HIPAA Compliance and Data Safeguards (for Service Providers)

The contract mandates the implementation of HIPAA-compliant safeguards for subcontractors engaged in the maintenance or repair of medical devices that involve access to protected health information. All parties must establish and enforce technical, administrative, and physical controls to ensure the confidentiality, integrity, and availability of health data during service activities, in full alignment with HIPAA regulations. This includes training personnel, securing data systems, restricting unauthorized access, and maintaining audit trails to demonstrate ongoing compliance. Subcontractors are required to operate under strict data handling protocols while performing work in Los Angeles, where the primary place of performance is located. The contract, issued under NAICS code 541611 by the Department of Internal Services in California, applies specifically to service providers and emphasizes accountability through documented policies and incident response procedures. Although the solicitation has already closed as of April 23, 2026, the terms serve as a binding framework for any awarded subcontractors to uphold patient privacy and regulatory standards throughout device service operations.