EXAMPLE: Use a password management application such as 1Password, LastPass, or KeePass that generates stores and protects long, random, unique passwords.

• A minimum of 8 characters in length
• For accounts that grant administrator privileges, a password of at least 12 characters in length must be used
• Include three of the following four character types:
  • A capital letter, A-Z
  • A lowercase letter, a-z
  • A number, 0-9
  • One of these symbols: `! @#$%^&*()-_+={}[]:<>.?/
• DO NOT use ~\|;”‘, or spaces, except where possible with UW NetID
• Must not match any of your last 5 passwords
• Never use the same character more than twice in a row

• Define roles and associated privileges
• Criteria for role assignment
• Identification of who is responsible for approving access
• Procedures for granting access, revalidating the need for access, and removal of access
• Procedures for documenting all individuals who have access, regardless of whether they are members of the study team (e.g., IT administrators, auditors, custodial services staff)

The access control policy and procedures should be commensurate with the size, complexity, and operational needs of the study. For example, a year-long study conducted by two UW faculty co-PIs would require fewer and simpler roles and processes than a multi-year study involving UW and external collaborators, rotating cohorts of research assistants, multiple lab facilities, and information systems owned by multiple organizations.

Existing departmental policy(ies) that satisfy this requirement may be used in lieu of developing a study-specific policy. Review HSD’s Research Data Access Control Policy template for guidance.

Disposal practices may be modeled after existing references like the UW Medicine Electronic Media Data Disposal Standard or UW-IT Secure Disposal of Computers and Devices or other applicable criteria. Note that Records Retention requirements may still apply to the data within the storage media planned for disposal.

CITI human subjects training is not sufficient for meeting this requirement.

Existing departmental policy(ies) that satisfy this requirement may be used in lieu of developing a study-specific policy. Review HSD’s Confidentiality and Security Training Policy template for guidance.

If MFA cannot be implemented at each authentication event, MFA should at least be incorporated into the nearest logical boundary or perimeter safeguards (e.g., requiring MFA to connect to the VPN before accessing data on a department server).

MFA is not required for accessing individual workstations by users physically present at the device unless explicitly specified for a study (e.g., some federal projects with extensive security obligations).

• UW-IT Two factor authentication for UW NetID information page
• NIST explanation article about MFA

Device configuration may be modeled after existing references like HSD’s WORKSHEET Device Configuration, the UW Medicine Minimum Computing Device Security Standard, UW-IT Security Laptops, UW-IT Smartphone configuration or other applicable criteria.

Where available, researchers are encouraged to leverage more rigorous configuration settings and/or advanced solutions offered or required by their department (e.g., using an Endpoint Detection and Response (EDR) product like CrowdStrike in lieu of the Microsoft Defender antivirus software built into Windows devices).

If the requirements of this document conflict with other policies, standards, practices, or similar obligations for a device, system, or dataset, the more restrictive or rigorous of the two should usually be implemented.

Never leave laptops and other mobile devices unattended (e.g., in your car).

Device disposal practices may be modeled after existing references like the UW Medicine Electronic Media Data Disposal Standard, UW-IT Secure Disposal of Computers and Devices or other applicable criteria.

Some portable devices may be used to view or access identifiable data if necessary (e.g., using a laptop’s web browser to view data collected via REDCap, accessing data stored on a department-managed fileserver requiring connectivity through a UW VPN). Other types of portable devices (e.g., cameras, audio recorders) may be used to temporarily store the original version of study data as part of data collection. In both circumstances, care must be exercised to ensure that the devices follow other applicable requirements set in this document (e.g., D4’s protection against loss or theft, D5’s sanitization practices, U1’s access limitations, U8’s reporting of loss requirements) and that copies of the data are not retained on the device.

• Data must not be stored locally on devices except in circumstances where temporary storage is required (e.g., storage media for recording audio or video). Consider disabling auto download features from web browsers.
• Data must not be stored in or processed by any cloud solution unless the solution is covered by appropriate contractual agreements (e.g., Business Associate Agreement, Data Processing Agreement).
  • Note UW has umbrella cloud agreements with vendors
  • Note Cloud training is available

Additional information about encryption and example encryption methods may be found at the UW-IT Whole Disk Encryption webpage or UW Medicine Encryption Guidance webpage.

• Devices are securely configured
• Updates and patches to operating systems and applications are installed promptly
• Devices are inventoried and tracked to avoid loss or theft and ensure unauthorized individuals do not have access
• Devices are used according to the UW Acceptable Use Policy (for UW data) and in accordance with data use agreements and other applicable requirements

Existing departmental policy(ies) that satisfy this requirement may be used in lieu of developing a study-specific policy. SeeReview HSD’s Device Management & Monitoring Policy template for guidance.

• A minimum of 8 characters in length
• For accounts that grant administrator privileges, a password of at least 12 characters in length must be used
• Include three of the following four character types:
  • A capital letter, A-Z
  • A lowercase letter, a-z
  • A number, 0-9
  • One of these symbols: `! @#$%^&*()-_+={}[]:<>.?/
• DO NOT use ~\|;”‘, or spaces, except where possible with UW NetID
• Must not match any of your last 5 passwords
• Never use the same character more than twice in a row

• Firewall configurations must restrict connections between publicly accessible servers and system components that store Confidential data. Firewalls and similar mechanisms should be configured to allow only the minimum viable level of access.
• All data must be encrypted in-transit using cryptographic protocols, such as Transport Layer Security (TLS 1.2 or greater)

UW-IT managed firewall

• Firewall configurations must restrict connections between publicly accessible servers and system components that store Confidential data. Firewalls and similar mechanisms should be configured to allow only the minimum viable level of access.
• All data must be encrypted in-transit using cryptographic protocols, such as Transport Layer Security (TLS 1.2 or greater)

UW-IT managed firewall

• Mechanisms for users to set or change passwords must be secure
• All default or temporary passwords must be changed prior to using an account, server, system, or service for its intended purpose

Commercial services must have contractual protections implemented commensurate with the data stored or processed, such as ensuring a Business Associates Agreement (BAA) is executed prior to allowing a service to access any electronic Protected Health Information (ePHI) and a Data Processing Agreement (DPA) before sharing any personal data with an external organization or contractor.

Researchers and server operators should consult with IT personnel within their department, major university organization, or other organizational unit to determine if any advanced and/or centrally administered anti-malware solutions are available for servers or services planned for use in their project.

• Access must be granted using the principle of least privilege (i.e., restricting users’ access to only the minimum-viable amount, level, or resources needed to perform a task)
• Access should be granted using a role-based access management scheme (i.e., controlling users’ access through membership to groups in lieu of manually configuring each type of access)

UW-IT managed firewall

Husky On Net (HON) UW-IT free individual VPN

Disposal practices may be modeled after existing references like the UW Medicine Electronic Media Data Disposal Standard, UW-IT Secure Disposal of Computers and Devices, UW Facilities Preparing items for surplus, or other applicable criteria. Note that Records Retention requirements may still apply to the data within the storage media planned for disposal.

Server operators and researchers should strongly consider enrollment into centrally administered vulnerability monitoring and scanning services that may be available for systems under their care. Options and eligibility for certain centrally administered solutions may vary across the organization. Teams may consider reviewing the UW Medicine Security Standards for Patch Management and UW Medicine Security Standards for Vulnerability Management as example approaches to follow when developing plans for their servers.

A “secure location” refers to an environment where access to records, servers, and system components is restricted and controlled to prevent unauthorized access, theft, or tampering. This can include using physical locks (e.g., cable locks, locked cabinets, or rooms) or implementing access controls such as keycards or biometric authentication and monitoring access to detect any unauthorized or anomalous activity. All locations where servers are stored or operated must have appropriate safeguards to ensure the integrity and confidentiality of the information. Further, locations where servers are stored or hosted should also consider potential risks that could arise from environmental or infrastructure sources (e.g., power or network outages, temperature and humidity management, fire suppression needs).

(Review also the in-transit encryption requirement in S2)

Systems that are not inherently designed to be cloud-hosted or accessed from the public internet must not be able to be accessible directly via the internet (i.e., without intermediary protections like connecting to the UW VPN).

UW-IT managed firewall

Husky On Net (HON) UW-IT free individual VPN

Be sure to consider non-research personnel such as administrative and custodial staff.

A “secure location” refers to an environment where access to records and system components is restricted and controlled to prevent unauthorized access, theft, or tampering. This can include using physical locks (e.g., cable locks, locked cabinets, or rooms) or implementing access controls such as keycards or biometric authentication and monitoring access to detect any unauthorized or anomalous activity. All locations where records or other non-digital data are stored or operated must have appropriate safeguards to ensure the integrity and confidentiality of the information.

• Physical paper records should be disposed of using UW Facilities Confidential Paper Documents Disposal Guide
• eMedia (e.g., CDs, videotapes) should be disposed of in accordance with UW Facilities Confidential eMedia Disposal Guide

Be sure to consider non-research personnel such as administrative and custodial staff.

Review UW Medicine’s Electronic Communications Security Standard

Note UW-IT provides an eFax Service (including HIPAA compliance on the UW side with request)

Arrangements must be made to ensure the intended recipient will receive and promptly store or process fax-transmitted data. This includes coordination of fax transmission to recipient fax machines and verification of the recipient’s fax number.

To the greatest extent practicable, confidential, and sensitive data should not be sent over fax.

Note UW-IT eFax Service (including HIPAA compliance on the UW side with request)

UW Medicine requirements are located in the Electronic Communications Security Standard and Encryption Security Standard.

In most circumstances, open and public Wi-Fi networks, consumer-oriented VPN (Virtual Private Network) services, and other insecure or unvetted means of connectivity and data transmission should not be used to transmit or access study data. Alternatives, such as cellular hot-spots or UW-provided VPN services, should be used instead.

Additional details on secure transmission of data may be found in UW Medicine’s Electronic Communications Security Standard and in Resources above.

• Users
• Use of portable devices
• Servers
• Security controls
• Paper records and other non-digital storage media
• Data transmission