4618-20261013152026 HATTIESBURG CLINIC.pdf

Hattiesburg Clinic RFP No. [HC-RTG-2026-IRE] — Scope of Work

Request for Proposals Scope of Work

EHR Isolated Recovery Environment (IRE) Service Hattiesburg Clinic, P.A. | 415 South 28th Avenue, Hattiesburg, MS 39401 | RFP No. [HC-RTG-2026-IRE]

Key Item Detail Issuing organization Hattiesburg Clinic, P.A. (the “Clinic”)

RFP posted October 12, 2026

Proposals due [Month DD, 2026], [time] CT

Point of contact Jerry Robinson, Director of Information Systems — Jerry.Robinson@hattiesburgclinic.com

Submission method Email to: Jerry Robinson

1. Background Hattiesburg Clinic is a multi-specialty physician practice headquartered in Hattiesburg, Mississippi, serving patients across more than 60 locations, including rural clinic sites throughout South Mississippi. The Clinic’s Epic electronic health record (EHR) is its most critical clinical and business system.

Ransomware and other destructive cyberattacks increasingly target backup systems and administrative credentials to prevent recovery. The Clinic is seeking a hosted, subscription-based Isolated Recovery Environment (IRE) service so that a clean, verified copy of the EHR environment can be restored even if the production environment, its backups, and its identity systems are compromised.

This project is funded in whole or in part with federal funds through the Mississippi Rural Health Transformation Program (MS RHTP). See Section 10 for applicable federal requirements.

2. Objectives

• Maintain immutable, logically isolated copies of the Clinic’s EHR environment that cannot be altered or deleted by an attacker who has gained administrative access to the Clinic’s production network.

• Provide an identity and management plane that is fully separate from the Clinic’s production Active Directory and Microsoft 365 identities.

• Provide a clean-room recovery environment in which restored systems can be scanned and validated before being returned to production.

• Reduce the time required to restore EHR operations after a destructive cyber event, and demonstrate that capability through regular testing.

3. Current Environment Detailed technical information (server counts, database sizes, change rates, network topology and existing backup tools) will be provided to interested bidders upon execution of the Clinic’s non-disclosure agreement. Summary information for sizing purposes:

4. Scope of Services The bidder shall provide all services, software, hosting, storage, and labor necessary to deliver a fully operational IRE service meeting the following requirements. Items marked (M) are mandatory; items marked (D) are desired and will be considered in evaluation.

4.1 Hosted Isolated Recovery Environment

• (M) Hosted in a vendor-operated or cloud facility located in the United States, physically and logically separate from the Clinic’s data centers.

• (M) Network isolation (logical air gap) between the Clinic’s production environment and the IRE, with no persistent administrative path from production into the vault.

• (M) Ability to recover the Clinic’s EHR environment, including database and supporting application servers, into an isolated clean-room environment.

• (D) Ability to run critical EHR functions in the IRE for a limited period while production is being rebuilt.

4.2 Immutable Storage

• (M) Immutable (WORM or equivalent) retention of protected copies that cannot be modified, encrypted, or deleted before expiration, including by Clinic or vendor administrators.

• (M) Configurable retention; minimum of [30] days of recovery points.

• (M) Encryption of data in transit and at rest (AES-256 or equivalent; FIPS 140-2/140-3 validated modules preferred).

• (D) Automated anomaly / ransomware detection on protected data.

4.3 Dedicated Identity and Management Plane

• (M) IRE administration uses identities that are separate from the Clinic’s production

Active Directory and Microsoft 365 tenant.

• (M) Phishing-resistant multi-factor authentication for all administrative access.

• (M) Multi-person authorization (or equivalent) required for destructive actions such as retention changes or data deletion.

• (M) Role-based access control and full audit logging of administrative actions, available to the Clinic on request.

4.4 Clean-Room Recovery and Validation

• (M) Ability to scan restored systems for malware and indicators of compromise before they are released back to production.

• (M) Documented, repeatable recovery runbooks for the EHR environment.

• (M) Stated recovery point objective (RPO) and recovery time objective (RTO) for the in-scope environment. Bidders shall state the RPO/RTO they will commit to.

4.5 Implementation

• (M) Project management, design, installation, configuration and integration with the

Clinic’s environment.

• (M) Initial seeding of protected data and verification of successful copies.

• (M) An initial full recovery test, witnessed by the Clinic, completed before final acceptance.

• (M) As-built documentation, runbooks and knowledge transfer / training for Clinic IS staff.

4.6 Ongoing Service, Testing and Support

• (M) 24x7x365 monitoring of the IRE service and support for recovery events.

• (M) Recovery testing at least [twice] per year, with written test results provided to the

Clinic.

• (M) Defined service levels (availability, support response times and incident notification), with remedies for failure to meet them.

• (M) Named point of contact / account manager for the term of the agreement.

5. Security, Privacy and Compliance

• (M) The awarded vendor will create, receive, maintain or transmit protected health information (PHI) and must execute the Clinic’s HIPAA Business Associate Agreement (BAA) before any access to Clinic data.

• (M) All Clinic data and backups must remain within the United States.

• (M) Provide a current SOC 2 Type II report (or equivalent independent assessment such as HITRUST or ISO 27001) for the hosting and service environment.

• (M) Notify the Clinic of any security incident affecting Clinic data within the time period required by the BAA.

• (M) Upon termination, return Clinic data in a usable format and certify secure destruction of all remaining copies.

6. Term The initial term is twelve (12) months from service acceptance. Bidders shall also price two (2) optional twelve-month renewal years on the Pricing Form. The Clinic is under no obligation to exercise renewal years, and renewal is subject to funding availability.

7. Deliverables and Acceptance # Deliverable Acceptance Criteria

1 Project plan and implementation schedule Approved by Clinic project lead

2 Solution design / architecture document Approved by Clinic project lead

3 IRE service provisioned; initial data seeded Successful, verified copies of all in-scope workloads

4 Initial full recovery test EHR environment recovered and validated in clean room; results documented

5 Runbooks, as-built documentation, training Delivered and reviewed with Clinic IS staff

6 Service acceptance Written acceptance by the Clinic;

subscription term begins

8. Proposal Requirements

Proposals must include the following, in this order. Proposals that omit required items may be deemed non-responsive.

1. Cover letter signed by an individual authorized to bind the bidder, including legal company name, address, primary contact, and Unique Entity ID (UEI).

2. Company overview and experience, including at least three (3) references from healthcare organizations, preferably Epic customers, for which the bidder provides a comparable service.

3. Technical response addressing each requirement in Sections 4 and 5 in order, stating for each whether it is met, partially met, or not met, with explanation.

4. Implementation plan and timeline, including staffing and Clinic resource expectations.

5. Proposed RPO/RTO and service level commitments.

6. Completed Pricing Form (Attachment B). Pricing must be submitted on the Clinic’s form; supplemental vendor quotes may be attached.

7. Signed and notarized Non-Collusion Affidavit (Attachment A).

8. SOC 2 Type II report (or equivalent), which may be provided under NDA.

9. Sample contract / service agreement and sample BAA (if bidder proposes its own terms for consideration).

9. Evaluation and Award Proposals will be evaluated by a Clinic evaluation committee using the following criteria. The Clinic intends to award to the responsible bidder whose proposal is most advantageous to the Clinic, with price and other factors considered.

Criterion Weight Technical solution — compliance with mandatory and desired requirements

40%

Cost (Year 1 and optional renewal years) 30%

Vendor experience, healthcare / Epic references 20%

Implementation approach and timeline 10%

Total 100%

Failure to meet any mandatory (M) requirement may result in disqualification. The Clinic may request clarifications, presentations or demonstrations from bidders, and may negotiate with the highest-ranked bidder(s). The Clinic reserves the right to reject any or all proposals, to waive informalities, and to cancel this solicitation at any time.

10. Federal Funding Requirements Because this procurement is funded with federal funds through the MS RHTP, the following apply to the awarded vendor and will be incorporated into the resulting contract:

• Applicable provisions of 2 CFR Part 200, including 2 CFR 200.327 and Appendix II (contract provisions).

• The bidder must not be suspended, debarred or otherwise excluded from federal procurement, and must have an active registration with no exclusions in SAM.gov (2 CFR Part 180).

• Byrd Anti-Lobbying Amendment certification (31 U.S.C. 1352) for awards exceeding $100,000.

• Equal employment opportunity and nondiscrimination requirements, as applicable.

• Prohibition on certain telecommunications and video surveillance equipment and services (2 CFR 200.216).

• Access to records and retention of records for the period required by 2 CFR 200.334, and cooperation with audits by the Clinic, the State of Mississippi, and federal agencies.

• Payment is contingent on the availability of grant funds and on invoices containing sufficient detail to support grant reimbursement.

Small businesses, minority-owned businesses, women’s business enterprises and labor surplus area firms are encouraged to submit proposals (2 CFR 200.321).

11. General Terms

• All costs of preparing a proposal are the responsibility of the bidder.

• Questions must be submitted in writing to the point of contact by the question deadline.

Answers will be issued as addenda to all known bidders. Bidders may not contact other Clinic staff regarding this RFP.

• Proposals must remain valid for one hundred twenty (120) days after the due date.

• Pricing shall exclude Mississippi sales tax unless otherwise noted; applicable taxes are to be listed separately on the Pricing Form.

• Information marked confidential will be protected to the extent permitted by law and by grant program requirements.

Attachments

• Attachment A — Non-Collusion Affidavit

• Attachment B — Pricing Form (fillable PDF)