Washington State DOH Data Information Sharing Agreement

Home Browse Search

2. The data are located in a secured computer area, which is accessible only by authorized personnel with access controlled through use of a key, card key, or comparable mechanism. a. If the servers or storage area networks are not located in a secured computer area or if the data is classified as Confidential or Restricted it must be encrypted as described under F, data storage on portable devices or media. D. Optical discs (CDs or DVDs) 1. Optical discs containing the data must be encrypted as described under F. data storage on portable devices or media. 2. When not in use for the purpose of this Agreement, such discs must be locked in a drawer, cabinet or other physically secured container to which only authorized users have the key, combination or mechanism required to access the contents of the container. E. Access over the Internet or the State Governmental Network (SGN). 1. When the data is transmitted between DOH and the Information Recipient, access is controlled by the DOH, who will issue authentication credentials. 2. Information Recipient will notify DOH immediately whenever: • An authorized person in possession of such credentials is terminated or otherwise leaves the employ of the Information Recipient • Whenever a person's duties change such that the person no longer requires access to perform work for this Contract. 3. The data must not be transferred or accessed over the Internet by the Information Recipient in any other manner unless specifically authorized within the terms of the Agreement. a) If so authorized the data must be encrypted during transmissions using a key length of at least 128 bits. Industry standard mechanisms and algorithms, such as those validated by the National Institute of Standards and Technology (NIST) are required. b) Authentication must occur using a unique user ID and Complex Password (of at least 10 characters). When the data is classified as Confidential or Restricted, authentication requires secure encryption protocols and multi -factor authentication mechanisms, such as hardware or software tokens, smart cards, digital certificates or biometrics. • Accounts must lock after 5 unsuccessful access attempts, and remain locked for at least 15 minutes, or require administrator reset. F. Data storage on mobile devices or portable storage media - 1. Examples of mobile devices are: smart phones, tablets, laptops, notebook or netbook computers, and personal media players. 2. Examples of portable storage media are: flash memory devices (e.g. USB flash drives), and portable hard disks. Page 13 of 16 rev 07/02/2013