5-A04 - Risk Assessment 0128.xlsx
XLSX spreadsheet 21 KB Posted
- Attached to
- Bad Debt Collection Services
- Solicitation number
- RFP 745-26-P13
- Issued by
- Bexar County, Texas
About this file
This is a risk assessment document completed for UT Health San Antonio (UTHSA) in connection with RFP 745-26-P13 for Bad Debt Collection Services. The assessment evaluates the vendor's compliance with information security standards based on ISO 27005:2011 risk management framework and related ISO security controls across 18 primary categories. The RFP seeks a qualified third-party vendor to perform collection activities for self-pay patient accounts associated with UTHSA Physicians, the Multi-Specialty & Research Hospital, the Medical Management Program, and the School of Dentistry. UTHSA makes no guarantee regarding volume, minimum, or maximum compensation under this solicitation or any resulting contract.
The risk assessment addresses critical security requirements including risk management programs, information security policies, human resource security, asset management, access controls, cryptography, physical security, operations security, communications security, systems acquisition and maintenance, supplier relationships, incident management, business continuity planning, and compliance protocols. The vendor assessment includes 78 evaluation questions covering data protection, encryption standards, network security architecture, audit logging, patch management, business continuity documentation, vulnerability testing, and emerging technology considerations such as artificial intelligence and machine learning implementation. The document specifically inquires whether data is stored and processed exclusively within the United States, requests data flow diagrams showing information movement to cloud systems, and requires disclosure of any Chinese component sourcing in accordance with Texas HB 130 requirements.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 7-A06 PDAA.xlsx | XLSX spreadsheet | |
| 13-Question Clarification No 1.pdf | ||
| 9-S06 Pricing and Delivery Schedule 0725.pdf | ||
| 3-A01D Addenda Checklist 0725.pdf | ||
| 11-A01A General info NO BAA 0922.pdf | ||
| 1-A01B Exec of Offer 0126.pdf | ||
| 2-A01C Gen Quest 0226.pdf | ||
| 6-A05 TX-Ramp 1003.pdf | ||
| 10-A02 SAMPLE AGREEMENT -COLLECTION AGENCY CONTRACT 745-26-P13.docx | DOCX document | |
| 8-S04 Terms Conditions 0226.pdf | ||
| 12-01 RFP 745-26-P13.pdf | ||
| 4-A03 VETHUB 0126.pdf |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Assessment
| Vendor Name: | ||||
| Name of person completing assessment: | ||||
| Date completed | ||||
| RFP Name | Bad Debt Collection Services | |||
| RFP Number | 745-26-P13 | |||
| Questions | ||||
| Risk Management (ISO 27005:2011) | Yes/No | Evidence Requested | Evidence Provided? | Framework |
Categories & Sub-Categories 1 Does your institution have a risk management program? Yes ID.BE
ID.GV1
ID.RM
ID.RM1
2 Does your institution have a process for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing sensitive information? Yes ID.RA3
ID.RA6
| Information Security Policies (ISO 5) | |||
| 3 | Does your institution have an information security policy that has been approved by management? | Yes | ID.GV1 |
| Human Resource Security (ISO 7) | |||
| 4 | Do all individuals interacting with university systems receive information security awareness training? | PR.AT |
PR.AT1
5 Does your institution have a process for revoking system and building access and returning assigned assets? Yes PR.AC
PR.AC2
PR.PT3
| Asset Management (ISO 8) | ||
| 6 | Has your organization identified critical information assets and the functions that rely on them? | ID.AM |
ID.BE2
| Access Control (ISO 9) | |
| 7 | Does your institution have an access control policy for authorizing and revoking access rights to information systems? |
| Yes | PR.AC | ||
| 8 | Does your institution have a password management program that follows current security standards? | ||
| Yes | PR.IP | ||
| 9 | Does your institution assign user access rights based on assigned roles in the system? | PR.AC1 | |
| 10 | Does your institution have a policy that enforces the concept of least privilege? | PR.AC4 | |
| 11 | Does your institution require multi-factor authentication for systems which access confidential or regulated data? | PR.AC7 | |
| 12 | Does your institution have procedures to regularly review users' access to ensure only needed privileges are applied? | PR.AC4 |
PR.AT2
13 Does your institution employ specific measures to secure remote access services? PR.AC3
PR.MA2
14 Does your institution employ technologies to block or restrict unencrypted sensitive information from traveling to untrusted networks? DE.AE1
PR.PT4
PR.DS5
| 15 | Does your institution have an authentication system in place that applies higher levels of authentication to protect resources with higher levels of sensitivity? | PR.AC7 |
| 16 | Does your institution have standards for isolating sensitive data and procedures and technologies in place to protect it from unauthorized access and tampering? | PR.DS |
PR.DS6
DE.CM7
PR.AC5
| Cryptography (ISO 10) | ||
| 17 | Does your institution use appropriate/vetted encryption methods to protect sensitive data in transit? | PR.DS2 |
| 18 | Does your institution use appropriate/vetted encryption methods to encrypt data at rest? | PR.DS2 |
| 19 | Do your policies indicate when encryption should be used (e.g., at rest, in transit, with sensitive or confidential data, etc.)? | PR.DS1 |
PR.DS2
| Physical and Environmental Security (ISO 11) | ||
| 20 | Do your institution's data centers include controls to ensure that only authorized parties are allowed physical access? | PR.AC2 |
| 21 | Does your institution have a media-sanitization process that is applied to equipment prior to disposal, reuse, or release? | PR.PT2 |
| Operations Security (ISO 12) | ||
| 22 | Are changes to information systems tested, authorized, and reported? | PR.IP3 |
| 23 | Are methods used to detect, quarantine, and eradicate known malicious code on information systems including workstations, servers, and mobile computing devices? | DE.AE2 |
DE.CM1
DE.CM2
DE.CM3
DE.CM4
DE.CM5
RS.AN1
| 24 | Does your institution have a segmented network architecture to provide different levels of security based on the information's classification? | Yes | ID.AM5 |
| 25 | Are Internet-accessible servers protected by more than one security layer (firewalls, network IDS, host IDS, application IDS)? | Yes | PR.PT |
PR.PT1
26 Are security-related activities such as hardware configuration changes, software configuration changes, access attempts, and authorization and privilege assignments automatically logged? PR.IP3
PR.AT2
27 Does your institution regularly review administrative and operative access to audit logs? PR.MA
PR.MA1
PR.MA2
PR.PT1
| 28 | Does your institution regularly review audit logs for access activity and abnormal activity? | PR.PT1 |
| Communications Security (ISO 13) | ||
| 29 | Does your institution continuously monitor your wired and wireless networks for unauthorized access? | DE.CM1 |
DE.CM7
| Systems Acquisition, Development, and Maintenance (ISO 14) | ||
| 30 | Are new information systems or enhancements to existing information systems validated against defined security requirements? | ID.BE5 |
DE.DP2
31 Does your institution have a patch management strategy in place and responsibilities assigned for monitoring and promptly responding to patch releases, security bulletins, and vulnerability reports? Yes ID.RA1
ID.RA2
ID.RA5
PR.IP12
RS.MI3
| Supplier Relationships (ISO 15) | ||
| 32 | Does your institution have a process in place for assessing that external information system providers comply with appropriate security requirements? | ID.AM4 |
DE.CM6
RS.CO5
33 Does your institution have a process in place where vendors go through a risk management process related to ensuring the confidentiality, processing integrity and security of UT Health SA’s data. DE.CM-6
STA-08
RA-4
| 34 | Has there been an external, independent review of the information security and technology environment within the past 12 months (i.e., ISO 27001, SOC 2, HITRUST, FedRAMP, FISMA, etc.)? | RA | |
| 35 | Has your institution had a significant breach in the last 5 years (i.e., compromise of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to protected data that is transmitted, stored, or processed)? | RA | |
| Information Security Incident Management (ISO 16) | |||
| 36 | Are incident-handling procedures in place to report and respond to security events throughout the incident life cycle, including the definition of roles and responsibilities? | Yes | PR.IP9 |
DE.AE5
RS.AN2
RS.AN4
RS.MI
RS.MI1
RSMI2
37 Are there procedures in place for security incident response, including the identification, resolution, and reporting of events? RS.AN
RS.MI
| Information Security Aspects of Business Continuity Management (ISO 17) | |||
| 38 | Does your institution have a documented business continuity plan for information technology that is based on a business impact analysis, is periodically tested, and has been reviewed and approved by senior staff or the board of trustees? | Yes | PR.IP9 |
ID.RA4
ID.RA5
DE.AE4
RS.AN2
| 39 | Are backup copies made according to pre-defined schedules, encrypted, and securely stored? | PR.IP4 |
| Compliance (ISO 18) | ||
| 40 | Does your institution perform periodic application and network layer vulnerability testing or penetration testing against critical information systems? | ID.A2 |
PR.IP12
DE.CM8
| 41 | Are you performing independent audits on information systems to identify strengths and weaknesses? | Yes | PR.PT1 | |
| 42 | If this requisition involves genomic instruments, are any parts of the equipment sourced from China? | None | Texas HB130 | |
| HIPAA General | Yes, No, N/A | |||
| 43 | Geographically speaking, is data stored and processed only in the US? If not, list location(s) outside of the US: | |||
| 44 | Will data be accessed only by entity representatives located outside the US? If no, list location(s) outside of the US: | |||
| Data Flow Diagram | Yes/No | |||
| 45 | Please provide a data flow diagram showing how data flows from UTHSCSA to your cloud. | Yes | ||
| Artificial Intelligence | Yes/No | |||
| 46 | Does your solution have AI features, or are there plans to implement AI features in the next 12 months? | |||
| 47 | Does your solution leverage machine learning (ML) or do you plan to do so in the next 12 months? | |||
| 48 | Does your solution leverage a large language model (LLM) or do you plan to do so in the next 12 months? | |||
| 49 | Does your solution have an AI risk model when developing or implementing your solution's AI model? | |||
| 50 | Can your solution's AI features be disabled by tenant and/or user? | |||
| 51 | Have your staff completed responsible AI training? | |||
| 52 | Please describe the capabilities of your solution's AI features. | None | ||
| 53 | Does your solution support business rules to protect sensitive data from being ingested by the AI model? | |||
| 54 | Are your AI developer's policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks conspicuously posted, unambiguous, and implemented effectively? | |||
| 55 | Have you identified and measured AI risks? | |||
| 56 | In the event of an incident, can your solution's AI features be disabled in a timely manner? | |||
| 57 | If disabled because of an incident, can your solution's AI features be re-enabled in a timely manner? | |||
| 58 | Do you have documented technical and procedural processes to address potential negative impacts of AI as described by the AI Risk Management Framework (RMF)? | |||
| 59 | If sensitive data is introduced to your solution's AI model, can the data be removed from the AI model by request? | |||
| 60 | Is user input data used to influence your solution's AI model? | |||
| 61 | Do you provide logging for your solution's AI feature(s) that includes user, date, and action taken? | |||
| 62 | Please describe how you validate user inputs. | None | ||
| 63 | Do you plan for and mitigate supply-chain risk related to your AI features? | |||
| 64 | Do you separate ML training data from your ML solution data? | |||
| 65 | Do you authenticate and verify your ML model's feedback? | |||
| 66 | Is your ML training data vetted, validated, and verified before training the solution's AI model? | |||
| 67 | Is your ML training data monitored and audited? | |||
| 68 | Have you limited access to your ML training data to only staff with an explicit business need? | |||
| 69 | Have you implemented adversarial training or other model defense mechanisms to protect your ML-related features? | |||
| 70 | Do you make your ML model transparent through documentation and log inputs and outputs? | |||
| 71 | Do you watermark your ML training data? | |||
| 72 | Do you limit your solution's LLM privileges by default? | |||
| 73 | Is your LLM training data vetted, validated, and verified before training the solution's AI model? | |||
| 74 | Do any actions taken by your solution's LLM features or plugins require human intervention? | |||
| 75 | Do you limit multiple LLM model plugins being called as part of a single input? | |||
| 76 | Do you limit your solution's LLM resource use per request, per step, and per action? | |||
| 77 | Do you leverage LLM model tuning or other model validation mechanisms? | |||
| 78 | Is the AI-enabled system regularly tested for biases, inequities, or other unintended consequences? |
Explanations
| Item No. | Request | Description |
| 42 | Please list Chinese companies. | |
| 51 | Please describe the capabilities of your solution's AI features. | |
| 61 | Please describe how you validate user inputs. |
File details come from the government source that posted it. Updated .