Laserfiche WebLink
b. When transmitting HCA's Confidential lnformation via paper documents, the Contractor must use <br />a Trusted System and must be physically kept in possession of an authorized person <br />3. Protection of Data <br />The Contractor agrees to store and protect Confidential lnformation as described: <br />a. Data at Rest: <br />Data will be encrypted with NIST 80O-series approved algorithms. Encryption keys will be <br />stored and protected independently of the data. Access to the Data will be restricted to <br />Authorized users through the use of access control lists, a unique user lD, and a <br />Hardened Password, or other authentication mechanisms which provide equal or greater <br />security, such as biometrics or smart cards. Systerns which contain or provide acclss to <br />Confidential lnformation must be located in an area that is accessible only to authorized <br />personnel, with access controlled through use of a key, card key, combination lock, or <br />comparable mechanism. <br />Data stored on PortablelRemovable Media or Devices: <br />(A) confidential lnformation provided by HCA on Removabre Media will be <br />encrypted with NIST 8O0-series approved algorithms. Encryption keys will be <br />stored and protected independently of the Data, <br />(B) HCA's data must not be stored by the Contractor on Portable Devices or Media <br />unless specifically authorized within the DSA. lf so authorized, the Contractor <br />must protect the Data by: <br />(1) Encrypting with NIST 80O-series approved algorithms. Encryption <br />keys will be stored and protected independenfly of the data; <br />t. <br />(2|Control access to the devices with a Unique User lD and Hardened <br />Password or stronger authentication method such as a physical <br />token or biometrics; <br />Keeping devices in locked storage when not in use; <br />Using check-in/check-out procedures when devices are shared; <br />Maintain an inventory of devices; and <br />Ensure that when being transported outside of a Secured Area, all <br />devices with Data are under the physical control of an Authorized <br />User. <br />(3) <br />(4) <br />(5) <br />(6) <br />b. Paper documents. Any paper records containing Confidential lnformation must be protected by <br />storing the records in a Secured Area that is accessible onty to authorized personnel. \Men not in <br />use, such records must be stored in a locked container, such as a file cabinet, locking drawer, or <br />safe, to which only authorized persons have access. <br />Washington Slate <br />Health Care Authority Page 18 HCA Contract No. K5885-1