RFQ 2025-43 Clarifying Questions 1.pdf
PDF 268 KB Posted
- Attached to
- 245131 2024a Salem Downtown Streetscape
- Solicitation number
- S-KS0043-00013877
- Issued by
- Marion County, Oregon
About this file
This is a clarifying questions and responses document issued by Clackamas County, Oregon, for Request for Quotes #2025-43 regarding HIPAA Privacy and Security Analysis services. The county is seeking a comprehensive assessment of its Health, Housing, and Human Services (H3S) department's compliance with Health Insurance Portability and Accountability Act (HIPAA) regulations. The scope of work encompasses one department comprising six divisions across approximately 12 physical locations, with primary technology infrastructure hosted at two data centers plus cloud services. The assessment will analyze how protected health information (PHI) and personally identifiable information (PII) is stored, processed, and transmitted across approximately 900 employees, with a key deliverable being the identification of where and how PHI/PII is maintained throughout the county by department and program.
The county has not provided a specific budget range, instead requesting that vendors submit competitive proposals based on the outlined scope of work. The assessment will evaluate five primary systems that store, process, or transmit PHI: Internal Servers, OCHIN Epic, CERNER, Doctor Cloud, and Navex. The infrastructure includes fully virtualized on-premises servers, cloud infrastructure, and co-located facilities with multiple VLANs across various work sites. A previous security risk assessment was conducted by OCHIN in 2022 for the Health Centers division. The county's Information Technology department comprises 60.5 full-time equivalent employees. Key deliverables include analysis of current HIPAA compliance policies and procedures, identification of necessary safeguards and documentation systems, recommendations for organizational and oversight changes, and templates for policies and procedures to support ongoing compliance.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
PH: 503-742-5400 WWW.CLACKAMAS.US
REQUEST FOR QUOTES #2025-43
HIPAA Privacy and Security Analysis
RESPONSE TO CLARIFYING QUESTIONS
June 3, 2025
Note that these are questions submitted by interested firms to the above referenced solicitation. The below answers are for clarification purposes only and in no way alter or amend the RFQ as published.
1. How many systems store, process, or transmit PHI?
• Internal Servers
• OCHIN Epic
• CERNER
• Doctor Cloud
• Navex
2. How many departments/divisions are in scope?
1 department made up of 6 divisions
3. How many locations/sites are in scope?
The work of H3S takes place in about 12 different locations as well as in the field.
From a technology perspective it's primarily two sites (where the datacenters are) and some cloud services.
4. How many employees handle PHI, or access systems that store, process, or transmit PHI?
Health Housing and Human Services has about a total of 900 employees. Not all of these employees handle PHI.
Part of the scope of this assessment is to audit and determine where and how PHI/PII is stored or maintained within the county by department or program.
5. Is there currently an incumbent company or previous incumbent, who completed a similar contract performing these services? If so - are they eligible to bid on this project and can you please provide the incumbent contract number, dollar value, and period of performance?
OCHIN provided a Security Risk Assessment for one of our divisions, Health Centers, in 2022.
6. Specify the VLAN details how many are included in the Scope?
For server infrastructure, there is only a few VLANS plus some remote cloud infrastructure. There could be 20 or more for the various sites the department works out of.
PH: 503-742-5400 WWW.CLACKAMAS.US
7. Can you please provide the current number of infrastructure details (Physical Server, Virtual Server, Network
Devices, etc.)?
Local server environment is 100% virtualized (file, db, apps).
8. How much (%) of the infrastructure is in the cloud?
This is undefinable.
9. In the IT department/environment, how many employees work?
Our technology services has 60.5 FTE
10. Do you manage your own data Center, or do you utilize any 3rd-party/colocation facilities?
We host our infrastructure on-prem, in the cloud, and co-located elsewhere.
11. Is there a funding/financial/budget range estimated that can help us to provide a quotation for this project?
We’re looking for pricing that reflects a fair and accurate response to the scope of work. We encourage you to submit your most competitive proposal based on the outlined requirements.
12. Page 3, Section III, Policies and Procedures, bullet a.
a. What do you mean by this?
One of the main bodies of work for this assessment is analyzing how our department is complying with Health Insurance Portability and Accountability Act (HIPAA). This includes ensuring we have up to date policies, have safeguards in place to protect health related information, have systems in place to maintaining proper documentation, and providing employee training.
b. Are you anticipating the vendor to document subitems I – iii, or something else?
We are looking for templates of existing policies and procedures we could use to comply with HIPAA.
We would be looking for a recommendation on any organizational and oversight changes we need to make to sure HIPAA compliance.
End of Clarifying Questions #1
File details come from the government source that posted it. Updated .