DPH | RFI Privacy Monitoring System

Background
The San Francisco Department of Public Health (DPH) is issuing this Request for Information (RFI) to gather information on possible solutions for a Privacy Monitoring System. DPH, with a budget of $3.2 billion and approximately 8,000 employees, serves over 100,000 patients annually through its public health department and healthcare delivery network. The goal of this RFI is to enhance patient privacy protection by detecting unauthorized access and other anomalies in electronic health records.

Work Details
DPH seeks a Privacy Monitoring System that can integrate with existing Electronic Health Record Systems (EHRs) such as EPIC and AVATAR. The system should be capable of:

1. Detecting patterns of unauthorized access;
2. Identifying inappropriate record modifications and views;
3. Monitoring anomalies in data extraction;
4. Tracking access by inactive users;
5. Recognizing abnormal behavior indicative of compromised credentials;
6. Detecting breaches and issuing notifications to affected individuals;
7. Providing case management and breach reporting;
8. Identifying insider security threats.

Period of Performance
The RFI was published on May 9, 2025, with responses due by June 6, 2025.

Place of Performance
The services will be performed in San Francisco, California.

Bidder Requirements
Respondents must register online as a City Supplier at the San Francisco City Partner site to submit their responses electronically. There are no specific set-aside certifications or local requirements mentioned in the RFI.