Fully Executed Contract - Laserfiche WebLink

Home Browse Search

8. ATTACHMENT A HIPAA AND DATA SECUHITY REOUIREMENTS Data Disposltion. When the contracted work has been completed or when the Data is no longer needed, except as noted above in Section 5.b, Data shall be returned to DOC or destroyed. Media on which Data may be stored and associated acceptable methods of destruction are as follows: Notification of Compromise or Potential Compromise. Contractor shall implement incident response practices consistent with NIST SP 800-61. The actual compromise of DOC Data must be reported to the DOC Contact designated in the Agreement within three (3) business days of disoovery. lf no DOC Contact is designated in the Agreement, then the notification must be reported to the DOC Contracts and Legal Affairs office at docclacontracts@doc1.wa.gov. Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or DOC. Data shared with Subcontractors. lf DOC Data provided under this Agreement is to be shared with a subcontractor, the Agreementwith the subcontractor must include allof the data security provisions within this Agreement and within any amendments, attachments, or exhibits within this Agreement. lf the Contractor cannot protect the Data as articulated within this Agreement, then the contract with the sub-Contractor must be submitted to the DOC Contact specified for this contract for review and approval. $ystem Audit Requirements, Contractor has completed a recent independent security audit by a SOC 2 Type 2 accredited firm of their development and operational practices, or that an independent security audit by an accredited firm will be completed within 6 months after contract execution, This audit must include vulnerability assessments, and 9. 10. 11. Washlngton State Department of Corrections K14078 Attachment A Page 18 of 19 26RAD Data stored on:Will be destroyed by: Server or workstation hard disks, or Removable media (e.9. floppies, USB flash drives, portable hard disks) excluding optlcal discs Using a "wipen utilig which will ovenirrrite the Data at least three (3) times using either random or single character data, or Degaussing sutficiently to ensure that the Data cannot be reconstructed, or Phvsically destrovino the disk Paper docurnents with sensitive or Confidential I nformation Recyeling through a contracted firm, provided the contract with the recycler assures that the confidentialitv of Data will be protected. Paper documents containing Confidential lnformation requiring special handling (e.9. protected health information) On-site shredding, pulping, or incineration Optical discs (e.9. CDs or DVDs)lncineration, shredding, or completely defacing the readable surface with a coarse abrasive Magnetic tape Degaussing, incinerating shreddino or crosscut