Washington State Healthcare Authority 3/22/2019

HCA General Terms and Conditions (b) Communicating with the intended recipient before transmission to ensure that the fax will be received only by an authorized person. (c) Verifying after transmittal that the fax was received by the intended recipient. (4) When transporting six (6) or more records containing Confidential Information, outside a Secure Area, do one or more of the following as appropriate: (a) Use a Trusted System. (b) Encrypt the Confidential Information, including: i. Encrypting email and/or email attachments which contain the Confidential Information. ii. Encrypting Confidential Information when it is stored on portable devices or media, including but not limited to laptop computers and flash memory devices. Note: If the HCA Data Security Requirements Exhibit is attached to this Interagency Agreement, this item, 12.b.(4), is superseded by the language contained in the Exhibit. (5) Send paper documents containing Confidential Information via a Trusted System. (6) Following the requirements of the HCA Data Security Requirements Exhibit, if attached to this Interagency Agreement. c. Upon request by HCA program staff, at the end of the Agreement term, or when no longer needed, the Contractor shall return the Data to HCA information technology staff or the Contractor shall certify in writing that they employed a HCA approved method to destroy the information. The Contractor may obtain information regarding approved destruction methods from the HCA contact identified on the cover page of this Interagency Agreement. d. Paper documents with Confidential Information may be recycled through a contracted firm, provided the contract with the recycler specifies that the confidentiality of information will be protected, and the information destroyed through the recycling process. Paper documents containing Confidential Information requiring special handling (e.g. protected health information) must be destroyed on-site through shredding, pulping, or incineration. e. Notification of Compromise or Potential Compromise. The compromise or potential compromise of Confidential Information must be reported to the HCA Contact designated on the cover page of this Interagency Agreement within one (1) business day of discovery. The Contractor must also take actions to mitigate the risk of loss and comply with any notification or other requirements imposed by law or the Authority. State of Washington Page 9 of 19 Contract No. K2850 Health Care Authority