RES-2022-148 - Laserfiche WebLink

Home Browse Search

4. Data Segregation HCA's Data received under this DSA must be segregated or otherwise distinguishable from non-HCA Data. This is to ensure that when no longer needed by the Contractor, all of HCA's Data can be identified for return or destruction. lt also aids in determining whether HCA's Data has or may have been compromised in the event of a security breach. a. HCA's Data must be kept in one of the following ways i. on media (e.9. hard disk, optical disc, tape, etc.) which will contain only HCA Data; or i. in a logical container on electronic media, such as a partition or folder dedicated to HCA's Data; or ii. in a database that will contain only HCA Data; or iii. within a database and will be distinguishable from non-HCA Data by the value of a specific field or fields within database records; or iv. when stored as physical paper documents, physically segregated from non-HCA Data in a drawer, folder, or other container. b. When it is not feasible or practicalto segregate HCA's Data from non-HCA data, then both HCA's Data and the non-HCA data with which it is commingled must be protected as described in this Attachment. c. Contractor must designate and be able to identify all computing equipment on which they store, process and maintain HCA Data. No Data at any time may be processed on or transferred to any portable storage medium. Laptopltablet computing devices are not considered portable storage medium devices for purposes of this DSA provided it is installed with end-point encryption. 5. Data Disposition Consistent with Chapter 4Q.14 RCW Contractor shall erase, destroy, and render unrecoverable all HCA Confidential Data and certify in writing that these actions have been completed within thirty (30) days of the disposition requirement or termination of this DSA, whiehever is earlier. At a minimum, media sanitization is to be performed according to the standards enumerated by NIST SP 800-8811 Guidelines for Media Sanitization. a. For HCA's Confidential lnformation stored on network disks, deleting unneeded Data is sufficient as long as the disks remain in a Secured Area and otherwise meet the requirements listed in Section 3, above. Destruction of the Data as outlined in this section of this Attachment may be deferred until the disks are retired, replaced, or otherwise taken out of the Secured Area. 6. Network Security Contractor's network security must include the following a. Network firewall provisioning; b. lntrusion detection; c. Qua(erly vulnerability assessments; and Washington State Health Care Authority Page 19 HCA Contract Na. K5885-1