HIPAA Risk Audit & BAA Guidance

Puget Sound Regional Fire Authority seeks qualified consultants to perform a comprehensive HIPAA risk audit and provide guidance on Business Associate Agreements (BAAs). The work will assess administrative, physical, and technical safeguards, evaluate policies, procedures, and data handling practices, and deliver a prioritized risk register and remediation roadmap. The contractor will also review existing BAAs (or draft new ones) and furnish templates, checklists, and an executive presentation for leadership. • Conduct a full HIPAA privacy and security risk assessment across ~10 systems, ~100+ mobile devices, and 18 physical locations. • Produce a detailed risk assessment report, risk register, compliance roadmap, and BAA review/templating deliverables. • Deliver an executive‑level PowerPoint presentation and optional knowledge‑transfer workshop. • Project duration is expected to be 8–12 weeks, with a hybrid onsite/remote execution model.