Resolution 2025-084 - Laserfiche WebLink

Home Browse Search

t Special Terms and Conditions Exhibit A - Data Security Requirements The words and phrases listed below, as used in this Exhibit, shall each have the following 1 Definitions definiiions: a. e b. c d t g h "AES'means the Advanced Encryption Standard, a specification of Federal lnformation Processing Standards Publications for the encryption of electronic data issued by the National ln_stitute of Standards and Technology (http://nvipubs.nlst.gov/nistpubs/FIPS/NlST.FlPS.197.pdf). "Authorized Users(s)" means an individual or individuals with a business need to access DSHS Confidential Information, and who has or have been authorized to do so. "Business Associate Agreement" means an agreement between DSHS and a contractor who is receiving Data cove.red under the Privacy and Security Rules of the Health lnsurance Portability and Acc-ountabiliiy Act of '1996. The agreement establishes permitted and required uses and disclosures of protected health information (PHl) in accordance with HIPAA requirements and provides obligations for business associates to safeguard the information. "Category 4 Data" is data that is confidential and requires special handling due to statutes or regutjiions that require especially strict protection of the data and from which especially serious consequences may arise in the event of any compromise of such data. Data classified as Category 4 includes but is not limited to data protected by:the Health lnsurance Portability and Accountability Act (HtpAA), pub. L. 104-'19',1 as amended by the Health lnformation Technology for Economic and Clinicat Heatth Act of 2009 (HITECH), 45 Cfi? parts 160 and 164;the Family Educational Rights andPrivacyAct(FERPA),20U.S.C.51232g;34CFRPart99;lnternalRevenueService Pubtication 1075 (https:liwww.irs.gov/pub/irs-pdf/p1075.pdf); Substance Abuse and MentalHealth Services Administration regulations on Confidentiality of Alcohoi and Drug Abuse Patient Records, 42CFRParl2; and/or CriminalJustice lnformation Services, 28 CFR Part 20. "Cloud" means data storage on servers hosted by an entity other than the Contractor and on a network outside tne contrJl of the Coniractor. Physical storage of data in the cloud typically spans multiple servers and often multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for companies and governmental entities. Examples oi conrumer grade storage would include iTunes, Dropbox, Box'com' and many other entities. Enterprise clou-d vendors include Microsoft Azure, Amazon Web Services, and Rackspace' "Encrypt" means to encode Confidential lnformation into a format that can only be read by those possessing a "key", a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key Gngth of at least 256 bits for symmetric keys, or 204.8 bits for asymmetric'keys. When a symmetric-t<ey is used, the Advanced Encryption Standard (AES) must be used if available. "FedRAMP" means the Federal Risk and Authorization Management Program (see www.fedramp gov), which is an assessmeni and authorization process thatfederal government agencies have-been directed to use to ensure security is in place when accessing Cloud computing products and services. "Hardened password" means a string of at least eight characters containing at least three of the followrng four character classes: Uppercase alphabetic, lowercase alphabetic, numeral, and special characters such as an asterisk, ampersand, or exclamation point' DSHS Cenl!-al Contract Services 6A17CF Courrty Program Agreement (10-31 -2417)Page 9