4618-20261013152929 HATTIESBURG CLINIC.pdf

Hattiesburg Clinic RFP No. [HC-RTG-2026-EMAIL] — Scope of Work

Request for Proposals Scope of Work

AI-Driven Email & Web-Browser Threat Detection for Microsoft 365 Hattiesburg Clinic, P.A. | 415 South 28th Avenue, Hattiesburg, MS 39401 | RFP No. [HC-RTG-2026-EMAIL]

Key Item Detail Issuing organization Hattiesburg Clinic, P.A. (the “Clinic”)

RFP posted October 13, 2026

Proposals due November 1, 2026

Point of contact Jerry Robinson, Director of Information Systems — Jerry.Robinsson@hattiesburgclinic.com

Submission method Email to: Jerry Robinson

1. Background Hattiesburg Clinic is a multi-specialty physician practice headquartered in Hattiesburg, Mississippi, serving patients across more than 60 locations, including rural clinic sites throughout South Mississippi. Email and the Clinic’s Microsoft 365 tenant are core infrastructure for clinical and business communication at every site.

The Clinic operates a mature secure email gateway that blocks known-signature and reputation-based threats before delivery. That gateway will remain in place. A growing class of attacks is designed to evade gateway inspection, including payloadless business email compromise (BEC), lookalike-domain and vendor-impersonation fraud, QR-code and image-based phishing, and links that become malicious only after delivery. The Clinic is seeking an AI-driven detection layer that operates behind the existing gateway to detect and contain these threats in the mailbox and in the user’s web browser.

This project is funded in whole or in part with federal funds through the Mississippi Rural Health Transformation Program (MS RHTP). See Section 10 for applicable federal requirements.

2. Objectives

• Detect and contain evasion-class email threats that reach the inbox after passing the existing secure email gateway.

• Protect users in the web browser, where credential theft occurs, against credential-harvesting and malicious sites.

• Deploy without changes to mail flow (MX records, connectors or gateway routing) and without new on-premises hardware.

• Provide monthly reporting on threats detected and contained, to support grant performance reporting.

3. Current Environment Item Value

Email / collaboration platform Microsoft 365 (Exchange Online)

Item Value

Users / mailboxes in scope 2,001

Existing email protection Cloud secure email gateway (pre-delivery filtering);

remains in place

Managed browsers Microsoft Edge

Endpoint management Group Policy / Tanium

4. Scope of Services The bidder shall provide all subscriptions, software, services and labor necessary to deliver a fully operational service meeting the following requirements. Items marked (M) are mandatory;

items marked (D) are desired and will be considered in evaluation.

4.1 Email Threat Detection

• (M) Cloud-delivered (SaaS) service integrating with Microsoft 365 via API, operating behind the existing secure email gateway without changes to mail flow or MX records.

• (M) AI / machine-learning detection that evaluates message intent, language, sender identity and sender-relationship anomalies, not solely signatures or reputation.

• (M) Detection of payloadless BEC, executive and vendor impersonation, lookalike domains, and credential phishing.

• (M) Detection of QR-code and image-based phishing, and of links that become malicious after delivery.

• (M) Automated post-delivery remediation (removal or quarantine of malicious messages from mailboxes), with administrator review and release.

4.2 Web-Browser Protection

• (M) Protection in the user’s web browser against credential-harvesting and malicious sites, including sites reached from email links.

• (M) Centrally deployable and managed (for example, a browser extension deployed through the Clinic’s endpoint management tools).

• (M) Coverage for all 2,001 licensed users.

4.3 Administration, Reporting and Integration

• (M) Web-based administrative console with role-based access control and multi-factor authentication.

• (M) Dashboards and exportable reports of threats detected, threats remediated and users targeted, available at least monthly.

• (M) Audit logging of administrative actions.

4.4 Implementation

• (M) Onboarding assistance for API integration with the Clinic’s Microsoft 365 tenant and deployment of browser protection.

• (M) Deployment substantially complete within [30] days of contract execution.

• (M) Administrator training / knowledge transfer for Clinic IS staff.

4.5 Support

• (M) Vendor technical support for the full subscription term, with stated support hours and response times.

• (M) Named point of contact / account manager for the term of the agreement.

5. Security, Privacy and Compliance

• (M) The awarded vendor will access email content that may contain protected health information (PHI) and must execute the Clinic’s HIPAA Business Associate Agreement (BAA) before any access to Clinic data.

• (M) Clinic data must be stored and processed within the United States.

• (M) Provide a current SOC 2 Type II report (or equivalent independent assessment such as ISO 27001 or HITRUST).

• (M) Least-privilege Microsoft 365 API permissions; the bidder shall list all permissions required.

• (M) Upon termination, delete Clinic data and certify destruction.

6. Term The term is twelve (12) months from service activation. Bidders shall also price two (2) optional twelve-month renewal years on the Pricing Form. The Clinic is under no obligation to exercise renewal years.

7. Deliverables and Acceptance # Deliverable Acceptance Criteria

1 Subscription activated; Microsoft 365 API integration completed

Service connected to tenant; all in-scope mailboxes protected

2 Browser protection deployed Deployed to in-scope users via Clinic endpoint management

3 Administrator training Delivered to Clinic IS staff

4 First monthly threat report Report shows detections and remediations

5 Service acceptance Written acceptance by the Clinic

8. Proposal Requirements Proposals must include the following, in this order. Proposals that omit required items may be deemed non-responsive.

1. Cover letter signed by an individual authorized to bind the bidder, including legal company name, address, primary contact, and Unique Entity ID (UEI).

2. Company overview and experience, including at least three (3) references, preferably healthcare organizations using Microsoft 365.

3. Technical response addressing each requirement in Sections 4 and 5 in order, stating whether it is met, partially met or not met, with explanation. Independent third-party efficacy test results may be included.

4. Implementation plan and timeline.

5. Completed Pricing Form (Attachment B). Pricing must be submitted on the Clinic’s form; supplemental quotes may be attached.

6. Signed and notarized Non-Collusion Affidavit (Attachment A).

7. SOC 2 Type II report (or equivalent), which may be provided under NDA.

8. Sample subscription agreement and sample BAA (if the bidder proposes its own terms).

9. Evaluation and Award Proposals will be evaluated by a Clinic evaluation committee using the following criteria. The Clinic intends to award to the responsible bidder whose proposal is most advantageous to the Clinic, with price and other factors considered.

Criterion Weight Technical solution — detection capability and compliance with requirements

45%

Cost (Year 1 and optional renewal years) 30%

Vendor experience and references 15%

Implementation approach and timeline 10%

Total 100%

Failure to meet any mandatory (M) requirement may result in disqualification. The Clinic may request clarifications, demonstrations or a proof-of-value, and may negotiate with the highest-ranked bidder(s). The Clinic reserves the right to reject any or all proposals, to waive informalities, and to cancel this solicitation at any time.

10. Federal Funding Requirements Because this procurement is funded with federal funds through the MS RHTP, the following apply to the awarded vendor and will be incorporated into the resulting contract:

• Applicable provisions of 2 CFR Part 200, including 2 CFR 200.327 and Appendix II (contract provisions).

• The bidder must not be suspended, debarred or otherwise excluded from federal procurement, and must have an active SAM.gov registration with no exclusions (2 CFR Part 180).

• Byrd Anti-Lobbying Amendment certification (31 U.S.C. 1352) for awards exceeding $100,000, if applicable.

• Equal employment opportunity and nondiscrimination requirements, as applicable.

• Prohibition on certain telecommunications and video surveillance equipment and services (2 CFR 200.216).

• Access to and retention of records for the period required by 2 CFR 200.334, and cooperation with audits by the Clinic, the State of Mississippi and federal agencies.

• Payment is contingent on the availability of grant funds and on invoices with sufficient detail to support grant reimbursement.

Small businesses, minority-owned businesses, women’s business enterprises and labor surplus area firms are encouraged to submit proposals (2 CFR 200.321).

11. General Terms

• All costs of preparing a proposal are the responsibility of the bidder.

• Questions must be submitted in writing to the point of contact by the question deadline.

Answers will be issued as addenda to all known bidders. Bidders may not contact other Clinic staff regarding this RFP.

• Proposals must remain valid for one hundred twenty (120) days after the due date.

• Pricing shall exclude Mississippi sales tax; applicable taxes are to be listed separately on the Pricing Form.

• Information marked confidential will be protected to the extent permitted by law and by grant program requirements.

Attachments

• Attachment A — Non-Collusion Affidavit

• Attachment B — Pricing Form (fillable PDF)