Laserfiche WebLink
regard to a crime any patient with a substance use disorder, except as provided at 42 C.F.R. §§ <br />2.12(c)(5) and 2.65. <br />4.3. This Contract does not constitute a release of the Data for the Contractor's discretionary use. <br />Contractor must use the Data received or accessed under this Contract only to carry out the <br />purpose and justification of this Contract as set out in the Data Licensing Statement(s). Any <br />analysis, use, or reporting that is not within the Purpose of this Contract is not permitted without <br />RCA's prior written consent. <br />4.4. This Contract does not constitute a release for Contractor to share the Data with any third parties, <br />including Subcontractors, even if for authorized use(s) under this Contract, without the third party <br />release being approved in advance by HCA and identified in the Data Licensing Statement(s). <br />4.5. Derivative Data Product Review and Release Process. All reports derived from Data shared under <br />this Contract, produced by Contractor that are created with the intention of being published for or <br />shared with external customers (Data Product(s)) must be sent to HCA for review of usability, data <br />sensitivity, data accuracy, completeness, and consistency with HCA standards prior to disclosure. <br />This review will be conducted and response of suggestions, concerns, or approval provided to <br />Receving Party within 10 business days. <br />a. Small Numbers. Contractor will adhere to HCA Small Numbers Standards, Attachment 2. HCA <br />and Contractor may agree to individual Permissible Use exceptions to the Small Numbers <br />Standards, in writing (email acceptable). <br />4.6. Any disclosure of Data contrary to this Contract is unauthorized and is subject to penalties identified <br />in law. <br />5. Data Modification(s) <br />Any modification to the Purpose, Justification, Description of Data to be Shared/Data Licensing Statement(s), <br />and Permissible Use, is required to be approved through HCA's Data Request Process. Contractor must <br />notify HCA's Contract Manager of any requested changes to the Data elements, Use, records linking needs, <br />research needs, and any other changes from this Contract, immediately to start the review process. Approved <br />changes will be documented in an Amendment to the Contract. <br />6. Security of Data <br />6.1. Data Protection <br />The Contractor must protect and maintain all Confidential Information gained by reason of this Contract <br />against unauthorized use, access, disclosure, modification or loss. This duty requires the Contractor to <br />employ reasonable security measures, which include restricting access to the Confidential Information by <br />a. Allowing access only to staff that have an authorized business requirement to view the <br />Confidential Information. <br />b. Physically securing any computers, documents, or other media containing the Confidential <br />Information. <br />6.2. Data Security Standards <br />Contractor must comply with the Data Security Requirements set out in Attachment 1 and the Washington <br />OCIO Security Standard, 141.10 (https:Hocio.wa.gov/policies/141-securing-information-technology- <br />Washington State <br />Health Care Authority Page 10 HCA Contract No. K5885-1 <br />