|
ATTACHMENT A
<br />HIPAA AND DATA SECURITY REQUIREMENTS
<br />n. "Secure Area" means an area to which only authorized representatives of the entity
<br />possessing the Confidential Information have access, and access is controlled through
<br />use of a key, card key, combination lock, or comparable mechanism. Secure Areas
<br />may include buildings, rooms or locked storage containers (such as a filing cabinet or
<br />desk drawer) within a room, as long as access to the Confidential Information is not
<br />available to unauthorized personnel. In otherwise Secure Areas, such as an office
<br />with restricted access, the Data must be secured in such a way as to prevent access
<br />by non -authorized staff such as janitorial or facility security staff, when authorized
<br />Contractor staff are not present to ensure that non -authorized staff cannot access it.
<br />o. "Trusted Network" means a network operated and maintained by the Contractor, which
<br />includes security controls sufficient to protect DOC Data on that network. Controls
<br />would include a firewall between any other networks, access control lists on
<br />networking devices such as routers and switches, and other such mechanisms which
<br />protect the confidentiality, integrity, and availability of the Data.
<br />p. "Unique User ID" means a string of characters that identifies a specific user and which,
<br />in conjunction with a password, passphrase or other mechanism, authenticates a user
<br />to an information system.
<br />q. "Biometric identifier" means any information, regardless of how it is captured,
<br />converted, stored, or shared, based on an individual's retina or iris scan, fingerprint,
<br />voiceprint, DNA, or scan of hand or face geometry, except when such information is
<br />derived from:
<br />(i) Writing samples, written signatures, photographs, human biological samples used
<br />for valid scientific testing or screening, demographic data, tattoo descriptions, or
<br />physical descriptions such as height, weight, hair color, or eye color;
<br />(ii) Donated organ tissues or parts, or blood or serum stored on behalf of recipients or
<br />potential recipients of living or cadaveric transplants and obtained or stored by a
<br />federally designated organ procurement agency;
<br />(iii) Information captured from a patient in a health care setting or information collected,
<br />used, or stored for health care treatment, payment, or operations under the federal
<br />health insurance portability and accountability act of 1996; or
<br />(iv) X-ray, roentgen process, computed tomography, magnetic resonance imaging
<br />(MRI), positron emission tomography (PET) scan, mammography, or other image or
<br />film of the human anatomy used to diagnose, develop a prognosis for, or treat an
<br />illness or other medical condition or to further validate scientific testing or screening.
<br />2. Authority. The security requirements described in this document reflect the applicable
<br />requirements of Washington State Data Sharing Policy, WaTech SEC-08
<br />(https:Ilwatech.wa.govlpoIiciesldata-sharing-policy), the terms and conditions set forth in
<br />this Agreement, and all applicable state and federal laws in its treatment of WA DOC Data.
<br />3. Administrative Controls. The Contractor must have the following controls in place:
<br />a. A documented security policy governing the secure use of its computer network and
<br />systems, and which defines sanctions that may be applied to Contractor staff for
<br />Washington State K14078 Page 10 of 19
<br />Department of Correctiolus Attachment A 26RAD
<br />
|