Laserfiche WebLink
DocuSign Envelope ID: 2A3301'11.63A7.4837-94A9-4126DA2ACCD4 <br />Special Terms and Conditions <br />EXHIBIT A <br />DATA SECURITY REQUIREMENTS <br />ORGANIZATION OF DATA SECURITY REQUIREMENTS <br />1. Definitions <br />2. Authority <br />3. Scope of Protection <br />4. Compliance with Laws, Rules, Regulations, and Policy <br />5. Administrative Controls <br />6. Authorization, Authentication, and Access <br />7. Protection of Data <br />8. Method of Transfer <br />9. System Protection <br />10. Data Segregation <br />11, Confidentiality Protection <br />12. Data Disposition <br />13. Data shared with Subcontractors <br />14. Notification of Compromise or Potential Compromise <br />15. Breach of Data <br />16. Public Disclosure <br />1. Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following <br />definitions: <br />a. "AES" means the Advanced Encryption Standard, a specification of Federal Information Processing <br />Standards Publications for the encryption of electronic data issued by the National Institute of <br />Standards and Techno€ogyhtt:_;fnvipubsnist.gov/nistpubsfFlPS/NI SS7'.Fit?5.197.pdf), <br />b. "Authorized Users(s)" means an individual or individuals with a business need to access DCYF <br />Confidential Information and who has been authorized to do so. <br />c. "Business Associate Agreement" means an agreement between DCYF and a contractor who is <br />receiving Data covered under the Privacy and Security Rules of the Health Insurance Portability <br />and Accountability Act of 1996. The agreement establishes permitted and required uses and <br />disclosures of protected health information (PHI) in accordance with FIIPAA requirements and <br />provides obligations for business associates to safeguard the information. <br />d. 'Category 4 Data" is data that is confidential and requires special handling due to statutes or <br />regulations that require especially strict protection of the data and from which especially serious <br />consequences may arise in the event of any compromise of such data. Data classified as Category <br />4 includes but is not limited to data protected by: the Health Insurance Portability and Accountability <br />Act (HIPAA), Pub. L. 104-191 as amended by the Health Information Technology for Economic and <br />Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educational Rights <br />and Privacy Act (FERPA), 20 U.S.C. §12329; 34 CFR Part 99; Internal Revenue Service <br />Publication 1075(f ttos:i ww�.irs govtpubiirs-df/ 51075.pdf); Substance Abuse and Mental Health <br />Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, <br />42 CFR Part 2; and/or Criminal Justice Information Services, 28 GFR Part 20. <br />Department of Children, Youth & Families <br />2017CF County Program Agreement (8-1-2019) Page 6 <br />