Laserfiche WebLink
Special Terms and Conditions <br />DATA SECURITY REQUIREMENTS <br />EXHIBIT A <br />1 <br />ORGANIZATION OF DATA SECURIW REQUIREMENTS <br />1. Definitions <br />2. Authority <br />3. Scope oi Protection <br />4. Compliance with Laws, Rules, Regulations, and Policy <br />5. Administrative Controls <br />6. Authorization, Authentication, and Access7. Protection of Data <br />8. Method of Transfer <br />9. System Protection <br />10. Data Segregation <br />'1 1. Confidentiality Protection <br />12. Data Disposition <br />13. Data shared with Subcontractors <br />14. Notification of Compromise or Potential Compromise <br />15. Breach of Data <br />16. Public Disclosure <br />Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following <br />definitions: <br />"AES" means the Advanced Encryption Standard, a specification of Federal lnformation Processing <br />Standards Publieations for the encryption of electronic data issued by the National lnstitute of <br />S ta n d a rd s a n d T e ch n o I o gy ( hllfiI/ nylsgb [,njlls,? r.lil$lpu bffi I*pdD . <br />"Authorized Users(s)" means an individual or individuals with a business need to access DCYF <br />Confidential lnformation and who has been authorized to do so. <br />c. "Business Associate Agreement" means an agreement between DCYF and a contractorwho is <br />receiving Data covered underthe Privacy and Security Rules of the Health lnsurance Portability <br />and Accountability Act of 1996. The agreement establishes permitted and required uses and <br />disclosures of protected health information (PHl) in accordance with HIPAA requirements and <br />provides obligations for business associates to safeguard the information. <br />d. "Category 4 Data" is data that is confidential and requires special handling due to statutes or <br />regulations that require especially strict protection of the data and from which especially serious <br />consequences may arise in the event of any compromise of such data. Data classified as Category <br />4 includes but is not limited to data protected by: the Health lnsurance Portability and AccountaUitity <br />Act (HIPAA), Pub. L. 104-191 as amended by the Health lnformation Technology for Economic and <br />Clinical Health Act of 2009 (HITECH),45 CFR Parts 160 and 164; the Family Educational Rights <br />and Privacy Act (FERPA), 20 U.S.C. $12329;34 CFR Part g9; lnternal Revenue Service <br />Publication 1075 ($lpeJ&wJrs.fi*j{*!gjig:pdik-10JS.':dI); Substance Abuse and Mental Health <br />Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, <br />42 CFR Part2; and/or Criminal Justice lnformation Services, 28 CFR Part 20. <br />b <br />Department of Children, Youth & Families <br />2O17CF County Program Agreement d24-2O Page 7