ATTM 024(b).xlsx

This document is a Service Provider Security Assessment Questionnaire (SPSAQ) Supplement issued by the South Carolina Department of Health and Human Services (SCDHHS) for proposals containing Artificial Intelligence (AI) and Machine Learning (ML) components. The questionnaire establishes seven mandatory minimal requirements that all proposed solutions must meet. These requirements address AI/ML compliance, disclosure, decision-making processes, data protection, bias assessment, and data separation. The document provides detailed response options for each requirement, distinguishing between existing instances and new buildouts, and includes conditional approval pathways where appropriate. Additionally, the document defines key terminology including AI, Machine Learning, models, PII, and PHI to ensure consistent understanding among vendors completing the assessment.

The seven required compliance areas mandate that vendors demonstrate: NIST AI Risk Management Framework standards compliance; full disclosure of all AI/ML uses and workflows; explicit disclosure of AI/ML involvement in eligibility and benefit determinations; documented human review and override capabilities for all final decisions; prohibition on using SCDHHS PHI or PII for model training without written authorization; implementation of bias, fairness, and impact assessments before deployment and on a recurring basis; and strict logical and physical separation of SCDHHS data with prohibition of cross-customer AI/ML training. The questionnaire accommodates scenarios where SCDHHS will maintain solutions internally or where vendors will provide certain functions, offering "Not Applicable" response options for those circumstances. This supplement ensures that any AI/ML-enabled proposals submitted to SCDHHS meet rigorous security, privacy, and operational standards before consideration.