B--Security Assessment for Omaha VA Hospital

Security Assessment Consultant Background: The VA Nebraska-Western Iowa Health Care System is an organization within the Department of Veterans Affairs, Veterans Health Administration. As such, the Health Care System has recently been given a significant number of new security regulations to implement within a short timeframe. Of particular interest are the new rules which are impacting the management of data for various research projects. In order to formulate a plan which can be acted upon and meet requirements for a 1 July certification by the Healthcare System director, an assessment must be conducted and an action plan must be developed. The objective statement and outline of deliverables defines the support needed. Objective VA Nebraska-Western Iowa Health Care System is seeking assistance to assess and recommend improvements to the current data security processes in place within the research department. The results should include recommendations and solutions to the following issues: Compliance with VA Security requirements. Organization of information (Data stored on Government Equipment on site within the VA or Equipment located at non-VA locations - UNMC or Creighton) Tools (Current and needed tools to encrypt data and manage access and transfer of data in the VA, in controlled, and perhaps uncontrolled environments outside the VA, and on laptops) Existing study activities (Inventory of study activities) This is a review of the various research studies which are on-going or planned within the VA research department and affiliated universities, and an assessment of the risk and data security associated with those studies. Deliverables The Consultant will provide comprehensive support in the delivery of products and materials associated with this request. In satisfying this request the deliverables include: Written recommendations and assessments as stated above Recommendations for tools which can be applied to provide greater control and audit reporting associated with the data maintained on all VA and non-VA platforms A training plan or program guide to ensure researchers (and support personnel) are properly informed of their responsibilities and to help them use tools to more effectively secure VA data. Assessment Criteria Knowledge of VA Security Rules Knowledge of information technology and security vulnerability issues Experience with medical information and medical facilities Responsiveness to solicitation Cost Government responsibility The VA will provide support as necessary to facilitate information gathering for the assessment part of this effort. VA will provide contact information to support coordination with VA OCIS, UNMC, and Creighton resources The VA will provide copies of current VA regulations and directives which are the foundation for VA compliance Consultant responsibility The consultant will conduct interviews, audit documentation, and analyze existing processes. The consultant will plan the assessment process and schedule activities in advance to allow VA escorting and participation The consultant will provide their own equipment for the purposes of developing deliverable documentation.