Laserfiche WebLink
Exhibit A <br />g. When it is not feasible or practical to segregate DSHS Data from non-DSHS data, then both the <br />DSHS Data and the non-DSHS data with which it is commingled must be protected as described in <br />this exhibit. <br />5. Data Disposition. When the contracted work has been completed or when no longer needed, except <br />as noted in Section 3. Protection of Data b. Network Server Disks above, Data shall be returned to <br />DSHS or destroyed. Media on which Data may be stored and associated acceptable methods of <br />destruction are as follows: <br />Data stored on: <br />Server or workstation hard disks, or <br />Will be destroyed by: <br />Using a "wipe" utility which will overwrite the Data at <br />least three (3) times using either random or single <br />Removable media (e.g. floppies, USB flash drives, character data, or <br />portable hard disks) excluding optical discs <br />Paper documents with sensitive or Confidential <br />Information <br />Paper documents containing Confidential Information <br />requiring special handling (e.g. protected health <br />information) <br />Degaussing sufficiently to ensure that the Data cannot <br />be reconstructed, or <br />Physically destroying the disk <br />Recycling through a contracted firm provided the <br />contract with the recycler assures that the <br />confidentiality of Data will be protected. <br />On-site shredding, pulping, or incineration <br />- — -- ............ <br />Optical discs (e.g. CDs or DVDs) Incineration, shredding, or completely defacing the <br />readable surface with a coarse abrasive <br />Magnetic tape Degaussing, incinerating or crosscut shredding <br />6. Notification of Compromise or Potential Compromise. The compromise or potential compromise of <br />DSHS shared Data must be reported to the DSHS Contact designated in the Contract within one (1) <br />business day of discovery. If no DSHS Contact is designated in the Contract, then the notification must <br />be reported to the DSHS Privacy Officer at dshsprivacyofficer@dshs.wa.gov. Contractor must also <br />take actions to mitigate the risk of loss and comply with any notification or other requirements imposed <br />by law or DSHS. <br />7. Data shared with Subcontractors. If DSHS Data provided under this Contract is to be shared with a <br />subcontractor, the Contract with the subcontractor must include all of the data security provisions within <br />this Contract and within any amendments, attachments, or exhibits within this Contract. If the <br />Contractor cannot protect the Data as articulated within this Contract, then the contract with the sub - <br />Contractor must be submitted to the DSHS Contact specified for this contract for review and approval. <br />DSHS Central Contract Services Page 19 <br />1769CS County Agreement 6-15-2017 <br />