Child Death Review Case Reporting System Data Use Agreement

Home Browse Search

5. Accounts are locked out when a user attempts but fails to log in successfully 5 times in 10 minutes; such accounts remain locked out until released by NCRPCD staff or assigned state administrators. 6. Accounts are automatically logged out after 60 minutes when there is no transmission to the server, unless the DOH adjusts this time-out expiration period in coordination with NCRPCD. 7. The Receiver and/or the DOH may terminate a user's access to the system at any time. F. Data Storage 1. All data submitted via the Internet using the CDR -CRS are stored on a server located within the MPHI Data Center. 2. Data are stored on this server indefinitely unless the Holder CDR staff terminate the data use agreement. 3. The Receiver ensures the security of these servers in the following ways: a. Data transmitted to and from the web server are authenticated and encrypted with 2048 -bit SSL (Secured Sockets Layer), which is the strongest currently available commercially. The certificate authority is GoDaddy and is renewed annually. b. Two stateful firewalls are utilized, as well as intrusion protection and detection products. The database server sits in a protected data network with a firewall between the database and the web server. c. The servers are in a physically secure location with restricted access and a complete automatic temperature alarm system and fire sprinkler protection system. The server rooms have separate air conditioning systems, and electrical supplies are backed up with uninterruptible power supplies, which are backed up by a diesel generator for long term power outages. d. When the MPHI Data Center is closed during non -business hours, the building is locked, an electronic alarm system is activated, and access into the building is permitted only through the use of electronic reader cards. The MPHI Data Center is also equipped with a video surveillance system. e. The Receiver continuously updates virus -scanning software on all servers and workstations. f. A small group of Receiver authorized staff have access to the server room for server management and maintenance. These staff abide by strict confidentiality agreements. These individuals will be identified and their signed confidentiality agreements provided upon request of the Holder. g. Custodial and building maintenance staff are not allowed in the server area except in the presence of authorized Receiver staff. h. The Receiver staff regularly audit database servers to ensure there are no security violations. 4. For disaster recovery, the Receiver's network servers are backed -up nightly online to disk storage and replicated to disk in a second location nightly. Daily backups are kept on disk for 30 days. Data is sent to encrypted tape weekly, and weekly backups are kept off- site for 30 days. Monthly backups are saved on the encrypted backup tapes for 7 years. The tapes are delivered in locked containers via courier and stored off-site in a physically secure location.