RFP #27-01 HIPPA Managed Compliance Services - Siskiyou County Public Health

Location:	California
Posted:	Oct 20, 2026
Due:	Oct 30, 2026
Agency:	Siskiyou County
Type of Government:	State & Local
Category:	Q - Medical Services R - Professional, Administrative and Management Support Services
Publication URL:	To access bid details, please log in.

Bid/RFP Status:

Open - accepting bids and proposals

Bid/RFP Due Date:

Friday, October 30, 2026 - 4:00pm

Bid/RFP Reference Number:

#27-01

Back to Bids/RFPs

Siskiyou County Health & Human Services Agency, Public Health Division (County) is soliciting proposals from qualified firms to provide HIPAA Managed Compliance Services to the Public Health Division. The County seeks a qualified contractor to provide advisory, governance, documentation, reporting, and coordination services to support the County’s ongoing compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the Privacy Rule, Security Rule, and Breach Notification Rule.

Estimated Timeline of Events

Date	Activity
10/12/26	Release of Request for Proposals (RFP)
10/22/26	Mandatory Pre-Bid Meeting via Zoom 10:00 – 11:00
10/26/26	Deadline to Submit Questions
10/30/26	Submission of Proposals due by 4:00 PM

**RFP document (V2) added 10/20/26 showing updated Zoom link for mandatory pre-bid meeting**

https://us02web.zoom.us/j/87133663233

Supporting Documents

RFP #27-01 - HIPPA Managed Compliance Services (250 KB)

RFP #27-01 - HIPPA Managed Compliance Services - Attachment A (234 KB)

RFP #27-01 - HIPPA Managed Compliance Services - Attachment B (325 KB)

RFP #27-01 - HIPPA Managed Compliance Services - V2 - Uploaded 10/20/2026 (291 KB)

Attachment Preview

County Of Siskiyou

Request for Proposals (RFP)

RFP # 27-01 – Public Health

for

HIPAA Managed Compliance Services for Siskiyou County

Public Health

Proposals may be mailed, delivered, or emailed to:

Shelly Davis

Director

Siskiyou HHSA-Public Health Division

810 S. Main St. Yreka, CA 96097

RFP_RFB_Submissions@co.siskiyou.ca.us

Proposals Due by:

October 30, 2026

4:00pm

Page 1 of 8

County of Siskiyou

Request for Proposals

The following schedule of events will be followed to the extent achievable; however, the

County reserves the right to adjust or make changes to the schedule as needed.

Estimated Timeline of Events

Date

10/12/26

Activity

Release of Request for Proposals (RFP)

10/22/26

Mandatory Pre-Bid Meeting via Zoom

10:00 – 11:00

10/26/26

Deadline to Submit Questions

10/30/26

Submission of Proposals due by 4:00

11/2/26

Review of Proposals

11/2/26

Notification of Final Selection

11/6/26

Estimated

Professional Service Agreement

Processed

12/8/26

Estimated

Professional Service Agreement Start

Date

Page 2 of 8

1.0 Purpose and Objectives

Siskiyou County Health & Human Services Agency, Public Health Division (County) is soliciting

proposals from qualified firms to provide HIPAA Managed Compliance Services to the Public

Health Division. The County seeks a qualified contractor to provide advisory, governance,

documentation, reporting, and coordination services to support the County’s ongoing

compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA),

including the Privacy Rule, Security Rule, and Breach Notification Rule.

The County intends to establish and maintain a documented, defensible compliance program

that supports current regulatory requirements and evolving federal guidance and enforcement

expectations.

This Request for Proposals (RFP) is intended to obtain proposals from firms with

demonstrated experience supporting public agencies, healthcare entities, or other covered

entities and business associates in HIPAA compliance program management.

The purpose of this RFP is to procure ongoing HIPAA managed compliance services that will

enable the County to:

1. Establish and maintain a documented HIPAA compliance program;

2. Identify, assess, and track compliance gaps and risks;

3. Provide governance, reporting, and oversight support;

4. Support County leadership and designated privacy, security, and compliance personnel;

5. Reduce compliance risk through continuous monitoring and advisory services; and

6. Maintain a structured and repeatable process for risk analysis, remediation planning,

policy review, training, and incident preparedness.

The selected contractor will provide advisory and support services. Ownership of policies,

enforcement decisions, operational decisions, and implementation of remediation actions shall

remain with the County unless otherwise provided under a separate agreement.

2.0 Scope of Work (SOW) — HIPAA Managed Compliance Services

The selected contractor shall provide HIPAA Managed Compliance Services including, but not

limited to, the following:

2.1 Program Governance and Compliance Oversight

The contractor shall support the County in an advisory compliance and security governance

capacity by:

1. Establishing and maintaining a HIPAA compliance framework;

2. Managing a compliance task matrix aligned to applicable HIPAA requirements;

3. Scheduling and facilitating periodic compliance review meetings;

4. Tracking compliance obligations, identified risks, and remediation activities;

5. Providing executive-level compliance status reporting; and

Page 3 of 8

6. Supporting coordination among County leadership and designated privacy/security

personnel.

2.2 Risk Analysis and Ongoing Risk Management

The contractor shall perform and maintain a structured HIPAA Security Risk Analysis,

including:

1. Identification of administrative, technical, and physical safeguard gaps;

2. Risk scoring and prioritization;

3. Development and maintenance of documented risk management plans;

4. Periodic reassessment based on environmental, operational, or regulatory changes;

and

5. Support for maintaining documentation sufficient to demonstrate a reasonable and

defensible compliance process.

2.3 Policy and Documentation Support

The contractor shall assist the County with HIPAA-related policy and documentation lifecycle

activities, including:

1. Review of existing HIPAA-related policies and procedures;

2. Identification of missing, outdated, or incomplete documentation;

3. Coordination of annual policy review activities;

4. Guidance regarding documentation updates needed due to regulatory or operational

changes;

5. Assistance with Notices of Privacy Practices and internal compliance documentation;

and

6. Template-based policy drafting and customization with County input, as requested.

2.4 Technical Safeguards Advisory

The contractor shall provide advisory guidance related to required and addressable technical

safeguards, including:

1. Identity and access management, including multi-factor authentication and least

privilege principles;

2. Encryption standards for data at rest and in transit;

3. Vulnerability management expectations;

4. Logging, monitoring, and audit controls;

5. Penetration testing considerations;

6. Vulnerability scanning practices;

7. Operating system and third-party software patch management practices;

8. Electronic health record (EHR) patch validation considerations, where applicable; and

Page 4 of 8

9. Security control domains such as application control, elevation control, network control,

storage control, configuration management, identity control, and web control.

Unless expressly authorized under a separate agreement, the contractor shall not make

hands-on changes to County systems or production environments.

2.5 Business Associate and Vendor Management Support

The contractor shall assist the County with compliance oversight of third-party vendors by:

1. Identifying vendors that access, store, process, or transmit electronic protected health

information (ePHI);

2. Assisting in the maintenance of a Business Associate register;

3. Supporting Business Associate Agreement (BAA) tracking;

4. Identifying vendor-related compliance risks; and

5. Recommending improvements to vendor compliance oversight processes.

2.6 Workforce Training and Awareness

The contractor shall support HIPAA workforce training requirements by:

1. Coordinating annual HIPAA Privacy and Security training;

2. Providing supplemental security awareness materials;

3. Tracking training completion status; and

4. Recommending role-based training approaches where appropriate.

2.7 Incident Preparedness and Breach Response Support

The contractor shall assist the County with preparedness and response planning, including:

1. Development or review of a Security Incident Response Plan;

2. Guidance related to HIPAA Breach Notification Rule requirements;

3. Facilitation of at least one tabletop incident exercise during the contract term, if

requested; and

4. Documentation support associated with incident response planning and related

compliance activities.

2.8 Deliverables

At a minimum, the selected contractor shall provide the following deliverables during the

contract term:

1. HIPAA Risk Analysis Report;

2. Compliance task matrix or checklist with defined review cadence;

3. Policy review summary and gap analysis;

4. Monthly or periodic executive compliance status reports;

5. Training coordination records;

Page 5 of 8

This is the opportunity summary page. It provides an overview of this opportunity and a preview of the attached documentation.

Daily notification on new contract opportunities

With GovernmentContracts, you can:

Find more opportunities and win more business
Receive daily alerts for all new bid opportunities
Get contract opportunities matched to your business

ONE WEEK FREE TRIAL

RFP #27-01 HIPPA Managed Compliance Services - Siskiyou County Public Health

Attachment Preview

See also