Appendix_7.4_HIPAA_Business_Associate_Assessment.xlsx
XLSX spreadsheet 12 KB Posted
- Solicitation number
- RFP 31786-00187
- Issued by
- Davidson County, Tennessee
About this file
This is a HIPAA Business Associate Assessment document prepared by the State of Tennessee, Department of Finance and Administration, Division of Benefits Administration, for evaluation of third-party administrator applicants for The Tennessee Plan, a self-insured supplemental medical insurance program serving Medicare-eligible state retirees. The assessment comprises a comprehensive questionnaire with 11 questions designed to evaluate organizational compliance with HIPAA privacy and security regulations. Respondents must provide "Yes" or "No" answers and supply additional information for specific line items (11, 24, and 26). The evaluation covers critical compliance areas including Protected Health Information (PHI) location tracking, designated privacy and security officer assignments, annual risk assessment completion, policy updates since February 2013, employee training documentation, HIPAA Compliance Plan documentation and accessibility, Business Associate or Subcontractor Agreements, Disaster Recovery Plan implementation and testing, and related compliance mechanisms. The RFP #31786-00187 requires proposals by December 10, 2025, with a Notice of Award expected February 26, 2026, and implementation activities scheduled from April through December 2026, followed by benefits coverage from January 1, 2027, through December 31, 2031, with a claims run-out period extending through December 31, 2033.
The assessment functions as a mandatory compliance screening tool rather than a pricing or service level evaluation document. The current incumbent is UMR, Inc., with the contract expiring June 30, 2028. The plan serves approximately 48,059 members as of July 2025, with consistent annual membership growth of 1,500-2,000 members. Annual claims volumes reach tens of millions of dollars with costs increasing approximately 4% annually. Selected contractors will be compensated through monthly per-member-per-month (PMPM) rates, with maximum contract liability determined by the best-evaluated cost proposal. The overall RFP scoring methodology allocates 10 points for general qualifications and experience, 40 points for technical qualifications and approach, and 50 points for the cost proposal.
View the file
Other files
Show 40 more
Latest 50 of 81 listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| HIPAA Business Associate Assessment | |||
| Mark "Yes" or "No" for each question Provide requested information. | |||
| Name of Organization: | |||
| QUESTION: | YES | NO | Please provide additional information - lines 11, 24, and 26 ONLY |
| 1. Do you know where all Protected Health Information is located |
in your company? (Electronic and Physical)
| 2. Does your company have a designated Privacy Officer? |
| Provide the Privacy Officer's Name and Contact Information: |
| 3. Does your company have a designated Security Officer? |
| Provide the Security Officer's Name and Contact Information: |
| 4. Has your company completed an Annual Risk Assessment? |
| Provide Date Last Risk Assessment was completed: |
| 5. Has your company created or updated HIPAA Privacy & Security Policies & Procedures since February 2013? |
| Provide Date of Last Update for Privacy & Security Policies & Procedures: |
| 6. Have all employees that have access to PHI completed the training on HIPAA Privacy & Security? |
| 7. Have all employees that have access to PHI completed training for your company's HIPAA Policies & Procedures within the last year? |
| Explain how employees are trained and how you track their completion: |
| 8. Is your HIPAA Compliance Plan completed and stored in a location where all staff members can find it? |
| Provide Date HIPAA Compliance Plan was enacted and where it is located: |
| 9. Do you have an Agreement with every Business Associate or |
Subcontractor that may have access to PHI?
| Provide list of Agreements: |
| 10. Do you currently have Disaster Recovery Plan? |
| When did you last update the Plan? |
| 11. If you have a Disaster Recovery Plan, have you tested it? |
| Provide Date Disaster Recovery Plan was last tested: |
Appendix 7.4
Sheet2
Sheet3
File details come from the government source that posted it. Updated .