Three Finalists, 42 CFR Part 2, and a 14-Month Deadline
Cascade Behavioral Health (14 outpatient clinics, 38,000 active patients, 210 clinicians) is replacing a 12-year-old practice management system. Its substance use disorder program falls under 42 CFR Part 2, so those records must be segmented and consent-managed separately from general behavioral health notes; the state HIE also exchanges data. An RFP produced three finalists scored on a 100-point scale: functionality 40, technical 20, cost 25, vendor viability 15. Vendor A scored 84 but demonstrated consent segmentation only in a slide deck and has two Part 2 customers. Vendor B scored 79 with a live segmentation demo but costs 30% more and has no EPCS certification yet. Vendor C scored 71 and is the incumbent's successor product, which staff already know. The CIO favors A, the CMO favors B, the CFO favors C. A decision is due in three weeks and the current system's support ends in 14 months.
1. The weighted scores are close. What would you validate before letting the scores drive the decision?
Read the worked answer
Scores measure demonstration quality, not fit, and the gap between 84 and 79 is smaller than the error in a committee's scoring. Validate the requirements that carry legal or clinical risk.
- Part 2 segmentation. Ask Vendor A to run a scripted scenario in a sandbox: a patient with an SUD record and a general behavioral health record, a consent that permits disclosure to one named recipient, and a query from the HIE. Watch whether the SUD data is excluded without consent. A slide is not evidence. Do the same with B and compare.
- Reference calls with Part 2 customers, asking specifically how consent revocation and re-disclosure tracking work, and what happens when a consent expires mid-treatment.
- EPCS. Verify current certification status with the certifying body, not the sales deck. If B is uncertified, get a dated roadmap and a contractual consequence.
- Total cost of ownership, not license cost. B's 30% premium may be offset by interfaces, training, and the cost of A's customization for segmentation.
- Viability and exit. C's incumbency is an advantage for adoption but a risk if the product is at the end of its roadmap.
Then rescore only those items with evidence. A weighted score built on unequal evidence is not comparable across vendors.
2. Make a recommendation and justify the tradeoffs you are accepting.
Read the worked answer
I would recommend Vendor B with conditions, and I would say plainly what is being traded away.
Part 2 segmentation is a legal requirement, not a differentiator. Vendor A's evidence is a slide deck plus two customers, and the organization has no in-house capacity to build consent segmentation if it turns out to be shallow. Choosing A on a four-point score advantage accepts a compliance risk that could halt SUD referrals and expose the organization to enforcement. Vendor C is the safe cultural choice but scored lowest on functionality and may not have the segmentation depth either.
B's live demo is the only direct evidence that the core requirement works. Its weaknesses are real: 30% higher cost and no EPCS certification. EPCS is mitigable in a way that segmentation is not. Prescribers can use a compliant external e-prescribing path temporarily, and EPCS is a defined certification with a predictable timeline. Segmentation failures are open-ended.
So the conditions are: a scripted acceptance test for segmentation and consent revocation before contract signature; a dated EPCS certification milestone with service credits or termination rights if missed; reference calls completed before signature; and a cost comparison that includes interfaces and training. If B fails the acceptance test, the recommendation changes to A or reissue, not to C by default.
I would also flag the 14-month runway: a three-week decision followed by a 9-12 month implementation leaves little slack, so the contract needs an implementation schedule with milestones, not just a license.
3. What contract protections matter most for this purchase?
Read the worked answer
The contract is where the demo stops being a promise.
- Acceptance criteria tied to the Part 2 scenarios, written as testable statements with pass/fail, not as "supports consent management." Payment should be milestone-based, with a meaningful holdback until acceptance.
- Regulatory change clause. Part 2 and information-blocking rules are moving; the vendor should be obligated to maintain compliance at no additional license cost, with a defined response window.
- EPCS milestone with remedy. A dated certification commitment and a remedy that has teeth: service credits, a right to procure a compliant alternative at vendor cost, or termination.
- Interoperability and interface pricing fixed for the term, including HIE and lab interfaces; B's higher price should not be followed by surprise interface invoices.
- Data ownership, export, and termination assistance, including extraction of segmented SUD data in a usable format and deletion certification. A behavioral health organization cannot afford a vendor that holds records hostage.
- Implementation milestones and resource commitments, with named vendor staff and a schedule that fits the 14-month window.
- Escrow for the source code if the vendor's viability score is low.
Finally, require the vendor's security documentation and a BAA, and confirm which party is responsible for consent enforcement at the HIE boundary.