Fully Executed Agreement (2) - Laserfiche WebLink

Home Browse Search

1 SPecial Terms and Conditions Exhibit A - Data Security Requirements The words and phrases listed below, as used in this Exhibit, shall each have the following b c Definitions definitions: a. e .AES, means the Advanced Encryption Standard, a specification of Federal lnformation Processing Standards Publications for the encryption of electronic data issued by the tlalio$ lnstttute of Standards and Technology (https //nvlpubs. nist.govi nistpubs/FIPS/NlST. FIPS' 197-upd 1 'pdO' ,,Authorized Users(s)" means an individual or individuals with a business need to access DSHS confidential lnformation, and who has or have been authorized to do so. "Business Associate Agreement" means an agreement between DSHS and a contractor who is receiving Data covered-under the privacy and"security Rules of the Health lnsurance Portability and Accountability Act of 1996, The agreement estabjishes permitted and required uses and disclosures of protecGd health informaltion (PHl) in accordance with HIPAA requirements and prouio*. obligations for business associates to safeguard the information- ,,category 4 Dala" is data that is confidential and requires special handling due to statutes or regulations that require especially strict protection oi the data and from which especially serious consequences may arise in the event of any compromlse.of such data' Data classified as Category 4 includes but is not limited to data protected Oy: ine Health,lnsurance Portability andAccountability Act (HlpAA), pub. t. lOt+-191 as amenOeO UV tire Healtfr lnformation Technology for Economic and Ctinicat Health Act of zoog iF{r6CH), 45 CFit parts 160 and 164; the Family Educational Rights and privacy nct (rrnFn), jo u s c.'S 1232g;34 CFR Part^99; lntetnal Revenue Service Publication 1075 (https://www.irs.gov/publiri-pOf/p1075'pdf);Su.bstance Abuse and Mental Health services Administration regulations on confidentiality of Alcoho,l and Drug Abuse Patient Records' 42 CFRpart2', and/or CririinalJustice lnformation Services, 28 CFR Part'20' "Cloud" means data storage on servers hosted by an entity other than the Contraclor and on a network outside tne contro'l of the contractor. Physical storage of data in the cloud typically spans rrfiipf" servers anO otten multiple locations. Cloud storage can be divided between consumer grade storage for personal files and enterprise grade for cbmpanies and governmental entities' Examples of consumJigi"J" ttorage wouh inc-lude iTunes, Dropbox' Box'com' and many other entities. Enterprise "rouiJ ulnoors i"nclude lVlicrosoft Azure, Amazon Web Services, and Rackspace' ,,Encrypt" means to encode confidential lnformation into a format that can only be read by those possessing a *key"; a password, digital certificate or other mechanism available only to authorized users. Encryption must use a key length of at least 256 bits for symmetr!9 xry:, or.20.48 bits for asymmetric t<e's. Wnenl r,rt"tti."fey is used, the Advanced Encryption Standard (AES) must be used if available. ,,FedRAMP" means the Federal Risk and Authorization Management Program (see www.fedramp.gov), which is an assessment and authorization process that federal government agencies have been directed to use to ensure security is in place when accessing Cloud computing products and services. ,,Hardened Password" means a string of at least eight characters containing at least three of the following four character classes: uppercase "lpt-tr-o*ti", lowercase alphabetic, numeral' and special charactirs such as an asterisk, ampersand, or exclamation point' d f g h DSHS Central Contract Services 6O17CF County Program Agreement (10-31-2017) Page 1 6