31212 - Nurse Triage Line Services

REQUEST FOR PROPOSALS FOR

NURSE TRIAGE LINE SERVICES

FOR

THE CURATORS OF THE UNIVERSITY OF MISSOURI ON BEHALF OF

MU HEALTH CARE RFP # 31212

DUE DATE: MARCH 6, 2026 TIME: 3:00 P.M. CT

THE CURATORS OF THE UNIVERSITY OF MISSOURI

Prepared by:

Melanie Binggeli

Strategic Sourcing Specialist

MU Health Care Supply Chain 2401 LeMone Industrial Blvd.

Columbia, MO 65201

Date Issued: January 28, 2026

RFP # 31212

NURSE TRIAGE LINE SERVICES

INDEX

CONTENTS

Notice to Respondents____________________________________________________Page 3

General Terms and Conditions ______________________________________________Page 4

Instructions to Respondents ________________________________________________Page 10

Detailed Specifications____________________________________________________ Page 14

Proposal Form__________________________________________________________ Page 22

Attachment A SDVE Participation Form________________________________________ Page 24

Attachment B Physician Self-Referral Questionnaire____________________________ Page 25

Attachment C IT and Technical, IR Security, HIPAA____________________________ Page 26

NOTICE TO RESPONDENTS

The University of Missouri requests for Proposals of NURSE TRIAGE LINE SERVICES, RFP# 31212 which will be received by the undersigned at MU Health Care Supply Chain, until MARCH 6, 2026 at 3:00 p.m. CT. The University assumes no responsibility for any vendor's on-time receipt at the designated location for proposal opening. Faxed responses will not be considered.

Specifications and the conditions of Request for Proposals together with the printed form on which Request for Proposals must be made may be obtained by accessing the following website: or from the Strategic Sourcing Specialist identified within this document.

In the event a Respondent chooses to use the Word version of the RFP to aid in the preparation of its response, the Respondent should only complete the response information. Any modification by the Respondent of the specifications provided will be ignored, and the original wording of the RFP shall be the prevailing document.

If you have any questions regarding the RFP, please send them to:

Melanie Binggeli

MU Health Care Supply Chain 2401 LeMone Industrial Blvd. Columbia, Missouri 65201

EMAIL:

All questions regarding the RFP must be received no later than 3:00 p.m. CST on February 13, 2026

The University reserves the right to waive any informality in Request for Proposals and to reject any or all Request for Proposals.

THE CURATORS OF THE UNIVERSITY OF MISSOURI

Prepared by:

Melanie Binggeli

Strategic Sourcing Specialist

MU Health Care Supply Chain

2401 LeMone Industrial Blvd.

Columbia, MO 65201

UNIVERSITY OF MISSOURI GENERAL TERMS AND CONDITIONS

Except as otherwise specifically provided herein:

"University" shall refer to The Curators of the University of Missouri.

"Respondent" refers to the person or entity that is responding to this Solicitation.

"Supplier" shall mean the successful Respondent(s) awarded a Contract as a result of this Solicitation.

"Solicitation" shall mean the Request for Quotation, Request for Qualification, Request for Bids, Request for Proposal, or other competitive procurement process for which Respondent is submitting a response.

"Contract" shall mean the contract awarded pursuant to this Solicitation.

Governing Laws and Regulations: Any Contract issued as a result of this Solicitation shall be governed by the laws of the State of Missouri without giving effect to the conflict of laws principles. Any action to enforce the provisions of a Contract issued as a result of this Solicitation shall be brought in a court of competent jurisdiction and proper venue in the State of Missouri. Additionally, the Supplier shall comply with all local, state, and federal laws, ordinances and regulations related to the performance of the Contract to the extent that the same may be applicable.

Taxes: The Supplier shall assume and pay all taxes and contributions including, but not limited to, State, Federal and Municipal which are payable by virtue of the furnishing and delivery of item(s) specified herein. Materials and services furnished the University are not subject to either Federal Excise Taxes or Missouri Sales Tax.

Sovereign Immunity: The Curators of the University of Missouri, due to its status as a state entity and its entitlement to sovereign immunity, is unable to accept contract provisions, which require The Curators to indemnify another party (537.600, RSMo). Neither the issuance of this Solicitation, resulting Contract nor any other conduct, action or inaction of any University representative relating to the Solicitation and any resulting Contract is a waiver of sovereign immunity by the University. Any indemnity language in proposed terms and conditions will be modified to conform to language acceptable to the University.

Preference for Missouri Firms: In accordance with University policy, preference shall be given to Missouri products, materials, services, and firms when the goods or services to be provided are equally or better suited for the intended purpose. In assessing overall value, consideration will be given to the extent to which proximity or Missouri preference of the Respondent provides potential advantages or reduction of risks. Firms are considered "Missouri firms" if they maintain a regular place of business in the State of Missouri.

Appropriation: The Curators of the University of Missouri is a public corporation and, as such, cannot create indebtedness in any one year (the fiscal year beginning July 1 to June 30) above what they can pay out of the annual income of said year as set forth in 172.250, RSMo. Therefore, if the University determines it has not received adequate appropriations, budget allocations or income to enable it to meet the terms of the awarded Contract, the University reserves the right to cancel the Contract with 30 days' notice.

Non-Discrimination: In connection with the furnishing of equipment, supplies, and/or services under the Contract, the Supplier and all subcontractors shall not discriminate against any recipients of services, or employees or applicants for employment on the basis of race, color, national origin, ancestry, religion, sex, pregnancy, age, disability, protected veteran status, or any other status protected by applicable state or federal law, and federal funds, if any, may not be used for programs that discriminate based on any such protected status.

The University serves from time to time as a contractor for and/or receives grant funding from the United States government and/or State of Missouri. Accordingly, the Supplier shall comply with all applicable state and federal laws, rules, regulations, and executive orders applicable to subcontractors of government contractors or to contractors of grant recipients, including those relating to non-discrimination, as each may be amended from time to time. Contract clauses required by the United States government or State of Missouri in such circumstances are incorporated herein by reference.

OSHA requirements: All items or services to be furnished hereunder shall meet all applicable State and Federal requirements of the Occupational Safety and Health Standard. All alleged violations and deviations from said State and Federal regulations or standards of the items of services to be furnished hereunder, must be set forth at the time of submission of the response. Or if at any later date the items or services contained herein shall not meet all applicable state and federal requirements after the Supplier is awarded the Contract hereunder, the Supplier must notify UM Procurement immediately in writing.

Anti-Discrimination Against Israel Act: If the Contract resulting from this Solicitation involves the acquisition or disposal of services, supplies, information technology, or construction and has a total potential value of $100,000 or more, and if Supplier is a company with ten (10) or more employees, then Supplier certifies that it, and any company affiliated with it, does not boycott Israel and will not boycott Israel during the term of the Contract. In this paragraph, the terms "company" and "boycott Israel" shall have the meanings described in Section 34.600 of the Missouri Revised Statutes.

Applicable Digital Accessibility Laws and Regulations: The University affords equal opportunity to individuals with disabilities in its employment, services, programs and activities in accordance with federal and state laws, including , Section 508 of the Rehabilitation Act, and RSMo. 161.935. This includes effective communication and access to electronic and information communication technology resources, and the University expects that all products will, to the greatest extent possible, provide equivalent ease of use for individuals with disabilities as for non-disabled individuals. The University of Missouri has adopted the Web Content Accessibility Guidelines (WCAG) 2.2 A and AA as the minimum standard.

Supplier shall: (1) deliver all applicable services and products in reasonable compliance with University standards (Web Content Accessibility Guidelines 2.2, Level A and AA or above); (2) provide the University with an Accessibility Conformance Report detailing the product's current accessibility according to WCAG standards using the latest version of the Voluntary Product Accessibility Template (VPAT); (3) if accessibility issues exist, provide a "roadmap" plan for remedying those deficiencies on a reasonable timeline to be approved by the University; (4) within 15 days of notice respond to assist the University with resolving any accessibility complaints and requests for accommodation from users with disabilities resulting from Supplier's failure to meet WCAG 2.2 A and AA guidelines at no cost to the University; and (5) indemnify and hold the University harmless in the event of any claims arising from inaccessibility. If supplier does not currently comply with WCAG 2.2 A and AA, they must provide confirmation that they have a roadmap in place to comply.

When installation, configuration, integration, updates, or maintenance are provided, the Supplier must ensure these processes are completed in a way that does not reduce the original level of WCAG conformance. If at any point after procurement it is determined that accessibility improvements need to be made in order to comply with the WCAG 2.2 A and AA standards, the Supplier agrees to work with the University to remedy the non-compliance by submitting a roadmap detailing a plan for improvement on a reasonable timeline; provided, however, that any such improvements shall be implemented within 15 days of notice. Resolution of reported accessibility issue(s) that may arise should be addressed as high priority, and failure to make satisfactory progress towards compliance with WCAG, as agreed to in the roadmap, shall constitute a breach of contract and be grounds for termination or non-renewal of the agreement. The foregoing requirements are subject to the discretion of the University of Missouri System Director of Accessibility and ADA Coordinator.

Applicable Health Related Laws and Regulations: If these specifications or any resulting Contract involves health care services or products, then the following provisions apply: (i)Supplier agrees to maintain and will further assure such compliance by its employees or subcontractors, the confidential nature of all information which may come to Supplier with regard to patients of the University. All services provided pursuant to this Contract shall be provided in accordance with all applicable federal and state laws including The Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, sections 261-264 (the Administrative Simplification sections) and any other regulatory agency; (ii) Supplier represents that it is not excluded from participating in federal health care programs including Medicare and Medicaid, and is not debarred or suspended or listed on the General Services Administration's List of Parties Excluded from Federal Procurement or Nonprocurement Programs; Supplier will notify University if it becomes excluded, debarred, or suspended during the term of the resulting Contract, Supplier will correct any breach of warranty at Supplier's sole expense. University does not waive any warranty by acceptance of goods, services or payment, and reserves all rights and remedies; and (iii) If the Supplier should be deemed a subcontractor of the University subject to the disclosure requirements of 42 U.S.C. 1395x(v)(1), Supplier shall, until the expiration of four years after the furnishing of services pursuant to the resulting Contract, make available upon request to the Secretary, U.S. Department of Health and Human Services, and the U. S. Comptroller General, or any of their duly authorized representatives, a copy of the resulting Contract and the books, documents and records of services that are necessary to certify the nature and extent of the costs incurred under this resulting Contract by Supplier. If services or any duties of the resulting Contract are through a subcontractor with a value or cost of $10,000 or more over a 12-month period with a third party, such subcontract shall contain a clause to the effect that should the third party be deemed a related organization, until the expiration of four years after the furnishing of services pursuant to such subcontract, the third party shall make available upon request to the Secretary, U.S. Department of Health and Human Services, and the U. S. Comptroller General, or any of their duly authorized representatives, a copy of the subcontract and the books, documents and records of such third party that are necessary to verify the nature and extent of the costs incurred under this resulting Contract by Supplier. No attorney-client, accountant-client or other legal privilege will be deemed to have been waived by either Party as a result of this resulting Contract; (iv) In relation to and for purposes of compliance with the "Stark" law, 42 U.S.C. 1395nn, Supplier represents and warrants that: (i) it is not a physician owned distributor or "POD", (ii) it is not owned by one or more providers or physicians (as defined by the Stark law), and (iii) there are no physicians or providers with investment interests in the Supplier, in the case of (ii) and (iii) where any such ownership or investment interest would cause this arrangement to create a financial relationship between a "DHS entity" and a physician (hereinafter a "Stark Entity"). In the event the above representation and warranty changes so that it is inaccurate, Supplier will provide University with prompt written notice and the parties will negotiate any amendments to this Agreement necessary to ensure compliance with the Stark law.

Excluded Individuals/Entities: The University will regularly check the "List of Excluded Individuals/Entities" (LEIE), maintained by the Office of Inspector General, United States Department of Health and Human Services ("OIG") to determine if any Respondents have been excluded from participation in federal health care programs, as that term is defined in 42 U.S.C. 1320a-7b(f). The University reserves the sole right to reject any Respondents who are excluded by the OIG, who have been debarred by the federal government, or who have otherwise committed any act that could furnish a basis for such exclusion or debarment.

Compliance with CDC Guidelines (if applicable): Supplier will monitor and comply with CDC and other federal, state, and local guidance related to any pandemic or global health concern; modifications to University operating procedures; and directives of University relating to protection of the health and safety of the University community.

Inventions, Patents, and Copyrights: The Supplier shall pay for all royalties, license fees, patent or invention rights, or copyrights and defend all suits or claims for infringements of any patent or invention right or copyrights involved in the items furnished hereunder. The Supplier shall indemnify, defend, protect, and hold harmless the University its officers, agents, servants, and employees against all suits of law or in equity resulting from patent and or copyright infringement concerning the Supplier's performance or products produced under the terms of the Contract.

Copyrights for any item developed for the University shall be the property of the University and inure to its benefit and the Supplier shall execute such documents as the University may require for the perfection thereof.

Gifts: Any Respondent to this Solicitation or Supplier shall refrain from offering any offers of gifts to the University, and all University of Missouri employees, in accordance with University of Missouri Policy #26301, Suppliers.

Third Party Software: If the resulting Contract contemplates or requires the use of third-party software, Supplier represents that none of the mandatory click-through, unsigned, or web-linked terms and conditions presented or required before using such third-party software conflict with any term of the resulting Contract or that it has authority to modify such third-party software's terms and conditions to be subordinate to the resulting Contract. Supplier shall indemnify and defend University against all claims resulting from an assertion that any such third-party terms and conditions are not in accord with, or subordinate to, the resulting Contract.

University Premises: If this resulting Contract requires Supplier's presence on University's premises or in University's facilities, Supplier will cause its employees, representatives, agents, and subcontractors to become aware of, fully informed about, and in full compliance with all applicable University rules and policies, including but not limited to those relative to personal health, security, environmental quality, safety, fire prevention, noise, smoking, and access restrictions.

Use of University Marks: Supplier shall not use the name or indicia of the University, nor of any of University's employees, in any manner of publicity, advertising, or news releases without prior written approval of the University.

Debarment and Suspension Certification: The Supplier certifies to the best of its knowledge and belief that it and its principals are not presently debarred, suspended, proposed for debarment, declared ineligible, or voluntarily excluded from covered transactions by any Federal department or agency in accordance with Executive Order 12549 (2/18/86).

Cooperative Purchasing: The intended coverage of this Solicitation, and any Agreement resulting from this Solicitation, shall be for the use by any MU Health Care locations. It shall also be available for use by all faculty, staff, students, departments, locations, and affiliates of the University of Missouri, as applicable. MU Health also has various affiliates.

MU Health Care seeks to make the terms and prices of this Contract available to MUHC's affiliates. Unless specifically included in the scope of the solicitation event, extension of the terms and prices to any or all affiliates is at the discretion of Supplier and shall not be considered in the award of this Contract. The Supplier shall further understand and agree that participation by affiliates is discretionary on the part of the affiliates, and MU Health Care bears no financial responsibility for any payments due the Supplier by such entities, nor will the MU Health Care be responsible for contract administration for affiliates.

Contract Assignment: The Contract to be awarded and any amount to be paid thereunder shall not be transferred, sublet, or assigned without the prior approval of the University.

Contract Termination for Cause: In the event the Supplier violates any provisions of the resulting Contract, the University may serve written notice upon Supplier and Surety setting forth the violations and demanding compliance with the Contract. Unless within ten (10) days after serving such notice, such violations shall cease and satisfactory arrangements for correction be made, the University may terminate the Contract by serving written notice upon the Supplier; but the liability of Supplier and Surety for such violation; and for any and all damages resulting there from, as well as from such termination, shall not be affected by any such termination.

Contract Termination for Convenience: The University reserves the right, in its best interest as determined by the University, to cancel the resulting Contract by giving written notice to the Supplier thirty (30) days prior to the effective date of such cancellation.

Force Majeure: University shall not be responsible for any failure to perform or delay in performing any of its obligations under this Agreement where and to the extent that such failure or delay results from causes outside the reasonable control of University. Such causes shall include, without limitation, war (whether declared or not), armed conflict or the serious threat of the same (including but not limited to hostile attack, blockade, military embargo), hostilities, invasion, act of a foreign enemy, extensive military mobilization; civil war, riot, rebellion, revolution, military or usurped power, insurrection, civil commotion or disorder, mob violence, act of civil disobedience; act of terrorism, sabotage or piracy; plague, epidemic, pandemic, outbreaks of infectious disease or any other public health crisis, including quarantine or other employee restrictions; act of authority whether lawful or unlawful, compliance with any law or governmental order, rule, regulation or direction, curfew restriction, expropriation, compulsory acquisition, seizure of works, requisition, nationalization; act of God or natural disaster such as but not limited to violent storm, cyclone, typhoon, hurricane, tornado, blizzard, earthquake, volcanic activity, landslide, tidal wave, tsunami, flood, damage or destruction by lightning, drought; explosion, fire, destruction of machines, equipment, factories and of any kind of installation, prolonged break-down of transport, telecommunication or electric current; general labor disturbance such as but not limited to boycott, strike and lock-out, go-slow, occupation of factories and premises; shortage or inability to obtain critical material or supplies, and the like.

Warranty and Acceptance: The Supplier expressly warrants that all equipment, supplies, and/or services provided shall: (1) conform to each and every specification, drawing, sample or other description which was furnished or adopted by the University, (2) be fit and sufficient for the purpose expressed in the Solicitation, (3) be merchantable, (4) be of good materials and workmanship, (5) be free from defect. Such warranty shall survive delivery and shall not be deemed waived either by reason of the University's acceptance of or payment for such equipment, supplies, and/or services.

No equipment, supplies, and/or services received by the University pursuant to a Contract shall be deemed accepted until the University has had a reasonable opportunity to inspect said equipment, supplies and/or services. All equipment, supplies, and/or services which do not comply with specifications and/or requirements or which are otherwise unacceptable or defective may be rejected. In addition, all equipment, supplies, and/or services which are discovered to be defective or which do not conform to any warranty of the Supplier upon inspection (or at any later time if the defects contained were not reasonably ascertainable upon the initial inspection) may be rejected.

The bidder hereby guarantees that no article listed herein is adulterated or misbranded within the meaning of the Federal Food, Drug and Cosmetic Act or an article which may not, under the provisions of Federal Law, be introduced into interstate commerce.

Accounting Practices: The Supplier shall maintain, during the term of the Contract, all books of account, reports, and records in accordance with generally accepted accounting practices and standard for records directly related to this Contract. The Supplier agrees to make available to the University, during normal business hours, all book of account, reports and records relating to this Contract for the duration of the Contract and retain them for a minimum period of one (1) year beyond the last day of the Contract term. In the event time and materials are a portion of this bid, the University reserves the right to audit supplier's records concerning this bid.

Personal Information: If Respondent provides any "personal information" as defined in 105.1500, RSMo concerning an entity exempt from federal income tax under Section 501(c) of the Internal Revenue Code of 1986, as amended, Respondent understands and agrees that it is voluntarily choosing to seek a contract with an entity of the State of Missouri and providing such information for that purpose. The University will treat such personal information in accordance with 105.1500, RSMo.

UNIVERSITY OF MISSOURI

INSTRUCTIONS TO RESPONDENTS

"University" shall refer to The Curators of the University of Missouri.

"Respondent" refers to the organization that is interested in or responds to this Solicitation.

"Supplier" shall mean the successful Respondent(s) awarded a Contract as a result of this Solicitation.

"Solicitation" shall mean the Request for Quotation, Request for Qualification, Request for Bids, Request for Proposal, or other competitive procurement process for which Respondent is submitting a response.

"Contract" shall mean the contract awarded pursuant to this Solicitation.

Solicitation Document: Respondents are expected to examine the complete Solicitation document and all attachments including, but not limited to, drawings, specifications, and instructions. Failure to do so is at Respondents' risk. It is Respondents' responsibility to ask questions, request changes or clarifications, or otherwise advise the University if any language, specifications, or requirements of the Solicitation appears to be ambiguous, contradictory, and/or arbitrary, or appear to inadvertently restrict or limit the requirements stated in the Solicitation to a single source.

Any and all communications from Respondents regarding specifications, requirements, or the Solicitation process should be directed to the University buyer of record referenced.

This Solicitation and any attachments constitute the complete set of specifications and response forms. No verbal or written information that is obtained other than through this Solicitation or its addenda shall be binding on the University. No employee of the University is authorized to interpret any portion of this Solicitation or give information as to the requirements of the Solicitation in addition to that contained in or amended to this written Solicitation document. In case of any doubt or difference of opinion as to the true intent of the Solicitation, the decision of the University's Chief Procurement Officer shall be final and binding on all parties.

2. Preparation of Solicitations: All Solicitation responses must be submitted in the format as specified in the detailed specifications. To receive consideration, Solicitation responses must be received prior to the due date and time stated.

Unless otherwise specifically stated in the Solicitation, all specifications and requirements constitute minimum requirements. All Solicitation responses must meet or exceed the stated specifications or requirements. All equipment and supplies offered must be new, of current production, and available for marketing by the manufacturer unless the Solicitation clearly specifies that used, reconditioned, or remanufactured equipment and supplies may be offered. Unless specifically stated and allowed in the Solicitation, all pricing submitted in response to this Solicitation is firm and fixed.

Whenever the name of a manufacturer, trade name, brand name, or model and catalog numbers followed by the words "or equal" or "approved equal" are used in the specifications, it is for the purpose of item identification and to establish standards of quality, style, and features. Proposals on equivalent items of the same quality are invited. However, to receive consideration, such equivalent proposals must be accompanied by sufficient descriptive literature and/or specifications to clearly identify the item and provide for competitive evaluation. The University will be the sole judge of equality and suitability. Whenever the name of a manufacturer is mentioned in the specifications and the words "or equal" do not follow, it shall be deemed that the words "or equal" follow unless the context specifies "no substitution." Unless noted in the specifications and/or on the proposal form, it will be deemed that the article furnished is that designated by the specifications. The University reserves the right to return, at Supplier's expense, all items that are furnished which are not acceptable as equals to items specified and Supplier agrees to replace such items with satisfactory items at the original proposed price.

Time will be of the essence for any orders placed as a result of this Solicitation. The University reserves the right to cancel any orders, or part thereof, without obligation if delivery is not made in accordance with the schedule specified by the Suppliers response and accepted by the University. Unless otherwise specified in the detailed specifications and/or on the proposal form, pricing shall include all packing, handling, and shipping charges FOB destination, freight prepaid and allowed. Risk of loss or damage to the goods prior to the time of their receipt and acceptance by the University is upon the Supplier.

3. Submission of Solicitation: Respondent shall furnish information required by the Solicitation in the form requested. All Solicitation responses shall be submitted by a duly authorized representative of Respondent's organization.

By submitting a response to this Solicitation, Respondent agrees to provide the specified equipment, supplies and/or services in the Solicitation, at the prices quoted, pursuant to all requirements and specifications contained therein. Furthermore, Respondent certifies that: (1) the Solicitation response is genuine and is not made in the interest of or on behalf of any undisclosed person, firm, or corporation, and is not submitted in conformity with any agreement or rules of any group, association, or corporation; (2) Respondent has not directly or indirectly induced or solicited any other Respondent to submit a false or sham response to this Solicitation; (3) Respondent has not solicited or induced any person, firm, or corporation to refrain from responding; (4) Respondent has not sought by collusion or otherwise to obtain any advantage over any other respondent or over the University.

If Respondent provides any "personal information" as defined in 105.1500, RSMo concerning an entity exempt from federal income tax under Section 501(c) of the Internal Revenue Code of 1986, as amended, Respondent understands and agrees that it is voluntarily choosing to seek a contract with an entity of the State of Missouri and providing such information for that purpose. University will treat such personal information in accordance with 105.1500, RSMo.

Withdrawal and Resubmission of Solicitation Response: Prior to the date and time designated for receipt of Solicitation response, Respondent may withdraw their response in writing to the buyer of record by a duly authorized respondent representative. Such withdrawal should be completed prior to the designated date and time for receipt of submission. Respondent may resubmit a withdrawn response up to the time designated for receipt of Solicitation response provided the resubmitted response complies with the Solicitation document. Respondent may not withdraw its response for a period of ninety calendar days after the time designated for receipt of Solicitation responses, unless the response contains an obvious and documented error for which it would be a manifest injustice to require Supplier to perform pursuant to such terms.

Open Records & Confidentiality: All submissions, information, and materials received by the University in connection with a Solicitation response shall be deemed open records pursuant to 610.021 RSMo. If Respondent believes any of the information contained in Respondent's response is exempt from 610.021 RSMo, Respondent's response must specifically identify the material which is deemed to be exempt and cite the legal authority for the exemption; otherwise, the University will treat all materials received as open records. The University shall make the final determination as to what materials are or are not exempt.

Evaluation and Award: Any clerical errors, apparent on its face, may be corrected by the University before Contract award. Upon discovering an apparent clerical error, the University shall contact Respondent and request clarification of the intended submission. The correction shall be incorporated in the notice of award. The University reserves the right to request clarification of any portion of Respondent's response in order to verify the intent. Respondent is cautioned, however, that its response may be subject to acceptance or rejection without further clarification.

The University reserves the right to make an award to the responsive and responsible Respondent whose product or service meets the terms, conditions, and specifications of the Solicitation and whose submission is considered to best serve the University's interest. In determining responsiveness and the responsibility of the Respondent, the following shall be considered when applicable: the ability, capacity, and skill of Respondent to perform as required; whether Respondent can perform promptly, or within the time specified without delay or interference; the character, integrity, reputation, judgment, experience and efficiency of Respondent; the quality of past performance by Respondent; the previous and existing compliance by Respondent with related laws and regulations; the sufficiency of Respondent's financial resources; the availability, quality and adaptability of Respondent's equipment, supplies and/or services to the required use; the ability of Respondent to provide future maintenance, service and parts.

The University reserves the right to make multiple awards, to accept or reject any or all responses, and to waive any technicality or informality in response to the Solicitation at the University's sole discretion.

The University has established formal protest procedures. For more information about these procedures, contact the Buyer of Record. In case of any doubt or difference of opinion as to the items and/or services to be furnished hereunder, the decision of the Assistant Vice President of Management Services, UM System shall be final and binding upon all parties.

Contract Award and Assignment: The successful Respondent(s) shall enter into a Contract with the University in a form approved by the University. The Contract Documents shall include, unless otherwise specified in the resulting Contract, the Advertisement for Solicitation, Specifications and Addenda, Exhibits, Solicitation Form and Terms and Conditions, Form of Contract, Statement of Work, Letter of Award, University Purchase Order, and Form of Performance Bond, if required.

Payment: Preferred settlement method is through the use of Electronic Accounts Payable solutions. Payment terms associated with these forms of payment will be issued as net 30 after the date of invoice. Payment terms associated with settlement by check will be net 30 days. Cash discounts for prompt payment may be offered, but they will not be considered in determination of award unless specifically stated in the Detailed Specifications. The University may withhold payment or make such deductions as may be necessary to protect the University from loss or damage on account of defective work, claims, damages, or to pay for repair or correction of equipment or supplies furnished hereunder. Payment may not be made until satisfactory delivery and acceptance by the University and receipt of correct invoice have occurred.

For consulting services and/or contract labor services performed for MU Health Care, the hourly rate and the number of hours worked must be included in the agreement and/or on the invoice submitted. Payment may not occur unless this information has been provided.

The University encourages Respondents to opt into its Single-Use Account (SUA) credit card program for payment of invoices. The SUA is an electronic, credit card-based payment solution that acts like a check. It provides a single 16-digit virtual account number for each payment. Similar to a check, the credit limit on each SUA is set to the specific payment amount. Payment terms for Respondents who participate in the SUA program are Net 0 as opposed to the standard Net 30 terms.

Service-Disabled Veteran Business Enterprise (SDVE) Preference: In accordance with section 34.074, RSMo, the Supplier should secure participation of qualified service-disabled veteran business enterprises (SDVE) in providing the products/services required herein. A three (3)-point bonus preference shall be granted to Suppliers who are a qualified SDVE or that provide at least three percent (3%) SDVE participation of the total contract value through the use of qualified SDVE subcontractors or suppliers.

In order to be considered a qualified SDVE, the SDVE must be certified by the State of Missouri, Office of Administration by the proposal opening date (date the proposal is due). The University will not accept certification from entities other than the State of Missouri, Office of Administration.

SDVE means a business that meets the requirements in section 34.074, RSMo and the implementing regulations of the State of Missouri, Office of Administration: doing business as a Missouri firm, a corporation, or individual or maintaining a Missouri office or place of business, not including an office of a registered agent; having not less than fifty-one percent (51%) of the business owned by one (1) or more service-disabled veterans (SDVs) or, in the case of publicly-owned business, not less than fifty-one percent (51%) of the stock of which is owned by one (1) or more SDVs; having the management and daily business operations controlled by one (1) or more SDVs; and the SDV possesses the power to make day-to-day as well as major decisions on matters of management, policy, and operation.

The services performed or the products provided by the SDVE must provide a commercially useful function related to the delivery of the contractually required service/product in a manner that will constitute an added value to the contract and shall be performed/provided exclusive to the performance of the contract. If the Supplier uses the services performed or the products provided by the SDVE, to any extent, in the Supplier's obligations outside of the contract, it shall not be considered a valid added value to the contract and shall not qualify as participation in accordance with this clause.

Shipments shall be marked as directed on the resulting Purchase Order or Contract.

The University shall not be responsible for articles or services furnished without a Purchase Order.

All invoices and correspondence shall show the Purchase Order Number. All invoices must contain full descriptive information on items or service furnished. Separate invoices shall be rendered for each order and forwarded to the University.

UNIVERSITY OF MISSOURI

DETAILED SPECIFICATIONS

OBJECTIVE

The Curators of the University of Missouri, a public organization, propose to contract on behalf of MU Health Care (hereinafter referred to as "MUHC") with an organization (hereinafter referred to as "Respondent"), to provide Nurse Triage Line Services as described herein.

SCOPE

MU Health Care is seeking proposals from qualified professional firms interested in providing Nurse Triage Line Services.

University Physicians (UP) and University of Missouri Health Care (MUHC) are seeking proposals for an after-hours Nurse Triage solution. The desired solution will increase the efficiency and reduce cost to MUHC and UP while delivering the highest quality care and service to our patients.

The vendor selected should staff their center with registered nurses utilizing software with symptom-driven guidelines written by Barton Schmitt, M.D., Pediatrics and David Thompson, M.D., Adult and Adolescent. The call center should also be accredited by the Utilization Review Accreditation Commission (URAC) and provide both adult and pediatric medical oversight by Board-Certified Physicians.

The service provider must partner with and maintain a continual relationship with University personnel and their contracted representatives as necessary to meet the objectives in operating and refining the system, including future upgrades.

The University will select one firm to manage this process with the possibility of expansion to 24/7 call center scheduling service in the future.

Vendors may be required to provide demo/presentations to the RFP review team. Once response have been received, opened, and reviewed, invites will be sent to those vendors selected to participate in presentations if required.

This RFP may be awarded to a single or multiple suppliers as determined to be in the best interests of MUHC at the sole discretion of MUHC.

BACKGROUND INFORMATION

MU Health Care is comprised of seven hospitals: Capital Region Medical Center, Children's Hospital, Ellis Fischel Cancer Center, Missouri Orthopedic Institute, Missouri Psychiatric Center, University Hospital, and Women's Hospital, as well as approximately 60 outpatient clinics. The inpatient hospitals have a combined 600 beds. Affiliates of MU Health Care include Columbia Surgical Associates and Rusk Rehabilitation Center.

CONTRACT PERIOD

The contract period shall be from the date of award for one (1) year with the option to renew for four (4) additional one-year periods.

Each respondent is required to state their maximum percent increase for items awarded for the successive annual renewal periods, if applicable. The percent increase shall be a percentage change in the unit prices and shall not exceed that percent. The percent increase will be considered when evaluating the financial proposals.

INSTRUCTIONS FOR PROPOSAL RESPONSE

Responses should be enumerated in the same order and fashion of the Mandatory and Desirable Specifications outlined within. Respondents are required to fully respond with compliance statements to each of the mandatory specifications. Respondents are required to fully respond with a description of ability and how to meet the evaluation criteria.

Respondents must be clear and concise in responses in order to be fully credited in the evaluation. Attach and reference any relevant documentation that would ensure the evaluating committee that both Mandatory and Desirable specifications are met. If "no response" or insufficient response to substantiate compliance is provided, MUHC reserves the sole right to reject respondent's response from further consideration.

Proposals are to be submitted in two (2) emails (not password protected) in the following manner.

Volume I - Functional Response - Response to mandatory and desirable criteria. Do not include financial information in this response.

Volume II - Financial Response - Include financial response, including proposal form, authorized respondent information, and Attachments A, B & C.

All proposals must be submitted via electronic mail to Melanie Binggeli at gerhardtm@health.missouri.edu. Subject line of emails to read RFP #31212, NURSE TRIAGE LINE SERVICES, Volume I and Volume II, respectively.

If there is a supplier related contract that must be signed as part of doing business, it should be included with the proposal response.

Respondent must complete and return the MUHC Proposal Form with their proposal response. Supplier quote sheets are not acceptable forms of bidding and could cause rejection of proposal.

Note: Any Respondent's proposal that makes material modifications to the University's Terms and Conditions may be found non-responsive, as solely determined by MUHC.

EVALUATION AND CRITERIA FOR AWARD OF PROPOSAL

Respondents must meet the mandatory/limiting criteria to be "qualified" for scoring. If requirements are not met, the respondents are disqualified from further evaluation/award. Qualified remaining respondents will be scored on their ability to meet scored desirable criteria, which includes qualitatively, how specifications are met. A team of MUHC individuals will evaluate and assign points to suppliers' responses to the evaluation questions. At the sole option of MUHC, the functional/technical review team may decide to go on a site visit, at their expense, or request suppliers to perform a presentation/demonstration to confirm specifications are met as provided in responses. MUHC could elect to not award to a potential respondent if site visits/presentations revealed compliance inconsistency.

MUHC may request suppliers selected as finalists to come onsite to the University, at the supplier's expense, for presentations as part of the RFP selection. Virtual presentations via Zoom may also be used at MUHC's discretion.

Proposals will be awarded based upon the functional and financial evaluation.

INSURANCE REQUIREMENTS

Supplier agrees to maintain, on a primary basis and at its sole expense, at all times during the life of any resulting contract the following insurance coverages, limits, including endorsements described herein. The requirements contained herein, as well as the University's review or acceptance of insurance maintained by Supplier is not intended to and shall not in any manner limit or qualify the liabilities or obligations assumed by Supplier under any resulting contract. Coverage to be provided as follows by a carrier with A.M. best minimum rating of A-VIII.

Commercial General Liability Supplier agrees to maintain Commercial General Liability at a limit of not less than $1,000,000 Each Occurrence, 2,000,000 Annual Aggregate. Coverage shall not contain any endorsement(s) excluding nor limiting Product/Completed Operations, Contractual liability, or Cross liability.

Supplier may satisfy the minimum liability limits required for Commercial General Liability or Business Auto liability under an Umbrella or Excess liability policy. There is no minimum per occurrence limit of liability under the Umbrella or Excess liability; however, the Annual Aggregate limit shall not be less than the highest "Each Occurrence" limit for either Commercial General Liability or Business Auto liability. Supplier agrees to endorse the officers, employees, and agents of The Curators of the University of Missouri as Additional Insured on the Umbrella or Excess Liability, unless the Certificate of Insurance state the Umbrella or Excess Liability provides coverage on a "Follow-Form" basis.

Business Auto Liability (if required in service performance) Supplier agrees to maintain Business Automobile Liability at a limit not less than $1,000,000 Each Occurrence. Coverage shall include liability for Owned, Non-Owned & Hired automobiles. In the event Supplier does not own automobiles, Supplier agrees to maintain coverage for Hired & NonOwned Auto liability, which may be satisfied by way of endorsement to the Commercial General Liability policy or separate Business Auto Liability policy.

Workers' Compensation & Employers Liability Supplier agrees to maintain Workers' Compensation in accordance with Missouri State Statutes or provide evidence of monopolistic state coverage. Employers Liability with the following limits: $500,000 each accident, disease each employee and disease policy limit.

Professional Liability Supplier agrees to maintain Professional Liability at a limit of not less than $1,000,000 Each Occurrence, $3,000,000 Aggregate.

Data Breach If capturing, transmitting or access to PII, PHI or PCI then coverage must also include Data Breach coverage of $1,000,000 per occurrence.

Contract Language

The officers, employees and agents of The Curators of the University of Missouri are to be Additional Insured with respect to the project to which these insurance requirements pertain. A certificate of insurance evidencing all coverage required is to be provided at least 10 days prior to the inception date of the contract between the supplier and the University. Supplier is required to maintain coverages as stated and required to provide written notice of cancellation according to the policy provisions. The University reserves the right to request a copy of the policy. The University reserves the right to require higher limits on any contract provided notice of such requirement is stated in the request for proposals for such contract.

Indemnification

The Supplier agrees to defend, indemnify, and save harmless The Curators of the University of Missouri, their Officers, Agents, Employees and Volunteers, from and against all loss or expense from any cause of action arising from the Supplier's operations. The supplier agrees to investigate, handle, respond to and provide defense for and defend against any such liability, claims, and demands at the sole expense of the Supplier or at the option of the University, agrees to pay to or reimburse the University for the Defense Costs incurred by the University in connection with any such liability claims, or demands.

The parties hereto understand and agree that the University is relying on, and does not waive or intend to waive by any provision of this Contract, any monetary limitations or any other rights, immunities, and protections provided by the State of Missouri, as from time to time amended, or otherwise available to the University, or its officers, employees, agents or volunteers.

Failure to maintain the required insurance in force may be cause for contract termination. In the event the Agency/Service fails to maintain and keep in force the required insurance or to obtain coverage from its subcontractors, the University shall have the right to cancel and terminate the contract without notice.

The insurance required by the provisions of this article is required in the public interest and the University does not assume any liability for acts of the Agency/Service and/or their employees and/or their subcontractors in the performance of this contract.

BUSINESS ASSOCIATE REQUIREMENTS

If the services requested by MUHC via this RFP require the respondents to use and/or disclose protected health information (PHI), a "Business Associate" relationship exists. The following 19 identifiers, together or individually, may constitute PHI:

Names;

All geographic subdivisions smaller than a state (e.g. street address, city, county, precinct, zip code);

All dates related to the individual (e.g. date of birth, admission date, discharge date, date of death);

Telephone number;

Fax number;

Electronic mail addresses;

Social Security Number {SSN);

Medical record number;

Health plan numbers;

Account numbers;

Certificate or license numbers;

Vehicle identification/serial numbers, including license plate numbers;

Device identification/serial numbers;

Universal resource locators (URL's);

Internet protocol (IP) addresses;

Biometric identifiers;

Full face photographs and comparable images;

Genetic information; or

Any other unique identifying number, characteristic or code

If a Business Associate relationship is determined to exist, the awarded supplier will be required to sign the University's Business Associate Agreement at the time of contract execution.

MANDATORY CRITERIA

Respondents must meet all mandatory requirements in this section in order to continue with a response to this RFP. Any Respondent that does not meet all the following requirements will be removed from further consideration. Respondents must provide a written, affirmative response to each of the criteria stated below and provide substantiating information to support your answer.

It is mandatory the respondent have at least five (5) years of after-hours nurse triage line service experience. CONFIRM Y or N_ and provide information to support your answer.

It is mandatory the respondent inform MUHC of the details of any suits, and/ or settlements due to suits, brought upon your company, or principals of your company, by any of your clients within the last five (5) years as it relates to the scope of this RFP. CONFIRM Y or N_ and provide information to support your answer.

It is mandatory that your nurses use physician- authored clinical guidelines to evaluate adult and pediatric symptoms. CONFIRM Y or N_ Please provide information to support your answer.

It is mandatory that U.S. state licensed registered nurses staff your Nurse Triage Line. CONFIRM Y or N_ Please provide information to support your answer.

DESIRABLE CRITERIA

It is the Respondent's responsibility to supply sufficient and complete information for a full evaluation of all items in this section, including detailed explanations.

Company Experience and References

Provide a general overview of your company's experience in providing after-hour nurse triage services. Specifically illustrate experience similar in size and scope to MU Health Care.

Describe what you believe to be the market differentiators between your organization and your competitors.

Provide three (3) client references you have provided the requested service. For each reference, include an overview of the services provided. The reference contact information should include the customer name, start/end dates of the service, customer phone number and e-mail.

Client/Patient Support, Service and Training

Describe your organizations service model offered to provide the requested service. Include the following:

Provide the evidence-based guidelines that will be utilize for service.

Operating hours for all inbound and outbound calls

Levels of support of calls

Escalation process of calls

Referral services

Provide a summary of the resources your company will employ to ensure that service offered addresses the following: reliability, responsiveness, competence, courtesy, communication, credibility, security and understanding of the patient's needs.

Describe your service response and escalation process to handle the following call types:

After Hour Calls

Emergency Calls

Will you provide a dedicated toll-free phone number for the Nurse Triage Line?

Do your nurses provide directions to in-network physicians and facilities?

Describe your ability to offer on demand, multi-lingual and hearing-impaired support for patients.

Describe how your organization will address opportunities of staff not performing to expectations and poor customer service.

It is desirable for the respondent to provide detail summary of all clinical and non-clinical staffing requirements, training and experience levels.

Initial training process

On-going training for all RNs and CSRs

Experience levels of staff employed

Describe your organization customer/patient support for the following items;

Speed to Answer (Average hold time)

Call Abandonment Rate

First Call Resolution

IT Resources and Integration

MU Health uses Cerner's Electronic Medical Record platform. Is your solution capable of interfacing with this platform? If so, describe integration successfully employed by other clients.

Describe any additional service capabilities offered through your solution clinical and/or marketing.

Describe and provide examples of any digital integration and mobile device features that your service has to offer.

Does your software and infrastructure support a remote workforce? If yes, please describe.

Briefly describe your organizations policies, procedures and protocols to data security and client confidentiality.

Describe your planned system downtime and disaster recovery service plans.

Reporting Capabilities/Implementation

Provide a brief description and share examples of available dashboards, reports and key performance indicators that can be utilized to maximize performance.

Member Inbound Call reasons

Referral activity between vendor programs with details

Volume of Resources referred by vendor

Redirection Rates-downward and upward

Operational Performance-average speed to answer, average hold time, call blockage rate, and call abandonment rate

Day and time of Calls with details

Does your system provide the ability to dynamically search all data, create, and modify custom reports? If so, explain the process. Can report templates be saved?

Can data and reports be printed and/or exported in multiple formats (PDF, MS Excel, Word, etc.)? If so, please explain.

Describe how a report can be generated for user access, security rights and for other auditing purposes.

How long do you maintain call logs for client review?

Describe and provide your standard implementation process, requirements, timeline with milestones, project plan and estimated deliverables. Outline the resource support that will be included with the implementation.

REQUEST FOR PROPOSAL FORM

REQUEST FOR PROPOSALS FOR

NURSE TRIAGE LINE SERVICES

FOR

THE CURATORS OF THE UNIVERSITY OF MISSOURI ON BEHALF OF

MU HEALTH CARE RFP #31212

DUE DATE: March 6, 2026 TIME: 3:00 P.M., CT

The undersigned proposes to furnish the following items and/or services in accordance with all requirements and specifications contained within this Request for Proposal issued by MU Health Care.

Provide the by call fee for the Nurse Triage Line services for this project:

$___________________________

Provide a price schedule for any additional services that can be provided:

$ ________________________

State any applicable maximum price increases for renewal years:

Renewal Year 1:__________________________

Renewal Year 2:__________________________

Renewal Year 3:__________________________

Renewal Year 4:__________________________

AUTHORIZED RESPONDENT REPRESENTATION

This signature sheet must be returned with your proposal.

ATTACHMENT A

SDVE PARTICIPATION FORM

Evaluation of Supplier's SDVE Participation: If a Respondent is proposing participation by a Service-Disabled Veteran Business Enterprise (SDVE), in order to receive evaluation consideration for participation by the SDVE, the Respondent must provide the required information with the proposal. Information not included with the proposal will not be considered in scoring.

SDVE Evaluation: The respondent must either be a SDVE or must be proposing to utilize a SDVE as a subcontractor and/or supplier that provides at least three percent (3%) of the total contract value. If the Respondent proposing a SDVE participation percentage meets or exceeds three percent (3%) of the total contract value and provides the required documentation identified herein, then the Supplier shall be assigned the three (3) bonus points.

SDVE Commitment: If the Respondent is awarded a contract and the Respondent received points for the SDVE participation in the evaluation, the percentage level of SDVE participation committed to by the Respondent shall be a contractual requirement.

Spending with SDVE Companies: If you are a certified SDVE, as defined in the Instructions to Respondents, section #9, please provide evidence of certification below.

SDVE Certified in Missouri: Are you a Service-Disabled Veteran Business Enterprise (SDVE) certified by the State of Missouri, Office of Administration? YES _____ or NO _____

If YES was checked above as being a certified SDVE by the State of Missouri, Office of Administration, provide the name of the SDVE your certificate is under. ______________________________________________________________________

If you are not a certified SDVE, are you willing to commit to using one or more certified SDVE companies in the performance of this contract if awarded? If yes, please explain the nature of the participation by each SDVE and provide the percentage of the contract value that will be attributable to such SDVE and evidence of certification. _______________________________________________________________________________________________

---------------------------THIS FORM MUST BE SUBMITTED WITH THE RESPONSE----------------------------

ATTACHMENT B

PHYSICIAN SELF-REFERRAL QUESTIONNAIRE

Section I - Company Ownership

Is your company a publicly traded stock company with more than $75 million in stockholder equity? NO______ YES

Is your company a public agency? NO______ YES

Section II - Physician Relationship

For purpose of answering these questions, the term "immediate family member" means the following individuals: husband or wife; natural or adoptive parent, child or sibling, stepparent, stepchild, stepbrother or stepsister, father-in-law, mother-in-law, son-in-law, daughter-in-law, brother-in-law, or sister-in-law, grandparent or grandchild, and spouse of a grandparent or grandchild.

Is your company owned or governed in whole or part by a physician (or an immediate family member of a physician) who may refer patients or treat patients at a MU Health Care facility? NO___ YES___

Is your company owned or governed in whole or part by any person (other than a physician or immediate family member of a physician) who may refer patients to a MU Health Care facility? NO______ YES______

Does your company employ or contract with a physician (or an immediate family member of a physician) who may refer patients or treat patients at a MU Health Care facility? NO______YES __

Does your company have compensation arrangements with a physician (or an immediate family member of a physician) that vary with or take into account the volume or value of referrals or other business generated by the physician for a MU Health care facility? NO______ YES______

If you answered "Yes" to any of the questions 1-4 of Section II, please provide the applicable physician name(s), the person(s) who refers patients to the health care facilities, the name(s) of the health care facilities, and if applicable, the name(s) of the immediate family members of the physicians or other person.

I represent the answers provided herein are truthful and accurate as of the date of my signature below. I agree to immediately notify the Director of MUHC Supply Chain Operations at 2910 LeMone Industrial Blvd., Columbia, MO 65201 of any changes in the above disclosed information.

Company Name

Signature Date

Print Name Title

ATTACHMENT C

SPECIFICATIONS WITH REQUIRED RESPONSES

IT and Technical, IT Security, HIPAA

RFP 31212 NURSE TRIAGE LINE SERVICES

SPECIFICATIONS

Most of these specifications will only require a 'Yes' or 'No' selection; however, when applicable, responses should include sufficient detail to demonstrate understanding and methodology.

CRITICAL: A "No" to a "MANDATORY" item may eliminate the Respondent from further consideration! Please ensure that you thoroughly justify a "No" in your response so that we may consider the reason you are not able to provide the mandatory item, e.g., "We are developing this and expect to have it by..."

Criterion 1: Application Specifications (if a "BAA" is required)

Criterion 2: Application Specifications (Security Related)

Criterion 3: Application Specifications (Non-Security Related)

Criterion 4: Documentation That Will Be Requested for Security Review

Criterion 1: Application Specifications (if a "Business Associate Agreement" [BAA] is required)

Will this solution include any exposure to Protected Health Information (PHI), thus require a "Business Associate" relationship? (See 'i' on the first from last page for PHI indicators)

Yes No / If "No" select "N/A" for numbers 1. through 5. and reply to number 6.

MANDATORY

Solutions that require a BAA / Agree to enter a BAA provided by or agreed to by MU Health Care.

Will Comply: Yes No N/A

Response:

Solutions that require a BAA / Will confirm that any subcontractors who have access to Protected Health Information (PHI) have signed a BAA with the vendor.

Will Comply: Yes No N/A

Response:

Solutions that require a BAA / "Role-Based Access Controls" (RBAC) must support minimum necessary standard.

Will Comply: Yes No N/A

Response:

Solutions that require a BAA / The solution meets "User Access Log Requirements" (see "ii" on last page)

Will Comply: Yes No N/A

Response:

Solutions that require a BAA / Business Associate shall not disclose PHI to a subcontractor not within the borders and jurisdiction of the United States of America without the prior written consent of Covered Entity which may be withheld in its sole discretion.

Will Comply: Yes No N/A

Response:

Solutions that DO NOT require a BAA / The solution logs access, modification, deletion, and export of data.

Will Comply: Yes No N/A

Response:

Criterion 2: Application Specifications (Security Related)

MANDATORY

Any Solution / Provides evidence of secure coding practices, including framework adoption.

Will Comply: Yes No

Response:

Any Solution / User accounts can be disabled or deactivated rather than deleted and disabled accounts are not subject to licensing.

Will Comply: Yes No

Response:

Any Solution / Meets "Authentication Requirements" (see "iii" on last page)

Will Comply: Yes No

Response:

Any Solution / Solution supports Microsoft Azure's Single-Sign-On through UM System's Azure instance or LDAP.

Will Comply: Yes No

Response:

Any Solution / Solution supports unique user identification requirement.

Will Comply: Yes No

Response:

Any Solution / Vendor utilizes zero trust methodology.

On-prem Servers, Appliances, and Devices (if applicable) must:

Support residing in an isolated VLAN where inbound and outbound traffic must be allow-listed.

Support MUHC endpoint detection and response (malware protection).

Support operating systems that are not end of life support.

Will Comply: Yes No

Response:

Any Solution / Solution supports Role-Based Access Controls (RBAC).

Will Comply: Yes No

Response:

Select "N/A" for any of the following that this solution will not utilize, and no response would then be required:

Solutions that need to send email where the "from" email address is from a UM domain (e.g., @health.missouri.edu, @umsystem.edu, @missouri.edu), the solution must support subdomains (e.g., @vendorsolution.health.missouri.edu).

Will Comply: Yes No N/A

Response:

Solutions that are fully or partially hosted by the vendor, or where the vendor stores, processes, creates, receives, or transmits MUHC PHI / All PHI on vendor's systems and subsystems will be encrypted with industry approved encryption technology.

Will Comply: Yes No N/A

Response:

Solutions that are fully or partially hosted by the vendor, or where the vendor stores, processes, creates, receives, or transmits MUHC data. / Vendor will provide evidence of independent audit (SOC 2 Type 2, HITRUST, ISO 27001) where the scope of the audit covers the vendor's operational practices and technical controls or complete a HECVAT FULL (most recent version). NOTE: Independent audit is desired over HECVAT.

Will Comply: Yes No N/A

Response:

Solutions that involve medical devices. / A "Manufacturer Disclosure Statement for Medical Device Security" (MDS2) is required.

Will Comply: Yes No N/A

Response:

Solutions that involve a mobile app used by MUHC workforce. / Mobile apps must be capable of running under MUHC's Mobile Device Management solutions.

Will Comply: Yes No N/A

Response:

Solutions that involve cloud-based, web-based, or API components. / Must provide complete vulnerability scan and penetration testing reports conducted within the past 12 months. NOTE: Independent vulnerability scan and penetration test is desired over internal.

Will Comply: Yes No N/A

Response:

DESIRABLE

Solutions that involve cloud-based, web-based, or API components. / Supports Allow-Listing of University IP address.

Provided: Yes No N/A

Response:

Solutions that involve desktop application. / Desktop application will not require admin privileges to be used by the end user of the application.

Will Comply: Yes No N/A

Response:

Criterion 3: Application Specifications (Non-Security Related)

MANDATORY

Solutions requiring integration with MUHC EMR. / Solution supports integration to Oracle Electronic Medical Record (EMR) system.

Will Comply: Yes No N/A

Response:

Solutions requiring the application of "Web Content Accessibility Guidelines" (WCAG) / Shall: (1) deliver all applicable services and products in reasonable compliance with University standards WCA Guidelines 2.1, Level AA or above; (2) provide the University with an Accessibility Conformance Report detailing the product's current accessibility according to WCAG standards using the latest version of the Voluntary Product Accessibility Template (VPAT); (3) if accessibility issues exist, provide a "roadmap" plan for remedying those deficiencies on a reasonable timeline to be approved by the University; (4) promptly respond to assist the University with resolving any accessibility complaints and requests for accommodation from users with disabilities resulting from Contractor's failure to meet WCAG 2.1 AA guidelines at no cost to the University; and (5) indemnify and hold the University harmless in the event of any claims arising from inaccessibility.

Will Comply: Yes No N/A

Response:

Criterion 4: Documentation That Will Be Requested for Security Review

Any Solution / Provide a general description of how the solution will be used.

For clinical use, describe what clinical procedures or type of patients.

For operational use, describe workflows, business processes, or analytic capabilities the solution provides.

Will Provide if Awarded: Yes No

Response:

Any Solution / Where multiple subscriptions and options exist, provide a list specific subscription and options are included in RFP (or reference which document has information).

Will Provide if Awarded: Yes No

Response:

Any Solution / List of all user-facing access points to the solution, such as web portals, mobile applications, or other interfaces. This does not require detailing every individual screen or page. The goal is to provide a clear understanding of each unique method by which users, whether patients, providers, or administrators, can access the system.

Will Provide if Awarded: Yes No

Response:

Any Solution / Network requirements, including, but not limited to firewall rules.

Will Provide if Awarded: Yes No

Response:

Any Solution / Describe solution's backup methodology.

Will Provide if Awarded: Yes No

Response:

Select "N/A" for any of the following that this solution will not utilize, and no response would then be required:

Solution will be fully or partially hosted by the vendor, or where the vendor stores, processes, creates, receives, or transmits MUHC data. / Recovery Time Objective (RTO) - Specify the maximum acceptable amount of time the solution may be unavailable during a disruption before normal operations are restored in alignment with the RTO.

Will Provide if Awarded: Yes No N/A

Response:

Solution will be fully or partially hosted by the vendor, or where the vendor stores, processes, creates, receives, or transmits MUHC data. / Recovery Time Objective (RTO) - Documentation on how the vendor intends to meet and how they have tested the RTO.

Will Provide if Awarded: Yes No N/A

Response:

Solution will be fully or partially hosted by the vendor, or where the vendor stores, processes, creates, receives, or transmits MUHC data. / Recovery Point Objective (RPO) - Specify the maximum acceptable amount of data loss measured in time (i.e., the point in time to which data must be restored following a disruption) in accordance with the solution's RPO.

Will Provide if Awarded: Yes No N/A

Response:

Solution will be fully or partially hosted by the vendor, or where the vendor stores, processes, creates, receives, or transmits MUHC data. / Must provide complete vulnerability scan and penetration testing reports conducted within the past 12 months. NOTE: Independent vulnerability scan and penetration test is desired over internal.

Will Provide if Awarded: Yes No N/A

Response:

Solutions where remote access is needed by the vendor to access servers or devices on MUHC's network. / Requirements and options for remote access.

Will Provide if Awarded: Yes No N/A

Response:

Solutions requiring Application Registrations or service accounts. / Documentation of Azure Application Registrations or service accounts, including permissions that are needed.

Will Provide if Awarded: Yes No N/A

Response:

Solutions that require desktop software to be installed. / Inventory of desktop-based software, modules, or add-ons, with documentation on what permissions are needed to install or run the application.

Will Provide if Awarded: Yes No N/A

Response:

Where the vendor intends to de-identify and use MUHC's data. / Documentation of intended use of MUHC's de-identified data. Include detailed description of how the data will be de-identified and if the vendor will be maintaining a mapping table (to re-identify a record) to the de-identified dataset.

Will Provide if Awarded: Yes No N/A

Response:

i Business Associate Agreement (PHI Indicators)

If the services requested by MUHC via this RFP require the respondents to use and/or disclose protected health information (PHI), a "Business Associate" relationship exists. The following 19 identifiers, together or individually, may constitute PHI:

Names,

All geographic subdivisions smaller than a state

(e.g. street address, city, county, precinct, zip code),

All dates related to the individual

(e.g. date of birth, admission date, discharge date, date of death),

Telephone number,

Fax number,

Electronic mail addresses,

Social Security Number {SSN),

Medical record number,

Health plan numbers,

Account numbers,

Certificate or license numbers,

Vehicle identification/serial numbers, including license plate numbers,

Device identification/serial numbers,

Universal resource locators (URL's),

Internet protocol (IP) addresses,

Biometric identifiers,

Full face photographs and comparable images,

Genetic information, or

Any other unique identifying number, characteristic or code.

ii User Access Log Requirements

Record Access - when a user views the single record or partial record of an individual within the solution.

List Access - when a user views PHI presented in a list view (i.e., list of patients scheduled that day, list of patients based on search).

The solution creates audit logs on the following:

When a user authenticates (login) to the solution.

When a user creates, modifies, or deletes a user of the solution.

When a user accesses, creates, modifies, or deletes PHI of an individual (Record Access).

When a user views PHI of individuals (List Access).

When a user exports PHI (e.g., creates a report, exports data to Excel or CSV).

Logs contain the following information:

User identifier such as username.

Description of action.

Date and time of action.

Description of data accessed or reference window name (e.g., demographics, lab results, clinical note).

Identifier of patient(s) (e.g., name, patient ID number, or medical record number).

For List Access, having the ability to determine which patients were displayed when the user accessed the list would be an acceptable compensating control with confirmation from the vendor that the report was thorough and accurate.

Access to Audit Logs: Customer can access the above-mentioned audit logs via the application.

Log Retention: The above-mentioned audit logs are available for no less than 12 months.

Log Integrity: Vendor implements protections to ensure that audit logs cannot be modified by the customer or vendor.

iii Authentication Requirements

The solution must support one of the following authentication methods:

Single Sign-On (SSO) via the UM System's Microsoft Azure instance

Integration with the UM' Systems LDAP directory

Application-based authentication that meets the criteria outlined below

If using application-based authentication, the solution must:

Support multi-factor authentication (MFA) using an authenticator app

Alternatively, support email or SMS-based MFA combined with IP allow-listing

If the application is internet-accessible and hosted by the vendor:

The vendor must confirm that login activity logs are actively monitored for suspicious access attempts.