RES-2022-148 - Laserfiche WebLink

Home Browse Search

7 assetsll4l 10-securinq-information{echnoloqv-asselg.) The Securitv Standard 141.10 is herebv incorporated bv reference into this Contract. 6.3. Data Disposition and Retention a. Contractor will dispose of HCA Data in accordance with this section. b. Upon request by HCA, or at the end of the Contract term, or when no longer needed, Confidential lnformationlData must be disposed of as set out in Attachment 1, Section 5 Data Disposition, except as required to be maintained for compliance or accounting purposes. Contractor will provide written certification to HCA of disposition using Attachment 4, C e ft if i c at i o n of D e stru ct i on /Dl'sposifrbn of C o nf i d e nt i a I I n fo rm ati on . Data Confidentiality and Non-Disclosure 7.1. DataConfidentiality. The Contractor will not use, publish, transfer, sell, or otherwise disclose any Confidential lnformation gained by reason of this Contract for any purpose that is not directly connected with the purpose, justification, and Permissible Use of this Contract, as set out in the attached Data Licensing Statement(s) except: (a) as provided by law; or (b) with the prior written consent of the person or personal representative of the person who is the subject of the Data. 7.2. Non-Disclosure of Data The Contractor must ensure that all employees or Subcontractors who will have access to the Data described in this Contract (including both employees who will use the Data and lT support staff) are instructed and made aware of the use restrictions and protection requirements of this Contract before gaining access to the Data identified herein. The Contractor will also instruct and make any new employe aware of the use restrictions and protection requirements of this Contract before they gain access to the Data. The Contractor will ensure that each employee or Subcontractor who will access the Data signs the User Agreement on Non-Disclasure of Confidential lnformafion, Attachment 3 hereto. The Contractor will retair the signed copy of lhe User Agreement on Non-Disclosure of Confidentiat lnformation in each employee'r personnel file for a minimum of six years from the date the employee's access to the Data ends. The documentation must be available to HCA upon request. 7.3. Penalties for Unauthorized Disclosure of Data State laws (including RCW 74.04.060 and RCW 70.02.020) and federal regulations (including HIPAA Privacy and Security Rules, 45 C.F.R. Part 160 and Part 164; Confidentiality of Alcoholand Drug Abuse Patient Records, 42 C.F.R., Parl2; and Safeguarding lnformation on Applicants and Beneficiaries, 42 C.F.R. Part 431, Subpart F) prohibit unauthorized access, use, or disclosure of Confidential lnformation. Violation of these laws may result in criminal or civil penalties or fines. The Contractor accepts full responsibility and liability for any noncompliance by itself, its employees, and its Subcontractors with these laws and any violations of the Contract. Data Shared with Subcontractors The Contractor will not enter into any Subcontract without the express, written permission of HCA, which will approve or deny the proposed subcontract in its sole discretion. lf Data access is to be provided to a Subcontractor under this Contract it will only be for the Permissible Use authorized by HCA and the Washington State Health Care Authority 8. Page 11 HCA Contraet No. K5885-1