Q-Net

QualityNet (Q-Net) is a general support system (GSS) that supports thirteen (13) diverse Center for Clinical Standards and Quality (CCSQ) Information Technology (IT) major applications (MA), in addition to supporting Network of Quality Improvement and Innovation Contractors (NQIIC) communities, and Clinical Data Abstraction Center (CDAC) via hosting, supporting, and maintenance of its AWS infrastructure, Commercial off-the-Shelf (COTS) applications and tools. The thirteen (13) MAs that operate and are supported, are not a part of the GSS boundary.

Q-Net is built and maintained within a CCSQ GOCO (Government Owned Contractor Operated) instance of Amazon Web Services (AWS) as the Cloud Service Provider (CSP) for hosting the supported Q-Net implementation. The GSS leverages the AWS East/West Regions for redundancy. The primary goal of the Q-Net Cloud is to add agility and flexibility to the delivery of Information Technology (IT) infrastructure and contractors to facilitate faster delivery of application services to Q-Net end users.

There are two (2) different service models within the Q-Net cloud which are leveraged under the CCSQ contract (Managed-Service and Self–Service). The Managed service model allows Application Developer Organizations (ADO) to update/maintain their system and manage their lower environments. Under the Self–Service model, the ADO is responsible for update/maintenance of their system, as well as managing servers and all environments.

The system is a General Support System (GSS) and does not directly collect or store information. The applications, systems services and tools residing in the GSS collect and store information. Therefore, individual Privacy Impact Assessments (PIAs) have been prepared and submitted for those specific applications and systems residing on this GSS. 

The QualityNet (QNet) Wide Area Network (WAN)/Local Area Network (LAN) network configuration provides the WAN/LAN connectivity and support for the Health Care Quality Improvement System that comprises of 13 Major Applications that collect information and operate within QNet network infrastructure:

CCSQ Data repository and Analytics Platform (CDRAP);
Delivery Administration, Report, and Repository Tool (DARRT);
Data Element Library (DEL); 
ESRD Quality Reporting System (EQRS); 
Financial Information and Vouchering System Next generation (FIVS NG);
Hospital Quality Reporting (HQR);
Internet Quality Improvement and Evaluation System (iQIES); 
Measure Authoring Tool (MAT);
Quality Improvement and Evaluation System (QIES); 
Quality Management and Review System (QMARS); 
QNET Enterprise Services (QNET ES); 
Quality Service Center (QSC); 
Survey and Certification Quality, Certification and Oversight Reports (SC QCOR). 

The GSS validates a user’s identity and access privileges via Health Care Quality Information Systems (HCQIS) Access Roles and Profile (HARP) which is covered by a separate PIA. 

Additionally, Q-Net uses AWS Active Directory (AD) for authentication. Only active AD accounts can log into AWS. User credentials are stored in Q-Net, which include, username, user ID, name, organization, work email address, phone number, and sometimes title.

The system is a General Support System (GSS) and does not directly collect or store information. The applications/systems residing on the GSS collect and store information. Therefore, individual PIAs have been prepared and submitted for the applications/systems residing on this GSS. 

The QualityNet (QNet) Wide Area Network (WAN)/Local Area Network (LAN) network configuration provides the WAN/LAN connectivity and support for the Health Care Quality Improvement System that comprises of 13 Major Applications that collect information and operate within QNet network infrastructure:

CCSQ Data repository and Analytics Platform (CDRAP);
Delivery Administration, Report, and Repository Tool (DARRT);
Data Element Library (DEL); 
ESRD Quality Reporting System (EQRS); 
Financial Information and Vouchering System Next generation (FIVS NG);
Hospital Quality Reporting (HQR);
Internet Quality Improvement and Evaluation System (iQIES); 
Measure Authoring Tool (MAT);
Quality Improvement and Evaluation System (QIES); 
Quality Management and Review System (QMARS); 
QNET Enterprise Services (QNET ES); 
Quality Service Center (QSC); 
Survey and Certification Quality, Certification and Oversight Reports (SC QCOR).

The GSS validates a user’s identity and access privileges via HARP which is covered by a separate PIA.

Additionally, Q-Net uses AWS Active Directory for authentication. Only active AD accounts can log into AWS. Additionally, User credentials are stored in Q-Net, which include, username, user ID, name, organization, work email address, phone number, and sometimes title.

• Name
• E-Mail Address
• Phone Numbers
• Other - User account information: username / user ID, organization, and sometimes title.

• Employees
• Vendors/Suppliers/Contractors

• In-Person

• Within the OPDIV

• Users: Users have access to PII to perform their job duties.
• Administrators: Administrators have authority to create user accounts.
• Contractors: All contractors are users and/or administrators in this system. All contractors are direct contractors.

User credentials are maintained until the user is no longer working on the system, or access is no longer required. The credentials are removed from the system as part of the routine maintenance of terminations and account maintenance. The General Records Schedule (GRS) is DAA-GRS-2013-0006 which states the retention period is "Destroy 1 year(s) after user account is terminated or password is altered or when no longer needed for investigative or security purposes, whichever is appropriate."

Each major application that resides on this system documents its retention policy in its respective PIA.

Administrative controls include but are not limited to contingency plans and annual testing, backups of all files, background checks for all personnel, incident response procedures for timely response to security and privacy incidents, Initial security training with refresher courses annually, and annual role-based security training for personnel with assigned security roles and responsibilities.

Technical controls include but are not limited to user authentication with least privilege authorization, firewalls, Intrusion Detection and Prevention systems (IDS/IPS), encrypted communications, auditing, and correlation of audit logs from systems.

Management controls include but are not limited to: Authority to Operate (ATOs), annual security assessments, monthly management of outstanding corrective action plans, ongoing risk assessments, and automated continuous monitoring.

The physical controls are handled through Amazon Web Services (AWS) since this system had a full migration.