VA · VA-24-2791 · record R2218

Internet of Medical Things (IoMT) Inventory

Department of Veterans Affairs · VHA: Veterans Health Administration

Overview

Development stage: PilotSource: b) Pilot – The use case has been deployed in a limited test or pilot capacity.
High-impact designation: Not high-impactSource: c) Not high-impact
Impact justification: Not reported
Start date: Not reported
Withheld from public reporting: Not reported

Mission

Topic area: Cybersecurity
Operational functions: Clinical and medical Derived by keyword rules; see methodology

Problem the AI is intended to solve

Automated categorization of medical devices based on MAC Address, installed software, network activity, etc.: the previous method was to schedule down time with clinical staff to manually verify if patches and vulnerabilities were installed and if not, manually install them.

Expected benefits

Used to identify devices and report operating system (OS) updates and vulnerability patches that have been installed to meet agency's NIST requirements. This will result in savings in personnel time (work hours) and reduce the downtime of a medical device.

System outputs

AI Use Case has AI via ML collect and organize information, then a person acts on it. A person generates a report and AI then collects and organizes the information in a format the user requested. The output will allow the user to see what systems have and have not been patched, are properly configured, etc.

Technology

AI classification: Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…
System name(s): Not reported
Custom-developed code: No
Public source code: Not reported

Sourcing

How it was built: Purchased from vendorSource: a) Purchased from a vendor
Vendor (as reported): Not reported
Vendors (standardized): None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII: Not reported
Privacy Impact Assessment: Not reported
Authorization to Operate: Not reported
Demographic features: Not reported
Training and evaluation data: Not reported
Federal Data Catalog: Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Pre-deployment testingNo answer reported

AI impact assessmentNo answer reported

Independent reviewNo answer reported

Ongoing monitoringNo answer reported

Operator trainingNo answer reported

Fail-safeNo answer reported

Appeal processNo answer reported

User and public consultationNo answer reported

Potential impacts and how they were identified

Not reported