Common use of Additional Data Security Requirements Clause in Contracts

Additional Data Security Requirements. DSHS shall provide DSHS laptop computers to Contractor staff authorized to access the DSHS systems and data. Using those computers, Contractor shall access DSHS systems within the State Government Network (SGN) using WaTech provided Virtual Private Network (VPN). Contractor staff will not have an administrative account on the DSHS provided device and will not change or attempt to change or bypass any security controls configured by DSHS before Contractor receives the device. Contractor may be allowed access to all applicable DSHS programs, systems, and databases upon completion of the remote access agreement, the confidentiality agreement, and in accordance with the following to complete authorized work by the Program: a. Purpose (1) Activity for which the Data is needed: To research client information to prepare for all visit types, and to document Statement of Deficiencies produced for ALTSA/RCS. (2) How Data Recipient will use Data: Evaluators will use the applicable DSHS systems to access client information and provider compliance history in order to plan, execute and complete the Evaluation process, including the preparation of the final report. b. Description of Data and Data Elements: (1) The STARS system contains data related to the providers that will be evaluated. No client data is included in the STARS system. Provider data includes, but is not limited to, names (such as d/b/a names), location addresses, license number, certification number, contact information, and previous enforcement actions, complaints and dispositions, (2) The CARE system contains Client data, including PHI. Such data includes, but is not limited to, name, location, health status, care plans, emergency contact information, and psychosocial information. (3) Timeframe(s) for Data disclosure or exchange: As needed. (4) Conditions under which, if any, that Data disclosed or exchanged can be linked to other data: Not Applicable. c. Data Access or Transfer (1) Method: Contractors must use a state-issued laptop to access the Washington state government’s VPN through which its staff will have access to applicable DSHS systems and program applications

Additional Data Security Requirements. DSHS shall provide DSHS laptop computers to Contractor staff authorized to access the DSHS systems and data. Using those computers, Contractor shall access DSHS systems within the State Government Network (SGN) using WaTech provided Virtual Private Network (VPN). Contractor staff will not have an administrative account on the DSHS provided device and will not change or attempt to change or bypass any security controls configured by DSHS before Contractor receives the device. Contractor may be allowed access to all applicable DSHS programs, systems, and databases upon completion of the remote access agreement, the confidentiality agreement, and in accordance with the following to complete authorized work by the Program: a. Purpose (1) Activity for which the Data is needed: To research client information to prepare for all visit types, and to document Statement of Deficiencies produced for ALTSA/RCS. (2) How Data Recipient will use Data: Evaluators will use the applicable DSHS systems to access client information and provider compliance history in order to plan, execute and complete the Evaluation process, including the preparation of the final report. b. Description of Data and Data Elements: (1) The STARS system contains data related to the providers that will be evaluated. No client data is included in the STARS system. Provider data includes, but is not limited to, names (such as d/b/a names), location addresses, license number, certification number, contact information, and previous enforcement actions, complaints and dispositions, (2) The CARE system contains Client data, including PHI. Such data includes, but is not limited to, name, location, health status, care plans, emergency contact information, and psychosocial information. (31) Timeframe(s) for Data disclosure or exchange: As needed. (42) Conditions under which, if any, that Data disclosed or exchanged can be linked to other data: Not Applicable. c. Data Access or Transfer (1) Method: Contractors must use a state-issued laptop to access the Washington state government’s VPN through which its staff will have access to applicable DSHS systems and program applications