ATTM 022(b).xlsx
XLSX spreadsheet 25 KB Posted
- Attached to
- MEDICAID CLINICAL DATA EXCHANGE
- Solicitation number
- 5400030026
- Issued by
- Richland County, South Carolina
About this file
This is a Service Provider Security Assessment Questionnaire (SPSAQ) Supplement for the South Carolina Department of Health and Human Services (SCDHHS) Medicaid Clinical Data Exchange contract opportunity, specifically addressing minimal requirements for proposals that include Artificial Intelligence (AI) and Machine Learning (ML) components.
The questionnaire establishes seven mandatory compliance requirements for all proposed AI/ML solutions. Vendors must demonstrate that their solutions will comply with the National Institute for Standards and Technology (NIST) AI Risk Management Framework standards; fully disclose all AI/ML uses including workflows, data processing activities, and decision-making functions; explicitly disclose whether AI/ML is used in eligibility determinations, claims decisions, or benefit approvals; ensure that no final decisions impacting eligibility, benefits, or claims are made solely by AI/ML without documented human review and override capability; prohibit the use of SCDHHS' Protected Health Information (PHI) or Personally Identifiable Information (PII) for AI/ML model training without explicit written authorization from SCDHHS' Security and Privacy Teams; document bias, fairness, and impact assessments before deployment and on a recurring basis for all decision-impacting AI/ML models; and ensure strict logical and physical separation of SCDHHS' data while prohibiting cross-customer AI/ML training. Each requirement includes response options for existing implementations, new buildouts, conditional compliance, or not applicable scenarios, with space for vendor comments to clarify their approach to meeting these security and operational standards.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Amendment 1.pdf | ||
| Amendment 2.pdf | ||
| PL 001.pdf | ||
| ATTM 005.pdf | ||
| PL 005.pdf | ||
| ATTM 003.pdf | ||
| ATTM 025.pdf | ||
| ATTM 019.pdf | ||
| ATTM 013.xlsx | XLSX spreadsheet | |
| ATTM 004.pdf | ||
| ATTM 017.pdf | ||
| ATTM 010.pdf | ||
| PL 002.pdf | ||
| ATTM 002.pdf | ||
| ATTM 007.pdf | ||
| ATTM 020.pdf | ||
| ATTM 018.pdf | ||
| ATTM 023.pdf | ||
| PL 004.pdf | ||
| ATTM 009.xlsx | XLSX spreadsheet | |
| ATTM 022(a).pdf | ||
| _MCDE RFP.pdf | ||
| ATTM 015.pdf | ||
| ATTM 006.pdf | ||
| ATTM 024.pdf | ||
| PL 003.pdf | ||
| ATTM 001.pdf | ||
| ATTM 008.xlsx | XLSX spreadsheet | |
| ATTM 014.pdf | ||
| ATTM 012.xlsx | XLSX spreadsheet | |
| ATTM 011.pdf | ||
| ATTM 021.pdf | ||
| ATTM 016.pdf |
Show all 33
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Minimal Requirements
SERVICE PROVIDER SECURITY ASSESSMENT QUESTIONNAIRE (SPSAQ) SUPPLEMENT
Proposals with Artificial Intellegence (AI) and Machine Learning (ML) components
| ATTM 022(b) | |||||
| ALL PROPOSED SOLUTIONS MUST MEET THE BELOW REQUIREMENTS. | |||||
| Instructions: | |||||
| For each item below, please select the most appropriate response from those provided in the pulldown menus and add any comments, as needed. | |||||
| ID# | Item | Response | Comments: | ||
| 1 | Is / will the AI/ML solution be compliant with National Institute for Standards and Technology (NIST) AI Risk Management Framework (RMF)'s standards and measures, as amended? | ||||
| REQUIRED | <Provide any clarifying comments, as needed.> |
| 2 | Does the proposed solution fully disclose all uses of AI/ML within the proposed solution, including all workflows, data processing activities, and decision-making functions? | ||
| REQUIRED | <Provide any clarifying comments, as needed.> | ||
| 3 | Does the proposed solution explicitly disclose whether AI/ML is used to make or influence eligibility determinations, claims decisions, or benefit approvals? | ||
| REQUIRED | <Provide any clarifying comments, as needed.> | ||
| 4 | Does the proposed solution ensure that no final decisions impacting eligibility, benefits, claims are made solely by AI/ML without documented human review and override capability? | ||
| REQUIRED | <Provide any clarifying comments, as needed.> | ||
| 5 | Does the proposed solution prohibit the use of SCDHHS’ PHI or PII for AI/ML model training, fine-tuning, or improvement unless explicitly authorized in writing by SCDHHS’ Security and Privacy Teams? | ||
| REQUIRED | <Provide any clarifying comments, as needed.> | ||
| 6 | Does the proposal include how the Offeror will conduct documented bias, fairness, and impact assessments before deployment and on a recurring basis for all decision-impacting AI/ML models? | ||
| REQUIRED | <Provide any clarifying comments, as needed.> | ||
| 7 | Does the proposed solution ensure strict logical and physical separation of SCDHHS’ data and prohibit cross-customer AI/ML training? | ||
| REQUIRED | <Provide any clarifying comments, as needed.> |
| OPTIONAL: |
| <Provide any clarifying comments, as needed.> |
Glossary
| Glossary | |
| Term | Definition |
| Agency | This is South Carolina Department of Health and Human Services (SCDHHS). |
| Artificial Learning (AI) | A machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. |
| Machine Learning (ML) | The development and use of computer systems that adapt and learn from data with the goal of improving accuracy. |
| Model <for AI/ML> | A component of an information system that implements AI technology and uses computational, statistical, or machine-learning techniques to produce outputs from a given set of inputs. |
| Offeror | This is the vendor who is filling out this questionnaire. |
| Personally Identifiable Information (PII) | Information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual. |
| Protected Health Information (PHI) | Individually identifiable health information: (1) Except as provided in paragraph (2) of this definition, that is: (i) Transmitted by electronic media; (ii) Maintained in electronic media; or (iii) Transmitted or maintained in any other form or medium. (2) Protected health information excludes individually identifiable health information in: (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 USC. 1232g; (ii) Records described at 20 USC. 1232g(a)(4)(B)(iv); and (iii) Employment records held by a covered entity in its role as employer. |
Response References
| ID | Response | ||||
| 1 | Yes. | ||||
| (Existing Instance / Buildout) The solution is compliant with NIST AI RMF's standards and measures, as amended. | Question 1: | FOR SCDHHS: | |||
| Yes. | |||||
| (New Instance / Buildout) The solution will be compliant with NIST AI RMF's standards and measures, as amended. | Is / will the AI/ML solution be compliant with National Institute for Standards and Technology (NIST) AI Risk Management Framework (RMF)'s standards and measures, as amended? | ||||
| REQUIRED | This tab will be hidden from vendors to see. The tab is a reference tab for the "Drop Arrow" responses. | ||||
| No. |
The solution will NOT be compliant with NIST AI RMF's standards and measures, as amended.
| 2 | Yes. | ||
| The proposal does fully disclose all uses of AI and ML within the proposed solution, including all workflows, data processing activities, and decision-making functions. | Question 2: | ||
| Yes, Conditionally. | |||
| The proposal does fully disclose all uses of AI and ML within the proposed solution, including all workflows, data processing activities, and decision-making functions. HOWEVER, appropriate agreements will be required (e.g. - Non-disclosure agreements, etc). | Will the proposal fully disclose all uses of AI/ML within the proposed solution, including all workflows, data processing activities, and decision-making functions? |
REQUIRED
No.
The proposal does NOT fully disclose all uses of AI and ML within the proposed solution, including all workflows, data processing activities, and decision-making functions.
| 3 | Yes. | ||
| (Existing Instance / Buildout) The solution DOES ALREADY explicitly disclose whether AI/ML is used to make or influence eligibility determinations, claims decisions, or benefit approvals. | Question 3: | ||
| Yes. | |||
| (New Instance / Buildout) The solution WILL explicitly disclose whether AI/ML is used to make or influence eligibility determinations, claims decisions, or benefit approvals. | Will the solution explicitly disclose whether AI/ML is used to make or influence eligibility determinations, claims decisions, or benefit approvals? |
REQUIRED
No.
The solution DOES NOT / WILL NOT explicitly disclose whether AI/ML is used to make or influence eligibility determinations, claims decisions, or benefit approvals.
Not Applicable.
The solution will be hosted within SCDHHS's network and SCDHHS will be required to perform this disclosure to users.
| 4 | Yes. | ||
| (Existing Instance / Buildout) The solution DOES NOT make any final decisions impacting eligibility, benefits, and/or claims that are made solely by AI/ML without documented human review and override capability. | Question 4: | ||
| Yes. | |||
| (New Instance/Buildout) - The solution WILL NOT make any final decisions impacting eligibility, benefits, and/or claims that are made solely by AI/ML without documented human review and override capability. | Will the proposed solution ensure that no final decisions impacting eligibility, benefits, claims are made solely by AI/ML without documented human review and override capability? |
REQUIRED
No.
The solution DOES / WILL make final decisions impacting eligibility, benefits, and/or claims that are made solely by AI/ML without documented human review and override capability.
| 5 | Yes. | ||
| (Existing Instance / Buildout) The proposed solution DOES prohibit the use of SCDHHS’ PHI or PII for AI/ML model training, fine-tuning, or improvement unless explicitly authorized in writing by SCDHHS’ Security and Privacy Teams. | Question 5: | ||
| Yes. | |||
| (New Instance / Buildout) The proposed solution WILL prohibit the use of SCDHHS’ PHI or PII for AI/ML model training, fine-tuning, or improvement unless explicitly authorized in writing by SCDHHS’ Security and Privacy Teams. | Will the proposed solution prohibit the use of SCDHHS’ PHI or PII for AI/ML model training, fine-tuning, or improvement unless explicitly authorized in writing by SCDHHS’ Security and Privacy Teams? |
REQUIRED
No.
The proposed solution REQUIRES the use of SCDHHS’ PHI or PII for AI/ML model training, fine-tuning, or improvement. This is/will be REGARDLESS if authorized in writing by SCDHHS’ Security and Privacy Teams.
| 6 | Yes. | ||
| The proposed solution include how the Offeror will conduct documented bias, fairness, and impact assessments before deployment and on a recurring basis for all decision-impacting AI models. | Question 6: | ||
| No. | |||
| The Offeror DOES NOT / WILL NOT conduct documented bias, fairness, and impact assessments before deployment and on a recurring basis for all decision-impacting AI models. | Does the proposal include how the Offeror will conduct documented bias, fairness, and impact assessments before deployment and on a recurring basis for all decision-impacting AI/ML models? |
REQUIRED
Not Applicable.
The proposed solution will be maintained FULLY BY SCDHHS and all bias, fairness, and impact assessments will be required to be performed by SCDHHS.
| 7 | Yes. | ||
| (Existing Instance / Buildout) The proposed solution DOES ensure strict logical and physical separation of SCDHHS’ data and prohibit cross-customer AI/ML training. | Question 7: | ||
| Yes. | |||
| (New Instance / Buildout) The proposed solution WILL ensure strict logical and physical separation of SCDHHS’ data and prohibit cross-customer AI/ML training. | Does the proposed solution ensure strict logical and physical separation of SCDHHS’ data and prohibit cross-customer AI/ML training? |
REQUIRED
No.
The proposed solution WILL NOT have strict logical and physical separation of SCDHHS’ data and prohibit cross-customer AI/ML training.
Not Applicable.
The proposed solution will be hosted within SCDHHS's network and the SCDHHS will be required to perform all logical and physical seperation.
File details come from the government source that posted it. Updated .