Appendix_7_10_HIPAA_Business_Associate_Assessment.xlsx

This is a HIPAA Business Associate Assessment form designed for use by the State of Tennessee's Department of Finance and Administration in evaluating vendors for Employee Assistance Program (EAP) and Behavioral Health Organization (BHO) services serving approximately 300,000 covered lives across three self-funded public sector plans. The assessment requires bidders to demonstrate compliance with HIPAA privacy and security requirements through a series of 11 yes-or-no questions addressing critical operational safeguards. Bidders must confirm knowledge of Protected Health Information (PHI) locations, designation of Privacy and Security Officers, completion of annual risk assessments, and implementation of updated HIPAA policies and procedures since February 2013. The form further requires documentation of employee training completion on HIPAA Privacy & Security and company-specific policies, verification of a completed and accessible HIPAA Compliance Plan, and confirmation of Business Associate agreements with all subcontractors having potential PHI access. Responses to questions 11, 24, and 26 require detailed supporting documentation, including test dates for disaster recovery plans. The assessment mandates that all employees with PHI access have completed requisite training within the past year, with tracking mechanisms in place.

The State of Tennessee issued the corresponding RFP on October 8, 2025, with written questions due October 22, 2025, and November 19, 2025, and proposals due December 19, 2025. Technical evaluations are anticipated to be completed by January 29, 2026, with cost proposal scoring on January 30, 2026, and contract negotiations scheduled for February 9-11, 2026. The contract will operate under a per-employee-per-month (PEPM) administrative fee model over an 86-month period, including eight months of implementation, 60 months of service delivery from January 1, 2027 through December 31, 2031, and an 18-month claims runout period. Successful vendors must maintain NCQA accreditation as a Managed Behavioral Healthcare Organization and URAC accreditation for utilization management programs, carry $5 million in cyber liability insurance, undergo annual SOC 2 Type 2 examinations and penetration testing, and demonstrate financial stability with relevant experience managing populations exceeding 10,000 members and annual claims adjudication experience exceeding $10 million for at least two clients. The incumbent contractor is responsible for transitioning existing members and services at no additional cost. The state encourages responses from minority-owned, women-owned, service-disabled veteran-owned, and small business enterprises. Annual self-funded claims total approximately $976 million across all three plans.