Attachment F - DHHA IT Security Risk Stratification Questionnaire.xlsx

XLSX spreadsheet 29 KB Posted

Attached to
Denver Health RFP# 1184 - Audit Services
Solicitation number
1184
Issued by
Denver County, Denver City, Colorado

About this file

Attachment F is an IT Security Risk Stratification Questionnaire for Denver Health, involving a detailed assessment of data record volumes across hosted vendor and cloud environments. The document categorizes data record quantities into four stratification levels: over 200,000 records, 50,001-200,000 records, and 500-50,000 records, which appears to be part of a comprehensive security risk evaluation process.

The associated RFP #1184 for Audit Services seeks proposals from qualified firms to provide auditing services for multiple Denver Health entities, including Denver Health and Hospital Authority, OMC QALICB, Inc., Denver Health and Hospitals Foundation, and Denver Health Medical Plan, Inc. The solicitation emphasizes the need for bidders with specialized healthcare expertise, particularly in hospital facility services, outpatient clinic services, Federally Qualified Health Center (FQHC) settings, physician services, and managed care perspectives from both provider and healthcare management plan viewpoints.

View the file

Other files

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Sheet1

Denver Health Hosted
Vendor Hosted/Cloud
IT Security Risk Stratification Tool
> 200,000 Records
50,001 - 200,000 Records
500 - 50,000 Records
<500 Records
Version 1.1
Updated: 09/01/2017PHI
VENDOR/SOLUTION SECURITY RISK FACTORSEmployee PII
Item #QuestionRequired AnswersComments / ExplanationDHHA Financial
1What type/sensitivity of data is being processed, transmitted, stored, or accessed? (A loss or unauthorized disclosure would cause harm to DENVER HEALTH)Research data
2Any data breaches or known security incidents for this vendor? (If yes, please explain in the comments section)Non-sensitive data
3Will any confidential data be shared with any third parties of this vendor? (If yes, please explain in the comments section)Yes
4Will any confidential data be transferred, stored or remotely accessed from offshore locations outside of the United States? (If yes, please explain in the comments section)No
5Is the solution hosted internally by DENVER HEALTH or vendor hosted (including web based and accessible over the Internet?) (Please explain where the solution is hosted in the comments section)
6Will unencrypted ePHI be stored on vendor's mobile devices or removable media devices?
7Will unencrypted ePHI be transported via electronic means over any public networks?
8Volume of Records: What is the maximum estimated number of records (Patient and/or Employee) that the Vendor will have access to at any point in time related to this product/service?Med
Low
AnalysisRiskNext StepRST Completed RA
Vendor hosted PHI - SaaS solutionHighHigh RAMedium RA
High RA
Next Step Legend
RST CompletedRST is the risk assessment due to low risk
Medium RABAA, ITSA, SOC review required
High RABAA, ITSA, full RA required

image1.png

File details come from the government source that posted it. Updated .