ATTM 014 SPSAQ SUPPLEMENT.xlsx

This is a Service Provider Security Assessment Questionnaire (SPSAQ) Supplement issued by the South Carolina Department of Health and Human Services (SCDHHS) for the NEMT Medical Transportation contract opportunity (ATTM 014). The supplement establishes mandatory minimum requirements for all proposed solutions that include Artificial Intelligence (AI) and Machine Learning (ML) components. Vendors must complete a seven-item questionnaire addressing AI/ML compliance, disclosure, decision-making processes, data protection, and bias assessment protocols. Each requirement is marked as mandatory, with responses selected from provided dropdown menus and supplemented by vendor comments as needed.

The seven required compliance areas include: NIST AI Risk Management Framework standards adherence; complete disclosure of all AI/ML uses within proposed solutions including workflows and data processing activities; explicit disclosure of whether AI/ML influences eligibility determinations, claims decisions, or benefit approvals; assurance that no final decisions impacting eligibility, benefits, or claims are made solely by AI/ML without documented human review and override capability; prohibition on using SCDHHS Protected Health Information (PHI) or Personally Identifiable Information (PII) for AI/ML model training without explicit written authorization from SCDHHS Security and Privacy Teams; documented bias, fairness, and impact assessments conducted before deployment and on a recurring basis for all decision-impacting AI/ML models; and strict logical and physical separation of SCDHHS data with prohibition of cross-customer AI/ML training. The supplement includes a glossary defining key terms including AI, Machine Learning, Model, PII, and PHI specific to healthcare information standards.