Incident Management and Investigation Training C5919

The Kentucky Department of Behavioral Health, Developmental and Intellectual Disabilities is requesting proposals for Incident Management and Investigation Training services under RFP 729 2600000478, with proposals due July 7, 2026. The awardee must execute a Business Associate Agreement compliant with HIPAA Security Rule standards, a decision-flipping requirement for vendors handling protected health information.

The scope comprises four primary training activities delivered annually: two Certified Investigator Training classes via ZOOM or TEAMS for up to 30 participants each (five days, 9:00 a.m. to 4:30 p.m. EST); one Mortality Review, Death Investigations, and Root Cause Analysis training class for up to 30 participants (two days); two Advanced Investigations and Evaluating the Quality of Investigations Training classes for up to 15 Certified Investigators each (three days instruction plus one off-site day for report evaluation and feedback); and consultative services available hourly for incident management process refinement, telephone consultation on investigative and regulatory issues, and curriculum updates reflecting litigation or regulatory changes. The cost proposal requires vendors to submit annual pricing for training activities and an all-inclusive hourly rate covering on-site and off-site consultation, telephone support, travel expenses for training delivery, and curriculum updates. An alternative in-person training option is provided for informational purposes only and is not scored.

The Business Associate Agreement mandates that the contractor implement administrative, physical, and technical safeguards for protected health information; restrict PHI access to personnel with legitimate business need; ensure subcontractor HIPAA compliance; notify Kentucky of any unauthorized PHI access or disclosure without unreasonable delay; provide access, amendment, and accounting of disclosures upon request; and indemnify the state for breaches or violations. The contractor assumes liability for non-compliance and must return or destroy all PHI upon contract termination unless retention is legally required.