Laserfiche WebLink
Exhibit C <br />Data Security Requirements <br />1. Definitions. The words and phrases listed below, as used in this Exhibit, shall each <br />have the following definitions: <br />a. "Authorized User(s)" means an individual or individuals with an authorized business <br />requirement to access HCA Confidential Information . <br />b. "Hardened Password" means a string of at least eight characters containing at least <br />one alphabetic character, at least one number and at least one special character <br />such as an asterisk, ampersand or exclamation point. <br />c. "Unique User ID" means a string of characters that identifies a specific user and <br />which, in conjunction with a password, passphrase or other mechanism, <br />authenticates a user to an information system . <br />2. Data Transport. When transporting HCA Confidential Information electronically, <br />including via email, the Data will be protected by: <br />a. Transporting the Data within the (State Governmental Network) SGN or OPSl's <br />internal network, or; <br />b. Encrypting any Data that will be in transit outside the SGN or Contrator's internal <br />network. This includes transit over the public Internet. <br />3. Protection of Data. Contractor agrees to store Data on one or more of the following <br />media and protect the Data as described : <br />a. Hard disk drives. Data stored on local workstation hard disks. Access to the Data <br />will be restricted to Authorized User(s) by requiring logon to the local workstation <br />using a Unique User ID and Hardened Password or other authentication <br />mechanisms which provide equal or greater security, such as biometrics or smart <br />cards . <br />b. Network server disks. Data stored on hard disks mounted on network servers and <br />made available through shared folders . Access to the Data will be restricted to <br />Authorized Users through the use of access control lists which will grant access only <br />after the Authorized User has authenticated to the network using a Unique User ID <br />and Hardened Password or other authentication mechanisms which provide equal or <br />greater security, such as biometrics or smart cards. Data on disks mounted to such <br />servers must be located in an area which is accessible only to authorized personnel, <br />with access controlled through use of a key, card key, combination lock, or <br />comparable mechanism. <br />For HCA Confidential Information stored on these disks, deleting unneeded Data is <br />sufficient as long as the disks remain in a Secured Area and otherwise meet the <br />requirements listed in the above paragraph. Destruction of the Data as outlined in <br />Section 5. Data Disposition may be deferred until the disks are retired, replaced, or <br />otherwise taken out of the Secured Area. <br />Washington State <br />Health Care Authority Page 85 of90 HCA Contract No, K3924