RISK ANALYSIS AND SECURITY ASSESSMENT SERVICES

Title: RISK ANALYSIS AND SECURITY ASSESSMENT SERVICES Procurement Section NYC Health + Hospitals () Agency Name 160 Water Street, Floor 13, New York, NY 10038 Request Address Mitchell Jacobs phone: (646) 458-8661 email: jacobsm1@nychhc.org Contact Information Current Status Human Services/Client Services Category Request for Proposals Selection Method 8/21/2018 Publication Date Solicitation Notice Type PIN#038-0027A - Due: 9/14/2018 3:00 PM PIN - Due Date Attachments 7 DBDF MWBE Forms Terms and Conditions PassPort Vendor Form Exhibit A Request for Proposal Description NYC Health plus Hospitals is looking for a vendor to provide annual information risk analysis and security assessment services for all of its facilities, entities, units, programs, and data centers, with a focus on electronic sensitive data including but not limited to electronic Protected Health Information (“ePHI”) as defined by the implementing regulations of the Health Insurance Portability and Accountability Act (“HIPAA”) of 1996. The requested risk analysis and security assessment services are broken down into the following seven activities: 1. HIPAA Enterprise-wide Risk Analysis (Application and ePHI Focused) 2. HIPAA Compliance Assessment, including the OCR Audit Protocol 3. Management Plan for addressing identified risks 4. Application Security - Penetration Testing 5. Infrastructure Security - Internal Penetration Testing (including server) 6. Infrastructure Security - Perimeter/DMZ Penetration Testing 7. Vendor Risk