0351.2021 - HIPAA Security Compliance Audit

OCHN is seeking a firm to provide the following services:

• An internal and external penetration test must be conducted at all three sites.  In addition, a complete risk assessment and policy review onsite with staff will be required for HIPAA HiTech compliance.
• A full HIPAA security gap analysis comparing (a) the standards and implementation specifications of the HIPAA Security Rule identified in Subpart C of Part 164 of Title 45 of the Code of Federal Regulations to (b) the current policies, procedures, and practices of OCHN pertaining to any information systems and databases that are used by OCHN to create, maintain, receive, or transmit Protected Health Information.
• A thorough and accurate risk audit of all system components, based on the NIST-800-30 standards, which will include the potential risks, threats, and vulnerabilities to the confidentiality, availability, and integrity of all PHI that OCHN creates, receives, maintains, or transmits.
• An analysis of where PHI is created, received, maintained, and transmitted by OCHN and a report documenting the sources and flow of PHI and the information sources which host it.
• A security vulnerability audit of both OCHN sites and systems that are used to create, receive, store, or transmit PHI.  The primary object of this audit is to identify vulnerabilities that can be exploited by persons (employees, contractors, others) with access to OCHN’s information systems or networks used to create, receive, maintain, or transmit PHI, and to identify areas of noncompliance with the HIPAA security rule.
• Conduct social engineering to identify risks.
• Describe pricing and payment options the vendor shall provide.
• Describe alternative approaches to the requested services, where feasible, or additional services offered or recommended, which may not be specifically requested but of benefit to OCHN.
• Conduct external and internal network vulnerability and penetration testing annually.
• Provide pricing to conduct a thorough HIPAA/security Assessment – Every three years
• Vendor will investigate and provide best practices recommendations to strengthen the Microsoft Office 365 security score.