Appendix_7_10_HIPAA_Business_Associate_Assessment.xlsx

This HIPAA Business Associate Assessment is a compliance evaluation tool developed by the State of Tennessee for the Employee Assistance Program (EAP) and Behavioral Health Organization (BHO) services procurement. The assessment questionnaire requires prospective vendors to demonstrate HIPAA compliance across ten critical operational areas, including Protected Health Information (PHI) location documentation, designation of Privacy and Security Officers, completion of annual risk assessments, and maintenance of current HIPAA Privacy & Security Policies and Procedures since February 2013. The evaluation requires vendors to confirm that all employees with PHI access have completed HIPAA training and company-specific policy training within the past year, maintain a documented and accessible HIPAA Compliance Plan, execute Business Associate Agreements with all subcontractors, and possess an operational Disaster Recovery Plan. Vendors must provide supporting documentation for responses to specific questions regarding Disaster Recovery Plan testing dates and employee training methodologies.

The assessment format requires vendors to mark "Yes" or "No" responses for each question with mandatory provision of additional information for questions 11, 24, and 26. This compliance questionnaire is essential for the procurement serving approximately 300,000 covered lives across three self-funded public sector plans, where contractors must handle sensitive health information and maintain $5 million in cyber liability insurance while complying with HIPAA, HITECH, and state security requirements including annual SOC 2 Type 2 examinations and penetration testing. The evaluation ensures that selected contractors meet the stringent data security and privacy standards required for managing claims adjudication and network administration across the State Plan (147,000 lives), Local Education Plan (128,000 lives), and Local Government Plan (26,000 lives) for a contract term running from January 1, 2027 through December 31, 2031, plus an 18-month claims runout period.