MHCC 26-001 ASMC TORFP Assessment of Privacy and Security Audit Reports

The Maryland Health Care Commission (MHCC) has issued a targeted solicitation (TORFP) numbered 26-001 for an Assessment of Privacy and Security Audit Reports, seeking a Master Contractor with specialized expertise in conducting comprehensive privacy and security audits. The primary focus is on identifying a contractor experienced in evaluating audit reports, particularly within healthcare organizations or health information exchange (HIE) technical infrastructure environments. The procurement requires the selected vendor to demonstrate advanced capabilities in preparing and critically reviewing technical privacy and security audit reports, with an emphasis on generating actionable recommendations. Key deliverables will likely include a detailed assessment of existing privacy and security protocols, identification of potential vulnerabilities, and strategic recommendations for improvement. The contract opportunity was posted on June 18, 2025, with proposals due by July 9, 2025, providing potential bidders approximately three weeks to prepare and submit comprehensive responses. Evaluation criteria will presumably center on the contractor's demonstrated expertise, previous experience in healthcare privacy audits, technical proficiency, and the quality of proposed methodological approaches.

While specific set-aside designations are not explicitly detailed in the provided documentation, Maryland state contracts often include provisions for small, minority-owned, and disadvantaged business enterprises. The solicitation appears targeted at established Master Contractors with specific technical and industry expertise, suggesting potential restrictions on new or less experienced vendors. No incumbent vendors are mentioned in the current documentation, and the procurement seems focused on securing a new contractor for this specialized assessment function. Although no specific budget range is provided, healthcare-related privacy and security audit contracts typically range from $50,000 to $250,000, depending on the complexity and scope of the required assessment. The MHCC's requirement for deep expertise in healthcare information exchange infrastructure implies a sophisticated and potentially high-value engagement that will demand significant technical competence and industry-specific knowledge from responding contractors.