Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTACHMENT A HIPAA AND DATA SECURITY REOUIREMENTS Authorized Users through the use of access control lists which will grant access only after the Authorized User has authenticated to the network using a Unique User lD and Hardened Password or other authentioation mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on disks mounted to such servers must be located in an area which is accessible only to authorized personnel, wlth access controlled through use of a key, card key, combination lock, or comparable rnechanism. For DOC Confidential lnformation stored on these disks, deleting unneeded Data is sufficient as long as the disks remain in a Secure Area and otherwise rneet the requirements listed in the above paragraph. Destruction of the Data, as outlined below in Section B Data Disposition, may be deferred untilthe disks are retired, replaced, or otherwise taken out of the Secure Area. c, Optlcal discs (CDs or DVDs) In local workstation optical disc drives. Data provided by DOC on optical discs which will be used in local workstation optical disc drives and which will not be transported out of a Secure Area. When not in use for the contracted purpose, such discs must be $tored in a Secure Area. Workstations which access DOC Data on optical discs must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable rnechanism, d. Optical discs (CDs or DVDs) in drives or jukeboxes attached to servers, Data provided by DOC on optical discs which will be attached to networkservers and which will not be transported out of a Secure Area. Access to Data on these discs will be restricted to Authorized Users through the use of access control lists which will grant access only afterthe Authorized User has authenticated to the network using a Unique User lD and Hardened Password or other authentication mechanisms which provide equal or greater security, such as biometrics or smart cards. Data on discs attached to such servers must be located in an area which is accessible only to authorized personnel, with access controlled through use of a key, card key, combination lock, or comparable mechanism. e. Paper documents. Any paper records must be protected by storing the records in a Secure Area which is only accessible to authorized personnel. When not in use, such records must be stored in a Secure Area. f, Remote Access. Access to and use of the Dala over the State Governmental Network (SGN) or Secure Access Washington (SAW will be controlled by DOC staff who will issue authentication credentials (e,9. a Unique User lD and Hardened Password) to Authorized Users on Contractor's staff, Contractor will notifu DOC statf immediately whenever an Authorized User in possession of such credentials is terminated or otheruvise leaves the employ of the Contractor, and whenever an Authorlzed User'$ duties change such that the Authorized User no longer requires access to perform work for this Contract. g, Data storage on portable devices or media. (1) Except where otherwise specified herein, DOC Data shall not be stored by the Contractor on portable devices or media unless specificatly authorized within the Washington $taLe Department of Corre ctions Kl4078 Attachment A Page1,4of 19 26RAD