You accept this policy when you register for an NUHS Commercial Cloud SSO account, and each time you sign in.
1. Scope
This policy covers your NUHS Commercial Cloud SSO account and every system it gives you access to: today the AWS POC Sandbox and the Cloud Budget Calculator, and future NUHS commercial cloud systems. A system may add its own terms, such as the sandbox terms you accept with each lease request. Those apply in addition to this policy.
This is a commercial cloud (AWS) account. It is not an HCC account and gives no HCC access.
2. Your account is personal
- Use your account yourself. Never share your password, authenticator or signed-in session, and never sign in for someone else.
- Keep multi-factor authentication (MFA) on. If you lose your authenticator device, contact the GITO Cloud Team to reset it.
- Every colleague who needs access must register for and use their own account through the registration form.
- Report a suspected compromise, or a lost device with your authenticator, to the GITO Cloud Team straight away.
3. Data
- No patient data. Never put real patient data, protected health information or personal data into a system unless that system is explicitly approved for it. The AWS POC Sandbox is never approved for it: use synthetic or public data only.
- No NUHS confidential, production or operational data unless the system is approved for that classification.
- Don't store NUHS passwords, API keys or certificates in any system, and don't put credentials in code repositories.
4. Acceptable use
- Use these systems for NUHS work only: learning, evaluation, proofs of concept and the purpose each system is built for.
- Don't disable, bypass or test the security controls, budget controls or guardrails of any system, or try to gain access you haven't been given.
- No unlawful activity, cryptocurrency mining, attacks on or scanning of third parties, or unlicensed software.
- Keep costs reasonable: stop or delete resources you no longer need. Spend is attributed to you and your project.
5. Monitoring
Sign-ins and activity are logged and may be reviewed by the GITO Cloud Team and NUHS security.
6. When access ends
- Access is removed when you leave NUHS or no longer need it. Tell the GITO Cloud Team if you no longer need your account.
- Accounts may be suspended at any time to investigate a suspected breach or security risk.
7. Breaches
A breach can lead to immediate loss of access to some or all systems and escalation to your reporting officer. Any incident involving patient or personal data is handled under NUHS data-incident procedures.
8. Contact
NUHS GITO Cloud Team: nuhs_gito_cloud@healthgrp.com.sg