RFP software for healthcare, sealed and defensible

Many of a health system’s significant purchases are multi-year vendor contracts that touch several departments. The selection behind them is rarely run by one person: supply chain, finance, IT and clinical leaders all have a say, and several of them may already know the vendors competing for the work. Vendors, for their part, are handing over pricing and proposals they would never want a competitor to see.

When that process runs through email attachments and a shared scoring spreadsheet, the questions that matter after the award are hard to answer: who saw the pricing before the deadline, whether every vendor received the same answers, and how each evaluator reached their scores. Pactwise Source is built so those answers are on the record by construction — the same controls described on the AI RFP Studio page, applied to a healthcare sourcing event.

Evaluators attest no conflict of interest before scoring, see only their own scores until lock, and outliers are flagged at lock time. The attestation is not a form filed somewhere else: the database rejects any score from an evaluator who has not attested, so a committee cannot quietly skip the step.

Scoring is blind in the sense that matters for a committee: until the evaluation locks, no evaluator sees another evaluator’s scores, so a senior voice’s first number cannot anchor the rest. The glossary explains blind evaluation and how an evaluation rubric of weighted criteria keeps scores comparable.

AI never scores, ranks, or recommends an award.

That is a structural rule, not a setting. Every score is a human act, made under these controls.

Each pricing submission is envelope-encrypted with its own data key, wrapped by a key the database never holds. The buyer sees that a bid exists — never its contents — until the reveal. A scheduled job opens every envelope at once after the deadline plus grace, re-checking the effective deadline at run time so an extension can never trigger an early reveal. The glossary’s sealed bid entry covers why that matters.

Vendors work on a separate host with its own sessions; a vendor identity can never become a buyer user. Deny-by-default row security, forced on every table. A cross-workspace isolation test runs on every merge: every vendor-visible table × a foreign workspace = zero rows. Single-use invitation links that only an explicit click consumes (corporate link scanners cannot burn them), plus step-up re-authentication before sensitive actions.

Technical proposals cannot stay sealed — the committee has to read them — so the control is attributable access. No one — vendor or buyer — reads a file directly. Every read is logged and served through a signed link that expires in 60 seconds. If a competitor’s proposal is ever said to have leaked, the record shows who opened it and when.

Large committees generate questions, clarifications and late changes. Vendors ask privately; answers publish to everyone, anonymized. Post-publish changes go out only as versioned addenda every vendor must acknowledge, and an addendum inside the notice window forces a deadline extension or a written override. No one on the buying side can brief a favored vendor through a side channel: questions arrive privately, and answers go to everyone.

After publish a deadline can only move later, every change is historized with a reason, and every vendor is notified at once. Lateness is frozen at submission time. Uploads are stamped with the server clock and a server-computed checksum, scanned, then frozen. Late uploads are accepted only with a written reason and flagged as late.

Before any of that, the package itself has to clear the publish gate. Publishing is a database check, not a checklist: contact details, Q&A cutoff spacing, minimum response window, criteria weights that sum to 100 and a pricing schedule are all enforced before an RFP can go out, and it warns when fewer than three vendors are lined up to invite.

An award needs a locked evaluation, a written justification, every vendor question answered, every abnormal-bid flag acknowledged, and an approver who is not the author. Regret letters to the vendors who did not win come from templates, so no one improvises a reason after the fact.

One write path into the audit log, no updates, no deletes, each event hash-chained to the one before. The glossary describes what a procurement audit trail should hold.

If a losing vendor challenges the decision, there is one document to start from. One export compiles the timeline, addenda and acknowledgments, published Q&A, submission metadata, locked scores, attestations and approvals into a single hashed document. The glossary explains what a bid protest is.

Prep Studio, “Draft with AI” in the buyer console, is the drafting half of the AI RFP Studio. AI-assisted intake that drafts the scope, requirements matrix, weighted criteria and pricing schedule, reads its own draft as a hostile bidder would, and hands every artifact to you for approval. Built and verified against recorded model runs; live-model drafting switches on with the model key.

AI drafts, code validates, a human approves: nothing reaches a vendor until a person on your team has approved it and the publish gate has passed it. If you are still deciding which kind of request to issue, the glossary compares an RFP, an RFQ and an RFI.

One subscription covers Pactwise Source and Pactwise Contracts. Pactwise Source holds sourcing records — the package, questions, proposals, pricing, scores and approvals — and patient information does not belong in an RFP; the Acceptable Use Policy sets the rules for regulated data.

• Compare the plans on the pricing page.
• See how a manual process compares in manual RFPs vs Pactwise Source.
• Read how public agencies use the same controls on the public-sector page.
• Running a smaller team? See Pactwise Source for mid-market teams.
• Walk through a sealed RFP from package to award on the AI RFP Studio page.