NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

8 Part 3: Secure ISO ClaimSearch® Information 1 . Security, Privacy, and Compliance Standards All Participating Organizations and Authorized Users agree to the following: • Comply with all applicable laws, rules, and regulations. • Safeguard ISO ClaimSearch® Information by exercising due care in accordance with industry best practices or commensurate with a Participating Organization’s controls if the controls exceed industry best practices when handling all ISO ClaimSearch Information. • Report to ISO all discoveries of inaccurate reporting to allow for corrections and the necessary disclosures to be released. • Report to ISO all instances of production data reported into a nonproduction environment. • Access or use ISO ClaimSearch, including any ISO ClaimSearch Information, only when you have a need to know that information and only when it relates to your job responsibilities. • Never browse files containing ISO ClaimSearch Information out of curiosity or for personal reasons. • Use care when documenting claims files with personally identifiable ISO ClaimSearch Information, especially when those records could be deemed publicly available. • Access ISO ClaimSearch and any ISO ClaimSearch Information only when using secure/ encrypted electronic devices (workstations, laptops, tablets, phones, and so forth) from secure locations. • Limit the potential for unauthorized disclosure when handling, processing, transmitting, trans- porting, and/or storing ISO ClaimSearch Information. For example, protect against “shoulder surfing” or eavesdropping by being aware of your surroundings when processing or discussing ISO ClaimSearch Information. • Do not share or store in written or electronic form user IDs and passwords that allow access to ISO ClaimSearch. • Do not e-mail ISO ClaimSearch Information that identifies an individual except through secure e-mail using industry-standard encryption. When e-mailing ISO ClaimSearch Information as an attachment, encrypt the attachment. If the encrypted attachment password must be shared with the recipient of the file, do not transmit the password in the e-mail that contains the attachment. Communicate the password to the recipient separately, for example, by phone or in person. • Store soft-copy files only when absolutely necessary, using industry-standard best practices or commensurate with a Participating Organization’s controls if the controls exceed industry best practices, which include, but are not limited to, file encryption, device encryption, and authentication-protected access. (Refrain from transporting hard-copy ISO ClaimSearch Information; however, if authorized by your Participating Organization to transport those docu- ments, they must be under the control of the authorized workforce member and locked in a secure container when not in use.) • Refrain from sending ISO ClaimSearch Information by fax; however, if authorized by your Participating Organization, ISO ClaimSearch Information transmitted by fax must have all personally identifiable information masked and arrangements made for the recipient to be present at the fax machine when the fax is transmitted. Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4