Laserfiche WebLink
2. <br />3. <br />g. "Unique User ID" means a string of characters that identifies a specific user and which, in <br />conjunction with a password, passphrase, or other mechanism, authenticates a user to an <br />information system. <br />CONFIDENTIAL INFORMATION TRANSMITTING <br />a. When transmitting HCA's Confidential Information electronically, including via email, the <br />Data must be encrypted using NIST 800 -series approved algorithms <br />(htt ://csrc.nist. ovl ublications/PubsSPs.html). This includes transmission over the public <br />internet. <br />b. When transmitting HCA's Confidential Information via paper documents, the Receiving Party <br />must use a Trusted System. <br />PROTECTION OF CONFIDENTIAL INFORMATION <br />The Contractor agrees to store Confidential Information as described: <br />a. Data at Rest: <br />Data will be encrypted with NIST 800 -series approved algorithms. Encryption keys will <br />be stored and protected independently of the data. Access to the Data will be restricted <br />to Authorized Users through the use of access control lists, a Unique User ID, and a <br />Hardened Password, or other authentication mechanisms which provide equal or <br />greater security, such as biometrics or smart cards. Systems which contain or provide <br />access to Confidential Information must be located in an area that is accessible only to <br />authorized personnel, with access controlled through use of a key, card key, <br />combination lock, or comparable mechanism. <br />Data stored on Portable/Removable Media or Devices: <br />Confidential Information provided by HCA on Removable Media will be encrypted <br />with NIST 800 -series approved algorithms. Encryption keys will be stored and <br />protected independently of the Data. <br />HCA's data must not be stored by the Receiving Party on Portable Devices or <br />Media unless specifically authorized within the Data Share Agreement. If so <br />authorized, the Receiving Party must protect the Data by: <br />Encrypting with NIST 800 -series approved algorithms. Encryption keys will <br />be stored and protected independently of the data; <br />2. Control access to the devices with a Unique User ID and Hardened <br />Password or stronger authentication method such as a physical token or <br />biometrics; <br />3 <br />4 <br />Washington State <br />Health Care Authority <br />Keeping devices in locked storage when not in use; <br />Using check- inlcheck-out procedures when devices are shared; <br />we <br />Description of Services <br />HCA Contract #K5885 <br />