Attachment F - DHHA IT Security Risk Stratification Questionnaire.xlsx
XLSX spreadsheet 29 KB Posted
- Attached to
- Denver Health RFP# 1184 - Audit Services
- Solicitation number
- 1184
- Issued by
- Denver County, Denver City, Colorado
About this file
Attachment F is an IT Security Risk Stratification Questionnaire for Denver Health, involving a detailed assessment of data record volumes across hosted vendor and cloud environments. The document categorizes data record quantities into four stratification levels: over 200,000 records, 50,001-200,000 records, and 500-50,000 records, which appears to be part of a comprehensive security risk evaluation process.
The associated RFP #1184 for Audit Services seeks proposals from qualified firms to provide auditing services for multiple Denver Health entities, including Denver Health and Hospital Authority, OMC QALICB, Inc., Denver Health and Hospitals Foundation, and Denver Health Medical Plan, Inc. The solicitation emphasizes the need for bidders with specialized healthcare expertise, particularly in hospital facility services, outpatient clinic services, Federally Qualified Health Center (FQHC) settings, physician services, and managed care perspectives from both provider and healthcare management plan viewpoints.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment H - Evaluation Matrix (EXAMPLE).xlsx | XLSX spreadsheet | |
| Denver Health RFP# 1184 - Audit Services.docx | DOCX document | |
| Attachment D - Blank w-9 form.pdf | ||
| Attachment A - Statement of Work (Audit Services).docx | DOCX document | |
| Attachment C - Service Agreement.doc | DOC document | |
| Attachment G - Simplified Cost Breakdown.docx | DOCX document | |
| Attachment B - Questions and Clarifications Form.doc | DOC document | |
| Attachment E - Voluntary Self-Certification Forms.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Denver Health Hosted | ||||
| Vendor Hosted/Cloud | ||||
| IT Security Risk Stratification Tool | ||||
| > 200,000 Records | ||||
| 50,001 - 200,000 Records | ||||
| 500 - 50,000 Records | ||||
| <500 Records | ||||
| Version 1.1 | ||||
| Updated: 09/01/2017 | PHI | |||
| VENDOR/SOLUTION SECURITY RISK FACTORS | Employee PII | |||
| Item # | Question | Required Answers | Comments / Explanation | DHHA Financial |
| 1 | What type/sensitivity of data is being processed, transmitted, stored, or accessed? (A loss or unauthorized disclosure would cause harm to DENVER HEALTH) | Research data | ||
| 2 | Any data breaches or known security incidents for this vendor? (If yes, please explain in the comments section) | Non-sensitive data | ||
| 3 | Will any confidential data be shared with any third parties of this vendor? (If yes, please explain in the comments section) | Yes | ||
| 4 | Will any confidential data be transferred, stored or remotely accessed from offshore locations outside of the United States? (If yes, please explain in the comments section) | No | ||
| 5 | Is the solution hosted internally by DENVER HEALTH or vendor hosted (including web based and accessible over the Internet?) (Please explain where the solution is hosted in the comments section) | |||
| 6 | Will unencrypted ePHI be stored on vendor's mobile devices or removable media devices? | |||
| 7 | Will unencrypted ePHI be transported via electronic means over any public networks? | |||
| 8 | Volume of Records: What is the maximum estimated number of records (Patient and/or Employee) that the Vendor will have access to at any point in time related to this product/service? | Med | ||
| Low |
| Analysis | Risk | Next Step | RST Completed RA |
| Vendor hosted PHI - SaaS solution | High | High RA | Medium RA |
| High RA |
| Next Step Legend | |
| RST Completed | RST is the risk assessment due to low risk |
| Medium RA | BAA, ITSA, SOC review required |
| High RA | BAA, ITSA, full RA required |
image1.png
File details come from the government source that posted it. Updated .