Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS g. When accessing the Data from within the Contractor's network (the Data stays within the Contractor's network at all times), enforce password and logon requirements for users within the Conhactor's neiwork, including: (1) A minimum length of B characters, and containing at least three of the followlng character classes: uppercase letters, lowercase letters, numerals, and special characters such as an asterisk, ampersand, or exclamation point. (2) That a password does not contain a user's name, logon lD, or any form of their full name. (3) That a password does not consist of a single dictionary word. A password may be formed as a passphrase which consists of multiple dictionary words- (4) That passwords are significantly different from the previous four passwords. Passwords that increment by simply adding a number are not considered significantly different. h. When accessing Confidential lnformation from an external location (the Data will traverse the lnternet or othenruise travel outside the Contractor's network), mitigate risk and enforce password and logon requirements for users by employing measures including: (1) Ensuring mitigations applied to the system don't allow end-user modification. (2) Not allowing the use of dial-up connections. (3) Using industry standard protocols and solutions for remote access. Examples would include RADIUS and Citrix. (4) Encrypting all remote access traffic from the external workstation to Trusted Network or to a component within the Trusted Network networks (using key lengths of 128 bits or greater) Algorithm modules validated by the National lnstitute of Standards and Technology (NIST) Crvptoqraohic Module Validation Proqram (CMVP) are required. The tratfic must be encrypted at alltimes while traversing any network, including the lnternet, which is not a Trusted Network. (5) Ensuring that the remote access system prompts for re-authentication or performs automated session termination after no more than 20 minutes of inactivity. (6) Ensuring use of Multi-factor Authentication to connect from the external end point to the internal end point. Authentication mechanisms must meet or exceed those described in the most recent version of NIST SP 800-63 for information requiring assurance level 3 or higher. One of the authentication factors should be provided by a device separate from the computer gaining access. (7) Ensuring all system and service accounts use Enterprise Active Directory or a similar centralized authentication and authorization mechanism. lf authentication methods such as SQL authentication are required by the system, Contractor uses credentials secured during transmission through encrypted sessions such as TLS1.2 (or greater) or lPSec, and in storage using a secure hash method validated !Vashington State Department of Corrections K14078 Attachment A Page 12 of 19 26RAD