Sub-Contract between Yakima Neighborhood Halth Services and KCPHD

Home Browse Search

DocuSign Envelope ID: 62955F1D-7A37-4CB0-A8D8-2BA7ADB5515E smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. For EXCHANGE Confidential Information stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secured Area and otherwise meet the requirements listed in the above paragraph. Destruction of the Data as outlined in Section 5. Data Disposition may be deferred until the disks are retired, replaced, or otherwise taken out of the Secured Area. c. Removable Media, including Optical discs (CDs or DVDs) in local workstation optical disc drives and which will not be transported out of a secure area. Sensitive or Confidential Data provided by HBE on removable media, such as optical discs or USB drives, which will be used in local workstation optical disc drives or USB connections shall be encrypted with 128 -bit AES encryption or better. When not in use for the contracted purpose, such discs must be locked in a drawer, cabinet or other container to which only authorized users have the key, combination or mechanism required to access the contents of the container. Workstations which access EXCHANGE Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers and which will not be transported out of a secure area. Data provided by HBE on optical discs which will be attached to network servers shall be encrypted with 128 -bit AES encryption or better. Access to Data on these discs will be restricted to authorized users through the use of access control lists which will grant access only after the authorized user has been authenticated to the network using a unique user ID and complex password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. e. Paper documents. All paper records must be protected by storing the records in a secure area which is only accessible to authorized personnel. When not in use, such records must be stored in a locked container, such as a file cabinet, locking drawer, or safe, to which only authorized persons have access. f. Access via remote terminal/workstation over the State Governmental Network (SGN) or WA Health Benefit Exchange network (EXCHANGE Network). Data accessed and used interactively over the SGN or EXCHANGE Network. Access to the Data will be controlled by EXCHANGE staff who will issue authentication credentials (e.g. a unique user ID and complex password) to authorized contractor staff. Contractor shall have established and documented access termination procedures for existing staff with access to EXCHANGE Data. These procedures shall be provided to EXCHANGE staff upon request. The Contractor will notify EXCHANGE staff immediately whenever an authorized person in possession of such credentials is terminated or otherwise leaves the employment of the contractor, and whenever a user's duties change such that the user no longer requires access to perform work for this Contract. g. Access via remote terminal/workstation over the Internet through Secure Access Washington. Data accessed and used interactively over the Internet. Access to the Data will be controlled by EXCHANGE staff who will issue remote access authentication credentials (e.g. a unique user ID and complex password) to authorized contractor staff. Contractor will HBE-349 YNHS Exhibit D — Data Security Requirements Page 25 of 41