RFP 27-03 Scope of Work FINAL.docx

SECTION I – SCOPE OF WORK:

1.1 SUMMARY OF REQUEST

Roswell Park Comprehensive Cancer Center (“Roswell Park”) is issuing this Request for Proposals (RFP) to solicit proposals from qualified vendors for a single, integrated revenue integrity and patient financial software platform.

The desired solution will support automated, auditable, and operationally usable workflows across multiple hospital revenue‑cycle functions, including:

· Underpayment reporting and recovery based on modeled contract terms

· Payer contract management and performance analytics, including scenario modeling

· Patient financial estimates, projections, and financial assistance workflows

· Eligibility verification and payer/product matching, including coverage discovery

Roswell Park’s objective is to select a vendor that can demonstrate automation, data integration, audit readiness, and measurable financial impact with minimal reliance on manual processes. Roswell Park strongly prefers a single‑vendor platform delivered under one agreement with an integrated implementation and support model.

This RFP is intended to support an expedited qualification and shortlisting process.

1.2 SCOPE OF REQUEST

The scope of this RFP includes the provision of a software platform and related services capable of supporting the functional requirements outlined below. Vendors must clearly describe how their proposed solution meets, exceeds, or does not meet each requirement within scope.

The scope of request includes, but is not limited to:

1.2.1 Underpayment Reporting & Recovery

· Contract‑based expected reimbursement calculation at the claim and line level

· Identification and prioritization of payment variance and underpayments

· Reporting and dashboards with drill‑down capability

· Recovery and appeal workflow support with outcomes tracking

1.2.2 Payer Contract Management & Performance Analytics

· Configuration and maintenance of complex payer contract terms and amendments

· Continuous monitoring of payer compliance to contract terms

· “What‑if” modeling to assess financial impact of proposed contract changes

· Analytics to support negotiations and ongoing performance management

1.2.3 Patient Financial Statements, Estimates & Financial Assistance

· Patient‑specific out‑of‑pocket estimates using eligibility and pricing inputs

· Automated estimate triggers and multi‑channel delivery

· Audit‑ready reporting comparing estimates to actual reimbursement

· Automated financial assistance screening and patient self‑service workflows

1.2.4 Eligibility Verification & Payer/Product Matching

· Real‑time and batch eligibility verification

· Coverage discovery to identify missing or secondary coverage

· Normalization and enrichment of eligibility responses

· Confidence scoring or equivalent logic to reduce false positives

1.2.5 Authorization Management

· Prior authorization initiation, submission, and tracking across payer types (commercial, Medicare Advantage, Medicaid managed care), including support for multi-code and multi-service requests relevant to oncology (e.g., chemotherapy regimens, radiation courses, surgical procedures, diagnostics)

· Real-time authorization status verification via payer portal integration, clearinghouse connectivity, and X12 278 transaction standards

· Rules-based identification of services requiring authorization, with payer- and plan-specific requirement logic tied to the patient's active coverage

· Automated authorization alerts and worklist prioritization flagging missing, expired, or expiring authorizations prior to service delivery

· Concurrent authorization monitoring and renewal workflow support for ongoing or multi-visit treatment courses

· Retrospective authorization identification and workflow support for services rendered without prior authorization, including appeal facilitation

· Authorization-to-claim matching to validate that services rendered align with approved authorization terms (approved codes, units, site of service, date range)

· Denial reason tracking and appeal workflow integration specific to authorization-related denials, with outcomes reporting

· Audit-ready documentation of all authorization activity, including request submissions, payer responses, status changes, and user actions

· Reporting and dashboards covering authorization approval rates, denial rates by payer and service type, turnaround time, and revenue at risk from pending or missing authorizations

1.3 REQUIREMENTS CHECKLIST AND SUPPORTING EVIDENCE

The following requirements are intended to assess each Vendor's capabilities, maturity, and alignment with Roswell Park's needs. Vendors should indicate whether they currently meet each requirement and provide supporting documentation where available.

· Vendors are not expected to meet every requirement.

· Responses will be evaluated based on the extent to which the requirement is met, the overall strength of the Vendor's capabilities, and the quality and completeness of the supporting evidence provided.

· Where a requirement is not currently met, Vendors should describe any planned enhancements, compensating controls, or alternative approaches.

· For each requirement, Vendors should provide the supporting documentation identified in the corresponding Required Evidence Pack Component column. The completeness, relevance, and quality of the submitted evidence will be considered as part of the evaluation.

· Responses will be evaluated based on both the Vendor’s demonstrated capability and the strength of the supporting evidence provided. More comprehensive and well-documented evidence demonstrating mature, operationally proven capabilities may receive higher scores.

Product/module list + architecture diagram

Sample SOW and support model overview

Data flow diagram + example end-to-end workflow

Expected vs actual report with drill-down

Technical description + sample output

Dashboard screenshots + ad hoc example

Workflow screenshots + outcome report

Example contract configuration (redacted)

Sample scenario analysis output

Compliance dashboard/report examples

RACI + update cadence

Methodology + sample estimate (redacted)

Configuration screenshot + trigger list

Patient-facing screenshots + sample PDF

Audit report screenshot/export

Accuracy dashboard/report sample

Collections report sample

Workflow screenshot + rules overview

Scoring bands + action mapping

Patient portal screenshots + status sample

Supported transactions + workflow examples

Connectivity statement + redundancy approach

Sample normalized response + alert example

Workflow diagram + sample results report

Description + sample output

Security overview / SOC2 summary

Reporting catalog

Supported transaction list + workflow screenshot

Configuration example + payer rule sample

Alert/worklist screenshot

Workflow diagram covering all three stages

Sample matching report or discrepancy output

Denial/appeal workflow screenshot + outcomes report

Audit log screenshot/export

Dashboard/report sample

1.4 QUESTIONS

Vendors must respond to all questions in this section using the numbering and structure provided below. Responses must be concise, factual, and specific to the proposed solution. Marketing language should be avoided.

1.4.1 Functional Capability Questions

(Revenue Integrity, Contract Performance, Patient Financial Platform)

a. Describe the solution’s approach to underpayment identification, variance analysis, and recovery workflow management, including payer types supported (e.g., commercial, Medicare, Medicaid) and tracking from detection through resolution.

b. Explain how payer contracts are ingested, versioned, and maintained, and to what extent configuration and reimbursement logic is manageable by Roswell Park versus requiring vendor involvement.

c. Describe how the platform supports eligibility verification and coverage discovery across the revenue cycle continuum, including pre-service through accounts receivable.

d. Describe available patient financial tools, including benefit validation, financial assistance screening, and financial clearance support.

e. Identify standard reports, dashboards, and KPIs available out of the box, and describe any advanced analytics or predictive capabilities included in the solution.

1.4.2 Authorization Management

a. Describe the solution’s authorization management capabilities across the full continuum — pre-service initiation, concurrent monitoring and renewal, and retrospective identification — including payer types and service types supported.

b. Explain how the platform determines which services require authorization, including how payer- and plan-specific rules are maintained and updated as payer requirements change.

c. Describe real-time authorization status verification capabilities, including supported integration methods (e.g., X12 278, payer portal, clearinghouse) and any payer connectivity limitations.

d. Describe how the platform supports authorization-to-claim matching, including how discrepancies in approved codes, units, site of service, or date ranges are identified and surfaced.

e. Explain how authorization-related denials are tracked, categorized, and routed into appeal workflows, including outcomes reporting.

f. Identify standard reports and dashboards available for authorization performance monitoring, including approval and denial rates by payer and service type, turnaround time, and revenue at risk from pending or missing authorizations.

1.4.3 Underpayment Reporting & Recovery

Vendors should respond concisely and specifically to the following high-filter questions. Responses will be used to assess solution maturity, scalability, and operational fit.

a. How frequently are pricing and audit runs performed (e.g., continuous, scheduled, event-triggered, or sampling-based)? Indicate any limitations or dependencies.

b. Identify at least three (3) standard reports or dashboards available out of the box for underpayment detection, recovery tracking, or variance analysis.

c. Describe how payer reimbursement rules, including government and regulatory rule changes, are maintained, updated, tested, and validated within the system.

1.4.4 Payer Contract Management & Analytics

a. Identify who is responsible for maintaining and updating payer contract terms (vendor-managed, client-managed, or hybrid), including typical update cadence.

b. Provide a redacted sample of “what‑if” scenario modeling output used to support payer contract negotiations or reimbursement impact analysis.

1.4.5 Integration, Data, Architecture & Security

a. Describe the integration approach and all required data inputs, upstream/downstream system dependencies (e.g., EHR, patient accounting, billing, clearinghouse), and any prerequisites for full platform functionality.

b. Describe data refresh frequency and latency for financial, contract, and eligibility data.

c. Identify the hosting model (e.g., cloud-based, SaaS) and data center location(s).

d. Describe security safeguards in place, including encryption, role-based access controls, HIPAA compliance, and how audit logging is captured, retained, and accessed.c

e. Describe the solution’s compatibility with current Electronic Health Record (EHR) systems and the expected approach to supporting integration with a future successor EHR platform.

Vendors must confirm that the proposed solution is capable of integrating with a successor EHR environment within an anticipated three-and-a-half (3.5) to four (4) year timeframe, or clearly describe any dependencies, limitations, or transition requirements.

Proposals should also identify any contractual, technical, or commercial considerations required to support transition to, or replacement by, a future EHR providing equivalent or overlapping functionality.

1.4.6 Implementation, Training & Support

a. Describe the proposed implementation approach, including estimated timeline, major phases, and a summary of vendor versus Roswell Park responsibilities (RACI).

b. Describe data migration, validation, and testing activities included in scope.

c. Explain training methods provided, including role-based options for Revenue Integrity, Patient Financial Services, and administrative users.

d. Describe post-go-live support, including hours, issue submission methods, escalation path, SLAs, and any ongoing client success or account management resources included.

1.4.7 Application

a. Describe the client-side application environment, including supported browsers, operating systems, required plugins, and whether a native mobile application is available and on which platforms.

b. Are OS administrator rights required for any client-side component? (Our standard is to not have users as local Admins on workstations.)

c. Describe available APIs, SDKs, and scripting/customization capabilities (e.g., REST, SOAP, HL7; scripting languages), and provide API documentation if available.

d. If a relational database is involved, describe direct data access options, database engine, support for user-defined tables, and availability of a data dictionary.

e. Describe the application update and patching process, expected downtime, and application logging capabilities.

f. Describe vendor-managed versus client-managed configuration, the overall application administration process, and confirm availability and cost of separate development, testing, and training environments, including the process for migrating changes between environments.

1.4.8 Security for Roswell Park/On-Prem Hosted

NOTE: If your software is cloud-based, please skip this section.

a. Confirm compatibility with endpoint security tools (e.g., CrowdStrike Falcon Protect), data-at-rest encryption (e.g., Dell DDPE, Microsoft BitLocker), and describe OS compatibility and any patching restrictions.

b. List any required third-party application dependencies (e.g., Java, Flash, Acrobat Reader), including required versions and patching restrictions.

c. Describe audit record capabilities, including time/user/action logging with support for centralized log forwarding, and whether data modification history is retained or overwritten.

d. Describe user account management, provisioning, and lockout processes.

1.4.9 Security for Vendor/Cloud Hosted

a. Describe what PHI, if any, is exchanged between Roswell Park and your platforms or affiliates (including any de-identification methods used), and confirm compliance with all applicable regulations (e.g., HIPAA, 21 CFR Part 11, PCI, NY SHIELD, GDPR).

b. Confirm current SOC 2 Type II, HITRUST, or equivalent certification (provide documentation if yes) and confirm that annual risk assessments are performed.

c. Confirm Roswell Park data will be stored exclusively in the U.S. and encrypted at rest and in transit using FIPS 140-3 compliant methods for all systems and devices.

d. Does your organization have a designated CISO or equivalent with data and infrastructure protection as their primary responsibility?

e. Describe your vulnerability management and penetration testing program, including frequency of internal and external network scanning, patch deployment cadence, and testing frequency.

f. Describe your broader security program, including third-party risk management, endpoint protection, employee background checks, security awareness training, and incident response policy/program.

g. Describe access controls, including multi-factor authentication for external access, IP restriction capabilities, and support for Roswell Park’s ADFS/SAML authentication.

h. Do you maintain a 24x7 Security Operations Center monitoring your environment?

1.5 TERM

The term of the Resultant Agreement(s) will be for a 3-year initial term (the “Initial Term) which shall automatically renew for two (2) successive one (1) year renewal terms (each a “Renewal Term”) unless written notice of nonrenewal by Roswell Park is given at least thirty (30) days prior to the expiration of the Term. The Initial Term and each Renewal Term shall be collectively referred to as the “Term”.

1.6 PRICING

Pricing proposed must remain firm and fixed for the initial three (3) year term of the agreement. Following the initial term, the Vendor may request a price increase no more than once annually by providing Roswell Park with at least sixty (60) days' prior written notice. Any approved annual increase shall not exceed two percent (2%) of the pricing in effect during the immediately preceding contract year.

Roswell Park reserves the right to normalize pricing responses to ensure an equitable comparison across all proposals.

Roswell Park is seeking complete pricing transparency. Vendors must clearly identify and disclose all costs associated with the proposed solution, whether one-time, recurring, transaction-based, usage-based, optional, or contingent.

· Clearly identify all pricing assumptions and cost drivers.

· Disclose all implementation, integration, onboarding, training, support, maintenance, hosting, licensing, transaction, and third-party costs.

· Identify any minimum volume commitments, usage thresholds, or contractual spend requirements.

· Describe all available quantity, volume, utilization, or tier-based discounts.

· Clearly identify any optional modules, add-on functionality, premium features, or services that are not included in the base pricing.

· Describe any future costs that may reasonably be incurred during the term of the agreement.

· By submitting a proposal, Vendor represents that all known costs, fees, charges, assumptions, and pricing dependencies have been fully disclosed. Roswell Park reserves the right to consider undisclosed costs, hidden fees, or material pricing omissions during evaluation and contract negotiations.

1.6.1 Pricing Structure and Assumptions

Pricing Model (subscription, transaction, hybrid, other)

Basis of Pricing (per claim, per user, per encounter, % collections, etc.)

Key Cost Drivers

Volume Assumptions

Minimum Commitments or Contractual Spend Requirements

Quantity/Volme Discount Structure

Third-Party Costs or Pass-Through Fees

1.6.2 Total Cost of Ownership

Include all costs required to implement, operate, maintain, and support the proposed solution. Optional functionality must be identified separately and may not be bundled into base pricing.

TOTAL COST (3-YEAR TCO)

1.7 VENDOR QUALIFICATIONS and REFERENCES

1.7.1 Vendor Qualifications

a. Confirm vendor has a Healthcare client footprint (hospitals/health systems) for each module and proven experience with PPS exempt and NCI designated cancer centers.

b. Provide 2–3 case examples demonstrating measurable outcomes in: underpayment recovery and leakage reduction; contract optimization/negotiation readiness; improved eligibility accuracy or reduced improper self-pay; improved estimate accuracy and/or pre-service collections.

1.7.2 References

Provide at least three client references for similar services within the last three (3) years (name, title, organization, email, phone) of which at least one (1) must be a NCI designated cancer center.

1.8 POST-BID INTERVIEWS

After evaluation of the RFP responses, it may be necessary to complete a Phase II evaluation consisting of presentations, interviews, demonstrations, etc. Respondents moving on to the next round will be asked to complete a Phase II evaluation consisting of interviews, presentations, post-bid demonstrations, etc. Those invited to participate in Phase II will be provided with information on the format, attendance, and additional information that is required.

1.9 EVALUATION CRITERION

1.10 PROPOSAL CHECKLIST FOR COMPLETE SUBMISSION

Please structure your response using the RFP section numbering below. Provide concise answers and include only relevant materials. Roswell Park will not consider vendors who do not submit required evidence for mandatory items.

Requested Response Length: 8–12 pages maximum, excluding the required Evidence Pack, required forms, and standard legal agreements.

Each Respondent’s Proposal must be submitted via email to jennifer.gaenzler@roswellpark.org and must include the following unless other instructions have been provided by Roswell Park:

1.10.1 Deliverables

a. Detailed Table of Contents with each section clearly labeled to correspond with each section of the RFP.

b. Company Background and Required Information:

i. Full legal name

ii. Address

iii. Primary contact information including name, title, phone, and email address

iv. Year founded/established

v. Type of business (i.e. Corporation, LLC, etc.)

vi. State of incorporation

vii. Number of employees

viii. Federal tax ID number

ix. D&B number (if applicable)

x. Business certifications (i.e. MBE, SDVOB, etc. if applicable)

xi. List all the addendums issued by Roswell Park and acknowledge that they have been read and incorporated into your proposal (if applicable).

c. Completed Requirements Checklist and Supporting Evidence including the Evidence Pack in Section 1.3

d. Responses to all Questions in Section 1.4

e. Pricing submission in Section 1.6

f. Demonstration of Vendor Qualifications and References in Section 1.7

g. Any additional forms or certifications requested

1.10.2 Non-Collusion Affidavit

Each Proposal must include a signed, completed “Non-Collusion Affidavit” from Section IV – Required Forms, a copy of which is attached to this RFP.

1.10.3 Disclosure Form

Each Proposal must include a signed, completed “Disclosure Form” from Section IV – Required Forms, a copy of which is attached to this RFP.

1.10.4 EEO Requirements

Roswell Park is required to implement the provisions of NYS Executive Law Article 15-A regarding equal employment opportunities (“EEO”) for minority group members and women (the Rev. Oct. 2018 3 “EEO Requirements”) for all contracts with a value in excess of: (i) $25,000.00 for labor, services (including legal, financial, and other professional services), travel, supplies, equipment, materials, and/or any combination of the foregoing, with the exception of the acquisition, construction, demolition, replacement, major repair, and/or renovation of real property and/or improvements thereon; and (ii) $100,000.00 for the acquisition, construction, demolition, replacement, major repair, and/or renovation of real property and/or improvements thereon (each an “EEO Requirement Threshold”).

a. EEO Policy Statement If the value of any Vendor’s Proposal and Resultant Agreement, if awarded by Roswell Park, will meet an EEO Requirement Threshold, then each such Vendor’s Proposal must include an EEO policy statement as described in Section 3.2 of this RFP. If any Vendor does not have an existing EEO policy statement and/or prefers to use the Roswell Park-Provided EEO Policy Statement from Section IV – Required Forms, then each such Vendor shall complete and submit such as part of its Proposal.

b. EEO Staffing Plan If the value of any Vendor’s Proposal and Resultant Agreement, if awarded by Roswell Park, will meet an EEO Requirement Threshold, then each such Vendor’s Proposal must include a completed EEO Staffing Plan from Section IV – Required Forms to document the composition of the proposed workforce to be utilized in the performance of the Resultant Agreements, if awarded by Roswell Park, in accordance with the criteria set forth in Section 3.3 of this RFP.

1.10.5 Certificates of Insurance

Each Proposal must include a sample certificate of insurance evidencing its compliance with the insurance requirements set forth in Appendix B – Roswell Park Terms and Conditions (v. 02.2025).

If any Vendor is unable to meet any of the insurance requirements, then such Vendor shall detail such as further indicated in Section 1.10.9 of this RFP.

1.10.6 W-9 Form

Each Proposal must include a signed, completed Request for Taxpayer Identification Number and Certification form.

1.10.7 EO 16 Certification

Each Proposal must include a signed, completed “Certification Under Executive Order No. 16, Prohibiting State Agencies and Authorities from Contracting with Businesses Conducting Business in Russia” from Section IV – Required Forms, a copy of which is attached to this RFP.

1.10.8 Sample Resultant Agreement(s)

Each Proposal must include all of the legal documents required from Section V – Sample Agreements and Required Language.

1.10.9 Exceptions

The documents included in Section V – Sample Agreements and Required Language, consisting of Appendix A – Roswell Park Required Clauses (v. 12-2025-1); Appendix A-1 – EEO Requirements (v. 12-2025-1), if applicable; Appendix B – Roswell Park Terms and Conditions (v. 02.2025); Appendix C – Information & System Security Requirements (v. 10.2025); and the Business Associate Agreement (v. 09.2025), collectively constitute the “Sample Agreement.” Subject to the below restrictions, if any Vendor has any exceptions to the Sample Agreement, then such exceptions shall be submitted in the form of redlined changes within the document and included as part of each Vendor’s Proposal. In addition, subject to the below restrictions, if any Vendor has any exceptions to any other terms and conditions in this RFP, then such exceptions shall be documented on a separate attachment and included as part of each Vendor’s Proposal. Any and all exceptions must be included as part of each Proposal, and Roswell Park will not negotiate changes if such were not included as part of the applicable Vendor’s Proposal. If any Vendor does not include exceptions as part of its Proposal, then each such Vendor shall be deemed to have accepted the terms of the Sample Agreement and this RFP. The exceptions taken by Vendors will be a factor in Roswell Park’s evaluation and determination of award. Notwithstanding any language to the contrary, Roswell Park will not entertain exceptions to the Sample Agreement or RFP that are of a material and substantive nature. Roswell Park reserves the right to negotiate and/or reject any proposed changes submitted by any Vendor. All exceptions are to be submitted in a Microsoft Word format as part of Vendors’ electronic Proposal copy.

1.10.10 Other Supporting Documentation (if applicable)

Each Proposal must include any additional supporting documentation if applicable.

SECTION II – GENERAL INFORMATION

2.1 DEFINED TERMS

All defined terms in this Request for Proposal (this “RFP”) in the singular form will be construed to include the plural and vice versa.

2.2 ABOUT ROSWELL PARK

Roswell Park Cancer Institute Corporation d/b/a Roswell Park Comprehensive Cancer Center (“Roswell Park”) was founded in 1898 by Dr. Roswell Park in Buffalo, New York. Roswell Park is a nationally and internationally recognized leader in cancer care, research, and education. As one of the first institutions designated a “Comprehensive Cancer Center” by the National Cancer Institute (NCI) in 1974, Roswell Park has maintained this prestigious designation continuously. Roswell Park is also a member of the National Comprehensive Cancer Network (NCCN), an alliance of the world’s leading cancer centers that sets the gold standard for clinical oncology guidelines.

Roswell Park is a New York State Public Benefit Corporation and, together with its research affiliate Health Research, Inc., employs over 4,200 professionals. Roswell Park is one of only 11 centers in the U.S. solely dedicated to cancer treatment and research. The institution offers a full spectrum of inpatient and outpatient services, conducts groundbreaking research, and leads public and professional education initiatives. Its global footprint continues to expand through international clinical and research partnerships.

Many of Roswell Park’s faculty serve on NCCN panels that develop the Clinical Practice Guidelines in Oncology—internationally recognized as the most comprehensive and frequently updated standards in cancer care.

2.3 RFP DATES/MILESTONES

2.3.1 Issue Date: July 8, 2026 at 8:00 am EST

2.3.2 Question Due Date: July 17, 2026 before 12:00 pm EST

2.3.3 Proposal Due Date: July 29, 2026 before 2:00 pm EST

2.4 QUESTIONS

Roswell Park will accept questions from Respondents regarding this RFP until the time indicated in Section 2.3.2. Questions must be submitted via email to Jennifer M. Gaenzler at jennifer.gaenzler@roswellpark.org. Roswell Park will share ALL Respondents’ questions and the associated answers collectively with all Respondents.

2.5 ADDENDA

If it becomes necessary to clarify and/or modify any portions of this RFP, as determined by Roswell Park, in its sole discretion, then Roswell Park will issue individually numbered addenda to the Respondents which shall contain such clarifications and/or modifications (each an “Addendum”).

2.6 VALIDITY OF PROPOSALS

Proposals must remain open and valid for a period of at least one hundred and eighty (180) days from the due date of the Proposals as indicated in this RFP (the “Proposal Validity Period”). During the Proposal Validity Period, the price quoted and the proposed offering in each Proposal must remain unchanged unless otherwise directed, in writing, by Roswell Park. If a Respondent is selected as a successful Respondent by Roswell Park (the “Successful Respondent”) and awarded a resultant agreement by Roswell Park (the “Resultant Agreement”) within the Proposal Validity Period, then, once accepted, the price quoted and the proposed offering in the Successful Respondent’s Proposal must remain unchanged and in effect and will be stated as such in the Resultant Agreement.

2.7 PROCUREMENT LOBBYING

Pursuant to Chapter 1 of the Laws of 2005, as amended by Chapter 596 of the Laws of 2005, as of the date this RFP is issued by Roswell Park, any direct and/or indirect contacts, communications, lobbying, and/or other attempts of any kind by any Respondent to influence the RFP award process are prohibited by NYS law.

2.8 RESTRICTIONS ON CONTACT DURING THE PROCUREMENT PROCESS

Pursuant to State Finance Law §139-j, as amended by Chapters 56 and 395 of the Laws of 2006, Chapter 501 of the Laws of 2007, Chapter 169 of the Laws of 2009 and Chapter 4 of the Laws of 2010, this RFP includes and imposes certain restrictions on communications between Roswell Park and any Respondent during the procurement process. All Respondents are restricted from making contacts from the earliest notice of this RFP through the final award and approval of the Resultant Agreement by Roswell Park to any other person at Roswell Park other than Jennifer M. Gaenzler unless it is a contact that is included among certain statutory exceptions set forth in State Finance Law §139-j(3)(a).

2.9 ROSWELL PARK’S RIGHTS

This RFP is a request for proposal and does not constitute an offer by Roswell Park. Roswell Park reserves the right, in its sole discretion, to: (i) award a Resultant Agreement to a single Respondent, to multiple Respondents, or to not award a Resultant Agreement at all; (ii) reject any or all Proposals; (iii) award only a portion of the RFP to any Respondent; (iv) adjust and/or correct any arithmetical error in any Proposal following notification to the applicable Respondent; (v) waive minor irregularities in any Proposal following notification to the applicable Respondent; (vi) adopt, as Roswell Park property, all submitted Proposals and corresponding attachments, and to use any portions thereof which are not specifically noted as proprietary by a Respondent; (vii) change any portion of this RFP following issuance of an Addendum to the Respondents; (viii) cancel and/or limit the scope of this RFP; (ix) consider and accept modifications in any Proposal at any time before the RFP award is made, if such action is in the best interest of Roswell Park, as determined by Roswell Park, in its sole discretion; (x) negotiate with any Respondent to serve the best interests of Roswell Park; and/or (xi) award a Resultant Agreement to any Respondent based on Roswell Park’s RFP evaluation criteria listed in Section 1.9 of this RFP, and not simply based on lowest bid.

2.10 INSURANCE REQUIREMENTS

Throughout the Term, Vendor shall, at its expense, and shall ensure that any Subcontractors, at their expense, maintain the minimum insurance coverages as outline in the Sample Agreement with insurers licensed to do business in New York State and having an A.M. Best rating of A- or greater.

2.11 COSTS TO PREPARE BID RESPONSES

Roswell Park is not responsible, and will not reimburse any Respondent, for any costs incurred by any Respondent in preparing and/or submitting a Proposal, in making any presentations to Roswell Park in relation to this RFP, in providing any demonstrations to Roswell Park in relation to this RFP, and/or in performing any other activities relative to this RFP prior to award of a Resultant Agreement. Furthermore, unless otherwise specified in writing by Roswell Park, Roswell Park is not liable for any costs incurred by the Successful Respondent following award of the RFP until a Resultant Agreement is fully executed, and all required approvals have been obtained by the Successful Respondent from Roswell Park.

2.12 MODIFICATIONS

Except as otherwise provided in this RFP and/or in any bid form and/or attachment hereto, Respondents shall not modify this RFP and/or any RFP forms and/or attachments without the express written approval of Roswell Park.

2.13 DISCREPANCIES

The Respondents are responsible for bringing discrepancies found in this RFP to the attention of Roswell Park.

2.14 LATE PROPOSALS

Late Proposals will not be opened and/or evaluated by Roswell Park. Each Respondent is responsible for assuring that its Proposal is received by Roswell Park by the due date and time indicated in this RFP.

2.15 FINAL AWARD

Final Award would be contingent upon both parties reaching an agreement and/or terms and conditions.

SECTION III – EEO REQUIREMENTS

3.1 EEO REQUIREMENTS OVERVIEW

Roswell Park is required to implement the provisions of NYS Executive Law Article 15-A regarding equal employment opportunities (“EEO”) for minority group members and women (the Rev. Oct. 2018 3 “EEO Requirements”) for all contracts with a value in excess of: (i) $25,000.00 for labor, services (including legal, financial, and other professional services), travel, supplies, equipment, materials, and/or any combination of the foregoing, with the exception of the acquisition, construction, demolition, replacement, major repair, and/or renovation of real property and/or improvements thereon; and (ii) $100,000.00 for the acquisition, construction, demolition, replacement, major repair, and/or renovation of real property and/or improvements thereon (each an “EEO Requirement Threshold”).

Should the EEO Requirement Threshold be met, the Successful Respondent and its subcontractors (each a “Subcontractor”) agree to, in addition to any other non-discrimination provisions set forth in the Resultant Agreement, and at no additional cost to Roswell Park, fully comply and cooperate with Roswell Park in the implementation of the EEO Requirements. These provisions will be deemed supplementary to, and not in lieu of, the non-discrimination provisions required by NYS Executive Law Article 15 (the “Human Rights Law”) and/or any other applicable Federal, State, and local statutory and/or constitutional non-discrimination laws.

The Successful Respondent and its Subcontractors shall: (i) comply with the provisions of the Human Rights Law, and all other Federal, State, and local statutory and constitutional non-discrimination provisions; (ii) not discriminate against any employee and/or applicant for employment because of race, religion, color, national origin, sex (including gender identity and/or expression), sexual orientation, age, disability, predisposing genetic characteristic, marital status, military status, and/or domestic violence victim status; and (iii) follow the requirements of the Human Rights Law with regard to non-discrimination on the basis of prior criminal conviction and prior arrest.

Separate EEO forms, plans, reports, etc., as indicated in this Section III, must be completed as instructed. Failure by any Respondent to comply with this Section III may result in such Respondent being found non-responsive, as determined by Roswell Park, in its sole discretion. Failure by any Successful Respondent and/or Subcontractor to comply with the requirements set forth in this Section III will be considered a breach of contract and may lead to the withholding of funds.

Notwithstanding any language to the contrary, the provisions set forth in this Section III must be incorporated into the Resultant Agreement. In addition, the Successful Respondent will include the provisions set forth in this Section III in every subcontract related to the Resultant Agreement in such a manner that the requirements in this Section III will be binding upon each Subcontractor in connection with the Resultant Agreement.

3.2 EEO REQUIREMENTS

The Successful Respondent and its Subcontractors will undertake or continue existing EEO programs to ensure that minority group members and women are afforded equal employment opportunities without discrimination because of race, religion, color, national origin, sex (including gender identity and/or expression), sexual orientation, age, disability, predisposing genetic characteristic, marital status, military status, and/or domestic violence victim status. For these purposes, EEO will apply in the areas of recruitment, employment, job assignment, promotion, upgrading, demotion, transfer, layoff, and termination, as well as rates of pay or other forms of compensation in connection with the Resultant Agreement.

To ensure compliance with the EEO Requirements, the Respondents must submit an EEO policy statement as part of their Proposals which must include the following:

1. A written statement that the Respondent and any of its proposed subcontractors (each a “Proposed Subcontractor”) will: (i) not discriminate against any employee and/or applicant for employment because of race, religion, color, national origin, sex (including gender identity and/or expression), sexual orientation, age, disability, predisposing genetic characteristic, marital status, military status, and/or domestic violence victim status; (ii) undertake or continue existing EEO programs to ensure that minority group members and women are afforded equal employment opportunities without discrimination; and (iii) make and document its conscientious and active efforts to employ and utilize minority group members and women in its work force.

2. A written statement that the Respondent, if selected as the Successful Respondent, and any of its Proposed Subcontractors, will state in all solicitations and advertisements for employees that, in the performance of the Resultant Agreement, all qualified applicants will be afforded equal employment opportunities without discrimination because of race, religion, color, national origin, sex (including gender identity and/or expression), sexual orientation, age, disability, predisposing genetic characteristic, marital status, military status, and/or domestic violence victim status.

3. A written statement from each employment agency, labor union, and/or authorized representative of workers with which the Respondent and any of its Proposed Subcontractors has/have collective bargaining agreements and/or other similar agreements and/or understandings, that such employment agency, labor union, and/or authorized representative will not discriminate on the basis of race, religion, color, national origin, sex (including gender identity and/or expression), sexual orientation, age, disability, predisposing genetic characteristic, marital status, military status, and/or domestic violence victim status, and that such employment agency, labor union, and/or authorized representative of workers will affirmatively cooperate in the implementation of the EEO Requirements under the Resultant Agreement.

If any Respondent and/or any of its Proposed Subcontractors does/do not have an existing EEO policy statement and/or prefer(s) to use the one Roswell Park has supplied with this RFP, then each such Respondent and/or Proposed Subcontractor may adopt the model statement “EEO Policy Statement” which is attached to this RFP(“Roswell Park-Provided EEO Policy Statement”).

3.3 EEO STAFFING

To ensure compliance with the EEO Requirements, the Respondents, and any of their Proposed Subcontractors, must complete and submit, as part of each Proposal, an “EEO Staffing Plan”, a copy of which is attached to this RFP (an “EEO Staffing Plan”).

3.4 QUARTERLY EEO COMPLIANCE REPORTS

The Successful Respondent will be required to submit to Roswell Park by the 10th day following each end of quarter throughout the Term, workforce employment utilization report(s) detailing updates made to the Successful Respondent’s and/or Subcontractor(s)’ EEO Staffing Plan(s), and information regarding the actual workforce utilized in the performance of the Resultant Agreement by the specified categories listed.

SECTION IV – REQUIRED FORMS

Please review the forms below and include a signed copy in your proposal/response.

SECTION V – SAMPLE AGREEMENTS and REQUIRED LANGUAGE

The documents listed below will form the basis of the agreement between Roswell Park and the successful Respondent. As part of its Proposal, each Respondent must review and incorporate these documents into its submission and provide any requested or applicable information consistent with the terms therein.

Respondents must clearly identify any exceptions by submitting redlined versions of the applicable documents reflecting all proposed changes. The nature and extent of any such redlines will be evaluated as part of the overall selection process and may impact award determination. If a Respondent does not include any redlines, Roswell Park will assume that the Respondent accepts the terms and conditions of these documents as written.

For software, SaaS, hosted, cloud-based, or technology-enabled solutions, Respondents may submit their standard agreement, order form, terms of service, data processing agreement, information security documentation, security exhibits, privacy terms, or other applicable contractual documents as part of their Proposal. Submitted materials will be reviewed as part of Roswell Park's legal, compliance, privacy, and information security review and may form the basis of contract negotiations.

PLEASE NOTE: APPENDIX A ROSWELL PARK REQUIRED CLAUSES and APPENDIX A-1 EEO REQUIREMENTS are considered mandatory documents by New York State. As a public benefit corporation, Roswell Park is unable to accept modifications to these schedules.

Respondents shall review Appendix C and identify any exceptions, alternative controls, or equivalent security measures. Respondents may submit their standard information security policies, security exhibits, Data Processing Agreements (DPAs), SOC reports, security questionnaires, certifications, audit reports, and other relevant security documentation as part of their Proposal.

Roswell Park will evaluate the Respondent's security program, controls, and supporting documentation as part of its overall assessment. Submission of alternative security documentation does not constitute acceptance by Roswell Park of any conflicting or additional terms.

Appendix C establishes Roswell Park's baseline information security requirements. To the extent a Respondent's security documentation conflicts with Appendix C, the parties will work in good faith to resolve such conflicts during contract negotiations; however, Roswell Park's information security requirements shall prevail unless otherwise expressly agreed to in writing as part of the final negotiated agreement.

5.2 Business Associate Agreement (v. 09.2025)

image1.png image2.png image3.jpeg