Laserfiche WebLink
c. Optical discs (CDs or DVDs) in local workstation optical disc drives. Data provided <br />by HCA on optical discs which will be used in local workstation optical disc drives <br />and which will not be transported out of a Secured Area. When not in use for the <br />contracted purpose, such discs must be locked in a drawer, cabinet or other <br />container to which only Authorized Users have the key, combination or mechanism <br />required to access the contents of the container. Workstations which access HCA <br />Data on optical discs must be located in an area which is accessible only to <br />authorized personnel, with access controlled through use of a key, card key, <br />combination lock, or comparable mechanism. <br />d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers . Data <br />provided by HCA on optical discs which will be attached to network servers and <br />which will not be transported out of a Secured Area. Access to Data on these discs <br />will be restricted to Authorized Users through the use of access control lists which <br />will grant access only after the Authorized User has authenticated to the network <br />using a Unique User ID and Hardened Password or other authentication <br />mechanisms which provide equal or greater security, such as biometrics or smart <br />cards. Data on discs attached to such servers must be located in an area which is <br />accessible only to authorized personnel, with access controlled through use of a key, <br />card key, combination lock, or comparable mechanism. <br />e. Paper documents. Any paper records must be protected by storing the records in a <br />Secured Area which is only accessible to authorized personnel. When not in use, <br />such records must be stored in a locked container, such as a file cabinet, locking <br />drawer, or safe, to which only authorized persons have access. <br />f. Remote Access . Access to and use of the Data over the State Governmental <br />Network (SGN) or Secure Access Washington (SAW) will be controlled by HCA staff <br />who will issue authentication credentials (e.g . a Unique User ID and Hardened <br />Password) to Authorized Users on Contractor staff. Contractor will notify HCA staff <br />immediately whenever an Authorized User in possession of such credentials is <br />terminated or otherwise leaves the employ of Contractor, and whenever an <br />Authorized User's duties change such that the Authorized User no longer requires <br />access to perform work for this Contract. <br />g . Data storage on portable devices or media. <br />(1) Except where otherwise specified herein, HCA Data shall not be stored by <br />Contractor on portable devices or media unless specifically authorized within the <br />terms and conditions of the Contract. If so authorized, the Data shall be given <br />the following protections: <br />(a) Encrypt the Data with a key length of at least 128 bits <br />(b) Control access to devices with a Unique User ID and Hardened Password or <br />stronger authentication method such as a physical token or biometrics. <br />(c) Manually lock devices whenever they are left unattended and set devices to <br />lock automatically after a period of inactivity, if this feature is available. <br />Maximum period of inactivity is 20 minutes. <br />Washington State <br />Health Care Authority Page 86 of90 HCA Contract No . K3924