the |   |   |   | VHA Handbook    |              |
|     requirements for       |   |   |   | 1605.1 §13      |              |
|     reporting to the       |   |   |   |                 |              |
|     Privacy Officer (PO)   |   |   |   |                 |              |
|     any unauthorized use,  |   |   |   |                 |              |
|     loss, or disclosure of |   |   |   |                 |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     patient information    |   |   |   |                 |              |
|     (also see D26).        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3.  IRB has established    |   |   |   | VHA Handbook    |              |
|     written procedures     |   |   |   | 1200.5 §7.d(13) |              |
|     that accurately        |   |   |   |                 |              |
|     reflect the            |   |   |   |                 |              |
|     requirements for       |   |   |   |                 |              |
|     reporting violations   |   |   |   |                 |              |
|     of VA information      |   |   |   |                 |              |
|     security requirements  |   |   |   |                 |              |
|     to the appropriate VHA |   |   |   |                 |              |
|     Information Security   |   |   |   |                 |              |
|     Officer (ISO).         |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4.  Obtaining and using    |   |   |   | VHA Handbook    |              |
|     medical, technical,    |   |   |   | 1200.5 §13b.    |              |
|     and administrative     |   |   |   |                 |              |
|     records from other VA  |   |   |   |                 |              |
|     facilities or VA       |   |   |   |                 |              |
|     databases (national,   |   |   |   |                 |              |
|     regional, or subject   |   |   |   |                 |              |
|     specific) for R&D      |   |   |   |                 |              |
|     purposes are in        |   |   |   |                 |              |
|     compliance with all    |   |   |   |                 |              |
|     VHA regulations and    |   |   |   |                 |              |
|     with the Standards for |   |   |   |                 |              |
|     Privacy of             |   |   |   |                 |              |
|                            |   |   |   |                 |              |
|  Individually-Identifiable |   |   |   |                 |              |
|     Health Information (45 |   |   |   |                 |              |
|     CFR Parts 160 and      |   |   |   |                 |              |
|     164).                  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5.  Obtaining and          |   |   |   | VHA Handbook    |              |
|     disclosing             |   |   |   | 1200.5 §13b.    |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     patient records are in |   |   |   |                 |              |
|     compliance with all    |   |   |   |                 |              |
|     applicable             |   |   |   |                 |              |
|     confidentiality        |   |   |   |                 |              |
|     statues and            |   |   |   |                 |              |
|     regulations including  |   |   |   |                 |              |
|     those discussed in     |   |   |   |                 |              |
|     subparagraph 7a(7) of  |   |   |   |                 |              |
|     VHA Handbook 1200.5    |   |   |   |                 |              |
|     (see Footnote 1).      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6.  Persons not employed   |   |   |   | VHA Handbook    |              |
|     by VA are given access |   |   |   | 1200.5 §13c.    |              |
|     to medical and other   |   |   |   |                 |              |
|     VA records for R&D     |   |   |   |                 |              |
|     purposes               |   |   |   |                 |              |
|     [only]{.underline}     |   |   |   |                 |              |
|     within the legal       |   |   |   |                 |              |
|     restrictions imposed   |   |   |   |                 |              |
|     by such laws as the    |   |   |   |                 |              |
|     Privacy Act of 1974;   |   |   |   |                 |              |
|     38 USC §5701, §5705,   |   |   |   |                 |              |
|     §7332; and VHA         |   |   |   |                 |              |
|     Handbook 1605.1 §13b   |   |   |   |                 |              |
|     (also see E3, E4, &    |   |   |   |                 |              |
|     E6).                   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7.  Access to medical and  |   |   |   | VHA Handbook    |              |
|     other VA records for   |   |   |   | 1200.5 §13c.    |              |
|     R&D purposes by        |   |   |   |                 |              |
|     persons not employed   |   |   |   |                 |              |
|     by VA is approved by   |   |   |   |                 |              |
|     CRADO (also see E3).   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8.  The IRB expedited      |   |   |   | VHA Handbook    |              |
|     review process is not  |   |   |   | 1200.5,         |              |
|     used when              |   |   |   | Appendix B, 1b. |              |
|     identification of the  |   |   |   |                 |              |
|     subjects and/or their  |   |   |   |                 |              |
|     responses would        |   |   |   |                 |              |
|     reasonably place them  |   |   |   |                 |              |
|     at risk of criminal or |   |   |   |                 |              |
|     civil liability; or be |   |   |   |                 |              |
|     damaging to the        |   |   |   |                 |              |
|     subject's financial    |   |   |   |                 |              |
|     standing,              |   |   |   |                 |              |
|     employability,         |   |   |   |                 |              |
|     insurability, and/or   |   |   |   |                 |              |
|     reputation; or be      |   |   |   |                 |              |
|     stigmatizing, unless   |   |   |   |                 |              |
|     reasonable and         |   |   |   |                 |              |
|     appropriate            |   |   |   |                 |              |
|     protections are        |   |   |   |                 |              |
|     implemented so that    |   |   |   |                 |              |
|     risks related to       |   |   |   |                 |              |
|     invasion of privacy    |   |   |   |                 |              |
|     and breach of          |   |   |   |                 |              |
|     confidentiality are    |   |   |   |                 |              |
|     minimal.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9.  Informed consent       |   |   |   | VHA Handbook    |              |
|     contains a description |   |   |   | 1200.5,         |              |
|     of any reasonably      |   |   |   | Appendix C,     |              |
|     foreseeable risks or   |   |   |   | 2.a(7)          |              |
|     discomforts to the     |   |   |   |                 |              |
|     subject including for  |   |   |   |                 |              |
|     example, privacy risks |   |   |   |                 |              |
|     (legal, employment,    |   |   |   |                 |              |
|     and social).           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 10. IRB documents the      |   |   |   | VHA Handbook    |              |
|     findings on which it   |   |   |   | 1200.5,         |              |
|     based its decision for |   |   |   | Appendix E, 1;  |              |
|     granting a waiver or   |   |   |   |                 |              |
|     alteration of the      |   |   |   | VHA Handbook    |              |
|     HIPAA Authorization    |   |   |   | 1605.1 §13      |              |
|     requirement.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| B.  **VA Memos & IT        |   |   |   |                 |              |
|     Directives**           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 1.  Researchers are        |   |   |   | Memo from       |              |
|     familiar with and      |   |   |   | DUSHOM & CRADO  |              |
|     abide by existing      |   |   |   | on 06/12/06     |              |
|     policies, procedures,  |   |   |   | *"Research      |              |
|     and directives         |   |   |   | R               |              |
|     regarding the          |   |   |   | esponsibilities |              |
|     protection of human    |   |   |   | for Protecting  |              |
|     subjects in research   |   |   |   | Sensitive       |              |
|     and the use and        |   |   |   | Information"*   |              |
|     disclosure of          |   |   |   |                 |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     information as         |   |   |   |                 |              |
|     outlined in VHA        |   |   |   |                 |              |
|     Handbook 1200.5, VA IT |   |   |   |                 |              |
|     Directive 06-2, VHA    |   |   |   |                 |              |
|     Handbook 1605.1, and   |   |   |   |                 |              |
|     VA Handbook 6500 (also |   |   |   |                 |              |
|     see Sections D & E of  |   |   |   |                 |              |
|     this checklist).       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2.  All removable or       |   |   |   | Memo from       |              |
|     transferable storage   |   |   |   | DUSHOM & CRADO  |              |
|     media (flash drives,   |   |   |   | on 06/12/06     |              |
|     CD ROMs, laptops,      |   |   |   | *"Research      |              |
|     etc.) are reviewed to  |   |   |   | R               |              |
|     remove or secure       |   |   |   | esponsibilities |              |
|     sensitive information  |   |   |   | for Protecting  |              |
|     (also see D12, D14, &  |   |   |   | Sensitive       |              |
|     D25).                  |   |   |   | Information"*   |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3.  Employees authorized   |   |   |   | VA IT Directive |              |
|     to remove confidential |   |   |   | 06-2            |              |
|     and Privacy            |   |   |   |                 |              |
|     Act-protected data     |   |   |   | *"Safeguarding  |              |
|     from VA take all       |   |   |   | Confidential    |              |
|     relevant precautions   |   |   |   | and Privacy     |              |
|     to safeguard that data |   |   |   | Act-Protected   |              |
|     until it is returned   |   |   |   | Data at         |              |
|     (also see D8, D9, &    |   |   |   | Alternative     |              |
|     D16).                  |   |   |   | Work            |              |
|                            |   |   |   | Locations"*     |              |
|                            |   |   |   | (06/06/06)      |              |
|                            |   |   |   |                 |              |
|                            |   |   |   | Memo from PDUSH |              |
|                            |   |   |   | and CRADO on    |              |
|                            |   |   |   | 06/27/06        |              |
|                            |   |   |   | *"Cyber         |              |
|                            |   |   |   | Security and    |              |
|                            |   |   |   | Privacy"*       |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4.  Employees authorized   |   |   |   | VA IT Directive |              |
|     to remove electronic   |   |   |   | 06-2            |              |
|     data consult with      |   |   |   |                 |              |
|     their supervisors and  |   |   |   | *"Safeguarding  |              |
|     ISOs to ensure the     |   |   |   | Confidential    |              |
|     data are properly      |   |   |   | and Privacy     |              |
|     encrypted and          |   |   |   | Act-Protected   |              |
|     password-protected in  |   |   |   | Data at         |              |
|     accordance with VA     |   |   |   | Alternative     |              |
|     policies (also see     |   |   |   | Work            |              |
|     D25, D28, & 30).       |   |   |   | Locations"*     |              |
|                            |   |   |   | (06/06/06)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5.  Employees who remove   |   |   |   | VA IT Directive |              |
|     confidential and       |   |   |   | 06-2            |              |
|     Privacy Act-protected  |   |   |   |                 |              |
|     data from VA premises  |   |   |   | *"Safeguarding  |              |
|     have written           |   |   |   | Confidential    |              |
|     authorization to do so |   |   |   | and Privacy     |              |
|     (also see D16).        |   |   |   | Act-Protected   |              |
|                            |   |   |   | Data at         |              |
|                            |   |   |   | Alternative     |              |
|                            |   |   |   | Work            |              |
|                            |   |   |   | Locations"*     |              |
|                            |   |   |   | (06/06/06)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6.  Employees handle       |   |   |   | VA IT Directive |              |
|     confidential and       |   |   |   | 06-2            |              |
|     Privacy Act-protected  |   |   |   |                 |              |
|     data as instructed by  |   |   |   | *"Safeguarding  |              |
|     VA policies (also see  |   |   |   | Confidential    |              |
|     Sections D, E, &       |   |   |   | and Privacy     |              |
|     Footnote 2).           |   |   |   | Act-Protected   |              |
|                            |   |   |   | Data at         |              |
|                            |   |   |   | Alternative     |              |
|                            |   |   |   | Work            |              |
|                            |   |   |   | Locations"*     |              |
|                            |   |   |   | (06/06/06)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7.  Employees report the   |   |   |   | VA IT Directive |              |
|     loss of confidential   |   |   |   | 06-2            |              |
|     or Privacy-Act         |   |   |   |                 |              |
|     protected data         |   |   |   | *"Safeguarding  |              |
|     immediately to the     |   |   |   | Confidential    |              |
|     facility ISO, PO, and  |   |   |   | and Privacy     |              |
|     his/her supervisor     |   |   |   | Act-Protected   |              |
|     (also see D26).        |   |   |   | Data at         |              |
|                            |   |   |   | Alternative     |              |
|                            |   |   |   | Work            |              |
|                            |   |   |   | Locations"*     |              |
|                            |   |   |   | (06/06/06)      |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8.  All employees have     |   |   |   | PDUSH Memo on   |              |
|     taken the mandatory    |   |   |   | 06/27/06        |              |
|     annual training for VA |   |   |   | *"Cyber         |              |
|     Cyber Security         |   |   |   | Security and    |              |
|     Awareness and VHA      |   |   |   | Privacy"*       |              |
|     Privacy Policy (also   |   |   |   |                 |              |
|     see D 2).              |   |   |   | Memo from PDUSH |              |
|                            |   |   |   | and CRADO on    |              |
|                            |   |   |   | 06/27/06        |              |
|                            |   |   |   | *"Cyber         |              |
|                            |   |   |   | Security and    |              |
|                            |   |   |   | Privacy"*       |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9.  Contact with veterans  |   |   |   | PDUSH Memo on   |              |
|     is limited to those    |   |   |   | 07/10/06        |              |
|     clinically essential   |   |   |   | *"Researcher    |              |
|     or as outlined in IRB  |   |   |   | Contacts with   |              |
|     approved protocols.    |   |   |   | Veterans"*      |              |
|     Contacts do not        |   |   |   |                 |              |
|     solicit sensitive      |   |   |   |                 |              |
|     information \[e.g.,    |   |   |   |                 |              |
|     Social Security        |   |   |   |                 |              |
|     Numbers (SSNs)\]       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 10. During the recruitment |   |   |   | PDUSH Memo on   |              |
|     process, researchers   |   |   |   | 07/10/06        |              |
|     make initial contacts  |   |   |   | *"Researcher    |              |
|     with veterans in       |   |   |   | Contacts with   |              |
|     person and/or by       |   |   |   | Veterans"*      |              |
|     letter prior to any    |   |   |   |                 |              |
|     telephone contact and  |   |   |   |                 |              |
|     provide a telephone    |   |   |   |                 |              |
|     number or other means  |   |   |   |                 |              |
|     that veterans can use  |   |   |   |                 |              |
|     to verify the validity |   |   |   |                 |              |
|     of the study.          |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 11. Informed consent       |   |   |   | PDUSH Memo on   |              |
|     documents used after   |   |   |   | 07/10/06        |              |
|     July 10, 2006, include |   |   |   | *"Researcher    |              |
|     information about      |   |   |   | Contacts with   |              |
|     where and how a        |   |   |   | Veterans"*      |              |
|     veteran could verify   |   |   |   |                 |              |
|     the validity of a      |   |   |   |                 |              |
|     study and authorized   |   |   |   |                 |              |
|     contacts.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 12. After recruitment and  |   |   |   | PDUSH Memo on   |              |
|     during follow-up       |   |   |   | 07/10/06        |              |
|     phase, researchers     |   |   |   | *"Researcher    |              |
|     begin calls by         |   |   |   | Contacts with   |              |
|     referring to previous  |   |   |   | Veterans"*      |              |
|     contacts and the       |   |   |   |                 |              |
|     information provided   |   |   |   |                 |              |
|     on the informed        |   |   |   |                 |              |
|     consent document.      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| In the previous version of |   |   |   |                 |              |
| this checklist, Elements   |   |   |   |                 |              |
| B13-B26 pertained to the   |   |   |   |                 |              |
| Memo from DUSHOM & CRADO   |   |   |   |                 |              |
| on 02/06/07                |   |   |   |                 |              |
| *"Certification by         |   |   |   |                 |              |
| Principal Investigators:   |   |   |   |                 |              |
| Security Requirements for  |   |   |   |                 |              |
| VA Research Information."* |   |   |   |                 |              |
| That Memo is rescinded as  |   |   |   |                 |              |
| of 04/01/08 and PIs are no |   |   |   |                 |              |
| longer required to         |   |   |   |                 |              |
| complete the checklist     |   |   |   |                 |              |
| annually. ORO is           |   |   |   |                 |              |
| coordinating with other VA |   |   |   |                 |              |
| and VHA offices to update  |   |   |   |                 |              |
| this checklist.            |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

+----------------------------+---+---+---+-----------------+--------------+
| C.  ***"Notifying Veterans |   |   |   |                 |              |
|     of Incidents Involving |   |   |   |                 |              |
|     Compromised Personal   |   |   |   |                 |              |
|     Information"* (Interim |   |   |   |                 |              |
|     Standard Operating     |   |   |   |                 |              |
|     Procedures (SOP),      |   |   |   |                 |              |
|     Office of Information  |   |   |   |                 |              |
|     & Technology, November |   |   |   |                 |              |
|     22, 2006)**            |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 1.  The substance of the   |   |   |   | Interim SOP,    |              |
|     notice to the veteran  |   |   |   | Section 1       |              |
|     about an incident      |   |   |   |                 |              |
|     involving personal     |   |   |   |                 |              |
|     information is reduced |   |   |   |                 |              |
|     to a stand-alone       |   |   |   |                 |              |
|     document and written   |   |   |   |                 |              |
|     in clear, concise, and |   |   |   |                 |              |
|     easy-to-understand     |   |   |   |                 |              |
|     language, capable of   |   |   |   |                 |              |
|     individual             |   |   |   |                 |              |
|     distribution and/or    |   |   |   |                 |              |
|     posting on VA's        |   |   |   |                 |              |
|     website and other      |   |   |   |                 |              |
|     information sites.     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2.  Written notifications  |   |   |   | Interim SOP,    |              |
|     to veterans include    |   |   |   | Section 1       |              |
|     all elements listed in |   |   |   |                 |              |
|     Section 1 of the SOP   |   |   |   |                 |              |
|     (see Footnote 3).      |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3.  All notifications use  |   |   |   | Interim SOP,    |              |
|     only the templates     |   |   |   | Section 2       |              |
|     attached to the SOP.   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4.  All notification       |   |   |   | Interim SOP,    |              |
|     letters (Initial       |   |   |   | Section 2       |              |
|     Incident Notification, |   |   |   |                 |              |
|     Credit Protection      |   |   |   |                 |              |
|     Notification, and      |   |   |   |                 |              |
|     Deceased Veteran       |   |   |   |                 |              |
|     Notification) are      |   |   |   |                 |              |
|     reviewed by facility   |   |   |   |                 |              |
|     incident response      |   |   |   |                 |              |
|     team, facility Office  |   |   |   |                 |              |
|     of Public and          |   |   |   |                 |              |
|     Intergovernmental      |   |   |   |                 |              |
|     Affairs, and Regional  |   |   |   |                 |              |
|     Counsel, as well as    |   |   |   |                 |              |
|     the VISN and National  |   |   |   |                 |              |
|     Level Incident         |   |   |   |                 |              |
|     response team, if      |   |   |   |                 |              |
|     appropriate.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5.  VISN Director and      |   |   |   | Interim SOP,    |              |
|     VACO-assigned VISN     |   |   |   | Section 2       |              |
|     DUSHOM Health System   |   |   |   |                 |              |
|     Specialist or          |   |   |   |                 |              |
|     designee, are notified |   |   |   |                 |              |
|     after the Notification |   |   |   |                 |              |
|     Letters receive local  |   |   |   |                 |              |
|     clearance and prior to |   |   |   |                 |              |
|     mailing to veterans.   |   |   |   |                 |              |
|     Institutional policies |   |   |   |                 |              |
|     specify who is         |   |   |   |                 |              |
|     responsible for        |   |   |   |                 |              |
|     notifying the VISN     |   |   |   |                 |              |
|     DUSHOM Health System   |   |   |   |                 |              |
|     Specialist or          |   |   |   |                 |              |
|     designee.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6.  No Notification        |   |   |   | Interim SOP,    |              |
|     Letters are mailed to  |   |   |   | Section 2       |              |
|     the veterans without   |   |   |   |                 |              |
|     first obtaining DUSHOM |   |   |   |                 |              |
|     and VHA Privacy Office |   |   |   |                 |              |
|     concurrence.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7.  Notification Letters   |   |   |   | Interim SOP,    |              |
|     regarding deceased     |   |   |   | Section 2       |              |
|     veterans are sent to   |   |   |   |                 |              |
|     veterans' next-of-kin, |   |   |   |                 |              |
|     and information in the |   |   |   |                 |              |
|     letters is tracked     |   |   |   |                 |              |
|     using the spreadsheet  |   |   |   |                 |              |
|     in Attachment D of the |   |   |   |                 |              |
|     SOP.                   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8.  Determination that     |   |   |   | Interim SOP,    |              |
|     credit protection      |   |   |   | Section 3       |              |
|     services should be     |   |   |   |                 |              |
|     offered is made        |   |   |   |                 |              |
|     according to Section 3 |   |   |   |                 |              |
|     of the SOP.            |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9.  Facility maintains a   |   |   |   | Interim SOP,    |              |
|     record of how          |   |   |   | Section 4       |              |
|     Promotional Codes for  |   |   |   |                 |              |
|     credit protection are  |   |   |   |                 |              |
|     dispersed and ensures  |   |   |   |                 |              |
|     that information       |   |   |   |                 |              |
|     listed in Section 4 of |   |   |   |                 |              |
|     the SOP is available   |   |   |   |                 |              |
|     when requested by      |   |   |   |                 |              |
|     VACO.                  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 10. Facility provides an   |   |   |   | Interim SOP,    |              |
|     800-number or local    |   |   |   | Section 5       |              |
|     call line to impacted  |   |   |   |                 |              |
|     veterans for questions |   |   |   |                 |              |
|     and implements all     |   |   |   |                 |              |
|     steps described in     |   |   |   |                 |              |
|     Section 5 of the SOP   |   |   |   |                 |              |
|     to ensure the lines    |   |   |   |                 |              |
|     are adequately and     |   |   |   |                 |              |
|     appropriately staffed. |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| D.  **VA Handbook 6500     |   |   |   |                 |              |
|     *"Information Security |   |   |   |                 |              |
|     Program"* (September   |   |   |   |                 |              |
|     18, 2007)**            |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 1.  All individuals with   |   |   |   | VA Handbook     |              |
|     access to VA           |   |   |   | 6500            |              |
|     information annually   |   |   |   | §5.b.(15)(c);   |              |
|     read, understand, and  |   |   |   | §5.b.(19)(f);   |              |
|     agree by signature to  |   |   |   | §6.b.(5)(a);    |              |
|     adhere to the VA       |   |   |   | Appendix G      |              |
|     National Rules of      |   |   |   |                 |              |
|     Behavior.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2.  Employees complete     |   |   |   | VA Handbook     |              |
|     annual security and    |   |   |   | 6500            |              |
|     privacy awareness      |   |   |   | §5.b.(18)(l);   |              |
|     training, annual       |   |   |   | §6.b            |              |
|     personnel contingency  |   |   |   | .(5)(a)(2)-(4); |              |
|     role training,         |   |   |   | §6.b.(10)(b)[4  |              |
|     incident response      |   |   |   | .]{.underline}; |              |
|     training and annual    |   |   |   | Appendix        |              |
|     refresher training.    |   |   |   | D.§3.h.;        |              |
|     Facility tests         |   |   |   | §6.b.(11)(b)    |              |
|     incident response      |   |   |   |                 |              |
|     capability annually,   |   |   |   |                 |              |
|     and conducts new       |   |   |   |                 |              |
|     employee orientation   |   |   |   |                 |              |
|     training on            |   |   |   |                 |              |
|     information security   |   |   |   |                 |              |
|     according to           |   |   |   |                 |              |
|     procedures described   |   |   |   |                 |              |
|     in §6.b.(11)(b).       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3.  Supervisors review     |   |   |   | VA Handbook     |              |
|     remote access user     |   |   |   | 6500            |              |
|     agreement annually,    |   |   |   | §5.b.(19)(i),   |              |
|     and notify local ISO   |   |   |   | (j), (k), (l),  |              |
|     of unfavorable results |   |   |   | & (n)           |              |
|     of background          |   |   |   |                 |              |
|     investigations and     |   |   |   |                 |              |
|     suspected incident     |   |   |   |                 |              |
|     upon discovery.        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4.  System                 |   |   |   | VA Handbook     |              |
|     interconnections       |   |   |   | 6500 §6.a.(13)  |              |
|     outside the accredited |   |   |   |                 |              |
|     boundary are monitored |   |   |   |                 |              |
|     and controlled. System |   |   |   |                 |              |
|     Interconnection        |   |   |   |                 |              |
|     Agreements (SIAs) are  |   |   |   |                 |              |
|     approved by the local  |   |   |   |                 |              |
|     OI&T management and    |   |   |   |                 |              |
|     the ISO, and SIAs or   |   |   |   |                 |              |
|     MOUs are obtained      |   |   |   |                 |              |
|     prior to connection.   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5.  No public access to    |   |   |   | VA Handbook     |              |
|     the VA's internal      |   |   |   | 6500 Appendix   |              |
|     networks is allowed    |   |   |   | D.§4.d.(8)(b)[  |              |
|     except when            |   |   |   | 1.]{.underline} |              |
|     appropriately          |   |   |   |                 |              |
|     mediated.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6.  Access granted to WOC  |   |   |   | VA Handbook     |              |
|     employees is limited   |   |   |   | 6500            |              |
|     to non-sensitive,      |   |   |   | §6.b.(1)(b)[    |              |
|     read-only information, |   |   |   | 6.]{.underline} |              |
|     whenever possible; and |   |   |   |                 |              |
|     request for access for |   |   |   |                 |              |
|     Volunteers, WOC and    |   |   |   |                 |              |
|     Work Study Students    |   |   |   |                 |              |
|     are routed through the |   |   |   |                 |              |
|     ISO for review and     |   |   |   |                 |              |
|     concurrence.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7.  Facility establishes   |   |   |   | VA Handbook     |              |
|     Physical Security      |   |   |   | 6500            |              |
|     Control System for IT  |   |   |   | §6.b.(4)(b)[2   |              |
|     areas listed in        |   |   |   | ]{.underline}.; |              |
|     §6                     |   |   |   | §6.b.(4)(b)[4   |              |
| .b.(4)(b)[2.]{.underline}, |   |   |   | ]{.underline}.; |              |
|     maintains visitor      |   |   |   | §6.b.(4)(b)[1   |              |
|     access logs that       |   |   |   | 3.]{.underline} |              |
|     include information    |   |   |   |                 |              |
|     described in           |   |   |   |                 |              |
|     §6                     |   |   |   |                 |              |
| .b.(4)(b)[4]{.underline}., |   |   |   |                 |              |
|     and maintain records   |   |   |   |                 |              |
|     of                     |   |   |   |                 |              |
|     repairs/modifications  |   |   |   |                 |              |
|     to physical components |   |   |   |                 |              |
|     of a facility that     |   |   |   |                 |              |
|     related to security.   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8.  Portable computers     |   |   |   | VA Handbook     |              |
|     that have sensitive    |   |   |   | 6500            |              |
|     information on their   |   |   |   | §6.b.(4)(b)[14. |              |
|     storage device(s) or   |   |   |   | d.]{.underline} |              |
|     have software that     |   |   |   | and             |              |
|     provides access to VA  |   |   |   | §6.b.(4)(b)[14. |              |
|     private networks, are  |   |   |   | e.]{.underline} |              |
|     secured under lock and |   |   |   | &               |              |
|     key when not in the    |   |   |   | [14.            |              |
|     immediate vicinity of  |   |   |   | f.]{.underline} |              |
|     the responsible        |   |   |   |                 |              |
|     employee, or when the  |   |   |   |                 |              |
|     computers must be left |   |   |   |                 |              |
|     in a meeting room, or  |   |   |   |                 |              |
|     other semi-public area |   |   |   |                 |              |
|     to which individuals   |   |   |   |                 |              |
|     other than the         |   |   |   |                 |              |
|     authorized employee    |   |   |   |                 |              |
|     have access, and       |   |   |   |                 |              |
|     follow clear desk      |   |   |   |                 |              |
|     practice in            |   |   |   |                 |              |
|     uncontrolled           |   |   |   |                 |              |
|     environment.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 9.  When traveling,        |   |   |   | VA Handbook     |              |
|     employees keep         |   |   |   | 6500            |              |
|     portable computers or  |   |   |   | §6.b.(4)(b)[14. |              |
|     storage devices in     |   |   |   | g.]{.underline} |              |
|     their possession, not  |   |   |   |                 |              |
|     in check-in baggage.   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 10. Mobile storage devices |   |   |   | VA Handbook     |              |
|     do not contain the     |   |   |   | 6500            |              |
|     only copy of sensitive |   |   |   | §               |              |
|     information. A back-up |   |   |   | 6.b.(4)(b)[14.h |              |
|     of the device must be  |   |   |   | .]{.underline}; |              |
|     created at regular     |   |   |   | §6.c.(4)(q)     |              |
|     intervals and stored   |   |   |   |                 |              |
|     securely.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 11. Personally owned       |   |   |   | VA Handbook     |              |
|     information systems    |   |   |   | 6500            |              |
|     are not used for       |   |   |   | §               |              |
|     official U.S.          |   |   |   | 6.b.(4)(b)[15.c |              |
|     Government business    |   |   |   | .]{.underline}; |              |
|     involving the          |   |   |   | §6.c.(3)(i)     |              |
|     processing, storage,   |   |   |   |                 |              |
|     or transmission of     |   |   |   |                 |              |
|     federal information    |   |   |   |                 |              |
|     unless a waiver is     |   |   |   |                 |              |
|     obtained from the      |   |   |   |                 |              |
|     Associate Deputy       |   |   |   |                 |              |
|     Assistant Secretary    |   |   |   |                 |              |
|     (ADAS) for the Office  |   |   |   |                 |              |
|     of Cyber Security      |   |   |   |                 |              |
|     (OCS).                 |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 12. Information systems or |   |   |   | VA Handbook     |              |
|     devices (software      |   |   |   | 6500            |              |
|     applications,          |   |   |   | §               |              |
|     thumb/zip/CD burner    |   |   |   | 6.b.(4)(b)[15.d |              |
|     drives, printers,      |   |   |   | .]{.underline}; |              |
|     etc.) not specifically |   |   |   | §6.c.(4)(e) &   |              |
|     purchase or authorized |   |   |   | (g)             |              |
|     by OI&T's Chief/CIO    |   |   |   |                 |              |
|     are not connected to   |   |   |   |                 |              |
|     VA networks or other   |   |   |   |                 |              |
|     OI&T resources.        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 13. Movement of computer   |   |   |   | VA Handbook     |              |
|     equipment from one     |   |   |   | 6500            |              |
|     physical location to   |   |   |   | §               |              |
|     another is authorized  |   |   |   | 6.b.(4)(b)[15.f |              |
|     by OI&T management.    |   |   |   | .]{.underline}; |              |
|                            |   |   |   | §6.c.(3)(c)     |              |
+----------------------------+---+---+---+-----------------+--------------+
| 14. When no longer needed, |   |   |   | VA Handbook     |              |
|     VA sensitive           |   |   |   | 6500            |              |
|     information is         |   |   |   | §6.b.(4)(b)[16. |              |
|     destroyed by a method  |   |   |   | d.]{.underline} |              |
|     rendering it           |   |   |   |                 |              |
|     unreadable,            |   |   |   |                 |              |
|     undecipherable, and    |   |   |   |                 |              |
|     irretrievable as       |   |   |   |                 |              |
|     outlined in VA's       |   |   |   |                 |              |
|     current electronic     |   |   |   |                 |              |
|     sanitization           |   |   |   |                 |              |
|     procedures.            |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 15. Employees follow       |   |   |   | VA Handbook     |              |
|     procedures described   |   |   |   | 6500            |              |
|     in VA Handbook 6500    |   |   |   | §6.b.(7)(b)[1   |              |
|     §6                     |   |   |   | 0.]{.underline} |              |
| .b.(7)(b)[10.]{.underline} |   |   |   |                 |              |
|     when handling viral or |   |   |   |                 |              |
|     malicious code         |   |   |   |                 |              |
|     infection.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 16. Employees,             |   |   |   | VA Handbook     |              |
|     contractors,           |   |   |   | 6500            |              |
|     subcontractors and     |   |   |   | §6.c.(3)(c);    |              |
|     volunteers transport,  |   |   |   | Appendix        |              |
|     transmit, access, and  |   |   |   | D.§4.b.(18)(d)[ |              |
|     use VA sensitive       |   |   |   | 2.]{.underline} |              |
|     information outside of |   |   |   |                 |              |
|     VA facilities only     |   |   |   |                 |              |
|     when their VA          |   |   |   |                 |              |
|     supervisor authorizes  |   |   |   |                 |              |
|     such actions in        |   |   |   |                 |              |
|     writing.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 17. VASI is not            |   |   |   | VA Handbook     |              |
|     transmitted via        |   |   |   | 6500            |              |
|     Internet or VA's       |   |   |   | §6.c.(3)(a)     |              |
|     internal network       |   |   |   |                 |              |
|     (Intranet) without     |   |   |   |                 |              |
|     proper security        |   |   |   |                 |              |
|     mechanisms that meet   |   |   |   |                 |              |
|     NIST FIPS 140-2        |   |   |   |                 |              |
|     criteria.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 18. Employees do not       |   |   |   | VA Handbook     |              |
|     simultaneously connect |   |   |   | 6500            |              |
|     to VA and one or more  |   |   |   | §6.c.(3)(f)     |              |
|     non-VA networks.       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 19. Only VA personnel      |   |   |   | VA Handbook     |              |
|     access VA-owned        |   |   |   | 6500            |              |
|     equipment used to      |   |   |   | §6.c.(3)(g)     |              |
|     process VA information |   |   |   |                 |              |
|     or access VA           |   |   |   |                 |              |
|     processing services.   |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 20. All requests for One   |   |   |   | VA Handbook     |              |
|     VA VPN accounts are    |   |   |   | 6500            |              |
|     approved by the        |   |   |   | §6.c.(3)(h)     |              |
|     immediate supervisor,  |   |   |   |                 |              |
|     the IT Chief/CIO and   |   |   |   |                 |              |
|     the ISO.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 21. ISO disables the       |   |   |   | VA Handbook     |              |
|     remote access account  |   |   |   | 6500            |              |
|     if it is not used for  |   |   |   | §6.c.(3)(q)     |              |
|     a period of 90 days    |   |   |   |                 |              |
|     and removes the        |   |   |   |                 |              |
|     account if it is not   |   |   |   |                 |              |
|     used for 6 months.     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 22. Upon termination of    |   |   |   | VA Handbook     |              |
|     the employees'         |   |   |   | 6500            |              |
|     required access        |   |   |   | §5.b.(19)(h);   |              |
|     privileges,            |   |   |   | §6.b.(1)(b)[5   |              |
|     supervisors confirm    |   |   |   | .]{.underline}; |              |
|     and notify the ISO     |   |   |   | §6.c.(3)(p);    |              |
|     that the employees     |   |   |   | Appendix        |              |
|     have returned all      |   |   |   | D.§3.a.(6)      |              |
|     VAGFE related to       |   |   |   |                 |              |
|     remote access.         |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 23. VA sensitive           |   |   |   | VA Handbook     |              |
|     information does not   |   |   |   | 6500            |              |
|     reside on other non-VA |   |   |   | §6.c.(4)(j) &   |              |
|     owned Other Equipment  |   |   |   | (k)             |              |
|     (OE) unless            |   |   |   |                 |              |
|     specifically           |   |   |   |                 |              |
|     designated and         |   |   |   |                 |              |
|     approved in advance by |   |   |   |                 |              |
|     the appropriate VA     |   |   |   |                 |              |
|     official (supervisor), |   |   |   |                 |              |
|     and a waiver has been  |   |   |   |                 |              |
|     issued by the VA's     |   |   |   |                 |              |
|     CIO. The non-VA        |   |   |   |                 |              |
|     systems or devices     |   |   |   |                 |              |
|     must conform to, or    |   |   |   |                 |              |
|     exceed, applicable VA  |   |   |   |                 |              |
|     security policies or   |   |   |   |                 |              |
|     are specifically       |   |   |   |                 |              |
|     authorized by official |   |   |   |                 |              |
|     VA policy.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 24. All remote systems     |   |   |   | VA Handbook     |              |
|     (VAGFE and OE) are     |   |   |   | 6500            |              |
|     equipped with, and     |   |   |   | §6.c.(4)(n)     |              |
|     use, a VA-approved     |   |   |   |                 |              |
|     antivirus software and |   |   |   |                 |              |
|     a personal (host-based |   |   |   |                 |              |
|     or enclave based)      |   |   |   |                 |              |
|     firewall that is       |   |   |   |                 |              |
|     configured with a      |   |   |   |                 |              |
|     VA-approved            |   |   |   |                 |              |
|     configuration.         |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 25. All devices used to    |   |   |   | VA Handbook     |              |
|     transmit and store VA  |   |   |   | 6500            |              |
|     information outside of |   |   |   | §6.c.(4)(o)     |              |
|     VA's protected         |   |   |   |                 |              |
|     environment use FIPS   |   |   |   |                 |              |
|     140-2 approved         |   |   |   |                 |              |
|     encryption. This       |   |   |   |                 |              |
|     includes laptops and   |   |   |   |                 |              |
|     thumb drives and other |   |   |   |                 |              |
|     removable storage      |   |   |   |                 |              |
|     devices                |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 26. Employees,             |   |   |   | VA Handbook     |              |
|     contractors,           |   |   |   | 6500            |              |
|     subcontractors, and    |   |   |   | §6.c.(4)(r)     |              |
|     volunteers immediately |   |   |   |                 |              |
|     report to his or her   |   |   |   |                 |              |
|     VA supervisor and the  |   |   |   |                 |              |
|     local ISO any incident |   |   |   |                 |              |
|     of theft, loss, or     |   |   |   |                 |              |
|     compromise of any VA   |   |   |   |                 |              |
|     sensitive information, |   |   |   |                 |              |
|     VA equipment or        |   |   |   |                 |              |
|     device, or any non-VA  |   |   |   |                 |              |
|     equipment or device    |   |   |   |                 |              |
|     used to transport,     |   |   |   |                 |              |
|     access, or store VA    |   |   |   |                 |              |
|     information.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 27. Portable and mobile    |   |   |   | VA Handbook     |              |
|     devices are not        |   |   |   | 6500            |              |
|     allowed access to any  |   |   |   | §6.c.(4)(s)     |              |
|     VA network without     |   |   |   |                 |              |
|     first meeting the VA's |   |   |   |                 |              |
|     and the facility's     |   |   |   |                 |              |
|     security policies,     |   |   |   |                 |              |
|     procedures, and        |   |   |   |                 |              |
|     configuration          |   |   |   |                 |              |
|     standards.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 28. Wireless devises are   |   |   |   | VA Handbook     |              |
|     equipped with FIPS     |   |   |   | 6500            |              |
|     140-2 Encryption       |   |   |   | §6.c.(4)(u)     |              |
|     unless a waiver has    |   |   |   |                 |              |
|     been approved by the   |   |   |   |                 |              |
|     CIO, up-to-date on the |   |   |   |                 |              |
|     latest anti-viral and  |   |   |   |                 |              |
|     software/security      |   |   |   |                 |              |
|     patch remediation as   |   |   |   |                 |              |
|     applicable, and        |   |   |   |                 |              |
|     authentication.        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 29. Data communication     |   |   |   | VA Handbook     |              |
|     pathways from VA       |   |   |   | 6500 §6.c.(6)   |              |
|     facilities to non-VA   |   |   |   |                 |              |
|     business partners that |   |   |   |                 |              |
|     cannot pass through    |   |   |   |                 |              |
|     the One-VA Internet    |   |   |   |                 |              |
|     gateways are fully     |   |   |   |                 |              |
|     documented and must    |   |   |   |                 |              |
|     have OI&T Chief/CIO    |   |   |   |                 |              |
|     and ISO approvals.     |   |   |   |                 |              |
|     These connections are  |   |   |   |                 |              |
|     managed and            |   |   |   |                 |              |
|     coordinated with and   |   |   |   |                 |              |
|     by the VA NSOC.        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 30. Electronic mail is     |   |   |   | VA Handbook     |              |
|     used for authorized    |   |   |   | 6500            |              |
|     government purposes    |   |   |   | §6.c.(7)(a)     |              |
|     and contains only      |   |   |   |                 |              |
|     non-sensitive          |   |   |   |                 |              |
|     information unless the |   |   |   |                 |              |
|     information is         |   |   |   |                 |              |
|     appropriately          |   |   |   |                 |              |
|     encrypted.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 31. Email messages are not |   |   |   | VA Handbook     |              |
|     automatically          |   |   |   | 6500            |              |
|     forwarded to addresses |   |   |   | §6.c.(7)(b)     |              |
|     outside the VA         |   |   |   |                 |              |
|     network.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 32. Facility controls all  |   |   |   | VA Handbook     |              |
|     physical access        |   |   |   | 6500 Appendix   |              |
|     points, except for     |   |   |   | D.§3.b.(3)(a)   |              |
|     those areas within the |   |   |   |                 |              |
|     facility officially    |   |   |   |                 |              |
|     designated as publicly |   |   |   |                 |              |
|     accessible, and        |   |   |   |                 |              |
|     verifies individual    |   |   |   |                 |              |
|     access authorizations  |   |   |   |                 |              |
|     before granting        |   |   |   |                 |              |
|     access.                |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 33. Intranet access points |   |   |   | VA Handbook     |              |
|     are equipped with      |   |   |   | 6500 Appendix   |              |
|     network-based          |   |   |   | D.§3.f.(5)(a)   |              |
|     intrusion detection    |   |   |   |                 |              |
|     systems.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 34. Scanning for           |   |   |   | VA Handbook     |              |
|     unauthorized wireless  |   |   |   | 6500 Appendix   |              |
|     access points is       |   |   |   | D.§4.b.(19)(c)  |              |
|     conducted at least     |   |   |   |                 |              |
|     monthly.               |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 35. The number of access   |   |   |   | VA Handbook     |              |
|     points to the          |   |   |   | 6500 Appendix   |              |
|     information system is  |   |   |   | D.§4.d.(8)(b)[  |              |
|     limited to allow for   |   |   |   | 3.]{.underline} |              |
|     better monitoring of   |   |   |   |                 |              |
|     inbound and outbound   |   |   |   |                 |              |
|     network traffic.       |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 36. Passwords for access   |   |   |   | VA Handbook     |              |
|     to individual          |   |   |   | 6500 Appendix   |              |
|     workstations, such as  |   |   |   | F.§3.e.(15)     |              |
|     passwords for screen   |   |   |   |                 |              |
|     savers, are encrypted  |   |   |   |                 |              |
|     when stored            |   |   |   |                 |              |
|     electronically.        |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| E.  **VHA Handbook 1605.1  |   |   |   |                 |              |
|     "Privacy and Release   |   |   |   |                 |              |
|     of Information" (May   |   |   |   |                 |              |
|     17, 2006)**            |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 1.  VHA investigators      |   |   |   | VHA Handbook    |              |
|     obtain written         |   |   |   | 1605.1          |              |
|     authorization or a     |   |   |   | §13a(2)(b)      |              |
|     waiver of              |   |   |   |                 |              |
|     authorization          |   |   |   |                 |              |
|     requirement from IRB   |   |   |   |                 |              |
|     for using VHA          |   |   |   |                 |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     health information     |   |   |   |                 |              |
|     involving non-employee |   |   |   |                 |              |
|     research subjects for  |   |   |   |                 |              |
|     research purposes.     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 2.  VHA investigators use  |   |   |   | VHA Handbook    |              |
|     the requested data     |   |   |   | 1605.1          |              |
|     only in a manner       |   |   |   | §13a(2)(d)      |              |
|     consistent with the    |   |   |   |                 |              |
|     approved research      |   |   |   |                 |              |
|     protocol for which the |   |   |   |                 |              |
|     information was        |   |   |   |                 |              |
|     requested.             |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 3.  Disclosure of          |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1605.1 §13b     |              |
|  individually-identifiable |   |   |   |                 |              |
|     information to non-VHA |   |   |   |                 |              |
|     investigators for      |   |   |   |                 |              |
|     research purposes is   |   |   |   |                 |              |
|     approved by CRADO.     |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 4.  Written authorization  |   |   |   | VHA Handbook    |              |
|     is obtained for        |   |   |   | 1605.1          |              |
|     disclosing VHA         |   |   |   | §13b(1)(a)      |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     health information     |   |   |   |                 |              |
|     involving non-employee |   |   |   |                 |              |
|     research subjects by   |   |   |   |                 |              |
|     VHA investigators to   |   |   |   |                 |              |
|     non-VHA investigators  |   |   |   |                 |              |
|     for research purposes. |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 5.  Without prior written  |   |   |   | VHA Handbook    |              |
|     authorization,         |   |   |   | 1605.1          |              |
|     disclosure of          |   |   |   | §13b(1)(b)      |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     health information,    |   |   |   |                 |              |
|     excluding 38 USC       |   |   |   |                 |              |
|     §7332-protected        |   |   |   |                 |              |
|     information, to        |   |   |   |                 |              |
|     Federal investigators  |   |   |   |                 |              |
|     is made only when the  |   |   |   |                 |              |
|     Under Secretary for    |   |   |   |                 |              |
|     Health or designee has |   |   |   |                 |              |
|     approved the research  |   |   |   |                 |              |
|     and an IRB or Privacy  |   |   |   |                 |              |
|     Board has waived the   |   |   |   |                 |              |
|     authorization          |   |   |   |                 |              |
|     requirement.           |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 6.  Without prior written  |   |   |   | VHA Handbook    |              |
|     authorization,         |   |   |   | 1605.1          |              |
|     disclosure of          |   |   |   | §13b(1)(c)      |              |
|                            |   |   |   |                 |              |
|  individually-identifiable |   |   |   |                 |              |
|     health information,    |   |   |   |                 |              |
|     excluding 38 USC       |   |   |   |                 |              |
|     §7332-protected        |   |   |   |                 |              |
|     information and names  |   |   |   |                 |              |
|     and addresses of the   |   |   |   |                 |              |
|     individual subjects,   |   |   |   |                 |              |
|     to non-Federal         |   |   |   |                 |              |
|     investigators is made  |   |   |   |                 |              |
|     only when approval by  |   |   |   |                 |              |
|     the Under Secretary    |   |   |   |                 |              |
|     for Health or designee |   |   |   |                 |              |
|     and waiver of          |   |   |   |                 |              |
|     authorization          |   |   |   |                 |              |
|     requirement by IRB or  |   |   |   |                 |              |
|     Privacy Board are      |   |   |   |                 |              |
|     obtained.              |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 7.  Title 38 USC           |   |   |   | VHA Handbook    |              |
|     §7332-protected        |   |   |   | 1605.1          |              |
|     information is         |   |   |   | §13b(1)(d)      |              |
|     disclosed without      |   |   |   |                 |              |
|     written authorization  |   |   |   |                 |              |
|     only when conditions   |   |   |   |                 |              |
|     listed in VHA Handbook |   |   |   |                 |              |
|     1605.1 §13b(1)(d) are  |   |   |   |                 |              |
|     met (see Footnote 4).  |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| 8.  The                    |   |   |   | VHA Handbook    |              |
|                            |   |   |   | 1605.1          |              |
|  individually-identifiable |   |   |   | §13b(2)(a)      |              |
|     information of         |   |   |   |                 |              |
|     research subjects in   |   |   |   |                 |              |
|     their capacity as VHA  |   |   |   |                 |              |
|     employees, excluding   |   |   |   |                 |              |
|     health information, is |   |   |   |                 |              |
|     disclosed to non-VHA   |   |   |   |                 |              |
|     Investigators for      |   |   |   |                 |              |
|     research purposes      |   |   |   |                 |              |
|     without written        |   |   |   |                 |              |
|     authorization only in  |   |   |   |                 |              |
|     accordance with the    |   |   |   |                 |              |
|     Privacy Act and        |   |   |   |                 |              |
|     applicable VA privacy  |   |   |   |                 |              |
|     policy.                |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| F.  **VA Handbook 5011/5   |   |   |   |                 |              |
|     "Hours of Duty and     |   |   |   |                 |              |
|     Leave" (September 22,  |   |   |   |                 |              |
|     2005)**                |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+
| Each research service      |   |   |   | VA Handbook     |              |
| employee with alternate    |   |   |   | 5011/5          |              |
| workplace arrangement has  |   |   |   | 6.(c)(1-10)     |              |
| properly executed          |   |   |   |                 |              |
| Alternative Workplace      |   |   |   |                 |              |
| Telework Agreement; a Form |   |   |   |                 |              |
| 0740a, Telework Proposal;  |   |   |   |                 |              |
| and VA Form 0740b,         |   |   |   |                 |              |
| Telework                   |   |   |   |                 |              |
| Self-Certification Safety  |   |   |   |                 |              |
| Checklist Work-at-Home.    |   |   |   |                 |              |
+----------------------------+---+---+---+-----------------+--------------+

**Acronyms are found in Appendix A.**

**Footnotes:**

1.  The facility policies and procedures include adequate provisions to
    meet applicable requirements in the following regulations:

```{=html}
<!-- -->
```
(1) HIPAA Privacy Rule, 45 CFR Parts 160 and 164

(2) Privacy Act of 1974 and 5 USC 552a

(3) VA Claims Confidentiality Statute, 38 USC 5701

(4) Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse,
    Infection with Human Immunodeficiency Virus (HIV), and Sickle Cell
    Anemia Medical Records, 38 USC 7332

(5) Confidentiality of Healthcare Quality Assurance Review Records, 38
    USC 5705

```{=html}
<!-- -->
```
2.  By reviewing education records and conducting interviews, members of
    assessment team will determine whether employees handle information
    properly according to VA policies in

```{=html}
<!-- -->
```
(1) VA Handbooks 5011/5 Chapter 4 "Alternative Workplace Arrangement"

(2) VA Handbook 6500 "Information Security Program."

(3) VA Handbook 6502 "Privacy Policies"

```{=html}
<!-- -->
```
3.  The notice to the veteran about an incident involving personal
    information should include the following elements:

```{=html}
<!-- -->
```
(1) A brief description of what happened;

(2) To the extent possible, a description of the types of personal
    information that were involved in the incident (e.g., full name,
    SSN, date of birth, home address, account number, disability code,
    etc.);

(3) A brief description of what the agency is doing to investigate the
    breach, to mitigate losses, and to protect against any further
    breaches;

(4) Contact procedures for those wishing to ask questions or learn
    additional information, including a toll-free telephone number,
    website, and/or postal address; and

(5) Steps individuals should take to protect themselves from the risk of
    identity theft, including steps to take advantage of Equifax credit
    protection and contact information for the Federal Trade Commission
    (FTC) website and publications.

```{=html}
<!-- -->
```
4.  Title 38 U.S.C. 7332-protected information may be disclosed without
    written authorization. The research protocol must indicate:

```{=html}
<!-- -->
```
(1) The information must be maintained in accordance with the security
    requirements of 38 CFR Section 1.466, or more stringent
    requirements;

(2) The information will not be re-disclosed except back to VA; and

(3) The information will not identify any individual patient in any
    report of the research, or otherwise disclose patient identities.

> **APPENDIX A**

**ACCRONYMS**

  ------------- ---------------------------------------------------------
  ADAS          Associate Deputy Assistant Secretary

  ACOS/R&D      Associate Chief of Staff for Research and Development

  CD ROM        Compact Disc Read-Only Memory

  CIO           Chief Information Officer

  CRADO         Chief Research and Development Officer

  CFR           Code of Federal Regulations

  DUSHOM        Deputy Under Secretary for Health for Operations &
                Management

  OE            Other Equipment

  FIPS          Federal Information Processing Standards

  FISMA         Federal Information Security Management Act of 2002

  FTC           Federal Trade Commission

  HIPAA         Health Insurance Portability and Accountability Act of
                1996

  IRB           Institutional Review Board

  ISO           Information Security Officer

  IT            Information Technology

  NIST          National Institute of Standards and Technology

  OCS           Office of Cyber Security

  OI&T          Office of Information and Technology

  PDUSH         Principal Deputy Under Secretary for Health

  PHI           Protected Health Information

  PO            Privacy Officer

  R&D           Research and Development

  SOP           Standard Operating Procedure

  SSN           Social Security Number

  VACO          Department of Veterans Affairs Central Office

  VAGFE         VA-owned Government Furnished Equipment

  VASI          VA Sensitive Information

  VHA           Veterans Health Administration

  VISN          Veterans Integrated Service Network

  VPN           Virtual Private Network
  ------------- ---------------------------------------------------------