RFP_31786-00187_Amendment_Three.pdf

STATE OF TENNESSEE

DEPARTMENT OF FINANCE & ADMINISTRATION, BENEFITS ADMINISTRATION

REQUEST FOR PROPOSALS #31786-00187

AMENDMENT #THREE

FOR ADMINISTRATIVE SERVICES ONLY TO

PERFORM AS THIRD-PARTY ADMINISTRATOR FOR

THE STATE’S THE TENNESSEE PLAN

DATE: December 3, 2025

RFP #31786-00187 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT TIME

(central time zone)

DATE

1. RFP Issued

September 23, 2025

2. Disability Accommodation Request Deadline 2:00 p.m. September 29, 2025

3. Pre-response Conference 1:00 p.m. September 30, 2025

4. Notice of Intent to Respond Deadline 2:00 p.m. October 1, 2025

5. Written “Questions & Comments” Deadline

NOTE: Submit written questions and comments on Appendix 7.6 the written questions and comments template.

2:00 p.m.

October 8, 2025

6. State Response to Written “Questions & Comments”

October 30, 2025

7. Written “Questions & Comments” Deadline

ROUND 2

NOTE: Respondents may submit no more than five (5) questions to the State in the 2 nd round of Written Questions and Comments

November 6, 2025

8. State Response to Written “Questions & Comments” Round 2

December 3, 2025

9. Response Deadline 2:00 p.m. December 10, 2025

10. State Completion of Technical Response Evaluations

January 15, 2026

11. State Opening & Scoring of Cost Proposals 2:00 p.m. January 16, 2026

12. Negotiations (Optional) 4:30 p.m. January 23-27, 2026

13. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

2:00 p.m.

February 26, 2026

14. End of Protest Period

March 5, 2026

15. State sends contract to Contractor for signature

March 6, 2026

16. Contractor Signature Deadline 2:00 p.m. March 13, 2026

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

RFP

SECTION

QUESTION / COMMENT

STATE RESPONSE

1. May we request a full census that includes member zip codes?

The State has added new

Appendix 7.7 Member

Demographics. See amendment item #3.

A.3.b.2 of the Pro

Forma

2.

We subcontract for our entire book of business. For those subcontracts, will the State agree prior consent is not needed?

As stated in A.3.b(1), the

Contractor shall provide the

State by the State specified in

Contract Section A.17 with a list of subcontractors to be used for this contract as of the

Go-Live date.

Additionally, please note additional requirements regarding subcontractors in the following sections: RFP

Sections 4.4 and 4.5, RFP

Question B.12, and pro forma contract section D.7.

A.11.i.1 of the pro forma

3.

Is the State open to other standards?

The Contractor has numerous systems, and the unsuccessful attempt lock out logic can vary by system.

Round 1 Response From State: Please submit alternative contract language for the State to consider in Round 2 written questions and comments.

Question for Round 2: Recommend the language be revised to read: “Restrict unsuccessful attempts to access system functions to maximum of ten (10), commensurate to the risk, sensitivity, and confidentiality of the information in each system, with a system function that automatically prevents further access attempts and records these occurrences.”

The State declines to revise language in A.11.i(1).

Pro Forma

Contract

4.

Regarding D.32: Insurance Requirements, we have follow-up questions about specific language.

1. Contractor agrees to name the State as an additional insured and to provide a waiver of subrogation in favor of the State under on its Commercial General Liability (“CGL”) insurance policy only any insurance policy with the exception of workers’ compensation (employer liability) and professional liability (errors and omissions) insurance. All policies must contain an endorsement for a waiver of subrogation in favor of the State.

The red edits were rejected in Round 1 of questions.

So for Round 2, here is our question:

General Liability and Cyber Liability are the only insurance coverages under the Agreement that are not expressly excluded from additional insured status. We have proposed revised language to allow additional insured status solely under the General Liability policy. However, our Cyber policy does not permit the inclusion of

To the extent the contractor opts not to self-insure to meet the cyber liability requirement, the State must be included as an additional insured with respect to cyber liability coverage.

third parties—such as the State— as additional insureds.

While our Cyber coverage provides robust third-party liability protections, including coverage for claims arising from breaches affecting external entities, naming the State as an additional insured would not extend first-party coverage.

Is this acceptable?

2. Contractor shall provide the COI ten (10) Business Days prior to the Effective Date and again thirty (30) calendar days before renewal or replacement of coverage.

Round 1 answer from the State:

The State rejects the substitution of “after” for “before” in the third paragraph; however, the State would agree to revise the requirement so that a COI must be provided “within ten (10) calendar days of the renewal or replacement of coverage.” See amendment item #6.

Our question: This is acceptable, but we request 15 calendar days instead of 10 to better ensure compliance. While we do everything we can to meet the timeline, we ultimately rely on our insurance carriers to issue policy numbers and broker to produce the COIs, which can sometimes take longer than we would like.

3. Contractor shall provide the State evidence that all

The State has revised language in D.32. See amendment item #8.

subcontractors maintain the required insurance or that subcontractors are included under the Contractor’s policy.

The State rejects the strikethrough of the requirement to provide evidence of subcontractor coverages.

We suggest alternate language.

“The Contractor shall provide the State with evidence that all subcontractors maintain insurance coverage that is appropriate to the nature and scope of their professional services, and in amounts that are commercially reasonable.”

The State has revised language in D.32. See amendment item #8.

E.5.a.4 of the Pro

Forma

5. We currently issue a SOC 1 report annually. Our independent public accountants perform a comprehensive examination, including testing our general procedures and controls related to our Claim

Administration transaction system. Would the State accept a SOC 1, Type 2 audit and our HITRUST certification in lieu of the SOC 2, Type 2 report?

The State agrees. See amendment item #9 below.

Pro Forma

Contract

BAA

6. • 2.4 and 3.3 – It is difficult to guarantee a business associate will agree to the same requirements, so will the State consider to revise to “substantially the same.” We have BAAs already in place with our business associates and we need to be able to use a single template.

Therefore is the State agreeable to the statement as revised:

2.4 Business Associate shall require any

agent, including a subcontractor, to

The State does not agree.

whom it provides PHI received from, maintained, created or received by

Business Associate on behalf of Covered

Entity or that carries out any duties for the Business Associate involving the use, custody, disclosure, creation of, or access to PHI or other confidential information, to agree, by written contract with Business Associate, in accordance with 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of business associate agree to substantially the same restrictions and conditions that apply to the business associate with respect to such information.

3.3 Business Associate shall ensure that

any agent, including a subcontractor, to whom it provides electronic PHI received from or created for Covered Entity or that carries out any duties for the Business Associate involving the use, custody, disclosure, creation of, or access to PHI supplied by Covered Entity, to agree, by written contract (or the appropriate equivalent if the agent is a government entity) with Business

Associate, in accordance with 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of business associate agree to substantially the same restrictions and conditions that apply to the business associate with respect to such information.

• 2.6 – We cannot agree that our business associates will report unauthorized uses and disclosures to us within 48 language in Contract hours. Our standard language in our BAAs is 2 business days, but we will occasionally agree to longer timelines.

2.6 Business Associate shall require its

employees, agents, and subcontractors to promptly (up to 48 hours) report, to Business Associate, immediately upon becoming aware of any use or disclosure of PHI in violation of this Agreement. Business Associate shall report to Covered Entity any use or disclosure of the

PHI not provided for by this Agreement.

Business Associate will also provide additional information reasonably requested by the Covered Entity related to the breach.

• 2.7.1 – we request a time frame longer than “immediately” for reporting to the State.

Business Associate shall provide to Covered Entity notice of a Potential or Actual Breach of Unsecured PHI promptly (within 5 business days) immediately upon becoming aware of the Breach.

• 2.15 – It is not part of our process to notify the State of access requests. We do fulfill them in accordance with HIPAA. Could we report to the State of Tennessee upon request?

2.15

If Business Associate receives a request from an Individual for a copy of the individual's PHI, and the PHI is in the sole possession of the Business Associate, Business Associate will provide the requested copies to the individual and notify the Covered Entity of

Attachment E, section 2.6. See amendment item #10.

such action. If Business Associate receives a request for PHI in the possession of the Covered Entity, or receives a request to exercise other individual rights as set forth in the Privacy Rule, Business Associate shall notify Covered Entity, upon request, of such request and forward the request to Covered Entity. Business Associate shall then assist Covered Entity in responding to the request.

• – Regarding the statement below, will the State consider modifying the timeline?

3.4 Business Associate shall require its

employees, agents, and subcontractors to report to Business Associate within five (5) Business Days, any Security

Incident (as that term is defined in 45

CFR § 164.304) of which it becomes aware. 45 CFR 164.314(a)(2)(C) requires that business associate shall report to the covered entity any security incident of which is becomes aware, including breaches of unsecured protected health information as required by 164.410.

Business Associate shall promptly (within five (5) Business Days) (up to 48 hours) report any Security Incident of which it becomes aware to Covered Entity.

Provided however, that such reports are not required for attempted, unsuccessful

Security Incidents, including trivial and routine incidents such as port scans, attempts to log-in with an invalid password or user name, denial of service attacks that do not result in a server

The State does not agree, but the State has revised language in Contract attachment E, section 3.4. See amendment item #10.

being taken off-line, malware, and pings or other similar types of events.

• Requesting this modification for item 3.7.

3.7 Notification for the purposes of

Sections 2.8 and 3.4 shall be in writing made by email/fax, certified mail or overnight parcel immediately promptly upon becoming aware of the event, with supplemental notification by facsimile and/or telephone as soon as practicable, to:

• We would also request the right to de-identify their PHI.

Will the State consider adding the following statement to the

BAA?

Carrier may de-identify PHI for further uses and disclosures to the extent permitted by law.

language in Contract

Attachment E, Section 3.7.

See amendment item #10.

3. Add the following as RFP Attachments and Appendices and renumber any subsequent sections as necessary:

New Appendix:

Appendix 7.7 Member Demographics

4. Delete Pro Forma Contract Section A.2.mm in its entirety and insert the following in its place.

mm. Subrogation: Unless the context indicates otherwise, subrogation shall mean the process used to seek reimbursement from the responsible party for a Claim paid by the Plan.

5. Delete Pro Forma Contract Section A.10.t in its entirety and insert the following in its place.

t. The Contractor shall implement a process to govern all recoveries to the Plan, including but not limited to Subrogation recoveries, and report recovery activities to the State. The Contractor’s process shall incorporate all procedural steps required by the State and must be approved by the State, In Writing, prior to Go-Live and proposed subsequent changes, if any. The Contractor shall submit to the State monthly recoveries reports of all recoveries including, but not limited to, Subrogation recoveries, in a format prior approved by the State and as provided in Contract Attachment C, Reporting Requirements, items #21 and #24.

The components of the Contractor’s process specific to Subrogation and reimbursement shall include provisions for the recovery of claims paid for treatment of work-related illnesses or injuries and illnesses or injuries resulting from actions of non-employer third parties. The Contractor’s process shall comply with the State’s directions regarding Subrogation recovery and shall implement new or revised requirements received from the State within sixty (60) calendar days of receipt of the requirements from the State, unless otherwise directed by the State.

The Contractor shall actively identify claims with Subrogation potential within the timeframe specified in the Contractor’s approved process and pursue Subrogation recovery or reimbursement of all sums paid for Member claims that are subject to Subrogation or reimbursement provisions in the Plan, as specified in the Contractor’s approved process. Notwithstanding the foregoing and at the sole discretion of the State, the State may refer any identified Subrogation interests or reimbursement claims to the Tennessee Office of Attorney General and Reporter for recovery and collection.

If payment has not been recovered within the timeframe specified in the Contractor’s approved process, after the initial demand for payment or Subrogation claim has been submitted, the Contractor shall refer the account to the State with a recommendation either requesting additional time with a specific target date range of completion or requesting that the matter be referred to the Tennessee Office of Attorney General and Reporter for additional legal action. It shall be at the sole discretion of the State to close an account.

All Subrogation or reimbursement settlements for reductions exceeding the threshold specified in the Contractor’s approved Subrogation process must be approved by the State, In Writing, and shall be at the sole discretion of the State. The Contractor shall not approve workers’ compensation Subrogation settlements that permit future related medical claims to be paid by the Plan without written approval by the State, which shall be at the sole discretion of the State.

6. Add Pro Forma Contract Section A.10.u and renumber any subsequent sections as necessary.

u. The Contractor shall not retain counsel to appear on behalf of the State in a judicial or administrative proceeding without written approval of the State.

7. Delete Pro Forma Contract Section C.3.d in its entirety and insert the following in its place.

d. Unless otherwise agreed to by the State, In Writing, in all Subrogation recoveries or collections handled by the Contractor, the State authorizes the Contractor to retain monies received through Subrogation, on a per patient basis, of no more than 5% of the gross recovery for administrative expenses, including in-house attorney fees. When Subrogation recovery is made by a subcontractor(s) and/or outside attorney(s), Contractor shall retain up to 20% of the gross recovery, but shall not retain an amount greater than the actual amount paid to the subcontractor(s) and/or outside attorney(s) for their services. The gross Subrogation recoveries will be remitted to the State within 90 days of final settlement and receipt of funds by payment as agreed on by the State.

Additionally, the Contractor will provide a report that itemizes cases information (including cases opened, pending and closed), year to date summary of recoveries, monthly non-response information, quarterly cases closed by Contractor, quarterly ‘made whole’ closures, and any other information deemed necessary by the State, to be submitted to the State monthly.

For purposes of this provision C.3,d gross recovery shall mean the total amount of Subrogation recovery due to the State after deducting litigation expenses and/or attorney(s) fees that the Member’s attorney is legally entitled to receive.

8. Delete Pro Forma Contract Section D.32 in its entirety and insert the following in its place.

D.32 Insurance. Contractor shall maintain insurance coverage as specified in this Section. The State reserves the right to amend or require additional insurance coverage, coverage amounts, and endorsements required under this Contract upon mutual agreement of both parties and just cause being shown.

Contractor’s failure to maintain or submit evidence of insurance coverage, as required, is a material breach of this Contract. If Contractor loses insurance coverage, fails to renew coverage, or for any reason becomes uninsured during the Term, Contractor shall immediately notify the State. All insurance companies providing coverage must be: (a) authorized by the Tennessee Department of Commerce and Insurance (“TDCI”); and (b) rated A- / VII or better by A.M. Best. All coverage must be on a primary basis and noncontributory with any other insurance or self-insurance carried by the State.

Contractor agrees to name the State as an additional insured on any insurance policy with the exception of workers’ compensation (employer liability) and professional liability (errors and omissions) insurance. All policies must contain an endorsement for a waiver of subrogation in favor of the State. Any deductible or self insured retention (“SIR”) over fifty thousand dollars ($50,000) must be disclosed to the State. The deductible or SIR and any premiums are the Contractor’s sole responsibility. The Contractor agrees that the insurance requirements specified in this Section do not reduce any liability the Contractor has assumed under this Contract including any indemnification or hold harmless requirements.

To achieve the required coverage amounts, a combination of an otherwise deficient specific policy and an umbrella policy with an aggregate meeting or exceeding the required coverage amounts is acceptable. For example: If the required policy limit under this Contract is for two million dollars ($2,000,000) in coverage, acceptable coverage would include a specific policy covering one million dollars ($1,000,000) combined with an umbrella policy for an additional one million dollars ($1,000,000). If the deficient underlying policy is for a coverage area without aggregate limits (generally Automobile Liability and Employers’ Liability Accident), Contractor shall provide a copy of the umbrella insurance policy documents to ensure that no aggregate limit applies to the umbrella policy for that coverage area. In the event that an umbrella policy is being provided to achieve any required coverage amounts, the umbrella policy shall be accompanied by an endorsement at least as broad as the Insurance

Services Office, Inc. (also known as “ISO”) “Noncontributory—Other Insurance Condition” endorsement or shall be written on a policy form that addresses both the primary and noncontributory basis of the umbrella policy if the State is otherwise named as an additional insured.

Contractor shall provide the State a certificate of insurance (“COI”) evidencing the coverages and amounts specified in this Section. The COI must be on a form approved by the TDCI (standard ACORD form preferred). The COI must list each insurer’s National Association of Insurance Commissioners (NAIC) number and be signed by an authorized representative of the insurer. The COI must list the State of Tennessee – CPO Risk Manager, 312 Rosa L. Parks

Ave., 3rd floor Central Procurement Office, Nashville, TN 37243 as the certificate holder. Contractor shall provide the COI ten (10) Business Days prior to the Effective Date and again within fifteen (15) calendar days of the renewal or replacement of coverage. Contractor shall provide the State evidence that all subcontractors maintain insurance coverage that is appropriate to the nature and scope of their professional services, and in amounts that are commercially reasonable or that subcontractors are included under the Contractor’s policy. At any time, the State may require Contractor to provide a valid COI.

The Parties agree that failure to provide evidence of insurance coverage as required is a material breach of this Contract. If Contractor self-insures, then a COI will not be required to prove coverage. Instead, Contractor shall provide a certificate of self-insurance or a letter, on Contractor’s letterhead, detailing its coverage, policy amounts, and proof of funds to reasonably cover such expenses.

The State agrees that it shall give written notice to the Contractor as soon as practicable after the State becomes aware of any claim asserted or made against the State, but in no event later than thirty (30) calendar days after the State becomes aware of such claim. The failure of the State to give notice shall only relieve the Contractor of its obligations under this Section to the extent that the Contractor can demonstrate actual prejudice arising from the failure to give notice. This Section shall not grant the Contractor or its insurer, through its attorneys, the right to represent the State in any legal matter, as the right to represent the State is governed by Tenn. Code Ann.

§ 8-6-106.

The insurance obligations under this Contract shall be: the minimum insurance coverage requirements and policy limits shown in this Contract. No representation is made that the minimum insurance requirements of the Contract are sufficient to cover the obligations of the Contractor arising under this Contract. The Contractor shall obtain and maintain, at a minimum, the following insurance coverages and policy limits.

a. Commercial General Liability (“CGL”) Insurance

1) The Contractor shall maintain CGL, which shall be written on an ISO Form CG 00 01 occurrence form (or a substitute form providing equivalent coverage) and shall cover liability arising from property damage, premises and operations products and completed operations, bodily injury, personal and advertising injury, and liability assumed under an insured contract (including the tort liability of another assumed in a business contract).

2) The Contractor shall maintain single limits not less than one million dollars ($1,000,000) per occurrence. If a general aggregate limit applies, either the general aggregate limit shall apply separately to this policy or location of occurrence or the general aggregate limit shall be twice the required occurrence limit.

b. Workers’ Compensation and Employer Liability Insurance

1) For Contractors statutorily required to carry workers’ compensation and employer liability insurance, the Contractor shall maintain:

i. Workers’ compensations and employer’s liability insurance in the amounts required by appropriate state statutes.

2) If the Contractor certifies that it is exempt from the requirements of Tenn. Code Ann. §§ 50-6-101 – 103, then the Contractor shall furnish written proof of such exemption for one or more of the following reasons:

i. The Contractor employs fewer than five (5) employees;

ii. The Contractor is a sole proprietor;

iii. The Contractor is in the construction business or trades with no employees;

iv. The Contractor is in the coal mining industry with no employees;

v. The Contractor is a state or local government; or

vi. The Contractor self-insures its workers’ compensation and is in compliance with the TDCI rules and Tenn. Code Ann. § 50-6-405.

c. Professional Liability Insurance

1) Professional liability insurance shall be written on an occurrence basis or on a claims-made basis. If this coverage is written on a claims-made basis, then:

i. The retroactive date must be shown, and must be on or before the earlier of the Effective Date of the Contract or the beginning of Contract work or provision of goods and services;

ii. Insurance must be maintained and evidence of insurance must be provided for at least five (5) full years from the date of the final Contract payment;

and

iii. If coverage is canceled or non-renewed, and not replaced with another claims-made policy form with a retroactive date on or prior to the Contract Effective Date, the Contractor must purchase “extended reporting” or “tail coverage” for a minimum of five (5) full years from the date of the final Contract payment.

2) Any professional liability insurance policy shall have a limit not less than one million dollars ($1,000,000) per claim and two million dollars ($2,000,000) in the aggregate; and

3) If the Contract involves the provision of services by medical professionals, a policy limit not less than three million ($3,000,000) per claim and three million dollars ($3,000,000) in the aggregate for medical malpractice insurance.

Cyber Liability Insurance:

d. Cyber Liability Insurance

1) The Contractor shall maintain technology professional liability (errors & omissions)/cyber liability insurance appropriate to the Contractor’s profession in an amount not less than ten million dollars ($10,000,000) per occurrence or claim and ten million dollars ($10,000,000) annual aggregate, covering all acts, claims, errors, omissions, negligence, infringement of intellectual property (including copyright, patent and trade secret); network security and privacy risks, including but not limited to unauthorized access, failure of security, information theft, damage to destruction of or alteration of electronic information, breach of privacy perils, wrongful disclosure and release of private information, collection, or other negligence in the handling of confidential information, and including coverage for related regulatory fines, defenses, and penalties.

2) Such coverage shall include data breach response expenses, in an amount not less than ten million dollars ($10,000,000) and payable whether incurred by the State or

Contractor, including but not limited to consumer notification, whether or not required by law, computer forensic investigations, public relations and crisis management firm fees, credit file or identity monitoring or remediation services and expenses in the performance of services for the State or on behalf of the State hereunder.

9. Delete Pro Forma Contract Section E.5.a(3) and E.5.a(4) in their entirety and insert the following in its place.

(3) The Contractor and any Subcontractor used by the Contractor to host State data, including data center vendors, shall be subject to an annual engagement by a licensed CPA firm in accordance with the standards of the American Institute of Certified Public Accountants (“AICPA”) for a System and Organization Controls for service organizations (“SOC”) 2 Type 2 examination or in accordance with the standards of HITRUST Alliance to be HITRUST Certified. The scope of the SOC 2 Type 2 examination engagement must include the Security, Availability, Confidentiality, and Processing Integrity Trust Services Criteria. In addition, the Contractor services that are part of this Contract, including any processing or storage services, must be included in the scope of the SOC 2 Type 2 examination engagement(s). If the Contractor is submitting the HITRUST CSF Certified letter, it shall be submitted annually which includes the interim assessment testing results in subsequent years during the Term and the Contractor and Contractor’s processing environment containing State Data shall maintain a current HITRUST risk-based 2-year (r2) validated assessment issued under the HITRUST Common Security Framework and performed by an authorized HITRUST External Assessor Organization.

(4) The Contractor must annually review its SOC 2 Type 2 examination reports or HITRUST assessment reports. Within 30 days of receipt of the examination report, or upon request from the State or the Comptroller of the Treasury, the Contractor must provide the State or the Comptroller of the Treasury a non-redacted copy of the Contractor’s SOC 2 Type 2 examination report(s) or the HITRUST assessment reports. The Contractor must review the annual SOC 2 Type 2 examination reports or HITRUST assessment reports for each of its Subcontractors and must also assist the State or Comptroller of the Treasury with obtaining a non-redacted copy of any SOC examination reports or HITRUST assessment reports for each of its Subcontractors, including data centers used by the Contractor to host or process State data.

If the Contractor’s SOC 2 Type 2 examination report includes a modified opinion, meaning that the opinion is qualified, adverse, or disclaimed, or if the Contractor’s HITRUST assessment report that hasn’t passed the Quality Assurance phase, the Contractor must share the SOC report or the HITRUST assessment report and the Contractor’s plan to address the modified opinion; or assessment report (that hasn’t passed Quality Assurance phase)with the State or the Comptroller of the Treasury within 30 days of the Contractor’s receipt of the SOC report or HITRUST assessment report; or upon request from the State or the Comptroller of the Treasury. If any Subcontractor(s) SOC 2 Type 2 examination report includes a modified opinion or HITRUST assessment report that hasn’t passed the Quality Assurance phase, the Contractor must assist the State or Comptroller of the Treasury with obtaining the Subcontractor(s) SOC report or HITRUST assessment report and the Subcontractor(s) plan to address the modified opinion or assessment report that has not passed the Quality Assurance phase.

The Contractor must have a process for correcting control deficiencies that were identified in the SOC 2 Type 2 examination or the HITRUST assessment, including follow-up documentation providing evidence of such corrections. Within 30 days of receipt of the examination report of the assessment report, or upon request from the State or the Comptroller of the Treasury, the Contractor must provide the State or the Comptroller of the Treasury with the current HITRUST assessment report in its entirety, the HITRUST Certification Letter for the current r2 Validated Assessment, issued by HITRUST Alliance after validation by an Authorized HITRUST External Assessor Organization (the letter must show assessment type, scope, and certification types), and a corrective action plan describing each identified deficiency, planned remediation steps, anticipated completion dates, and evidence of correcting the control deficiencies. The Contractor must require each of its Subcontractors, including data centers used by the Contractor to host State data, to have a process for correcting control deficiencies identified in their SOC examination reports or HITRUST assessment reports and must assist the State or Comptroller of the Treasury with obtaining a corrective action plan and obtaining evidence of correcting control deficiencies identified in Subcontractor(s) SOC reports or HITRUST assessment reports. The Contractor shall ensure that all documentation remains current, complete, and accurate throughout the term of the Contract.

No additional funding shall be allocated for these examinations as they are included in the Maximum Liability of this Contract.

10. Delete Contract Attachment E, sections 2.6, 3.4, and 3.7 in their entirety, and replace with the following.

2.6 Business Associate shall require its employees, agents, and subcontractors to promptly (up to two business days) report, to Business Associate, immediately upon becoming aware of any use or disclosure of PHI in violation of this Agreement.

Business Associate shall report to Covered Entity any use or disclosure of the PHI not provided for by this Agreement. Business Associate will also provide additional information reasonably requested by the Covered Entity related to the breach.

3.4 Business Associate shall require its employees, agents, and subcontractors to report to Business Associate within five (5) Business Days, any Security Incident (as that term is defined in 45 CFR § 164.304) of which it becomes aware. 45 CFR 164.314(a)(2)(C) requires that business associate shall report to the covered entity any security incident of which is becomes aware, including breaches of unsecured protected health information as required by 164.410. Business Associate shall promptly (up to two business days) report any Security Incident of which it becomes aware to Covered Entity. Provided however, that such reports are not required for attempted, unsuccessful Security Incidents, including trivial and routine incidents such as port scans, attempts to log-in with an invalid password or user name, denial of service attacks that do not result in a server being taken off-line, malware, and pings or other similar types of events.

3.7 Notification for the purposes of Sections 2.8 and 3.4 shall be in writing made by email/fax, certified mail or overnight parcel promptly upon becoming aware of the event, with supplemental notification by facsimile and/or telephone as soon as practicable, to:

State of Tennessee Benefits Administration Attn: Chanda Rainey

HIPAA Privacy & Security Officer 312 Rosa L. Parks Avenue

1900 W.R.S. Tennessee Towers Nashville, TN 37243-1102

Phone: (615) 770-6949

Facsimile: (615) 253-8556

With a copy to:

State of Tennessee Benefits Administration Attn: Heather Pease

Director of Procurement and Contracts 312 Rosa L. Parks Avenue

1900 W.R.S. Tennessee Towers Nashville, TN 37243-1102

Phone: (615) 253-1652

11. Delete pro forma contract section A.9.s in its entirety and replace with the following.

s. Within 45 days of the contract effective date, the Contractor shall provide the

State with a copy of all Contractor and subcontractor online terms and conditions, online service agreements, privacy policies, notices of privacy policy, or other documents required to be accepted by members of the State of TN health plans when they access online accounts, services, or programs being delivered by Contractor or subcontractors pursuant to this Contract.

Contractor and its subcontractors shall not require members of the State of

TN health plans to agree to online Terms of Use, Privacy Policies, Notices of

Privacy Policies, or other similar documents that contain provisions which conflict with the terms of the Contract or Business Associate Agreement

(BAA) between the State of TN and Contractor, or with the terms of the contract or BAA between Contractor and its subcontractors in order to access services provided pursuant to this contract. Any terms contained in such online documents which violate this prohibition shall be deemed void and not applicable to or binding upon the State of TN plan members.

The Contractor shall be responsible for ensuring compliance with this provision and non-compliance with this provision by the Contractor or its subcontractor is a material breach of this Contract for which the Contractor shall be directly responsible.

Under no circumstances will disputes between the Contractor or its subcontractors and a member of the State of TN health plan arising from services provided pursuant to this contract be governed by law other than

Tennessee law and applicable federal law or adjudicated in forums other than those in the State of Tennessee with subject matter jurisdiction over the dispute.

12. Delete RFP #31786-00187, Release #2 in its entirety, and replace with RFP #31786-

00187, Release #3. Revisions of the original RFP document are emphasized within the new release. Any sentence or paragraph containing revised or new text is highlighted.

13. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.