Laserfiche WebLink
EXHIBIT A <br />DATA SECURITY REQUIREMENTS <br />ORGANIZATION OF DATA SECURITY REQUIREMENTS <br />1. Definitions <br />2. Authority <br />3. Scope of Protection <br />4. Compliance with Laws, Rules, Regulations, and Policy <br />5. Administrative Controls <br />6. Authorization, Authentication, and Access <br />7. Protection of Data <br />8. Method of Transfer <br />9. System Protection <br />10. Data Segregation <br />11. Confidentiality Protection <br />12. Data Disposition <br />13. Data shared with Subcontractors <br />14. Notification of Compromise or Potential Compromise <br />15. Breach of Data <br />16. Public Disclosure <br />Definitions. The words and phrases listed below, as used in this Exhibit, shall each have the following <br />definitions: <br />a. "AES' means the Advanced Encryption Standard, a specification of Federal Information Processing <br />Standards Publications for the encryption of electronic data issued by the National Institute of <br />Standards and Technology(http://nvlpubs.nist.gov/nistpubs/PIPS/NIST FIPS 197 pdf). <br />b. "Authorized Users(s)" means an individual or individuals with a business need to access DCYF <br />Confidential Information and who has been authorized to do so. <br />c. 'Business Associate Agreement' means an agreement between DCYF and a contractor who is <br />receiving Data covered under the Privacy and Security Rules of the Health Insurance Portability <br />and Accountability Act of 1996. The agreement establishes permitted and required uses and <br />disclosures of protected health information (PHI) in accordance with HIPAA requirements and <br />provides obligations for business associates to safeguard the information. <br />d. "Category 4 Data" is data that is confidential and requires special handling due to statutes or <br />regulations that require especially strict protection of the data and from which especially serious <br />consequences may arise in the event of any compromise of such data. Data classified as Category <br />4 includes but is not limited to data protected by: the Health Insurance Portability and Accountability <br />Act (HIPAA), Pub. L. 104-191 as amended by the Health Information Technology for Economic and <br />Clinical Health Act of 2009 (HITECH), 45 CFR Parts 160 and 164; the Family Educational Rights <br />and Privacy Act (FERPA), 20 U.S.C. §1232g; 34 CFR Part 99; Internal Revenue Service <br />Publication 1075 (https //www irs qov/pub/irs-pdf/p1075 pdf); Substance Abuse and Mental Health <br />Services Administration regulations on Confidentiality of Alcohol and Drug Abuse Patient Records, <br />42 CFR Part 2; and/or Criminal Justice Information Services, 28 CFR Part 20. <br />Department of Children, Youth & Families <br />2017CF County Program Agreement 6-24-20 Page 8 <br />