J_4_1Sample_Task_Order_2_-_EDN_Rules_Of_Behavior_v7_1.pdf

Rules of Behavior

Electronic Disease Notification –

Version 7.1

04/05/2010

Rules of Behavior for Access to Center for Disease Control and Prevention (CDC)

Division of Global Migration and Quarantine (DGMQ) Electronic Disease Notification System (EDN)

I. Introduction

The Center for Disease Control and Prevention (CDC), Division of Global Migration and Quarantine (DGMQ), Electronic Disease Notification System (EDN) is an electronic system to notify CDC’s public health partners about diseases of public health importance, such as tuberculosis, and disease outbreaks occurring among mobile populations entering the United States. Such mobile populations include immigrants, refugees, migrants, and international travelers (including temporary visitors). The information contained on this electronic system includes personally-identifiable medical information and other sensitive information that requires protection from unauthorized access, disclosure, or modification based on confidentiality, integrity, and availability requirements.

As a condition for access to the EDN, individuals agree to comply with the user rules established by CDC governing the use of this system. Failure to comply with the user rules may result in termination of user access and other sanctions as appropriate. The user rules established by CDC are in addition to any requirements that may exist at your state or local agency. In general, users should comply with all applicable rules, regulations, and policies.

II. User Rules

In General:

Do not use the EDN system for any unauthorized purpose. The EDN system may only be accessed and used for official government purposes only.

Do not attempt to access any data or programs on the EDN system for which you do not have authorization.

Do not engage in, encourage, conceal any “hacking” or “cracking,” denial of service, unauthorized tampering, or unauthorized attempted use of (or deliberate disruption of) any computer system within the EDN program.

Do not share any information obtained through the EDN system with individuals who have not been granted access or other unauthorized persons.

Do not knowingly engage in any activity that:

1. Degrades the performance of the system

2. Deprives an authorized user access to a resource

3. Obtains or attempts to obtain extra resources beyond those allocated

4. Circumvents security measures in order to gain access to any automated system for which proper authorization has not been granted

EDN state and local users will require access to the Internet to use EDN application. EDN will carefully document all external connections to ensure access to EDN is limited to controlled points of entry through Secured Data Network (SDN). Individual users acknowledge and consent to such monitoring by EDN.

Users are also responsible for reporting security incidents and suspected fraud, waste, or misuse of the EDN system to the CDC Point of Contact.

CDC Point of Contact:

Joseph Dell (Security Steward, 404-639-1457, jdell@cdc.gov)

User IDs:

Do not share user identification (IDs) or system accounts with any individual.

When leaving a session unattended for a short period of time, lock the keyboard with a password-protected screen saver so that person’s confidential information is not open to public.

Employ the automatic password/screen saver option feature offered by the operating system.

Logoff when leaving your session unattended for an extended period of time.

Be aware of logon and logoff times to ensure that someone else is not using your

ID.

Passwords:

Your password SHOULD

1. Be difficult to guess (Do not use names that are easily identified with you or appear in a dictionary, to include anniversary dates, etc.

2. Be changed frequently (at least every 90 days).

3. Contain a minimum of 8 characters in length.

4. Contain a mix of upper case, lower case, number, or special character.

5. Be changed immediately if you suspect it has been compromised.

Your password SHOULD NOT

1. Have the same character/alphanumeric appear more than once.

2. Be shared with anyone.

3. Be written down.

4. Be stored on a programmable key.

III. SIGNATURE

I acknowledge receipt of, understand my responsibilities, and agree to comply with the user rules for the EDN system.

Signature of User Date

Print Name

Agency

Please sign and retain a copy for your records. Email pdf or fax to:

Nekeia Gray, EDN Administrator hvq6@cdc.gov Or Fax 404-929-0136

References:

Freedom of Information Act. http://www.hhs.gov/foia Privacy Act. http://www.usdoj.gov/foia/privstat.htm Computer Security Act. http://www.epic.org/crypto/csa/csa.html OMB publications. www.whitehouse.gov/omb

National Institute of Standards and Technology (NIST) publications August 31, 2004. http://nvl.nist.gov/

HIPAA. September 8, 2004 http://hippa.org

Section 508 of the Workforce Investment Act of 1998. August 31, 2004.

http://www.section508.gov/index.cfm?FuseAction=Content&ID=3

Public Health Information Network (PHIN) Compatibility http://www.cdc.gov/phin/

Secured Data Network (SDN) http://www.cdc.gov/irmo/ea/sdn.htm Computer Security Act Public Law 100-235. August 31, 2004.

http://cio.doe.gov/Documents/CSA.HTM