Fully Executed Contract - Laserfiche WebLink

Home Browse Search

ATTAGHMENT A HIPAA AND DATA $ECURITY REOUIREMENTS terrns and conditions of the Agreement. lf so authorized, the Data shall be given the following protections: (a) Encrypt the Data. (b) Control access to devices with a Unique User lD and Hardened Password or stronger authentication method such as a physicaltoken or biometrics, (c) Manually lock devices whenever they are left unattended and set devices to tock automatically after a period of inactivity, if this feature is availabte, Maximum period of inactivity is 20 minutes, (d) Apply administrative and physical security conhols to Portable Devices and Portable Media by: i. Keeping them in a Secure Area when not in use, ii. Uslng check-in/check-out procedures when they are shared, and iii, Taking frequent inventories. (2) When being transported outside of a Secure Area, Portabie Devices and Portable Media with DOC Confidential lnformation must be under the physical control of Contractor staff with authorization to access the Data, even if the Data is encrypted. h. Data stoted for backup purposes. (1) DOC Confidential lnformation may be stored on Portable Media as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. $uch storage is authorized until such time as that media would be reused during the course of normal backup operations. lf backup media is retired while DOC Confidential lnformation stillexists upon it, such media will be destroyed at that time in aceordance with the disposition requirements below in Section 8 Data Disposition. (2) Data may be stored on non-portable media (e,9. Storage Area Network drives, virtual media, etc.) as part of a Contractor's existing, documented backup process for business continuity or disaster recovery purposes. lf so, such media will be protected as otherwise described in this exhibit, lf this media is retired while DOC Confidential lnformation still exists upon it, the data witl be destroyed at that time in accordance with the disposition requirements below in Section 8 Data Disposition. i, Cloud storage. DOC Confidential lnformation requires protections equalto or greater than those specified elsewhere within this exhibit. Cloud storage of Data is problematic as neither DOC nor the Contractor has control of the environrnent in which the Data is stored. For this reason: (1) DOC Data will not be stored in any consumer grade Cloud solution, unless all of the following conditions are met: Washington State Dcpartment of Corrections K14078 Attachment A Page 15 of 19 26RAD