Laserfiche WebLink
ATTACHMENT A <br />HIPAA AND DATA SECURITY REQUIREMENTS <br />8. Data Disposition. When the contracted work has been completed or when the Data is <br />no longer needed, except as noted above in Section 5.b, Data shall be returned to DOC <br />or destroyed. Media on which Data may be stored and associated acceptable methods <br />of destruction are as follows: <br />Data stored on: <br />Will be destroyed by: <br />Server or workstation hard disks, or <br />Using a "wipe" utility which will overwrite the <br />Data at least three (3) times using either <br />Removable media (e.g. floppies, USB flash <br />random or single character data, or <br />drives, portable hard disks) excluding optical <br />discs <br />Degaussing sufficiently to ensure that the Data <br />cannot be reconstructed, or <br />Physically destroying the disk <br />Paper documents with sensitive or <br />Recycling through a contracted firm, provided <br />Confidential Information <br />the contract with the recycler assures that the <br />confidentiality of Data will be protected. <br />Paper documents containing Confidential <br />On -site shredding, pulping, or incineration <br />Information requiring special handling (e.g. <br />protected health information <br />Optical discs (e.g. CDs or DVDs) <br />Incineration, shredding, or completely <br />defacing the readable surface with a coarse <br />abrasive <br />Magnetic tape <br />Degaussing, incinerating or crosscut <br />shredding <br />9. Notification of Compromise or Potential Compromise. Contractor shall implement <br />incident response practices consistent with NIST SP 800-61. The actual compromise of <br />DOC Data must be reported to the DOC Contact designated in the Agreement within three <br />(3) business days of discovery. If no DOC Contact is designated in the Agreement, then <br />the notification must be reported to the DOC Contracts and Legal Affairs office at <br />docclacontracts@doc1.wa.gov. Contractor must also take actions to mitigate the risk of <br />loss and comply with any notification or other requirements imposed by law or DOC. <br />10. Data shared with Subcontractors. If DOC Data provided under this Agreement is to be <br />shared with a subcontractor, the Agreement with the subcontractor must include all of the <br />data security provisions within this Agreement and within any amendments, attachments, <br />or exhibits within this Agreement. If the Contractor cannot protect the Data as articulated <br />within this Agreement, then the contract with the sub -Contractor must be submitted to the <br />DOC Contact specified for this contract for review and approval. <br />11. System Audit Requirements. Contractor has completed a recent independent security <br />audit by a SOC 2 Type 2 accredited firm of their development and operational practices, <br />or that an independent security audit by an accredited firm will be completed within 6 <br />months after contract execution. This audit must include vulnerability assessments, and <br />Washington State K14078 Page 18 of 19 <br />Department of Corrections Attachment A 26RAD <br />