SHJ26-007 DOC 1 FOR 1 COMPACT - PARTIALLY EXECUTED

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REQUIREMENTS g. When accessing the Data from within the Contractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Contractor's network, including: (1) A minimum length of 8 characters, and containing at least three of the following character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point. (2) That a password does not contain a user's name, logon ID, or any form of their full name. (3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words. (4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different. h. When accessing Confidential Information from an external location (the Data will traverse the Internet or otherwise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including: (1) Ensuring mitigations applied to the system don't allow end -user modification. (2) Not allowing the use of dial -up connections. (3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix. (4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network networks (using key lengths of 128 bits or greater) Algorithm modules validated by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program C( MVP) are required. The traffic must be encrypted at all times while traversing any network, including the Internet, which is not a Trusted Network. (5) Ensuring that the remote access system prompts for re -authentication or performs automated session termination after no more than 20 minutes of inactivity. (6) Ensuring use of Multi -factor Authentication to connect from the external end point to the internal end point. Authentication mechanisms must meet or exceed those described in the most recent version of NIST SP 800-63 for information requiring assurance level 3 or higher. One of the authentication factors should be provided by a device separate from the computer gaining access. (7) Ensuring all system and service accounts use Enterprise Active Directory or a similar centralized authentication and authorization mechanism. If authentication methods such as SQL authentication are required by the system, Contractor uses credentials secured during transmission through encrypted sessions such as TLS1.2 (or greater) or IPSec, and in storage using a secure hash method validated Washington State K140VS Page 12 of I9 Department of Corrections Attachment A 26RAD