1-4478 Electronic Health Record (EHR) Software Solution final.pdf

CITY OF NORWALK

PURCHASING DEPARTMENT

SEALED RFPS MUST BE RECEIVED BY THE OFFICE OF THE PURCHASING AGENT, 125 EAST AVENUE NORWALK, CT 06851

BY THE DATE AND TIME OF RFP OPENING

PROJECT NUMBER: 4478

REQUESTING DEPARTMENT: Department of Health

DATE OF RFP ISSUANCE: 12/15/2025

TITLE OF RFP:

Electronic Health Record (EHR) Software Solution

RFI/QUESTION DEADLINE: 2:00PM 12/26/2025

ELECTRONIC SUBMISSION DEADLINE: 2:00PM 01/13/2026

HARD COPY SUBMISSION DEADLINE: N/A

MANDATORY WALKTHROUGH:

DATE, TIME, AND LOCATION OF WALKTHROUGH

YES ( ) NO (X )

N/A

TIME/DATE OF RFP OPENING: 2:00 PM 01/13/2026

RFP DEPOSIT REQUIRED:

IF YES, AMOUNT REQUIRED

YES ( ) NO (X )

SUCCESSFUL BIDDERS ONLY:

PERFORMANCE & PAYMENT BOND REQUIRED:

IF YES, AMOUNT REQUIRED

YES ( ) NO (X )

SUCCESSFUL BIDDERS ONLY:

MAINTENANCE BOND REQUIRED:

YES ( ) NO ( X)

ALL TERMS AND CONDITIONS, SPECIFICATIONS AND BID FORMS ARE ATTACHED HERETO.

NOTE: THE FOLLOWING DOCUMENTS WILL BE REQUIRED FOR A BID TO BE COMPLIANT

1. BIDDER’S INFORMATION AND ACKNOWLEDGEMENT FORM

2. RFP FORMS, INCLUDING PRICING SHEETS AND ADDENDA ACKNOWLEDGMENT FORMS

3. EXCEPTIONS (IF ANY)

Page 1 of 61 4478 Electronic Health Record (EHR) Software Solution

NOTICE TO BIDDERS

1. ALL RFPS WILL BE OPENED PROMPTLY AT THE ADVERTISED TIME OF OPENING. THERE WILL BE NO DELAYS OR

POSTPONEMENTS WHICH ARE NOT PUBLICLY ADVERTISED. ANY RFP RECEIVED AFTER THE ADVERTISED TIME

OF OPENING WILL NOT BE ACCEPTED.

2. OBLIGATION OF BIDDERS:

a. AT THE TIME OF OPENING RFPS, EACH BIDDER SHALL BE PRESUMED TO HAVE INSPECTED THE SITES

AND TO HAVE MADE THEMSELVES THOROUGHLY FAMILIAR WITH THE PLANS AND CONTRACT

DOCUMENTS, INCLUDING ALL ADDENDA. THE FAILURE OR OMISSION OF ANY BIDDER TO RECEIVE OR

EXAMINE ANY FORM, INSTRUMENT OR DOCUMENT SHALL IN NO WAY RELIEVE ANY BIDDER FROM

ANY OBLIGATION IN RESPECT TO THEIR RFP.

b. EACH BIDDER MUST FULLY INFORM THEMSELVES OF THE CONDITONS RELATING TO THE WORK

WHICH WILL BE PERFORMED. FAILURE TO DO SO WILL NOT RELIEVE THE SUCCESSFUL BIDDER OF

THEIR OBLIGATION TO FURNISH ALL LABOR AND MATERIALS NECESSARY TO CARRY OUT THE

PROVISIONS OF THE CONTRACT DOCUMENTS AND TO COMPLETE THE CONTEMPLATED WORK. IN AS

MUCH AS POSSIBLE, THE CONTRACTOR MUST, IN CARRYING OUT THEIR WORK, EMPLOY SUCH MEANS

AND METHODS AS WILL NOT CAUSE ANY INTERRUPTIONS OR INTERFERENCE WITH THE WORK OF ANY

OTHER CONTRACTOR.

3. TIME IS OF THE ESSENCE (IF APPLICABLE):

a. IF THE PROJECT IS NOT COMPLETED BY THE DATE SPECIFIED AS THE SUBSTANTIAL COMPLETION DATE

IN THE CONTRACT ENTERED INTO BY THE CITY AND THE CONTRACTOR, THE CONTRACTOR WILL BE

SUBJECT TO CONSEQUENTIAL AND/OR LIQUIDATED DAMAGES.

Page 2 of 61 4478 Electronic Health Record (EHR) Software Solution

GENERAL INFORMATION

1. INTRODUCTION

The City of Norwalk for the Norwalk Health Department is issuing this Request for Proposals (RFP) to solicit proposals from qualified organizations (Proposers) who can provide an Electronic Health Record (EHR) software solution, that will allow the City to enhance clinical operations and improve the efficiency, accuracy, and quality of healthcare delivery. The requirements of this project are outlined in greater detail under Section 2 Scope of Work/Project Specifications.

2. RFP DOCUMENTS

All RFP documents for this invitation are available over the internet at http://www.norwalkct.gov. Adobe

Acrobat reader is required to view this document. If you do not have this software you may download it for free from Adobe.

3. ADDENDA

All addenda, if issued will be available over the internet at http://www.norwalkct.gov. We strongly suggest that you check for any addenda a minimum of forty-eight hours in advance of the RFP deadline. It is the responsibility of the bidder to check for issuance of any addenda.

4. BIDDER’S LIST

Bidder’s list for this solicitation will not be published.

5. QUESTIONS CONCERNING THIS RFP

All questions concerning this solicitation must be directed, via e-mail, to Chris McCauley, Purchasing Officer at cmccauley@norwalkct.gov. Please include the Project Number and Project Title in the subject line. The deadline for the submission of questions is 2:00 pm, December 26, 2025.

6. SUBMISSION OF RFP

The City of Norwalk requires electronic sealed submission for this project in the City of Norwalk’s BONFIRE portal (https://norwalkct.bonfirehub.com/portal/?tab=openOpportunities)

All sealed electronic submissions must be submitted in Bonfire no later than January 13, 2026, at 2:00PM.

7. SUMMARIES

A list of the proposing firms will be available any time after 5:00 pm on the day of the RFP opening at Purchasing-Bid Postings. RFP results will not be provided over the phone.

Page 3 of 61 4478 Electronic Health Record (EHR) Software Solution http://www.norwalkct.gov/ http://www.norwalkct.gov/ mailto:cmccauley@norwalkct.gov https://norwalkct.bonfirehub.com/portal/?tab=openOpportunities https://www.norwalkct.gov/Bids.aspx?CatID=showStatus&txtSort=Date&showAllBids=on&Status=open

SPECIAL NOTES:

1. Public Opening: Per the City of Norwalk Purchasing Guidelines, Bids shall be opened publicly by the Purchasing

Agent or his designee, in the presence of one or more witnesses at the time and place designated in the

Invitation for Bids. Receipt of Proposals: Proposals shall be opened so as to avoid disclosure of contents to competing proposers during the process of negotiation. A Register of Proposals shall be prepared in accordance with these Procurement Guidelines and shall be open for public inspection after contract award. If you wish to hear the bid/RFP opening, please join us through a teleconference.

Access Number: (866) 640-4044 or (678) 302-3554

Participant Code: 968 704

Page 4 of 61 4478 Electronic Health Record (EHR) Software Solution https://www.norwalkct.gov/DocumentCenter/View/334/City-Procurement-Guidelines?bidId=

SECTION 1 – RESPONSE FORMS

Page 5 of 61 4478 Electronic Health Record (EHR) Software Solution

PROPOSER’S INFORMATION AND ACKNOWLEDGMENT FORM

Proposer’s Name

Street Address

City State Zip

Business Telephone:

Email Address:

Printed Name and Title of Individual Submitting Proposal

The undersigned acknowledges that the terms, conditions and specifications of this RFP are understood and unconditionally accepted.

Signature Date

Page 6 of 61 4478 Electronic Health Record (EHR) Software Solution

Exceptions: Note any vendor(s) responding to this proposal shall indicate any/all exceptions (if any) taken to language in this proposal. BIDDERS MAY NOT TAKE EXCEPTION TO SUBSTANTIVE TERMS OF STANDARD

CONTRACT FORMS PROVIDED IN THE RFP/RFQ/ITB. Exceptions must be declared below in order to be considered by the City:

Page 7 of 61 4478 Electronic Health Record (EHR) Software Solution

1.1 PROPOSAL RESPONSE FORM

Vendor Name -

Address -

Phone -

Fax -

Email -

Manager -

Fed ID#

The undersigned hereby declares that they have carefully examined the plans, specifications and project sites and has satisfied themselves as to all the quantities and conditions and understands that in signing this proposal they waives all right to plead any misunderstanding regarding the same.

The undersigned further understands and agrees that they will furnish and provide all the necessary material, machinery, implements, tools, labor, services, and other items of whatever nature, and to do and perform all the work necessary under the aforesaid conditions, to carry out the contract and to accept in full compensation therefore the amount of the contract as agreed to by the Contractor and the City.

It is further understood and agreed that all information included in, attached to, or required by the Request for Proposal shall be public record upon delivery to the City.

A. PROPOSED FEES

SOFTWARE

PACKAGE

YEAR 1

Implementation and 1st Yr. of Maintenance

YEAR 2

YEAR 3

Maintenance

YEAR 4 (1st Option to renew)

Maintenance

YEAR 5 (2st Option to renew)

Maintenance

Data Conversion

Configuration

User Licenses*

Staff Training

Support and

Other Expenses**

TOTAL

Page 8 of 61 4478 Electronic Health Record (EHR) Software Solution

*User Licenses: Please indicate if the user licenses are all inclusive, the costs are based on a range of license seats, or there is scalability of “Volunteer”/Public Health Response team in response to an event. Please provide additional details in the section provided “User Licenses”.

**Use ONLY the categories listed above to show costs. If there are any additional cost categories, please include them in the “Other Expenses” and describe those expenses below.

User Licenses*

OTHER EXPENSES**

Page 9 of 61 4478 Electronic Health Record (EHR) Software Solution

B. CERTIFICATION

Submitted By: Signature:

Authorized Agent of Company (Name & Title):

Date:

C. The above signatory acknowledges receipt of the following addenda issued during the bidding period and understands that they are a part of the bidding documents (if applicable):

Addendum # Dated Addendum # Dated

Addendum #

Dated Addendum #

Dated

Page 10 of 61 4478 Electronic Health Record (EHR) Software Solution

1.2 STATEMENT OF QUALIFICATIONS

Please answer the following questions regarding your company's past performance. Failure to reply to this instruction may be regarded as justification for rejecting a bid.

1. Number of years in business:

2. Number of personnel employed: Part Time Full Time

3. List six contracts of this type/size your firm has completed within the last four years:

Project Date Contact Person Phone No.

4. SUBCONTRACTORS: If subcontractors are to be used, please list firm name, address, name of principal, and phone number below or on a separate sheet. Also indicate portion or section of work subcontractor will be performing.

COMPANY NAME ADDRESS PRINCIPAL PHONE PORTION/SECTION

OF WORK

Page 11 of 61 4478 Electronic Health Record (EHR) Software Solution

5. ORGANIZATIONAL

STRUCTURE OF

BIDDER (check which applies) general partnership limited partnership limited liability corporation limited liability partnership corporation doing business under a trade name individual doing business under a trade name other (specify)

6. STATUS OF THE

BUSINESS AND ITS

CURRENT STANDING

WITH THE SECRETARY

OF STATE'S OFFICE; e.g., are all required filings current and in good standing or has the entity been withdrawn or canceled

Connecticut corporations - Will the

Secretary of State be able to issue a

Certificate of Good Standing within 30 days of the bid opening?

Yes No

Out-of -State corporations - Do you have a valid license to do business in the State of

Connecticut? (Evidence in the form of a

Certificate of Authority from the

Connecticut Secretary of State will be required within 30 days of the bid opening.)

Yes No

7. CT eLICENSE (https://www.elicense.ct.gov ) / Business Registration (https://business.ct.gov/?language=en_US) :

8. Is your local organization an affiliate of a parent company? If so, Indicate the principal place of business of your company and the name of the agent for service if different from what has been indicated on the response form:

Business

Name

Address

City. State

& Zip

Name of

Agent

Page 12 of 61 4478 Electronic Health Record (EHR) Software Solution https://www.elicense.ct.gov/ https://business.ct.gov/?language=en_US

NOTE: In the case of a Limited Liability Corporation or a Limited Liability Partnership a certified copy of the Articles of

Organization certified as valid and in effect as of the date of the bid opening will be required within 30 days of the bid opening. A listing of the corporate officers, in the case of a corporation; the general or managing partners, in the case of a partnership; or the managers and members in the case of either a limited liability partnership or company will be required within 30 days of the bid opening.

9. Your company may be asked to submit the following information relative to your company's financial statements prior to receiving an award. This information will not be part of the public bidding record and will remain confidential.

All information should be supported with appropriate audited financials

a. Book Value (Total Assets (-) Total Liabilities)

b. Working Capital (Current Assets (-) Current Liabilities

c. Current Ratio (Current Assets/Current Liabilities)

d. Debt to Equity Ratio (Long Term Debt/Shareholder's Equity)

e. Return on Assets (Net Income/Total Assets)

f. Return on Equity (Net Income/Shareholder's Equity)

g. Return on Invested Capital (Net Income/Long Term Debt = Shareholders' Equity)

All responses to this questionnaire are understood to be proprietary to the vendor, and will be considered confidential.

Additional information may be requested subsequent to your responding to this bid request.

1.3 CITY OF NORWALK VENDOR RECORDS

If you have not done business with the City of Norwalk as a vendor, your business information needs updating or your

City of Norwalk vendor record has not been updated over three (3) years. Please complete and include the latest version of Internal Revenue Service (IRS) W-9 Form with your submission. Here is the URL to the IRS website:

https://www.irs.gov/forms-pubs/about-form-w-9

1.4 INSURANCE

Insurance Agency Name: Tel:

Agency Address: Email:

Page 13 of 61 4478 Electronic Health Record (EHR) Software Solution https://www.irs.gov/forms-pubs/about-form-w-9

1.5 CITY OF NORWALK VENDOR QUESTIONNAIRE – IT INFORMATION SECURITY

Page 14 of 61 4478 Electronic Health Record (EHR) Software Solution

City of Norwalk Vendor Questionnaire

IT Information Security

Rev 8.4.22

1. Third-Party Contact Information (please provide the POC for follow-up questions to this questionnaire):

Vendor Name, Address, Point-of-Contact Name, Phone Number and Email

2. Description of Services/Products: Please provide a detailed description of services/products your organization aims to provide to the City?

3. System and Equipment Access: Will your organization use your own systems and equipment to perform the services, or will your organization need access to the City’s systems, equipment and network? (Yes or

No, If Yes, please explain)

YES ☐ NO ☐

4. Description of Data: Are you using data from the City in order provide the services/product to the City

(Yes or No, if Yes proceed to 3.1)

a. What data is needed to provide the services/products to the City?

Example: Name, Social Security Number, Trade Information, Source Code, Payroll or Accounts Payable data, student or patient data, Law Enforcement data, any Personally Identifiable Information (PII), etc.

Page 15 of 61 4478 Electronic Health Record (EHR) Software Solution

If your answers to Questions 3 and 4 are BOTH “NO”, thank you for completing the IT

Information Security Questionnaire.

If one or both questions are “YES”, please complete the remaining questions.

5. Office Locations: How many office locations does your organization have? Please include the locations of your organization.

6. Data Center Locations: How many data centers does your organization utilize to provide services/products to the City? Please include the locations of the data centers utilized by your organization.

7. Business Entity: What is your business entity type?

*Example: Sole Proprietorship, Partnership, C Corporation, S Corporation, Limited Liability Corporation (LLC), Limited Liability Partnership (LLP)

8. How many employees and contingent workers do you have in your organization?

1-10 ☐ 10-50 ☐ 50-100 ☐ 100-500 ☐ 500-1000 ☐ 1000 or more ☐

9. Physical Access: Does your organization need to be onsite or offsite to provide services/products to the City?

Page 16 of 61 4478 Electronic Health Record (EHR) Software Solution

10. Access to Data: How is your organization accessing City data?

*Example: Is the data supposed to be sent to your organization via email or will the data need to be uploaded to an application?

*Note: For third-parties that are providing an application to perform the services, please specify whether the application will be an internally hosted solution, cloud-based solution (i.e. SaaS, IaaS, PaaS), or a traditional web-based application (i.e. eBay, WebEx, online banking application)

11. Data Storage: Does your organization outsource data storage or does your organization utilize its own databases to store data? Does your organization store data outside of the United States?

YES ☐ NO ☐

12. Segregation of Data: Does your organization’s database structure allow segregation of sensitive client data?

YES ☐ NO ☐

13. Independent Attestations: Does your organization have independent attestations such as (i.e. ISO 27001, SSAE-18 SOC-1, SOC-2, PCI- DSS, ISO 9001)?

Page 17 of 61 4478 Electronic Health Record (EHR) Software Solution

14. Information Security

a. Does your organization have written information security policies and procedures (WISP)?

b. How often are the information security policies and procedures reviewed and updated?

c. Who in the organization is responsible for reviewing and updating the information security policies and procedures?

d. Does your organization have privacy policies and procedures?

e. How often are the privacy policies and procedures updated?

f. Who in the organization is responsible for reviewing and updating the privacy policies and

g. What methods of encryption are utilized for data at rest and in transit?

Page 18 of 61 4478 Electronic Health Record (EHR) Software Solution

h. Are the encryption methods utilized FIPS 140-2 approved?

i. Does your organization utilize firewalls to filter incoming data and information from the internet into your company network?

j. Does your organization perform penetration testing at least once per year to determine if unauthorized access to the computer network and malicious activity is possible externally?

k. Does your organization perform vulnerability testing at least once per year in order to identify vulnerabilities within the internal network?

l. Does your organization perform background checks on employees and contingent workers prior to onboarding them? Describe the nature of these background checks (i.e., criminal, credit, international, etc.).

Page 19 of 61 4478 Electronic Health Record (EHR) Software Solution

m. Does your organization utilize multi-factor authentication?

n. Does your organization utilize scan cards or biometric scans to grant employees and contingent workers access to the building and data centers where data is stored?

o. If offering a technology product, does the organization utilize software development life cycle (SDLC) or

Agile to build and maintain technological product?

p. Does the technological product undergo information security testing and quality assurance testing prior to deployment?

q. Does the Vendor provide annual Cybersecurity Awareness training to their employee?

Page 20 of 61 4478 Electronic Health Record (EHR) Software Solution

r. Does the Vendor provide annual phishing simulations for their employee?

s. Have users been educated on how to report suspected security violations or vulnerabilities?

t. Does the Vendor have an employee identified as the Chief Information Security Officer?

u. Are all the Vendor laptops encrypted?

v. Are all Vendor computers (workstations, notebooks) required to join the Company’s domain and receive Group Policies?

w. Does the Vendor meet the NIST 800-63 password guidelines?

Page 21 of 61 4478 Electronic Health Record (EHR) Software Solution

15. Risk Management

a. Does your organization have an enterprise risk management framework implemented at your organization?

b. Does your organization have documented enterprise risk management policies and procedures?

c. Who in the organization is responsible for reviewing the enterprise risk management policies and

d. Does your organization utilize an outside third-party to provide services/products to the client?

e. Does your organization have a third-party risk management program (TPRM)?

Page 22 of 61 4478 Electronic Health Record (EHR) Software Solution

f. Does your organization include right-to audit clauses in contracts with third parties?

g. Does your organization have a certificate of insurance (COI)? Please attach a copy of your COI.

Business Continuity/Disaster Recovery

a. Does your organization have a business continuity plan?

b. How often is the business continuity plan updated?

c. Does your organization conduct business continuity tests once per year?

Page 23 of 61 4478 Electronic Health Record (EHR) Software Solution

d. Does your organization have a disaster recovery plan?

e. How often is the disaster recovery plan updated?

f. Does your organization conduct disaster recovery tests once per year?

g. Does your organization have business continuity and/or disaster recovery sites?

h. Are the business continuity/disaster recovery sites located in the United States or outside the

United States? Please include the locations of business continuity/disaster recovery sites?

Page 24 of 61 4478 Electronic Health Record (EHR) Software Solution

SECTION 2 – SCOPE OF WORK / PROJECT SPECIFICATIONS

Page 25 of 61 4478 Electronic Health Record (EHR) Software Solution

2.1 Introduction

The City of Norwalk for the Norwalk Health Department is issuing this Request for Proposals (RFP) to solicit proposals from qualified organizations (Proposers) who can provide an Electronic Health Record (EHR) software solution, that will allow the City to enhance clinical operations and improve the efficiency, accuracy, and quality of healthcare delivery. Key features required in the EHR system include enhanced security, data-driven insights, regulatory compliance and reporting, and improved patient care.

The purpose of this RFP is to select the most qualified, feasible, flexible, and cost-effective Proposer. The City invites proposals from firms that have experience in providing these products and services to municipal public health organizations of similar size and scope. The timeline for the project is for the successful Firm to fully implement the selected system within Nine (9) months after contract execution.

2.2 Background

The City of Norwalk Health Department works to promote and protect the public's health through a vast array of programs. The Health Department with a staff of 37 employees is organized into six divisions (Administration &

Operations, Community Health, Emergency Preparedness, Environmental Health, Epidemiology & Informatics, and

Preventable Diseases/Clinical Services) and the Office of the Director. The software application is primarily intended to support the Preventable Diseases clinical programs, which include immunizations for children, adults, and travelers, large scale community vaccine clinics, sexual health services, and tuberculosis control activities.

For an understanding of system and program size, scope, activity, and growth, below are some statistics from the current City of Norwalk’s Health Department Electronic Health Record based on fiscal year 2024:

• At least #25 users (#5 Administration staff, #5 Clinical staff, #2 Epi staff, #6 Data Entry Profiles, #1 DOH, #2 Med

Director, #4 Comm Health)

• User tiers/hierarchy to control access to data (i.e. ability to restrict by user profile access to certain information)

• Approximately #2137 patient records;

• Approximately #2302 visits;

• Approximately #80,975 other system entries (services detail)

The Health Department intends to convert the current Electronic Health Record database into a single EHR software solution. For migration and data sizing purposes, the current system contains the following Database statistics. The

Record numbers and Storage figures below are approximate:

• Appropriate data storage and capacity for continued use for foreseeable future: Current usage is 3GB which includes all data and attached documents; the current system is set up for 128GB which can be expanded as needed.

• 56,919 Patient Records (represents current total)

• Other Supporting Documents (Attachments) including pdf, jpg, doc and xls formats

2.3 Scope of Services

The information below summarizes the minimum required functional capabilities and parameters in the selected software. All such functionality modules must be included with the system at no additional cost to the City of Norwalk.

Page 26 of 61 4478 Electronic Health Record (EHR) Software Solution

The desired software must be HIPAA (Health Information Portability & Accountability Act) compliant and should run without the development of custom programming, or third party developed software, while achieving all required functions.

The system should have the flexibility to provide an unlimited number of employee user licenses for use of the software at any given time.

The City desires access to a sandbox/demo environment to further enhance the City’s understanding of the software’s environment and capabilities.

The proposed EHR software solution shall, at a minimum, include the following:

General Scope (including Clinical Requirements)

• Dedicated project manager.

• Seamless data migration (conversion) of existing Electronic Health Record data to new system.

• Implementation, testing, and ongoing remote and/or onsite training services of the new system and updates.

o Electronic health record (on-line appointment scheduling and management, on-line registration, on-line or tablet/kiosk registration, risk assessment, document signing, record merging capabilities) o Track the time patients spend waiting for service, receiving service and checking out.

• Automated functionality of capturing all health record data input from various forms and methods meeting at a minimum all current and future state requirements.

• Provide clinicians the ability to review previous encounters, record current patient encounter information using drop down menus and/or templates for frequently occurring services and record signatures on a portable device preferably a tablet computer.

• Ability to create clinical templates.

• Automated functionality to store and retrieve data via queries, reporting and ad hoc requests on locally (in office) connected or remotely (field) unconnected devices.

• Automated management and administration functionally for defining of staff assignments, scheduling and prioritization, reporting, and tracking of activities, time reporting, billing and collection capabilities.

o Master calendar and daily schedules, automatically shared with appropriate staff o Time tracking and management (including clinical and support staff spend in each program area) o Work queues, task functions for office staff and medical staff to assign next steps and automatically pass it on to the next person responsible for next steps

• Clinical reports and/or dashboard generation (various types and formats such as Excel, Word, pdf, csv, charts, tables, etc.)

• Inventory management:

o Barcode scanning for data entry o Medication and vaccine tracking

Page 27 of 61 4478 Electronic Health Record (EHR) Software Solution o Collection of patient information/identification o Logging inventory and alerts o Automatically update inventory as information is entered into the medical record during patient

• Laboratory ordering and results management (internal and external) o Specimen label printing

• E-prescribing capabilities

• Prescription, medication, and laboratory testing tracking and status updates

• Communication:

o Electronic faxing o Telehealth integration o Mass texting and email capabilities with ability to automatically send out emails and SMS messages to targeted groups.

o Automatically produce and send outbound appointment reminders via telephone call, email, fax, letters, or postcards o Secure system internal messaging o Patient portal; secure bidirectional messaging between provider and patient o Secure referral functionality

• Ability to attach, collect, and store documents and photographs

• Mobility to accommodate large scale programs (for testing, administration of vaccines, or distribution of medications)

• For mass immunization and/or countermeasure distribution, a paperless system to register patients, record informed consent for treatment, document care provided in the encounter(s) and bill for payment of services.

• Investigation and surveillance capabilities

• Variety of modules from which to choose

• Auto-populate, update, and print vaccine information sheets (VIS) and care instructions report in English, Spanish and preferably other languages.

• Ability to compartmentalize data for differing public health uses/functions (i.e. non-clinical).

• Ability to customize demographics – categories of data, ability to respond to drop-down or open-ended.

• Automated system functionality for security rights, scheduling of batch jobs, host and remote data transmissions, and flexibility for integration to State.

• Hosting Services Service Level Agreement to include Help desk, customer support, data storage, data backup, disaster recovery, software upgrades, notification updates, training updates and user group meetings.

encounters

Page 28 of 61 4478 Electronic Health Record (EHR) Software Solution o Efficient system of managing identified system issues o Communication Tracking System between users and software team (e.g., ticketing system)

• Provide data replication/back-up to facilitate internal ad hoc reporting.

• On-going and responsive technical support.

• Secure patient portal for identification and documentation requirements, medical and immunization records, visit details, communications, insurance, billing, invoicing, payments, verification, and pre- and post-appointment activities/requirements.

o Ability to easily register or book securely in person and online through a cloud base web portal accessible through a computer, tablet, mobile phone and/or mobile phone app.

o Portal should include ability for patients to contact the office, ask provider questions or request updates or medications, and vice versa, and capabilities for office staff to reach patient and confirm patients electronically as well.

Additional Software Functional Requirements

• Software system should be up to date with changing technology trends and cybersecurity protocols.

• Automation to improve operational efficiency and functioning.

• Automated system for password and log in retrieval and update.

• Electronic signature pad and abilities to sign HIPAA and financial responsibility forms and any other forms.

• Any changes in the system are live and viewable both internally and online.

• User-friendly search function.

• Software has online built-in waiver functionality with acceptance recorded as an electronic signature.

• Registration page is designed to visually match City of Norwalk’s department website.

• Ability to upload required documents (one or many) as it pertains to the Health Department activity by staff member and/or customer.

• Easy to use email functionality.

• User alerts.

• Ability to dump raw data from the system to an Excel file and have canned and custom reporting capabilities.

• Ability to communicate with other healthcare EHRs via standardized protocols (e.g., HL7, FHIR,

• Optional: API to pull data into other secure environment

• Interoperability with State registries, HIEs, etc.

o Actively share data via Connecticut’s Health Information Exchange (“Connie”) o Actively share data via the Connecticut Immunization Information System (“CT WiZ”)

Page 29 of 61 4478 Electronic Health Record (EHR) Software Solution

Payment Processing Requirements

• Insurance:

o Insurance verification (real-time) and automated insurance and payment eligibility checks at appointment scheduling o Ability to add insurances and payers based on patient insurance cards (including unique claims addresses, phone numbers, etc.)

o Access to Electronic Remittance Advice o Batch and individual claim submission capabilities o Compliance with billing and medical coding (ICD-10, CPT, HCPCS, etc.)

o Manual posting capability o Primary, secondary, tertiary insurance details and submission capability.

o Medicare D capability (in place of TransactRX)

• Medical billing clearinghouse

• Patient payment processing:

o Process all payment types and generate end of day reports o Patient Cost Estimation, especially for out-of-pocket expenses o Electronic invoicing o Easy payment and status tracking o Ability to integrate credit card processing for all payments. Prefer integration with Clover.

o Recurring billing and streamline automatic payments o Generation of clear, timely statements o Payment plan setup options o Patient portal access to balances, billing history, and payments o Produce payment receipts with necessary information to allow patients to submit to insurance for reimbursement

• Register for clinical services on-line along with the ability to pay with credit or with debit cards.

• Notes or flags for billing follow-up

• Accurate, real-time capture of services rendered

• Integration with clinical notes to generate billable codes

• Encounter-based charge entry

Page 30 of 61 4478 Electronic Health Record (EHR) Software Solution

• Must work with cash drawers, barcode readers, receipt printers and credit card readers.

• Ability to have variety of payment tiers, such as a discount payment code, early registration pricing, pricing based on age brackets, group discounts, or late registration fees.

• Accepts multiple payment types (cash, check, debit, credit, gift certificates, ACH, and other payment services

[PayPal, Venmo, Cash App, etc.]) in person and online.

• Ability to combine payment types for a single transaction.

• Ability to refund customers from software directly including credit cards.

• Ability to add peripherals including cash drawer and receipt printers.

• All online transactions meet all PCI compliance standards.

• Automatic billing retries failed transactions.

• Automatic billing communicates failed payments to customers and staff.

• Electronic billing and or paper roster billings as required by Medicare, Medicaid and or other payers. Both are required (not either or).

Accounting/Finance Requirements

• System must be able to interface with other software such as Tyler Technologies-MUNIS or other third parties.

• Reporting functions can be easily used for financial accounting for the Comptroller’s team.

• Software will produce branded customer invoices and/or statements.

• Software allows for printing, emailing and database access to receipts.

• Automatic recurring payments (payment plans).

• Software accommodates refunds, credits, and surcharges.

• Accounts Receivable/aging reports

• Reconciliation reports/dashboards

• Claims status tracking and reports

• Reimbursement trends by payer

• Denial analysis and appeal tracking

IT Vendor Security

The selected vendor must demonstrate a robust and proactive approach to cybersecurity to protect sensitive health data. The proposed Electonic Health Record solution must comply with industry best practices, federal and state regulatory requirements, and municipal IT security standards. The following requirements are mandatory:

Page 31 of 61 4478 Electronic Health Record (EHR) Software Solution

Data Encryption

• All data in transit must be encrypted using TLS 1.2 or higher.

• All data at rest must be encrypted using AES-256 or stronger.

• Encryption must use FIPS 140-2 validated cryptographic modules.

• Vendor must provide details on key management processes and whether customer-managed keys (CMK) are supported.

Access Control

• The system must provide role-based access control (RBAC), with granular and customizable permissions.

• RBAC must integrate with the City’s Microsoft Azure Active Directory (AAD) for centralized identity governance and provisioning.

• Support for SCIM or equivalent automated user provisioning/de-provisioning is required.

• All access changes must be logged and auditable.

Authentication

• The system must enforce multi-factor authentication (MFA) for all administrative and privileged accounts, as well as for end users accessing PHI.

• Strong password policies must be enforced: minimum 12 characters, complexity rules, and lockout thresholds.

• Password expiration should follow NIST SP 800-63B guidance (expiration only when compromise is suspected, not arbitrary cycles).

Single Sign-On (SSO) Integration

• The solution must integrate seamlessly with the City’s Microsoft Office 365 / Azure AD SSO service.

• SSO must support SAML 2.0 or OIDC for secure authentication.

Audit Trail

• The system must maintain an immutable and tamper-evident audit trail of all user and administrative activities.

• Audit logs must include logins, data access, modifications, and configuration changes.

• Logs must be retained for a minimum of 7 years or as required by law.

• The vendor must support export of logs to the City’s SIEM (Microsoft Sentinel, Splunk, etc.) in real time.

Page 32 of 61 4478 Electronic Health Record (EHR) Software Solution

Regular Security Updates

• Vendor must provide security patches within 30 days of release, or sooner for critical vulnerabilities (CVSS score

≥ 7.0).

• Updates must be delivered without disruption to system availability or compromise of data integrity.

• Vendor must maintain a published patch and vulnerability management policy.

Incident Response

• Vendor must maintain a documented incident response plan, including detection, containment, recovery, and root-cause analysis.

• Vendor must notify the City of Norwalk IT Department of any confirmed security breach within 24 hours.

• Vendor must cooperate fully with City IT and Public Safety during investigations and provide incident reports within 10 business days of closure.

Compliance Standards

• The solution must comply with:

• HIPAA and HITECH for PHI protection.

• SOC 2 Type II certification (required annually).

• HITRUST CSF certification (preferred).

• FIPS 140-2 standards for cryptography.

• If hosted in a cloud environment, the cloud provider must maintain FedRAMP Moderate or equivalent certification.

Third-Party Security Assessments

• Vendor must undergo at least annual third-party penetration testing and vulnerability assessments.

• Results and remediation status must be made available to the City upon request.

• Vendor must provide a copy of their most recent SOC 2 Type II or HITRUST certification report with the proposal.

Data Backup and Recovery

• Vendor must implement daily backups of all City data.

• Backups must be encrypted, geographically redundant, and stored in immutable storage (protected from modification/deletion).

Page 33 of 61 4478 Electronic Health Record (EHR) Software Solution

• Vendor must perform and document quarterly recovery testing.

• The solution must meet the following minimum targets:

• RPO (Recovery Point Objective): ≤ 24 hours

• RTO (Recovery Time Objective): ≤ 4 hours

Business Associate Agreement (BAA)

• The vendor must execute and maintain a Business Associate Agreement (BAA) with the City of Norwalk in compliance with HIPAA and HITECH.

• The BAA must cover vendor staff, subcontractors, and any third-party hosting providers.

• The BAA must define responsibilities for safeguarding PHI, incident notification, right-to-audit, and subcontractor compliance.

• A sample vendor BAA is encouraged to be supplied with the proposal.

Minimum Qualifications

• Respondent must demonstrate adequate experience in the following areas: qualification, general experience and technical competence of the project team

• Experience, resources and technical expertise with similar type/size project with similar partners (e.g., local government partners)

• Feedback from References with projects similar in size and scope.

2.4 Proposal Submission Format

Proposals should put forth full, accurate, and complete but concise information as required by this request. The City shall not be liable for costs incurred in the preparation of the response to this RFP or in connection with any presentation before a Selection Committee.

Firms should create their submissions in 8½” x 11” document size using a minimum 12-point font size, double sided, include page numbers and any blank pages must be watermarked “Intentionally Left Blank”. Proposals should be prepared simply and economically, providing a straightforward, concise description of the applicant's ability to meet the requirements of the RFP. Emphasis should be on completeness and clarity of content.

The City reserves the right to reject proposals/parts thereof or to solicit new proposal and award contracts as it deems tin its best interest. All proposals will remain property of the City. It is further understood and agreed that all information included in, attached to, or required by the Request for Proposal shall be public record upon delivery to the

City.

To enable the City to compare the proposals received we ask that your proposal include the information specified below, the sequence listed, with each section of your proposal numbered to correspond to the numbers sequenced below.

Page 34 of 61 4478 Electronic Health Record (EHR) Software Solution

Proposal to Include (at minimum):

1. Detailed project plan and methodology - work plan outlining the approach for implementation, including specific techniques, and project control mechanisms

2. Explanation of how requirements will be fulfilled - a section-by-section description of how the proposal meets the specific requirements listed in the RFP, covering clinical, software, payment processing, accounting/finance, and technical requirements

3. Training and support - details on end-user training programs, ongoing user support options, and contingency plans for system issues

4. Data migration - explanation of how vendor will support data migration into the new system

5. Cost breakdown - including initial implementation, licensing, training, ongoing support, and maintenance fees

6. Vendor qualifications

a. summary of vendor describing qualification, general experience and technical competence of the project team

b. proof of license to operate in CT (as needed/required)

c. years of business operating and software operational

d. experience, resources and technical expertise with similar type/size project with similar partners (e.g., local government partners)

e. prior or current implementations in CT at other municipalities, clinics, healthcare orgs, etc.

f. feedback from References with projects similar in size & scope; and

g. qualifications such as a SBE, DBE, MBE, WBE.

7. Proposed timeline - including selection steps, implementation phases, and final project completion dates

8. Assurance of legal compliance, including features that support HIPAA and other relevant regulations

9. Ability to customize - clearly state whether the solution is customizable or standard and how it will be best tailored to our needs

10. Integration - explain how the new EHR can integrate with third-party systems

Request for Proposal (RFP) shall include the following, in this order:

1. Section 1-Executive Summary: Provide a brief history of your firm, company structure, and identify key qualities or services provided that distinguishes your firm from other firms. This section shall include a concise statement of the consultant's approach to the project and a summary of the Consultant's ability to provide the required services. Also include in this section include the Name and address of firm(s) and identification and contact information of the Project Lead.

2. Section 2-Project Team Organization and Staffing: Identification of Project Manager and all other team members

– as well as any subcontractors to this project – and assigned duties, including a percentage breakdown of personnel hours and associated costs.

The City reserves the right to interview and specify key staff members on this project.

3. Section 3-Project Approach: A clear description of how your firm would complete this project, including scope and methodology. This section shall also include the following:

Page 35 of 61 4478 Electronic Health Record (EHR) Software Solution

- A detailed Work Plan Schedule, including estimated completion times for each milestone, allocated staff time per phase, and an overall timeframe for completion of project.

4. Section 4-References/Statement of Qualifications: Provide four (4) most recent current or previous government clients in which your firm provides the same size and scope of services requested by the City. Highlight how it’s directly related to City of Norwalk. The City, at its discretion may check references in order to determine the Offeror’s experience and ability to provide services described in the Scope of Work. All client reference information must be documented and verifiable. Reference contacts must be aware that they are being used as a reference and agreeable to City interview for follow up. References shall include the following, in this order:

a. Client/Agency Name

b. Contact Name and Title (project manager role preferred), Telephone, and Email

c. Number of Projects Completed for Client/Agency

d. Project Names

e. Project Descriptions

f. Project Approach and Methodology

g. Year of Project and Length of Project

h. Project Budgets and Final Invoiced Amount

i. Contractor Personnel Assigned to Project and Project Role

5. Section 5-Other Information: Provide any other information that you believe will assist the City of Norwalk in making its selection. Such information may be in this section of your proposal

6. Section 6-Forms: Fully Completed Section 1 – Response Forms

2.5 Selection Process

Proposals will be initially reviewed by a Selection Committee. The Selection Committee may select the two or three firms that best meet the City’s requirements. These firms will then be invited to represent their proposals to and respond to questions from the Selection Committee.

Following this selection process, the Selection Committee will make a recommendation to the Common

Council Committee. Approval to enter into a contract has to be authorized by the Norwalk Common Council.

The City of Norwalk reserves the right to reject any and all proposals submitted, to request additional information from all proposers and to negotiate with one or more of the finalists regarding the terms of this engagement. The City of Norwalk also reserves the right to retain the proposals, use any ideas contained in the proposals and is not obligated in any manner to reimburse the proposers for the costs incurred in connection with responding to this Request for Proposals.

The Selection Committee intends to recommend the firm that, in its opinion, best meets the City’s needs, not necessarily the firm with the lowest fees.

The anticipated selection schedule is as follows:

RFP Interviews January 2026

Common Council Committee Review January/February 2026

Common Council Review February 2026

Page 36 of 61 4478 Electronic Health Record (EHR) Software Solution

2.6 Criteria for Evaluating Proposal Submissions

The City of Norwalk shall be responsible for reviewing the proposals received and will further evaluate them, using the following criteria. The City reserves its rights to examine any other criteria and take the same under consideration and to reject any firm or proposals despite its compliance with these criteria if it determines that to do so would be in its best interests.

Criteria Weight

Qualifications and Experience:

• Respondent must demonstrate adequate experience in the following areas:

qualification, general experience and technical competence of the project team

• Licensed to operate in CT (as needed/required)

• Years of business operating and software operational

• Experience, resources and technical expertise with similar type/size project with similar partners (e.g., local government partners)

• Prior or current implementations in CT at other municipalities, clinics, healthcare orgs, etc.

• Feedback from References with projects similar in size & scope

• Customer Service/Support

15%

Overall Impression of Proposal

• Organization, clarity, conciseness, and thoroughness.

• Approach to the scope of services and statement of works

• Proposed project schedule and management

• Interview/Presentation

• Communication (clarity, timeliness, efficiency)

• Demonstration

15%

Software Functionality, Technical Capability, and Suitability

• Core functionality, system architecture, and configurability

• Interoperability (w/ limited or multiple options for 3rd-party services)

• Compatibility (mobile, computer, etc.)

• Scalability/Future Development and Support

• User Experience/Friendliness

• Security/HIPAA-compliance

30%

Cost Schedule/Model and Additional Expenses:

• Cost proposal should include any payment schedule setting forth the frequency and amount of progress payments and identifying the tasks and deliverables (“milestones”) to be completed for each payment to be deemed earned.

• Historical Data Migration and Clean-up

• Digitization and Building of Existing Records/Data/Forms

• Modules or Additional Components/Features

• Estimates of 3rd-Party Services/Integrations (Insurance clearinghouses, billing, and other services)

• Training of Staff (Limited or As Needed)

• Maintenance Fees

• Training

30%

Additional Considerations (applicable only when not in conflict with state or federal guidelines)

• Longevity of Support/Sustainability

10%

Total Possible Points 100%

Page 37 of 61 4478 Electronic Health Record (EHR) Software Solution

2.7 Prime Proposer Responsibility

Firm’s submitting proposals to this RFP may utilize the services of subcontractors. If subcontractors are planned to be used, this should be clearly explained in the proposal. The prime proposer will be responsible for the entire contract performance whether or not subcontractor is to perform.

All corporate information required in this RFP must be included for each proposed subcontractor. The proposal must also include copies of any agreements to be executed between the prime proposer and any subcontractors in the event of contract award. Under this RFP, the City of Norwalk retains the right to approve all subcontractors.

2.8 Key Personnel

The personnel and commitments identified on any proposer’s proposal will be considered essential to the work to be performed under this RFP. Prior to diverting any of the specified individuals to other programs or changing the level of effort of the specified individuals, the proposer must notify the City of Norwalk fourteen (14) days in advance and will be required to submit justification, including proposed substitutions, in sufficient detail, to permit evaluation of the impact on the project. The proposer will make no deviation without the prior written consent of the City of Norwalk.

Replacement of personnel will be with personnel or equal ability and qualifications.

Any employee of the proposer, who in the sole opinion of the City…