VA & Federal
Compliance & Security Architecture
The regulatory, security, and accessibility posture procurement officers and ISSOs need to evaluate federal readiness.
Regulatory Compliance Status
Device Status
- Device classification: Class II
- Indication for use: continuous cardiac and respiratory monitoring in ambulatory heart failure patients
Cloud Platform Security
- Platform: purpose-built secure medical cloud
- Encryption: AES-256 at rest, TLS 1.3 in transit
- Continuous monitoring: CISO-approved
Federal Information Security
- VHA Directive 1189 (RPM): Compliant
- Information Security Policy: Implemented
- Information Security Program: Full compliance
Data Security & Encryption
Transport Security
- All data transmission over TLS 1.3
- No unencrypted data transfer
- Certificate pinning implemented
Data at Rest
- Storage encryption: FIPS 140-3 validated cryptographic modules
- Key management: VA-controlled
- Encryption algorithm: AES-256
Authentication & Authorization
- Multi-factor authentication (MFA) required for all users
- Role-based access control (RBAC) configurable by VA
- Session management with automatic timeout
- Audit logging: all access logged and retained
Accessibility (Section 508)
Full WCAG 2.1 AA compliance verified. Section 508 VPAT published.