RES-2022-148 - Laserfiche WebLink

Home Browse Search

Attachment 2: Data Security Requirements 1. Definitions ln addition to the definitions set out in the Data Use, Security, and Confidentiality Schedule, the definitions below apply to this Attachment. a. "Hardened Password" means a string of characters containing at least three of the foltowing character classes: upper case letters; lower case letters; numerals; and special characters, such as an asterisk, ampersand or exclamation point. i. Passwords for external authentication must be a minimum of 10 characters long. i. Passwords for internal authentication must be a minimum of 8 characters long. ii. Passwords used for system service or service accounts must be a minimum of 20 characters long. b. "Portable/Removable Media" means any data storage device that can be detached or removed from a computer and transported, including but not limited to: optical media (e.g. CDs, DVDs); USB drives; or flash media (e.9. CompactFlash, SD, MMC). c. "Portable/Removable Devices" means any small computing device that can be transported, including but not limited to: handheldslPDAslsmartphones; Ultramobile PCs, flash memory devices (e.9. USB flash drives, personal media players); and laptop/notebooUtablet computers. lf used to store Confidential lnformation, devices should be Federal lnformation Processing Standards (FIPS) Level 2 compliant. d. "Secured Area" means an area to which only Authorized Users have access. Secured Areas may include buildings, rooms, or locked storage containers (such as a filing cabinet) within a room, as long as access to the Confidential lnformation is not available to unauthorized personnel. e. "Transmitting" means the transferring of data electronically, such as via email, SFTP, webservices, AWS Snowball, etc. f. "Trusted System(s)" means the following methods of physical delivery: (1) hand-delivery by a person authorized to have access to the Confidential lnformation with written acknowledgement of receipt; (2) United States Postal Service ('USPS") first class mail, or USPS delivery services that include Tracking, such as Certified Mail, Express Mail, or Registered Mail; (3) commercial delivery services (e.9. FedEx, UPS, DHL) which offer tracking and receipt confirmation; and (4) the Washington State Campus mail system. For electronic transmission, the Washington State Governmental Network (SGN) is a Trusted System for communications within that Network. g. "Unique User lD" means a string of characters that identifies a specitic user and which, in conjunction with a password, passphrase, or other mechanism, authenticates a user to an information system. 2. Data Transmission a. When transmitting HCA's Confidential lnformation electronically, including via email, the Data must be encrypted using NIST 8O0-series approved algorithms (htto:llcsrc.nist.qovlpubliqationslPubsSPs.html). This includes transmission over the public internet. Washington State Haalth Care Authoity Page 17 HCA Contract Na. K5885-1