Siskiyou County Municode #27-02

Siskiyou County HIPAA Managed Compliance Advisory Services

Siskiyou County is seeking advisory support to manage HIPAA compliance for its Public Health Division. - Buyer: County of Siskiyou, Health & Human Services Agency (HHSA), Public Health Division; the solicitation identifies Shelly Davis. An attached draft agreement also identifies County Counsel. - Scope: HIPAA compliance governance, security risk analysis and risk management, policy and documentation support, technical safeguards advice, business associate and vendor oversight, workforce training coordination, and incident and breach-response preparation. - Deliverables: Risk Analysis Report, compliance task matrix or checklist, policy gap analysis, periodic executive reports, training records, incident-response materials, meeting and action logs, and an ePHI inventory/data-flow map when County information is available. - Important limits: The provider’s role is advisory; the County retains operational and remediation decisions. Hands-on system changes require separate authorization. A tabletop exercise is to be supported if requested. - A draft agreement attachment describes separate, on-request specialized legal consulting by an attorney. It does not identify an attorney, define a legal matter or term, or specify rates or a compensation cap; travel time is capped at 50% of the attorney’s hourly rate. - No OEMs, commercial vendors, products, part numbers, or quantities are identified. The HIPAA service quantities and contract value are not specified.

Description

Siskiyou County Health & Human Services Agency, Public Health Division, is soliciting proposals from qualified firms to provide ongoing HIPAA managed compliance services. The work includes advisory, governance, documentation, reporting, and coordination support for compliance with HIPAA’s Privacy, Security, and Breach Notification Rules. Scope includes security risk analysis, policy and documentation support, technical safeguards guidance, vendor oversight, workforce training, incident preparedness, and specified reports and other deliverables. Proposals are due November 20, 2026, at 4:00 PM.

View original listing