Secondary Pharmacy Distribution Services

Roswell Park is requesting proposals for secondary pharmacy distribution services to supply oral medications, oral suspensions, and other pharmaceutical medications on an as-needed basis, with proposals due July 29, 2026 at 2:00 PM EST. No set-asides or contracting goals apply to this procurement — SDVOB, MBE, WBE, and DBE goals are all 0.00%.

The scope requires a qualified secondary pharmaceutical distributor with Drug Supply Chain Security Act (DSCSA) compliance and full Track-and-Trace (T3) data reporting capability, a diverse product portfolio with transparent sourcing, real-time inventory visibility including critical-stock access during shortages, temperature-controlled logistics with reliable and fast delivery, flexible ordering terms without long-term commitments, and responsive customer service channels. The agreement will have an initial three-year term with two successive one-year automatic renewals unless either party provides ninety days' notice of non-renewal intent.

Evaluation is weighted as follows: ability to meet Roswell Park's needs and criteria (75%), bidder's qualifications, experience, and references (20%), overall bid response completeness and content (2%), New York State vendor status (1.5%), and Western New York vendor status (1.5%). BluPax Pharmaceuticals, LLC held an identical or substantially similar contract within the past five years. Roswell Park reserves the right to award to a single or multiple respondents, reject any or all proposals, or cancel the RFP entirely.

Respondents must complete a Requirements Questionnaire, submit a comprehensive price file detailing additional medications they can supply, provide minimum three client references with detailed service documentation, and submit an EEO Staffing Plan as part of their proposal. Vendors accessing Roswell Park data or systems must implement security aligned with NIST Cybersecurity Framework, HITRUST, ISO 27001, or CSA Cloud Controls Matrix, including formal patch management, annual penetration testing, FIPS 140-3 encryption in transit and at rest, role-based access controls, and annual cybersecurity awareness training. All contracts require Executive Order 16 certification regarding Russian business operations. Questions are due July 17, 2026 at 12:00 PM EST to Matthew Jankowiak. Proposals must remain valid for 180 days from the due date.