Document text
Request for Proposal: Managed IT Services
Issued by Harborview Family Clinics
RFP number HFC-RFP-2026-014
Issue date 2 October 2026
Proposals due 23 October 2026 at 5:00 p.m. Eastern
Single point of contact Jenna Okafor, Procurement Manager procurement@harborview-clinics.example · (614) 555-0142
1. Background
Harborview Family Clinics operates nine outpatient primary care clinics with 340 staff. Clinical records are kept in a cloud-hosted electronic health record (EHR); scheduling and billing run in a practice management system from the same vendor. Each clinic has a local network, printers and imaging workstations; a small server room at the administrative office hosts six servers.
Our current managed IT services contract ends in January 2027 and will not be renewed. We are looking for one provider to run day-to-day IT support, security monitoring and backup from 30 November 2026, with a transition period overlapping the current provider.
2. Scope of work
The provider will deliver the following services across all nine clinics and the administrative office:
Service desk for all staff, 24 hours a day, 365 days a year
Endpoint management, patching and software deployment
Network and firewall management at ten sites
Microsoft 365 administration, including identity and email security
Endpoint detection and response with security operations center monitoring
Backup and disaster recovery for servers and Microsoft 365
Onsite support at the clinics
Coordination with the EHR vendor and other third-party vendors
Monthly service reporting and quarterly business reviews
Current volumes
Item Quantity
Sites (nine clinics + administrative office) 10
Staff (users) 340
Endpoints (Windows and macOS) 410
Servers 6
Network devices (switches, firewalls, access points) 58
Average service desk tickets per month (last 12 months) 520
Out of scope: EHR application support (provided by the EHR vendor), telephone system, medical devices, purchase of hardware and licenses.
3. Requirements
Must requirements are pass/fail: a proposal that does not meet a must requirement will not be scored. Should requirements are scored under the evaluation criteria. Answer each one in the response form: Meets, Partially meets or Does not meet, with a comment.
ID Requirement Priority
R1 24/7/365 service desk by phone, email and portal, staffed in the United States Must
R2 Priority 1 incidents: response within 30 minutes, 24/7 Must
R3 Signs a HIPAA Business Associate Agreement before any access to systems Must
R4 Endpoint management and patching for 410 Windows and macOS devices; monthly patch compliance of 95% or better Must
R5 Endpoint detection and response with 24/7 security operations center monitoring Must
R6 Daily backup of servers and Microsoft 365; quarterly restore test; RPO 24 hours, RTO 8 hours Must
R7 Onsite support at all nine clinics by the next business day Should
R8 Current SOC 2 Type II report or equivalent independent attestation Should
R9 Monthly service report and quarterly business review Should
R10 Experience supporting EHR and practice management systems in outpatient healthcare Should
4. Timeline
Milestone Date
RFP issued 2 October 2026
Deadline for supplier questions 9 October 2026
Answers published to all suppliers 13 October 2026
Proposals due (5:00 p.m. Eastern) 23 October 2026
Shortlist presentations 4 November 2026
Award decision 13 November 2026
Contract signature (target) 20 November 2026
Transition starts 30 November 2026
Harborview Family Clinics may change these dates. Any change will be sent to all suppliers at the same time.
5. Evaluation criteria
Proposals that meet all must requirements are scored 1 to 5 on each criterion by an evaluation panel of three. Price is scored by formula: lowest 3-year cost ÷ this proposal's 3-year cost × 5, where 3-year cost = one-time price + 3 × annual price. The weighted total decides the ranking.
Criterion What we look for Weight
Technical solution and fit How well the proposal meets the scope and requirements; tools, staffing and escalation 25%
Security and HIPAA compliance Security monitoring, access control, BAA terms, attestations, incident handling 20%
Service levels Response and resolution targets, service desk hours, service credits 15%
Healthcare experience and references Comparable outpatient clients; reference checks 10%
Transition plan Realistic plan and timeline to take over from the current provider 5%
Account management and reporting Named account manager, monthly reports, quarterly reviews 5%
Price (3-year cost) One-time price + 3 × annual price; scored by formula 20%
Total 100%
Scoring scale: 5 exceeds the requirement with clear evidence; 4 fully meets with some added value; 3 meets; 2 partly meets; 1 does not address it.
6. Pricing form
Quote in US dollars, excluding sales tax. Include every fee; anything not quoted here will not be paid. Enter the totals in the response form as well.
Price item One-time, USD Annual, USD
Transition and onboarding n/a
Service desk, endpoint and network management n/a
Security monitoring (EDR and SOC) n/a
Backup and disaster recovery n/a
Onsite support n/a
Reporting and account management n/a
Other (describe)
Total
3-year cost (one-time + 3 × annual)
7. Submission instructions
Submit through the response link sent with this RFP. Answer every field; attach your proposal and any supporting documents (PDF, DOCX or XLSX).
Send questions in writing to procurement@harborview-clinics.example by 9 October 2026. Answers go to all suppliers without naming who asked.
Proposals received after 23 October 2026 at 5:00 p.m. Eastern will not be considered.
Do not contact evaluators or other staff about this RFP. All communication goes through the single point of contact.
Keep your proposal valid for at least 90 days after the due date.
8. Terms and conditions
This RFP is not an offer to contract. Harborview Family Clinics may accept any proposal, reject all proposals, negotiate with one or more suppliers, or cancel the process.
Suppliers bear their own costs of preparing and presenting a proposal.
Information in this RFP is confidential and may be used only to prepare a proposal. Mark any part of your proposal you consider confidential.
Suppliers must disclose any relationship with our staff, board members or evaluators that could be a conflict of interest.
The selected supplier will be asked to sign our services agreement. A proposed contract term is three years, with two optional one-year renewals.
Before any access to our systems the selected supplier must sign our HIPAA Business Associate Agreement.
The selected supplier must carry cyber liability insurance of at least $2,000,000 and professional liability insurance of at least $1,000,000.
Appendix: requirement response sheet
The response form asks for the same answers. Use this sheet if you also attach a written proposal.
ID Priority Meets / Partially meets / Does not meet Comment
R1 Must
R2 Must
R3 Must
R4 Must
R5 Must
R6 Must
R7 Should
R8 Should
R9 Should
R10 Should
Made with Layers — layers.md