Appendix%207.11%20HIPAA%20Business%20Associate%20Assessment.xlsx
XLSX spreadsheet 12 KB Posted
- Solicitation number
- RFP 31786-00190
- Issued by
- Davidson County, Tennessee
About this file
This is a HIPAA Business Associate Assessment checklist document for the State of Tennessee's Third Party Administrator Services contract for the State's Public Sector Health Plans. The assessment is a compliance evaluation tool designed to verify that prospective contractors understand and can demonstrate adherence to Health Insurance Portability and Accountability Act requirements before engaging as business associates handling Protected Health Information.
The assessment comprises 11 core evaluation questions covering critical HIPAA compliance infrastructure. Respondents must indicate "Yes" or "No" answers and provide supporting documentation for specific items, including designation of Privacy and Security Officers with contact information; completion dates for annual risk assessments; dates of last updates to HIPAA Privacy and Security Policies and Procedures since February 2013; confirmation that all employees with PHI access have completed HIPAA training and company-specific policy training within the past year with tracking methods documented; location and enactment date of the completed HIPAA Compliance Plan; a list of all Business Associate Agreements or Subcontractor Agreements for entities with PHI access; details on current Disaster Recovery Plans and their update dates; and testing dates for Disaster Recovery Plans. Additional information is specifically required for questions 11, 24, and 26, though only question 11 regarding Disaster Recovery Plan testing is present in the assessment document provided.
View the file
Other files
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| HIPAA Business Associate Assessment | |||
| Mark "Yes" or "No" for each question Provide requested information. | |||
| Name of Organization: | |||
| QUESTION: | YES | NO | Please provide additional information - lines 11, 24, and 26 ONLY |
| 1. Do you know where all Protected Health Information is located |
in your company? (Electronic and Physical)
| 2. Does your company have a designated Privacy Officer? |
| Provide the Privacy Officer's Name and Contact Information: |
| 3. Does your company have a designated Security Officer? |
| Provide the Security Officer's Name and Contact Information: |
| 4. Has your company completed an Annual Risk Assessment? |
| Provide Date Last Risk Assessment was completed: |
| 5. Has your company created or updated HIPAA Privacy & Security Policies & Procedures since February 2013? |
| Provide Date of Last Update for Privacy & Security Policies & Procedures: |
| 6. Have all employees that have access to PHI completed the training on HIPAA Privacy & Security? |
| 7. Have all employees that have access to PHI completed training for your company's HIPAA Policies & Procedures within the last year? |
| Explain how employees are trained and how you track their completion: |
| 8. Is your HIPAA Compliance Plan completed and stored in a location where all staff members can find it? |
| Provide Date HIPAA Compliance Plan was enacted and where it is located: |
| 9. Do you have an Agreement with every Business Associate or |
Subcontractor that may have access to PHI?
| Provide list of Agreements: |
| 10. Do you currently have Disaster Recovery Plan? |
| When did you last update the Plan? |
| 11. If you have a Disaster Recovery Plan, have you tested it? |
| Provide Date Disaster Recovery Plan was last tested: |
Appendix 7.11
Sheet2
Sheet3
File details come from the government source that posted it. Updated .