Laserfiche WebLink
3. <br />g "Unique User lD" means a string of characters that identifies a specific user and which, in <br />conjunction with a password, passphrase, or other mechanism, authenticates a user to an <br />information system. <br />2. CONFIDENTIAL INFORMATION TRANSMITTING <br />a. When transmitting HCA's Confidential lnformation electronically, including via email, the <br />Data must be encrypted using NIST 8OO-series approved algorithms <br />(http://csrc.nist.oov/publications/PubsSPs.html). This includes transmission over the public <br />internet. <br />b. When transmitting HCA's Confidential lnformation via paper documents, the Receiving Party <br />must use a Trusted System. <br />PROTECTION OF CONFIDENTIAL INFORMATION <br />The Contractor agrees to store Confidential lnformation as described <br />a. Data at Rest: <br />Data will be encrypted with NIST 80O-series approved algorithms. Encryption keys will <br />be stored and protected independently of the data. Access to the Data will be restricted <br />to Authorized Users through the use of access control lists, a Unique User lD, and a <br />Hardened Password, or other authentication mechanisms which provide equal or <br />greater security, such as biometrics or smart cards. Systems which contain or provide <br />access to Confidential lnformation must be located in an area that is accessible only to <br />authorized personnel, with access controlled through use of a key, card key, <br />combination lock, or comparable mechanism. <br />ii. Data stored on Portable/Removable Media or Devices <br />Confidential lnformation provided by HCA on Removable Media will be encrypted <br />with NIST 80O-series approved algorithms. Encryption keys will be stored and <br />protected independently of the Data. <br />a <br />a <br />4. <br />Washington State <br />Health Care Authority <br />HCA's data must not be stored by the Receiving Party on Portable Devices or <br />Media unless specifically authorized within the Data Share Agreement. lf so <br />authorized, the Receiving Party must protect the Data by: <br />1. Encrypting with NIST 80O-series approved algorithms. Encryption keys will <br />be stored and protected independently of the data; <br />2. Control access to the devices with a Unique User lD and Hardened <br />Password or stronger authentication method such as a physicaltoken or <br />biometrics; <br />3. Keeping devices in locked storage when not in use; <br />Using check-in/check-out procedures when devices are shared; <br />30 Description of Services <br />HCA Contract #K5885