Res-2022-072 - Laserfiche WebLink

Home Browse Search

5. Maintain an inventory of devices; and 6. Ensure that when being transported outside of a Secured Area, all devices with Data are under the physical control of an Authorized User. b. Paper documents. Any paper records containing Confidential lnformation must be protected by storing the records in a Secured Area that is accessible only to authorized personnel. When not in use, such records must be stored in a locked container, such as a file cabinet, locking drawer, or safe, to which only authorized persons have access. 4. CONFIDENTIAL INFORMATION SEGREGATION HCA Confidential lnformation received under this Contract must be segregated or otheruvise distinguishable from non-HCA data. This is to ensure that when no longer needed by the Contractor, all HCA Confidential lnformation can be identified for return or destruction. lt also aids in determining whether HCA Confidential lnformation has or may have been compromised in the event of a security Breach. a. The HCA Confidential lnformation must be kept in one of the following ways: t.on media (e.9., hard disk, optical disc, tape, etc.) which will contain only HCA Data; or in a logical container on electronic media, such as a partition or folder dedicated to HCA's Data; or in a database that will contain only HCA Data; or within a database and will be distinguishable from non-HCA Data by the value of a specific field or fields within database records; or when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container. b. When it is not feasible or practical to segregate HCA Confidential lnformation from non- HCA data, then both the HCA Confidential lnformation and the non-HCA data with which it is commingled must be protected as described in this Attachment. 5. CONFIDENTIAL INFORMATION SHARED WITH SUBCONTRACTORS lf HCA Confidential lnformation provided under this Contract is to be shared with a Subcontractor, the contract with the Subcontractor must include all of the Confidential lnformation Security Requirements. CONFIDENTIAL INFORMATION DISPOSITION When the Confidential lnformation is no longer needed, except as noted below, the Confidential lnformation must be returned to HCA or destroyed. Media are to be destroyed using a method documented within NIST 800-88 (http://csrc.nist.gov/publications/PubsSPs.html). il iv V Washington State Health Care Authority Description of Services HCA Contract #K5885 6. 31