RFP 26-004 HIPAA and Hitech Consulting for Fiscal Years 2027 - 2031

REQUEST FOR PROPOSALS
FOR
HEALTH INSURANCE COMPLIANCE CONSULTING
(HIPAA and HITECH)
FOR
THE
PUBLIC EDUCATION EMPLOYEES' HEALTH INSURANCE PLAN
For the Fiscal Years
2027 through 2031
October 1, 2026 through September 30, 2031
RFP 26-004
Issue Date: April 17, 2026

THIS RFP CONTAINS INFORMATION UNDER THE FOLLOWING HEADINGS:
SECTION I
General Information for the Proposer
A. Purpose
B. Background
C. Description of PEEHIP's Management
D. Operations
E. Other Information
F. Proposal Opening
G. Key Dates
H. Scope of Services
I. Payment Schedule
J. Selection of Firm
K. Economy of Preparation
L. News Releases
M. Addenda to the RFP
N. Contact Point
O. Minimum Qualifications
P. Agents
Q. STAARS Registration
R. Exceptions
SECTION II
Information Required from Proposers
A. Qualifications of the Firm
B. Cost Proposal
SECTION III
Criteria for Evaluation
A. General
B. PEEHIP's Rights
C. Termination
D. Proposal Evaluation
E. Proposal Evaluation Form
SECTION IV
Additional Documents
A. State of Alabama Disclosure Statement (Pursuant to the Code of Alabama 1975, Title 41,
Chapter 16, Article 3B)
B. Sample PEEHIP State Contract
C. Immigration Compliance Certificate
D. Proposer Profile Form
E. Proposer References Form
F. PEEHIP Statement on HIPAA Compliance Documentation
G. Sample Business Associate Agreement
H. IRS Form W-9
I. Non-Disclosure Agreement
J. IT Security Questionnaire
K. Certification of Bidder or Proposer

SECTION I
General Information for the Bidder
A. Purpose:
This Request For Proposal (RFP) solicits vendor proposals to provide audit, training, and consulting services for
the Public Education Employees' Health Insurance Board, acting on behalf of the Public Education Employees'
Health Insurance Plan (PEEHIP) to ensure PEEHIP's compliance with the Health Insurance and Portability
Accountability Act of 1996 and accompanying regulations, as amended from time to time, (HIPAA) and the Health
Information Technology for Economic and the Clinical Health Act of 2009 and any regulations promulgated
thereunder (HITECH).
B. Background:
The PEEHIP provides hospital medical health insurance benefits for all full-time employees and certain part-time
employees of the Alabama public educational institutions, which provide instruction at any combination of grades
K-14. These insurance benefits are also available to retired employees with a portion of the retiree's cost paid
through the employer premium for active employees. Coverage is also offered to eligible dependents.
Members have the following choices for health insurance coverage as follows:
* Hospital medical administered by Blue Cross and Blue Shield of Alabama - Actives and Non-Medicare
eligible retirees and eligible dependents.
* Prescription Drug coverage administered by Express Scripts - Actives and Non-Medicare eligible retirees
and eligible dependents.
* Health Maintenance Organization - Viva - Actives and Non-Medicare eligible retirees.
* Medicare Advantage Prescription Drug Plan (MAPDP) - Humana - Medicare eligible retirees and
Medicare eligible dependents of retirees
* Optional Coverage administered by Southland Benefit Solutions, LLC - consisting of Dental, Hospital
Indemnity, Vision, and Cancer.
* Supplemental Hospital Medical administered by Blue Cross and Blue Shield of Alabama-supplemental
coverage for Actives and Non-Medicare eligible retirees
Members electing one of the hospital medical plans must pay a small amount each month for single coverage plus
an additional amount if the member elects family coverage. Additionally, members may select the optional coverage
plans or supplemental plan in lieu of the hospital medical coverage. Members electing hospital medical coverage
may also elect to pay an additional amount to acquire one or more of the optional plans.
C. Description of PEEHIP's Management:
The PEEHIP's self-insurance plan and administrative responsibility for this fund is with the Retirement Systems of
Alabama (RSA) administrative staff. The Chief Executive Officer (CEO) of the Teachers' Retirement System (TRS)
also serves as CEO for the PEEHIP. All matters relating to the PEEHIP have been assigned to staff who serve under
the direction of the Deputy Director for Administration.

D. Operations:
The Accounting Division of the RSA is responsible for budgeting projected claims and working with the insurance
consultant to estimate premium rates necessary to fund the claims and maintain adequate reserves for unreported
and unpaid claims.
The PEEHIP Division maintains insurance records for the approximately 360,000 active and retired members and
eligible dependents via Member Online Services. All changes are reported to the third-party administrators via
electronic file transfer.
In March 2007, the Alabama Retired Education Employees' Health Care Trust, a multiple-employer cost-sharing
defined benefit post-employment healthcare plan, was established to provide healthcare benefits to retirees of state
and local educational institutions. As of September 30, 2025, the assets totaled $2.7 billion.
Claims paid by third party administrators and payments to HMOs for Fiscal Years 2023-2025 are summarized as
follows (cash basis):
(Amount in Millions)
TPA 2023 2024 2025
Medical - BCBS of AL $ 1,013 $ 1,043 $ 1,119
Drug - ESI $ 254 $ 288 $ 247
MAPDP $ 77 $ 57 $ 203
HMO - VIVA $ 20 $ 18 $ 19
Optionals - CDIV - Southland $ 63 $ 60 $ 66
Flex $ 8 $ 9 $ 10
Other (e.g., ADPH) $ 5 $ 6 $ 5
Total Claims $ 1,440 $ 1,481 $ 1,669
Number of Members with medical contracts and number of dependents enrolled in PEEHIP Medical Coverage and
Optional Coverage as of January 31, 2026:
As of January 31, 2026 Active Retired Total Total Covered
Hospital/Medical Single Family Single Family Single Family Contracts Persons
Hosp/Med 35,297 52,286 3,753 5,580 39,050 57,866 96,916 230,639
Supplemental 188 1,537 546 770 734 2,307 3,041 8,596
Total Hosp/Med 35,485 53,823 4,299 6,350 39,784 60,173 99,957 239,235
Humana - - 40,442 20,437 40,442 20,437 60,879 80,907
Viva Health 727 518 133 90 860 608 1,468 2,747
Total Hospital/Medical 36,212 54,341 44,874 26,877 81,086 81,218 162,304 322,889

As of January 31, 2026 Active Retired Total Total Covered
Optional Plans Single Family Single Family Single Family Contracts Persons
Cancer 3,850 6,175 4,636 5,127 8,486 11,302 19,788 39,054
Dental 24,340 45,564 28,777 30,718 53,117 76,282 129,399 272,384
Vision 8,585 13,678 7,071 9,488 15,656 23,166 38,822 81,865
Indemnity 2,608 3,825 2,503 2,249 5,111 6,074 11,185 22,141
All optional plans are with
Southland
PEEHIP also implemented a MAPDP effective January 1, 2017. The member count for this program is
approximately 81,000 (included above), and the plan is currently administered by Humana.
E. Other Information:
Additional terms and conditions appliable to, and hereby incorporated within, this RFP and all proposals submitted
in response to this RFP are located at https://www.rsa-al.gov/about-rsa/itb-rfp/ and titled:
* RSA Reservation of Rights and Requirements for ITBs and RFPs
* RSA Standard Terms and Conditions for Solicitations and Contracts
* RSA Procedure for Resolution of Controversies
By submitting a proposal, all proposers are deemed to have agreed to all terms and conditions included within the
above documents unless a proposer provides RSA with a document clearly stating its exceptions to any term or
condition, along with a detailed justification therefore.
Other documents that are considered as part of this RFP may be located via the internet as follows:
RSA's website - www.rsa-al.gov
PEEHIP information on RSA's website - www.rsa-al.gov/index.php/members/peehip/
Alabama Secretary of State's website - www.sos.alabama.gov
PEEHIP Law - Code of Alabama 1975, Title 16, Chapter 25A, Article 1
Flexible Benefits Plan Law - Code of Alabama (1975), Title 16, Chapter 25A, Article 2
F. Proposal Opening:
Please submit one printed non-redacted and one printed redacted copy of your proposal, and a digital copy (non-
redacted and redacted) on a USB drive in a sealed envelope with the following plainly marked on the front:
PEEHIP
HEALTH INSURANCE COMPLIANCE CONSULTING PROPOSAL
RFP 2026-004
OPENING June 4, 2026

Proposals will be sent to:
Proposals sent via UPS or FedEx: Proposals sent via U.S. Mail:
Taylor Benefield Taylor Benefield
Accounting Dept. Accounting Dept.
Retirement Systems of Alabama Retirement Systems of Alabama
201 South Union Street P.O. Box 302150
Montgomery, AL 36104 Montgomery, AL 36130-2150
Proposals may be hand delivered to Taylor Benefield of the Retirement Systems Building, 7th floor, 201 South
Union Street, Montgomery, Alabama. Proposals will be accepted until 2:00 p.m. CST on June 4, 2026. Proposals
will not be accepted after this date and time. Proposals will be opened after 2:00 p.m. CST on June 4, 2026. PEEHIP
reserves the right to reject any and all responses to this RFP.
Any questions regarding this RFP must be submitted electronically via email by May 1, 2026, at 2:00 p.m. CST to
Taylor Benefield at Taylor.Benefield@rsa-al.gov.
All responses to this solicitation may be subject to public disclosure upon request. Proposers should be aware of
the Open Records Act (Ala. Code 36-12-40), the Alabama Trade Secrets Act (Ala. Code 8-27-1 and 8-27-6),
and the Public Record Status of Certain Procurement Information statute (Ala. Code 41-4-115).
Any confidential, trade secret, or proprietary commercial information contained in a proposal must be clearly
marked as such. Identification of an entire proposal as confidential is not acceptable unless the proposer states in
detail the specific grounds and applicable laws which support treatment of the entire proposal as protected from
disclosure.
G. Key Dates:
RFP 26-004 KEY DATES
Activity Date
RFP to be Issued/Posted on RSA's website April 17, 2026
Deadline to Submit Questions May 1, 2026 @ 2:00 p.m. CST
Responses to Questions posted to RSA's website May 6, 2026 @ 5:00 p.m. CST
Responses Due by June 4, 2026 @ 2:00 p.m. CST
Bid Opening Date June 4, 2026
Finalist Conferences (if held) Week of June 8, 2026
Award of Bid June 12, 2026

H. Scope of Services:
Compliance requirements for HIPAA, HITECH, and Healthcare Reform are constantly evolving. PEEHIP is
required to stay abreast of those changes in order to appropriately safeguard protected health information (PHI) and
reduce adverse impacts to the fund. The requirements listed below will help PEEHIP ensure the plan stays consistent
with meeting those objectives and become further proactive in fulfilling the requirements issued by Health and
Human Services (HHS). PEEHIP requires all compliance and training materials to be updated at minimum on a
yearly basis or more frequently as required by legislation.
Specific services required include:
* Providing highly qualified legal guidance to the PEEHIP management team regarding legal/legislative
developments related to healthcare security, privacy, and confidentiality. PEEHIP requires legal opinions to
be issued by personnel with an official Juris Doctor degree and a subject matter expert in the area of healthcare
security and privacy. A team of HIPAA experts should be assigned to PEEHIP in the event of an emergency
by providing a call tree and escalation plan for after-hours emergencies.
* Providing yearly in-person compliance training (or, at PEEHIP's sole discretion, computer-based live or
recorded training) to all PEEHIP staff with updated training materials reflecting new or modified legislation
and regulatory guidance, which also includes performing a gap analysis of training content. Training materials
and in-person training should be completed by successful proposer no later than February 28 of each contract
year. In the event that training cannot be performed onsite due to a national pandemic, or other cause deemed
by PEEHIP as prohibiting onsite training, proposer must be able to create content and conduct training
remotely. Proposer must be able to capture the training in a format that can be easily replayed by PEEHIP
and RSA employees and provide the recording to RSA within thirty (30) days from the in-person training if
requested by PEEHIP.
* Reviewing Business Associate Agreements (BAA) to ensure verbiage is updated and complies with health
care security and privacy regulations.
* Providing yearly HIPAA/HITECH security and privacy assessments based on established industry
frameworks for auditing healthcare plans, with compliance reports completed by June 30th each year.
* Conducting onsite visits to determine if physical security requirements comply with HIPAA privacy and
security regulations.
* Updating PEEHIP policy handbooks to reflect changes in regulations and operating procedures.
* Attending PEEHIP board meetings as requested by management to address compliance or litigation concerns
that may arise.
* Interviewing select management and staff members regarding common privacy and security-related
practices within PEEHIP to include, but not be limited to, disposal, storage, and encryption practices or
procedures.
* Identifying all information systems and communication networks that store, maintain, or transmit electronic
PHI and determine compliance with documented HIPAA privacy and security regulations or other state
privacy and security statutes related to healthcare.
* Evaluating potential risks (to include the cost of failure related to privacy or security breaches and related
public communication costs) associated with how PEEHIP collects, uses, manages, houses and discloses

health information and evaluate options or changes to current practices in order to meet HIPAA Privacy
and Security regulations or other state privacy and security statutes. Evaluate risks related to current
policies, procedures, tools, and techniques related to management investigation and remediation of privacy
or security breaches.
* Determining if PEEHIP procedures for release, disclosure and recording of health information comply with
each of the HIPAA Privacy and Security standards.
* Determining if breach notification procedures are appropriate, sufficient, and up to date.
* Assisting with any other HIPAA/HITECH consulting requested from time to time by PEEHIP.
I. Payment Schedule:
Payments will be made no more frequently than monthly based upon the firm's actual hours worked.
PEEHIP requires payment terms to be payable 30 days from receipt of invoice.
J. Selection of Firm:
PEEHIP reserves the right to make no award under this RFP. PEEHIP expects to enter into a contract with the
successful proposer(s). PEEHIP also reserves the right to award all or part of required services under this RFP to
one or more proposers, and this decision will be at the sole discretion of PEEHIP. PEEHIP makes no guarantee that
the successful proposer(s) will be the exclusive provider(s) of the services during the term of any resulting contract.
All firms submitting a proposal under this RFP will be notified in writing within a reasonable length of time
following the selection. Prior to an award of contract(s), one or more proposers who submit proposals determined
to be reasonably susceptible of being selected for award may be requested to make oral presentations to the
evaluation committee; however, proposals may be accepted, and a final selection made, without such oral
presentations. All proposals shall become the property of the PEEHIP.
Internet and/or website links will not be accepted in responses as a means to supply any requirements stated within
this solicitation. Unless stated elsewhere in this solicitation, PEEHIP will accept and evaluate alternate submittals
on this RFP provided that the response meets all published requirements. PEEHIP reserves the right to waive minor
discrepancies or errors within proposals or to request clarification from a proposer to the extent allowed by law.
The failure of PEEHIP to require performance of any provision of the solicitation or resulting contract shall not
affect PEEHIP's right to require performance at any time thereafter, nor shall a waiver of any breach or default
constitute a waiver of any subsequent breach or default nor constitute a waiver of the provision itself.
K. Economy of Preparation:
Proposals should be prepared simply and economically and provide a concise description of the bidder's response
to the requirements of this RFP. Emphasis should be on clarity. PEEHIP will not be responsible for any costs
incurred by any bidder in the preparation of a proposal.
L. News Releases:
News releases pertaining to this RFP, the service, or the audits to which it relates will be made only with prior
written approval of the CEO or his representative.

M. Addenda to the RFP:
RSA may, at any time prior to the deadline for proposals, modify this RFP, including the timeline associated with
the RFP. Any modifications made to the RFP prior to the proposal's due date will be provided in writing to all
solicited vendors.
N. Contact Point:
Any questions that arise concerning this RFP may be directed to Taylor Benefield at Taylor.Benefield@rsa-al.gov.
O. Minimum Qualifications:
Proposals will be accepted from firms where both the firm and the assigned lead consultant have consulted with
and advised a self-insured health insurance plan on its HIPAA security and privacy practices, with such plan having
at least 150,000 covered lives and claims of at least $500 million annually. This experience should be for three (3)
years of the most recent five (5) years. Subcontractors and joint ventures are not approved to bid on this RFP.
The proposer shall affirmatively state and describe how it meets all of the minimum experience requirements as
noted in this Section as a part of its response to this RFP.
P. Agents:
No agents' fees will be payable by PEEHIP or successful vendor. PEEHIP will respond only to parties interested
in proposing and performing the services.
Q. STAARS Registration:
Successful proposer must be registered and subscribed in the STAARS Vendor Self Service Portal (VSS) at
https://procurement.staars.alabama.gov prior to contract award and execution of contract.
R. Exceptions.
By signing the proposal, Proposer agrees to be bound by all terms and conditions of the RFP. Any exceptions to
the specified terms and conditions must be clearly set forth within Proposer's proposal and are subject to the
acceptance of PEEHIP.
SECTION II
Information Required from Proposers
Proposals must be submitted in the format outlined below:
A. Qualifications of the Firm:
1. Business Organization:
State the full name and address of your organization, and if applicable, the branch office or other subordinate
element that will perform or assist in performing the work hereunder. Indicate whether you operate as an
individual, partnership, limited liability company, or corporation, and provide the state in which your company
was incorporated or formed. State whether you are licensed to operate in the State of Alabama.

2. Experience:
As part of the proposal, the proposer shall provide a concise narrative (not to exceed ten (10) pages) describing
the proposer's understanding of the services requested under this RFP, the qualifications and relevant
experience of the personnel who will be assigned to the engagement, and the firm's experience performing
similar services for comparable organizations. Marketing materials or general corporate background brochures
should not be included.
The narrative should emphasize experience directly applicable to providing HIPAA and HITECH compliance
audit, training, and consulting services for health plans, particularly governmental or large self-insured plans.
Proposers should also identify a contact person for large self-insured clients for whom similar services have
been performed per subparagraph "e" below.
The proposal must address the specific experience and qualifications outlined in the sections below.
a. Understanding of the Engagement
Provide a narrative demonstrating the proposer's understanding of the services requested under this RFP,
including:
* The proposer's understanding of PEEHIP's need for HIPAA and HITECH compliance support,
including audit, training, and consulting services.
* Key risks, regulatory considerations, and operational issues relevant to health plan compliance with
HIPAA and HITECH.
b. Scope and Methodology
Describe the specific services the proposer will provide, including:
* The proposed approach to conducting HIPAA privacy, security, and breach notification compliance
reviews.
* Methods for identifying compliance gaps and recommending corrective actions.
* Approach to training PEEHIP staff and Board members regarding HIPAA and HITECH requirements.
c. Personnel Assigned to the Engagement
Identify the personnel who will be assigned to this engagement and provide the following information:
* Name, title, and role of each key individual.
* Relevant professional qualifications and certifications.
* Years of experience performing HIPAA/HITECH compliance services.
* Description of relevant experience with public sector health plans or governmental entities.
* Identification of the individual who will serve as the primary engagement lead and point of contact.
d. Relevant Experience
Provide a description of the proposer's experience performing services similar to those requested in this
RFP, including:
* Experience conducting HIPAA and HITECH compliance audits or assessments.
* Experience providing training and consulting services related to HIPAA privacy, security, and breach
notification rules.
* Experience working with governmental health plans, large public employers, or health insurance
programs.
* Examples of similar engagements completed within the last five years.