RFP #27-01 HIPPA Managed Compliance Services - Siskiyou County Public Health

The County of Siskiyou seeks a qualified vendor to provide comprehensive HIPAA Managed Compliance Services for its Public Health Division. The contractor will act as a strategic partner delivering governance, risk analysis, policy development, technical advisory, vendor management, workforce training, and incident‑response support on an ongoing basis. Services include creating and maintaining a HIPAA compliance framework, conducting periodic risk analyses, updating policies, advising on technical safeguards, managing Business Associate Agreements, coordinating annual training, and assisting with breach response exercises. The award will result in a professional‑services agreement with no disclosed ceiling; pricing is to be proposed by the vendor. • Provide continuous HIPAA program governance and compliance oversight. • Conduct and update Security Risk Analyses, risk‑management plans, and policy gap analyses. • Advise on technical safeguards (IAM, encryption, vulnerability management) without direct system changes. • Manage Business Associate relationships, coordinate training, and support incident‑response tabletop exercises. • Deliver regular executive status reports, training records, and documentation of ePHI inventories.