Appendix_7.4_HIPAA_Business_Associate_Assessment.xlsx

This is a HIPAA Business Associate Assessment questionnaire issued by the State of Tennessee, Department of Finance and Administration, Division of Benefits Administration, as part of the evaluation process for third-party administrator (TPA) services for The Tennessee Plan, a self-insured supplemental medical insurance program for Medicare-eligible state retirees. The assessment is designed to evaluate organizational compliance with HIPAA privacy and security regulations through an 11-question questionnaire requiring "Yes" or "No" responses with supplemental information. The evaluation covers critical compliance areas including Protected Health Information (PHI) location tracking, designation of privacy and security officers, completion of annual risk assessments, updates to HIPAA privacy and security policies and procedures since February 2013, employee training on HIPAA requirements, documentation and accessibility of the HIPAA Compliance Plan, execution of Business Associate agreements with all subcontractors, maintenance of a Disaster Recovery Plan with testing verification, and organizational readiness to handle health information in a secure manner. Prospective bidders must complete this assessment as part of their proposal submission by the December 10, 2025 response deadline, with the Notice of Award expected on February 26, 2026. The selected TPA will manage comprehensive administrative functions including claims processing, member communications, call center services, and HIPAA compliance for approximately 48,059 members as of July 2025, with the contract term running from January 1, 2027 through December 31, 2031, and a claims run-out period extending through December 31, 2033.

The incumbent contractor is UMR, Inc., with the current contract expiring on June 30, 2028. The plan serves exclusively qualified state retirees who began employment prior to July 1, 2015 and are eligible for Medicare Part A. Member enrollment has demonstrated steady growth from approximately 23,642 members in 2007 to 48,059 members in July 2025, with consistent annual increases of 1,500-2,000 members. Claims history data indicates annual plan costs increase by approximately 4%, with total paid amounts suggesting an annual claims volume in the tens of millions of dollars. Compensation for the TPA will be structured through monthly per-member-per-month (PMPM) rates, with maximum contract liability determined by the best-evaluated cost proposal. The RFP evaluation methodology allocates 10 points for general qualifications and experience, 40 points for technical qualifications and approach, and 50 points for the cost proposal. Key deliverables include weekly claims payment processing, subrogation recovery services, and adherence to a detailed Service Level Agreement (SLA) Scorecard. Implementation activities are scheduled from April 2026 through December 2026.