HIPAA Business Associate Assessment Summary

This document is a HIPAA Business Associate Assessment spreadsheet used by the State of Tennessee, Department of Finance and Administration, Division of Benefits Administration, to evaluate organizational compliance with federal privacy and security regulations for the Third-Party Administrator (TPA) contract supporting The Tennessee Plan. The assessment comprises 11 questions requiring yes/no responses with supplementary information for specific line items, designed to evaluate prospective TPAs' capability to handle Protected Health Information (PHI) in administering the self-insured supplemental medical insurance program for Medicare-eligible state retirees. The RFP timeline indicates responses are due December 10, 2025, with a Notice of Award expected February 26, 2026, and implementation occurring from April through December 2026, with contract coverage extending from January 1, 2027, through December 31, 2031, plus a claims run-out period through December 31, 2033.

The assessment evaluates critical HIPAA compliance requirements including PHI location tracking, designation of privacy and security officers, completion of annual risk assessments, policy updates since February 2013, employee training completion and tracking on HIPAA regulations and company-specific procedures, documented HIPAA Compliance Plans, Business Associate Agreements with all subcontractors having PHI access, and Disaster Recovery Plan testing with documentation. The current incumbent TPA is UMR, Inc., with a contract expiring June 30, 2028. The plan serves approximately 48,059 members as of July 2025, with annual enrollment growth of 1,500 to 2,000 members and annual claims costs increasing by approximately 4 percent, indicating a substantial contract valued in the tens of millions of dollars annually, compensated through monthly per-member-per-month (PMPM) rates with maximum liability determined by the best-evaluated cost proposal.