Sleep Lab Management

2026-11-03

SEC 1 SECTION 1 — System , Application & Data Overview Vendor Response 1a Does the system / application handle PHI , PII , PCI , Financial , Regulatory , or other sensitive / critical data ? Please specify data types . 1b Is the solution hosted on ‑ premises at UConn Health , vendor ‑ hosted , or hybrid ? 1c If vendor ‑ hosted , Identify the hosting provider ( e . g ., AWS , Azure , etc .). 1d If vendor hosted have supporting systems attained a 3rd party assessment ( i . e . SSAE - 16 SOC Type audit / review )? If yes , please provide . 1e If not using a third ‑ party cloud provider , describe physical security controls at your data center . 1f Do you conduct vulnerability scans and periodic penetration tests on your applications and networks ? 1g Provide cybersecurity whitepapers , architectural diagrams , MDS2 , and other security documentation . 1h Provide SLA information related to system uptime , downtime , and service disruption . SEC 2 SECTION 2 — Hosting , Infrastructure & System Requirements Vendor Response 2a Server requirements ( physical or virtual ). 2b If virtual is an option , provide approved hypervisor that are supported and any requirements . 2c What is the expected storage requirement in GB , including 5 ‑ year projected growth . 2d Operating system requirements ( server and workstation ). 2e Can all operating system patches be applied without vendor validation ? 2f Can UConn Health deploy CrowdStrike on all involved servers / workstations ? 2g Provide desktop specifications required for deployment . 2h Who is responsible for application / system administration ? SEC 3 SECTION 3 — User Access , Authentication & Identity Management Vendor Response 3a If system comes installed with default accounts , can they be modified / removed ( i . e . accounts with generic names such as " admin " or " guest ") 3b Does the system prohibit shared / generic accounts ? 3c User access management can be conducted by a UConn Health Application Owner / System Administrator - If no , specify in " Response " who will manage this . 3d Does the application support Multi - Factor Authentication ( MFA )? 3e Does the application support Role - Based Access Control ( RBAC )? 3f Are there session time - out controls to force re - authentication / login due to inactivity - Specify criteria in " Response " column 3g Is there a session time - out that blacks out or hides state of activity for sessions shown on screens / monitors 3h Does the System / Application has the ability to interface with client ’ s enterprise directory services ( e . g . AD , LDAP ) for user authentication . If Yes - skip to Section 4 3i Authentication requirements ( unique IDs , no blank passwords , etc .) 3j Password controls ( complexity , expiration , history , age ). 3k Password reset process ( self - service or admin - assisted ). 3l Account lockout controls . 3m Session timeout controls . SEC 4 SECTION 4 — Security Controls & System Hardening Vendor Response 4a Do servers have anti - virus / anti - malware mechanisms that are current and actively running ? Who is responsible for maintaining these programs ? 4b Is UConn Health responsible for system OS patches ? If No , does the Vendor routinely implement patching in a timely fashion ? How often does patching occur ? 4c Are all interactions / transmissions with the application utilizing strong encryption protocols ? Please specify encryption in " Response " column 4d How do you ensure the solution does not introduce cybersecurity risk ? 4e Do you maintain Incident Response , Disaster Recovery , and Business Continuity Plans ? SEC 5 SECTION 5 — Logging , Monitoring & Auditing Vendor Response 5a List which audit events can be captured ( login , data changes , transmissions , failed logins ). 5b Can logs be modified or deleted ? 5c What are the log retention and reporting capabilities ? 5d Can the System / Application forward logs to a SIEM ( Security Information and Event Management )? ( e . g ., QRadar ). 5e Can the System / Application generate Ad Hoc reports containing the data elements listed above ? SEC 6 SECTION 6 — Network , Interfaces & Integration Vendor Response 6a Do you require HL7 / FHIR integration to EMR or other applicable systems ? 6b Data transmission method ( VPN , interface , API ). 6c Do you require data extracts from our EMR ? If yes , please include the types of date extracts required . 6d Are you a Covered Entity under HIPAA ?

Connecticut

2026-05-05