Laserfiche WebLink
ATTACHMENT A <br />HIPAA AND DATA SECURITY REQUIREMENTS <br />"Cloud" means data storage on servers hosted by an entity other than the Contractor <br />and on a network outside the control of the Contractor. Physical storage of data in the <br />cloud typically spans multiple servers and often multiple locations. Cloud storage can <br />be divided between consumer grade storage for personal files and enterprise grade <br />for companies and governmental entities. Examples of consumer grade storage would <br />include iTunes, Dropbox, Box.com, and many other entities. Enterprise cloud vendors <br />include Microsoft Azure, Amazon Web Services, and Rackspace. <br />g. "Encrypt' means to encode Confidential Information into a format that can only be read <br />by those possessing a "key"; a password, digital certificate or other mechanism <br />available only to authorized users. Encryption must use a key length of at least 256 <br />bits for symmetric keys, or 2048 bits for asymmetric keys. When a symmetric key is <br />used, the Advanced Encryption Standard (AES) must be used if available. <br />"FedRAMP" means the Federal Risk and Authorization Management Program (see <br />www.fedramp.gov), which is an assessment and authorization process that federal <br />government agencies have been directed to use to ensure security is in place when <br />accessing Cloud computing products and services. <br />i. "Hardened Password" means a string of at least eight characters containing at least <br />three of the following four character classes: Uppercase alphabetic, lowercase <br />alphabetic, numeral, and special characters such as an asterisk, ampersand, or <br />exclamation point. <br />"Mobile Device" means a computing device, typically smaller than a notebook, which <br />runs a mobile operating system, such as iOS, Android, or Windows Phone. Mobile <br />Devices include smart phones, most tablets, and other form factors. <br />k. "Multi -factor Authentication" means controlling access to computers and other IT <br />resources by requiring two or more pieces of evidence that the user is who they claim <br />to be. These pieces of evidence consist of something the user knows, such as a <br />password or PIN; something the user has such as a key card, smart card, or physical <br />token; and something the user is, a biometric identifier such as a fingerprint, facial <br />scan, or retinal scan. `PIN' means a personal identification number, a series of <br />numbers which act as a password for a device. Since PINs are typically only four to <br />six characters, PINs are usually used in conjunction with another factor of <br />authentication, such as a fingerprint. <br />'Portable Device' means any computing device with a small form factor, designed to <br />be transported from place to place. Portable devices are primarily battery powered <br />devices with base computing resources in the form of a processor, memory, storage, <br />and network access. Examples include, but are not limited to, mobile phones, tablets, <br />and laptops. Mobile Device is a subset of Portable Device. <br />m. 'Portable Media" means any machine readable media that may routinely be stored or <br />moved independently of computing devices. Examples include magnetic tapes, optical <br />discs (CDs or DVDs), flash memory (thumb drive) devices, external hard drives, and <br />internal hard drives that have been removed from a computing device. <br />Washington State K14078 Page 9 of 19 <br />Department of Corrections Attachment A 26RAD <br />