HHS HRSA- Cybersecurity Assessment Services - MRAS

The Department of Health and Human Services (HHS), through the General Services Administration (GSA), is conducting market research to support the Health Resources and Services Administration (HRSA) in its mission to provide health care services to vulnerable populations. As part of this effort, HRSA oversees the National Practitioner Data Bank (NPDB), a critical tool designed to enhance the quality of healthcare by serving as an alert system for licensing and certification authorities, hospitals, and other healthcare entities. The NPDB helps these organizations evaluate the qualifications of healthcare practitioners, thereby reducing healthcare fraud and abuse.

The NPDB collects information on medical malpractice payments, adverse clinical privileges actions, adverse licensure actions, and other relevant data concerning healthcare providers. This information is disclosed to authorized entities that need it for making informed decisions about granting clinical privileges or hiring practitioners. The database processes over 11.6 million queries annually and is entirely funded by user fees collected from these queries, with no congressional appropriations involved.

To ensure secure financial transactions within the NPDB's operations, there is a requirement for cybersecurity assessment services aimed at achieving PCI-DSS certification. This involves evaluating the current cybersecurity measures in place for handling Electronic Funds Transfer (EFT) and credit card transactions processed via Pay.gov. The goal of this assessment is to ensure that all payment processes meet stringent security standards mandated by PCI-DSS to protect sensitive financial data during transactions.

The cybersecurity assessment will play a crucial role in maintaining the integrity and security of financial operations within the NPDB. By achieving PCI-DSS certification, HRSA aims to safeguard against potential data breaches or fraud that could compromise sensitive financial information related to user queries. This initiative reflects HRSA's commitment to upholding high standards of security while continuing its mission to support healthcare providers across various regions effectively.