RFP #27-01 HIPPA Managed Compliance Services - Siskiyou County Public Health

County Of Siskiyou
Request for Proposals (RFP)
RFP # 27-01 - Public Health
for
HIPAA Managed Compliance Services for Siskiyou County
Public Health
Proposals may be mailed, delivered, or emailed to:
Shelly Davis
Director
Siskiyou HHSA-Public Health Division
810 S. Main St. Yreka, CA 96097
RFP_RFB_Submissions@co.siskiyou.ca.us
Proposals Due by:
October 30, 2026
4:00pm
Page 1 of 8

County of Siskiyou
Request for Proposals
The following schedule of events will be followed to the extent achievable; however, the
County reserves the right to adjust or make changes to the schedule as needed.
Estimated Timeline of Events
Date Activity
10/12/26 Release of Request for Proposals (RFP)
10/22/26 Mandatory Pre-Bid Meeting via Zoom
10:00 - 11:00
10/26/26 Deadline to Submit Questions
10/30/26 Submission of Proposals due by 4:00
PM
11/2/26 Review of Proposals
11/2/26 Notification of Final Selection
11/6/26 Professional Service Agreement
Estimated Processed
12/8/26 Professional Service Agreement Start
Estimated Date
Page 2 of 8

1.0 Purpose and Objectives
Siskiyou County Health & Human Services Agency, Public Health Division (County) is soliciting
proposals from qualified firms to provide HIPAA Managed Compliance Services to the Public
Health Division. The County seeks a qualified contractor to provide advisory, governance,
documentation, reporting, and coordination services to support the County's ongoing
compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA),
including the Privacy Rule, Security Rule, and Breach Notification Rule.
The County intends to establish and maintain a documented, defensible compliance program
that supports current regulatory requirements and evolving federal guidance and enforcement
expectations.
This Request for Proposals (RFP) is intended to obtain proposals from firms with
demonstrated experience supporting public agencies, healthcare entities, or other covered
entities and business associates in HIPAA compliance program management.
The purpose of this RFP is to procure ongoing HIPAA managed compliance services that will
enable the County to:
1. Establish and maintain a documented HIPAA compliance program;
2. Identify, assess, and track compliance gaps and risks;
3. Provide governance, reporting, and oversight support;
4. Support County leadership and designated privacy, security, and compliance personnel;
5. Reduce compliance risk through continuous monitoring and advisory services; and
6. Maintain a structured and repeatable process for risk analysis, remediation planning,
policy review, training, and incident preparedness.
The selected contractor will provide advisory and support services. Ownership of policies,
enforcement decisions, operational decisions, and implementation of remediation actions shall
remain with the County unless otherwise provided under a separate agreement.
2.0 Scope of Work (SOW) - HIPAA Managed Compliance Services
The selected contractor shall provide HIPAA Managed Compliance Services including, but not
limited to, the following:
2.1 Program Governance and Compliance Oversight
The contractor shall support the County in an advisory compliance and security governance
capacity by:
1. Establishing and maintaining a HIPAA compliance framework;
2. Managing a compliance task matrix aligned to applicable HIPAA requirements;
3. Scheduling and facilitating periodic compliance review meetings;
4. Tracking compliance obligations, identified risks, and remediation activities;
5. Providing executive-level compliance status reporting; and
Page 3 of 8

6. Supporting coordination among County leadership and designated privacy/security
personnel.
2.2 Risk Analysis and Ongoing Risk Management
The contractor shall perform and maintain a structured HIPAA Security Risk Analysis,
including:
1. Identification of administrative, technical, and physical safeguard gaps;
2. Risk scoring and prioritization;
3. Development and maintenance of documented risk management plans;
4. Periodic reassessment based on environmental, operational, or regulatory changes;
and
5. Support for maintaining documentation sufficient to demonstrate a reasonable and
defensible compliance process.
2.3 Policy and Documentation Support
The contractor shall assist the County with HIPAA-related policy and documentation lifecycle
activities, including:
1. Review of existing HIPAA-related policies and procedures;
2. Identification of missing, outdated, or incomplete documentation;
3. Coordination of annual policy review activities;
4. Guidance regarding documentation updates needed due to regulatory or operational
changes;
5. Assistance with Notices of Privacy Practices and internal compliance documentation;
and
6. Template-based policy drafting and customization with County input, as requested.
2.4 Technical Safeguards Advisory
The contractor shall provide advisory guidance related to required and addressable technical
safeguards, including:
1. Identity and access management, including multi-factor authentication and least
privilege principles;
2. Encryption standards for data at rest and in transit;
3. Vulnerability management expectations;
4. Logging, monitoring, and audit controls;
5. Penetration testing considerations;
6. Vulnerability scanning practices;
7. Operating system and third-party software patch management practices;
8. Electronic health record (EHR) patch validation considerations, where applicable; and
Page 4 of 8

9. Security control domains such as application control, elevation control, network control,
storage control, configuration management, identity control, and web control.
Unless expressly authorized under a separate agreement, the contractor shall not make
hands-on changes to County systems or production environments.
2.5 Business Associate and Vendor Management Support
The contractor shall assist the County with compliance oversight of third-party vendors by:
1. Identifying vendors that access, store, process, or transmit electronic protected health
information (ePHI);
2. Assisting in the maintenance of a Business Associate register;
3. Supporting Business Associate Agreement (BAA) tracking;
4. Identifying vendor-related compliance risks; and
5. Recommending improvements to vendor compliance oversight processes.
2.6 Workforce Training and Awareness
The contractor shall support HIPAA workforce training requirements by:
1. Coordinating annual HIPAA Privacy and Security training;
2. Providing supplemental security awareness materials;
3. Tracking training completion status; and
4. Recommending role-based training approaches where appropriate.
2.7 Incident Preparedness and Breach Response Support
The contractor shall assist the County with preparedness and response planning, including:
1. Development or review of a Security Incident Response Plan;
2. Guidance related to HIPAA Breach Notification Rule requirements;
3. Facilitation of at least one tabletop incident exercise during the contract term, if
requested; and
4. Documentation support associated with incident response planning and related
compliance activities.
2.8 Deliverables
At a minimum, the selected contractor shall provide the following deliverables during the
contract term:
1. HIPAA Risk Analysis Report;
2. Compliance task matrix or checklist with defined review cadence;
3. Policy review summary and gap analysis;
4. Monthly or periodic executive compliance status reports;
5. Training coordination records;
Page 5 of 8

6. Incident response documentation support materials;
7. Meeting notes and compliance action tracking logs; and
8. ePHI asset inventory and data flow map, to the extent information is made available by
the County.
Proposers should feel free to include any other services not specified that they deem
necessary to achieve the goals of this RFP.
3.0 Submission Requirements
Proposal Format: Proposals must contain the following:
1. Cover Letter
a. Please provide the Proposer's name, address, and telephone number. The
letter must be signed by a representative authorized to enter into contracts on
behalf of the Proposer.
2. Qualifications
a. Provide specific information concerning the Proposer's experience with the
services specified in this RFP. Contractor must be duly licensed and authorized
to perform healthcare technology and billing services in accordance with
applicable state and federal regulations, and must maintain professional liability
insurance throughout the contract term. Examples of completed projects, as
current as possible, should be submitted as appropriate.
3. Company Profile
a. Provide a brief description of your company, including business structure,
address, the total number of employees, overall industry experience,
certifications, affiliations, and relevant experience. Support your capacity to
perform the services detailed in this RFP.
4. Approach:
a. Provide an analysis of the methodology developed to perform all required
services and your response to the scope of work as referenced above.
5. References:
a. Please include at least three (3) references, including name, address,
telephone number, and Email, for whom similar services have been provided.
6. Price Proposal:
a. Provide a transparent fee schedule that outlines all of the costs associated with
the required services, broken down by category of products and services, and
all on-going costs for recommended or required services.
Page 6 of 8

The proposal must include all requirements as listed and correlate to the Scope of Work outlined
under this RFP.
Conflict of Interest: Proposer(s) shall disclose to the County any interest, direct or indirect,
which could conflict in any manner or degree with the performance of service required. At the
County's discretion, a potential conflict of interest, to the extent it is waivable, may be waived
or factored into the final award decisions and/or a modified Scope of Work.
4.0 Selection Process
The proposals received in response to this RFP will be screened by a selection committee.
The selection committee will consider only the proposals which have been considered
responsive to the RFP. Any proposal that fails to meet the RFP's requirements will be regarded
as non-responsive and may be rejected. A proposal, which is in any way incomplete, irregular
or conditional, at the County's discretion, may be rejected. The following criteria will be used in
the evaluation of the potential consultants:
1. Qualifications
2. Approach
3. Experience and references
4. Proposed costs
A contract will be negotiated with one or more qualified entities selected during the evaluation
process. Proposals not selected in the evaluation process may be awarded a contract should
negotiations with the selected Proposer(s) prove unsuccessful. The County reserves the right to
reject any and all proposals and reserves the right to waive any non-substantive defects in the
proposals.
Page 7 of 8

5.0 General Information
Proposals must be submitted by way of mail, hand delivery, and/or electronic means, as
described below:
* Electronic Copy Submittal: Submit an electronic copy of the proposal via email.
Electronic copies shall be emailed to RFP_RRB_Submissions@co.siskiyou.ca.us and
must be received by October 30, 2026 4:00pm. Please include "RFP # 27-01" in
subject line.
Proposers submitting proposals electronically will only be required to send one signed copy.
Proposers are asked to submit all inquiries related to the project(s) at the mandatory pre-bid
meeting on October 22, 2026 10:00 AM, which will take place via Zoom
(https://us02web.zoom.us/j/88430867760).
The County will provide the following to assist the selected entity(s):
a. Designate a person to act as the County's point of contact with respect to the work
performed under the contract.
b. Information, as legally allowed and reasonably attainable, in possession of the County
that relates to the requirements of the project(s) or which is relevant for the project(s).
c. Facilitate coordination with other entities, local agencies, organizations, and
individuals if necessary.
d. Advice on the project scope of work.
e. Review and validation of project deliverables.
A contract award resulting from this RFP will be made without discrimination on any basis
prohibited under state or federal law.
6.0 Attachments
1. Required Documents
a. Attachment A: Professional Service Agreement Template
2. For Reference
a. Attachment B: HIPAA Template Contract with BAA language - BOS signature
######
Page 8 of 8