Download Password Guidance (PDF)

Minnesota CAREWare Policies and Procedures Title: Passwords Issue Date: July 17, 2009 Revised: May 27, 2014 Purpose: The Ryan White Program requires client level data for reporting to HRSA and for Parts A, B and state HIV services grant management. In Minnesota, these data are collected in Minnesota CAREWare. This policy ensures the security of Ryan White data and reduces the risk of disclosure. Policy: 1) Passwords should be changed if directed to do so by the Minnesota CAREWare Help Desk, system administrator, or security officer. 2) Passwords for WinSCP and CAREWare application need to be updated every 30 days. Procedures: 1) Minimum length for the WinSCP and CAREWare application passwords is 8 characters with at least one number and one special character (!, @, #, $, %, ^, &, *). 2) Passwords must not be disclosed to anyone. 3) Passwords must be changed immediately if they have been revealed to someone else. 4) Passwords must be manually entered at each level of authentication. 5) Passwords should not be written down. If users need to write down passwords, they must be kept in a secure location such as a locked drawer or office. 6) Passwords should always be changed after the system administrator issues a temporary password. 7) Idle user account time out for the CAREWare application is 15 minutes. 8) Idle user account time out for the WinSCP is 30 minutes. 9) One connection per user. 10) Unique passwords must be used to access the WinSCP and CAREWare application. 11) No more than five (5) grace logins will be allowed following expiration. 12) The account will be locked after five (5) consecutive, unsuccessful login attempts. Other questions regarding passwords may be directed to the Minnesota CAREWare Help Desk.