ESBD_473701_1764956668456_Release of Information Scope of Work.pdf

AIS-BUS-01651-RFP

The University of Texas M. D. Anderson Cancer Center (MD Anderson)

Request for Proposal (RFP) Statement of Work (SOW) Release Of Information (ROI)

Table of Contents

1. INTRODUCTION

2. BACKGROUND AND OBJECTIVES

2.1. BACKGROUND

2.2. BUSINESS OBJECTIVES OF THE SYSTEM

2.3. REQUEST VOLUME OVERVIEW

3. SUMMARY OF REQUIREMENTS

3.1. CORE SOLUTION SCOPE

3.2. ADDITIONAL SOLUTION SCOPE

3.3. MINIMAL SYSTEM/SUPPLIER REQUIREMENTS

3.4. ADDITIONAL FUNCTIONALITY/APPLICATION REQUIREMENTS

3.5. WORKFLOW AND IMPLEMENTATION EXPERIENCE

4. PRODUCT DEMONSTRATIONS AND SITE VISIT

5. EXPENSE AND PROFIT MODEL

1. Introduction The intent of this Request for Proposal (RFP) is to solicit bids from qualified suppliers to perform Release of Information (ROI) services for The University of Texas M. D. Anderson Cancer Center (MD Anderson), with a focus on patient and customer service, compliance, efficiency, and high-quality service delivery.

2. Background and Objectives

2.1. Background

MD Anderson in Houston, Texas, celebrating eight decades of Making Cancer History™, is one of the world’s most respected institutions devoted exclusively to cancer patient care, research, education, and prevention. Created by the Texas Legislature in 1941 as a component of The University of Texas System, MD Anderson continues to rank among the nation’s top cancer hospitals in the U.S. News & World Report’s Best Hospitals survey for over 30 years.

MD Anderson was one of the first three federally designated comprehensive cancer centers by the National Cancer Act of 1971. Over 150,000 people annually seek care at MD Anderson. The team approach to cancer care, pioneered at MD Anderson, has been strengthened by consolidating specialty clinics into multi-disciplinary care centers that allow patients to receive more ambulatory care and treatment in a single location.

2.2. Business Objectives of the System

MD Anderson is seeking a qualified supplier to provide comprehensive medical record retrieval, processing, and delivery services to support the needs of MD Anderson Health Information Management (HIM) department and other institutional stakeholders. The goal is to ensure patient-friendly, accurate, timely, and secure handling of patient medical records in compliance with all applicable state, federal, accreditation, and institutional requirements, (“Applicable Regulations”), including but not limited to:

o Joint Commission Standards/National Patient Safety Goals RI.01.01.01: “The hospital respects, protects, and promotes patient rights.” (CAMH, 2024) RI.01.01.03: “The hospital respects the patient’s right to receive information in a manner the patient understands.” (CAMH, 2024) RI.01.05.01: “The hospital addresses patient decisions about care, treatment, and services received at the end of life.” (CAMH, 2024) o Centers for Medicare & Medicaid Services (CMS)

Condition of Participation: Patient’s Rights, 42 CFR § 482.13, Tags A- 0115, A-0117, A-0121, A-0131, A-0132, A-0133, A-0143, A-0144, A- 0148, A-0215, A-0216, A-0217 (2024) o Centers for Medicare & Medicaid Services, Department of Health and Human Services - Condition of Participation: Confidentiality of Patient Records, 42 CFR § 482.13, Tags A-0147, A-0441, A-1562, 2023.

o Health Information Technology for Economic and Clinical Health (HITECH) Act.

o Health Insurance Portability and Accountability Act of 1996 (HIPAA).

o HIPAA Privacy & Security Rules, 45 C.F.R. Parts 160, 162 & 164.

The selected supplier will be expected to provide both the technology platform and the operational capabilities necessary for the end-to-end retrieval process from request initiation to delivery with seamless integration into MD Anderson’s systems, including Epic and OnBase.

The selected supplier(s) will collaborate with MD Anderson stakeholders to:

Provide detailed implementation and onboarding plan, including supplier and MD Anderson team roles and knowledge transfer plan.

Offer reporting and analytics to track turnaround times (TATs), completion rates, and request trends.

Deploy and configure technology platforms to manage requests, track status, and securely deliver records.

Integrate with existing MD Anderson systems, for secure data transfer and document indexing.

Deliver tailored training programs for MD Anderson staff on system use, request workflows, and best practices.

Supplier must ensure staff represent MD Anderson professionally, with institution values and patient-centered communication.

Supplier must provide at least two (2) ROI personnel in person during business hours (Monday through Friday 8:00AM-5:00PM CST and occasional Saturdays based on MD Anderson weekend activity) for patient facing services in the offices of MD Anderson facilities.

Supplier must provide at least one (1) ROI in-person personal, that is a certified notary during business hours for patient facing services in the offices of MD Anderson facilities.

Support change management and provide go-live assistance for a mutually agreed period.

Ensure compliance with all Applicable Regulations.

Address additional operational or technical needs as they arise.

2.3. Request Volume Overview

MD Anderson processes a high and consistently growing volume of Release of Information (ROI) requests across multiple categories. Suppliers must demonstrate the operational capacity, staffing structure, and technological capability to support these volumes without service degradation.

Current annualized ROI activity includes:

• Patient requests: 12,054

• Patient Portal requests: 1,927

• Patient walk-ins: 2,594

• Audit requests: 9,232

• Coordination of Care (CoC): 44,581

• Disability requests: 4,056

• Insurance requests: 6,310

• Legal requests: 4,007

• Research requests: 51

• Workers’ Compensation: 44

• Medicare Risk Adjustments: 21,031

Total annual ROI volume: 105,887 requests

In addition to current ROI activity, MD Anderson anticipates expanded service needs that may be included in future phases of the engagement. These volumes are provided to ensure suppliers can demonstrate long-term scalability.

Potential Future Phase ROI activity includes:

• Patient Business Servies requests: 92,030

• Retrieval Requests: 1,979

Total annual Potential Future Phase ROI volume: 94,009 requests

This volume includes both electronic and in-person walk-in requests and represents a blend of routine, urgent, and complex requests requiring prioritization, validation, and coordination across HIM and multiple internal departments. Suppliers must show how their staffing model, workflow management tools, and quality control processes can support this level of demand.

3. Summary of Requirements

3.1. Core Solution Scope

Core services include:

Retrieval of medical records from healthcare providers, facilities, and third-party systems.

Processing, indexing, and delivering records in Fax, email, mail, patient pick-up, MyChart, and electronic formats.

Ensuring secure data transfer, privacy protection, and compliance with Applicable Regulations.

3.2. Additional Solution Scope

In addition to the core services, MD Anderson is interested in exploring suppliers that can offer:

Enhanced tracking and reporting of request status, turnaround times, and volume metrics.

Technology solutions that streamline request submission, retrieval workflows, and internal communication.

Optional support for legal, insurance, or research-related record requests.

Integration capabilities with MD Anderson’s systems.

Supplier must disclose system access needs before implementation.

3.3. Minimal System/Supplier Requirements

The minimum requirements of the system/supplier are as follows:

Secure technology platform for request initiation, tracking and communication Multi-factor authentication, encryption at rest and in transit, and audit logging.

Configurable user roles and access permissions.

Compliance & Data Privacy o Supplier must demonstrate full compliance with Applicable Regulations.

o Provide clear breach notification processes and documented privacy/security protocols, including timeframes for notifying MD Anderson and affected individuals in the event of breach.

o System must support MD Anderson required turnaround times (e.g., ≥99% within 5 days and ≥100% within 30 days) for both standard and urgent request categories, with escalation workflows clearly documented.

Clear breach notification processes and documented privacy/security protocols.

Performance Standards o Supplier must meet or exceed MD Anderson required turnaround times (e.g., ≥99% within 5 days and ≥100% within 30 days).

o Accuracy rate for released information must meet HIM-defined benchmarks (e.g., ≥99% within 5 days and ≥100% within 30 days).

o Supplier must ensure audit logs, demonstrate timeliness, completeness, and compliance of all requests.

o Supplier must provide monthly reporting of performance against Key Performance Indicators (KPIs) (e.g., turnaround times, accuracy, error rates).

Maintain quality control measures to ensure accuracy and completeness of retrieved records.

Supplier must clearly define how affidavits, denial letters, and other correspondence will be stored, accessed and linked to ROI requests.

Support for structured and unstructured data formats – Records can be released in either format upon request, including structured data (e.g., billing information, vital signs, lab results, medication lists) and unstructured data (e.g., clinical notes, scanned documents, imaging).

Operational Support o Supplier must conduct quality control processes to ensure accuracy, completeness, and timeliness of all released records.

o Supplier must outline the process for in-person/walk-in requests, including procedures for authorization verification, processing timelines, and integration.

o Supplier must have staff available onsite to handle walk-in ROI requests in addition to standard electronic and mailed requests. Staff must be trained to verify identity, validate authorization, and process requests in accordance with MD Anderson policies and regulatory requirements.

o Supplier must provide accurate logging of all requests – both complete and incomplete - with audit trails visible to MD Anderson HIM leadership and staff.

o Supplier must provide dedicated account management and customer support, including escalation protocols and continuity plans during surges in volume.

Technical Integration o The system must integrate with MD Anderson’s systems, to support both structured and unstructured data formats, ensuring full interoperability and data exchange consistency with exiting institutional systems.

o Supplier must ensure interoperability with other institutional systems as needed for ROI workflows.

o The supplier must ensure that required Release of Information (ROI) data elements are accurately mirrored with MD Anderson’s systems.

Provide onsite staff to support walk-in requests in addition to standard ROI functions.

Dedicated account management team.

Staff trained in Applicable Regulations.

Support available during MD Anderson business hours.

Supplier must provide on-site staff capable of handling walk-in requests from patients, caregivers, or authorized representatives. This includes validating authorizations, processing requests promptly, providing clear instructions for follow-up, and ensuring walk-in requests are tracked and reported consistently with all other ROI workflows.

3.4. Additional Functionality/Application Requirements

Collaboration & Accountability Tools Shared dashboards or reporting tools for HIM staff and supplier teams to track performance, escalation needs, and workload distribution.

Real-time communication tools for clarifying requests and resolving delays.

Analytics & Continuous Improvement Reporting on turnaround time, request volumes, request completion rates, and trends.

Ability to generate compliance and productivity metrics for internal review.

Record summarization or abstraction for specific use cases.

Translation services for non-English records.

Retrieval from international sources when applicable.

Supplier must provide a centralized call center, aligned with MD Anderson business hours 8:00AM CST to 5:00pm CST.

Defined escalation process for urgent/unresolved requests, with expected resolution timelines.

Set customer service satisfaction tracking methods for patients, third parties and internal staff.

3.5. Workflow and Implementation Experience

Proven, standardized onboarding process, including timelines, milestones, and training plans.

Supplier-leading training for MD Anderson staff on system use, workflows, and best practices.

Experience supporting large academic medical centers, oncology programs, or other complex healthcare institutions.

Documentation and support for downtime, disaster recovery, and contingency planning.

Demonstrated history of successful implementation and sustained performance in similar engagements.

4. Product Demonstrations and Site Visit After a preliminary review of RFP responses, MD Anderson may identify a short-list of suppliers for presentations and detailed product demonstrations. The presentations will take place virtually. Some questions from the RFP may be extended and used as a basis for presentations. Short-listed suppliers will receive an agenda and guidance to prepare for the presentations and ample time at the end for an audience Q & A session.

5. Expense and Profit Model Supplier must outline all costs invoiced to MD Anderson (supplies, training, ongoing operations, optional service, and system enhancements).

Supplier must disclose profit sharing or revenue sharing models, including anticipated amounts based on current volumes.

Outlined billing processes, invoicing frequency, and expectations for reconciliation of charges.

Identify any additional or optional fees (e.g., retrievals from outside facilities)

6. Overall Assumptions The selected supplier (s) will be expected to:

Demonstrate financial stability and proven experience providing Release of Information (ROI) services for large healthcare institutions, preferably academic medical centers and oncology-focused organizations. Demonstrate openness to collaborate with MD Anderson to streamline processes, integrate technology, and support advancements in performance and patient experience.

Meet and exceed contractually defined KPIs and service requirements, including but not limited to:

Response time for all release of information (ROI) requests whether from patients, third parties, legal representatives, or regulatory agencies. The supplier must meet established service level expectations and contractual requirements.

Compliance with Applicable Regulations.

Patient satisfaction with ROI request handling and responsiveness.

MD Anderson staff satisfaction with supplier collaboration and service delivery.

Ability to supply complete, accurate, and timely documentation with minimal rework.

Demonstrated accountability through escalation pathways and remediation plans for missed deadlines or service failures.

Low rate of errors, incomplete requests, or improper disclosures.

To have a documented disciplinary action plan in place for addressing employee non-compliance Service Level Agreements (SLAs) for technical support must clearly define response and resolution times for issues ranging from urgent (system outages or data access failures) to routine (general inquiries or minor functionality issues). SLAs should also specify escalation procedures, communication methods, and performance metrics to ensure timely and effective issue resolution.

System availability and uptime guarantee, with defined metrics for downtime limits.

Secure transfer of PHI, with audit logs and breach notifications procedures.

Data transmission latency and speed for file uploads/downloads.

Accuracy rate of request fulfillment and error rate tracking.

Integration with MD Anderson’s systems, including real-time updates where feasible, to avoid manual dual entry.

Client user experience, including MD Anderson staff’s ability to track, report, and escalate requests seamlessly.

Full adherence to applicable regulations.

Meet cybersecurity, data storage, and access control requirements deemed necessary by MD Anderson.

Provide a documented disaster recovery and business continuity plan.

Maintained flexibility in staffing to meet fluctuating in request volumes.

Provide onsite staffing support for walk-in ROI requests, including patients, caregivers, and legal representatives, with defined hours of coverage.

Ensure suppliers account managers and escalation contacts are available to MD Anderson during business hours.

Provide services that are accurate and timely evaluated by MD Anderson through weighted acceptance criteria.

Offer regular reporting and analytics on request volume, turnaround time, and compliance.

Demonstrate commitment to continuous process improvement and adoption of industry best practices in ROI.

Centralized call center option for supplier For cloud-based solutions, the selected supplier must comply with Senate

Bill 475 – Texas Risk and Authorization Management Program (TX- Ramp) Certification. For more information, please visit:

https://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramphttps://dir.texas.gov/texas-risk-and-authorization-management-program-tx-ramp.

Translation services, system updates or expedited requests.