Data Security and Compliance for Confidential Health Information

The contract requires secure handling of confidential youth health information in strict alignment with federal and state regulations, including NIST, HITRUST, and SOC 2 standards, ensuring robust data protection throughout all phases of processing, storage, and transmission. The subcontractor must implement comprehensive security controls and maintain continuous compliance with established frameworks governing sensitive health data, with particular attention to the unique protections required for minors. All activities must be conducted in Hardin County, Iowa, with performance expectations tied to rigorous audit readiness and demonstrated adherence to privacy and security best practices. Proposals must be submitted by July 20, 2026, under NAICS code 541512, which categorizes the work under computer systems design and related services. The solicitation is managed by the Iowa office of the Department of Health and Human Services and is intended for a subcontractor to support broader health data initiatives. Bidders are expected to demonstrate proven experience in securing youth health data, possess current certifications aligned with the required frameworks, and provide documented processes for incident response, data minimization, and employee training. Access to full details is available through the provided Iowa bid portal link.