DSHS Agreement 1863-31751 - Laserfiche WebLink

Home Browse Search

Special Terms and Conditions (2) Data will not be stored on an Enterprise Cloud storage solution unless either: (a) The Cloud storage provider is treated as any other Sub-Contractor, and agrees in writing to all of the requirements within this exhibit; or, (b) The Cloud storage solution used is FedRAMP certified. (3) If the Data includes protected health Information co vered by the Health Insurance Portab ility and Accountablllty Act (HIPAA), the Cloud provid er must sign a Business Associate Agreement prior to Data being stored in their Cloud solution. 6. System Protection. To prevent compromise of systems which contain DSHS Data or through which that Data passes: a. Systems containing DSHS Data must have all security patches or hotfixes applied within 3 months of being made available. b. The Contractor will have a method of ensuring that the requisite patches and hotfixes have been applied within the required timeframes. c. Systems containing DSHS Data shall have an Anti-Malware application, if available, installed. d. Anti-Malware software shall be kept up to date. The prod uct, its anti-virus engine, and any malware database the system uses, will be no more than one update behind curren t. 7. Data Segregation. a. DSHS Data must be segregated or otherwise distinguishable from non-DSHS data. This is to ensure that when no longer needed by the Contractor, all DSHS Data can be identified for return or destruction. It also aids in determining whether DSHS Data has or may have been compromised in the event of a security breach. As such, one or more of the following methods will be used for data segregation. (1) DSHS Data will be kept on media (e.g. hard disk, optical disc, tape, etc.) which will contain no non-DSHS Data. And/or, (2) DSHS Data will be stored in a logical container on electronic media, such as a partition or folder dedicated to DSHS Data. And/or, (3) DSHS Data will be stored in a database which will contain no non-DSHS data. And/or, (4) DSHS Data will be stored within a database and will be distinguishable from non-DSHS data by the value of a specific field or fields within database records. (5) When stored as physical paper documents, DSHS Data will be physically segregated from non- DSHS data in a drawer, folder, or other container. b. When it is not feasib le or practical to seg regate DSHS Data from non-DSHS data, t hen both the DSHS Data and the non-DSHS data with whi~h it is commingled must be protecte d as described in this exhibit. 8. Data Disposition. When the contracted work has been complet ed or when the Data i's no longer needed, except as noted above in Section 5.b, Data shall be returned to DSHS or destroyed . Media on which Data may be stored and associated acceptable methods of destruction are c;1s follows : DSHS Central Contract Services 5048CF County Program Agreement (11-22-2011) Page 12