Description
The County of Siskiyou seeks a qualified contractor to provide ongoing HIPAA Managed Compliance Services for its Public Health Division. The work includes governance, risk analysis, policy and documentation support, technical safeguard advisory, business‑associate management, workforce training, and incident‑response planning. The contractor must deliver regular executive reports, risk analysis documentation, policy gap analyses, training records, and incident‑response support, while adhering to strict HIPAA Business Associate Agreement requirements. No hands‑on changes to County IT systems are permitted unless a separate agreement is made.
• Build and maintain a HIPAA compliance framework, risk‑analysis, and task‑matrix tracking.
• Advise on technical safeguards (IAM, encryption, vulnerability management) and vendor/BAA oversight.
• Coordinate annual HIPAA training, tabletop breach‑response exercises, and produce periodic executive status reports.
• Comply with rigorous reporting timelines (e.g., 3‑day breach notice, 2‑day access request response) and retain records for five years.