Surgy Health
Healthcare AI

Healthcare AI RFP Template and Vendor Scorecard (Free Excel Kit)

A free healthcare AI RFP template for hospitals: 25 vendor questions, a 9-criterion weighted scorecard with scoring rubric, a worked example and an Excel kit.

Mohammed Jamil Nasir
Mohammed Jamil Nasir
· 11 min read
Hospital RFP document beside a weighted vendor scorecard clipboard

Key takeaways

  • Write the problem as a number you want to move, with today's baseline, before you invite vendors.
  • Publish the 9 scorecard weights to every vendor before any demo, so the demo can't change the rules.
  • Make security a gate, not a weight: below 3 out of 5 on security and data governance disqualifies.
  • Ask all vendors the same 25 questions in writing, then demo on your own anonymised data.
  • Run a 2-week shadow pilot with agreed thresholds, and write a 90-day review into the contract.

Short answer: A healthcare AI RFP should name one measurable problem, describe your systems and data rules, ask every vendor the same 25 written questions, and score the answers on a published 9-criterion scorecard where a security score below 3 out of 5 disqualifies the vendor. Then run a demo on your anonymised data and a 2-week shadow pilot before you sign.

Disclosure: Surgy Health sells AI software to hospitals. This template is vendor-neutral and works for any AI purchase, including ours.

Download the free kit

The Hospital AI RFP Kit includes the scorecard spreadsheet (weights and formulas pre-filled), the 25 vendor questions in a ready-to-send document, and a contract-clause checklist.

Get the free Hospital AI RFP Kit →

What is an RFP in healthcare?

A request for proposal (RFP) is a written document a hospital sends to shortlisted vendors, describing the problem, the environment and the rules, and asking each vendor to answer the same questions so their responses can be scored side by side. In AI purchases, the RFP also sets how the product will be tested on your data before you sign.

Document Use it when What you get back
RFI (request for information) You don't yet know which vendors or approaches exist Capability summaries to build a shortlist
RFP (request for proposal) You know the problem and have 3–6 credible vendors Comparable written answers, a demo and a price
RFQ (request for quotation) Scope is fixed and only price is open Prices for an agreed specification

For most hospital AI purchases, send a short RFI first, then an RFP to 3–4 vendors.

The 7 sections of a hospital AI RFP

  1. The problem and the number. One measurable problem (for example, "unanswered OPD calls after 6 pm" or "AR days above 60"), its current baseline and the target after 90 days.
  2. Your environment. HIS/EMR in use, whether it has an API, data you can export (CSV/Excel), sites and departments in scope, user count, languages patients and staff use, and telephony and WhatsApp set-up.
  3. Rules vendors must meet. Data protection (India's DPDP Act and Rules; UAE health-data law; Saudi PDPL), hosting region, medical-device status where relevant (CDSCO in India, SFDA in Saudi Arabia, MOHAP in the UAE), accreditation needs (NABH, JCI) and national platforms (ABDM, NHCX, NPHIES, Malaffi, NABIDH).
  4. The 25 questions. Identical for every vendor, answered in writing (listed below).
  5. The scorecard. The 9 weighted criteria, the 1–5 rubric and the security gate, published in full.
  6. The test. Demo on your anonymised sample, then a 2-week shadow pilot with written success thresholds.
  7. Commercial terms. Pricing unit, 5-year total cost, service levels, exit rights and data return.

The weighted vendor scorecard

Score each criterion from 1 to 5, multiply by its weight, add the results and divide by 5 to get a score out of 100.

Criterion Weight
Fit to your constraint 15
Accuracy on your own data 15
Security and data governance (gate: below 3 disqualifies) 15
Regulatory fit 10
Integration and start mode 10
Total cost of ownership (5 years) 10
Implementation plan and support 10
Usability and adoption by staff 10
Vendor viability and roadmap 5
Total 100

Shortlist rule: a vendor goes to contract negotiation only if it scores 3 or more on security and data governance, has no criterion at 1, and is within 10 points of the top eligible score.

Scoring rubric: what 1, 3 and 5 look like

Criterion 1 — Weak 3 — Acceptable 5 — Strong
Fit to your constraint Generic pitch; can't name the metric it moves Names your metric; evidence from another hospital Moved your metric in the shadow pilot against your baseline
Accuracy on your own data Only vendor-chosen demo data Ran on your anonymised sample; error or edit rate reported Pilot results broken down by department, language and patient group
Security and data governance No processing agreement; data may be used to train models Processing agreement, encryption in transit and at rest, role-based access, audit log All of 3, plus named sub-processors, in-region hosting, zero data retention with AI providers, incident notice within hours
Regulatory fit Can't say whether any feature is regulated Clear statement of regulatory status; DPDP support documented Registration or licence evidence where needed; live national-platform integrations shown
Integration and start mode Needs a full HIS integration before any value Starts from CSV/Excel; integration plan with dates Live with your HIS or proven with your HIS vendor elsewhere; no-integration start in days
Total cost of ownership Price only for year 1; extras unclear 5-year cost including implementation and training 5-year cost with caps on increases and no-cost data export at exit
Implementation plan and support No named team or plan Week-by-week plan; support hours stated Named on-site lead; super-user training; support SLA with credits
Usability and adoption Staff need long training; no mobile use Staff complete core tasks after short training Staff in your pilot used it daily without prompting
Vendor viability and roadmap No paying hospital references Paying hospitals of your size; roadmap shared References you choose; stable team; roadmap items tied to dates

Worked example: three vendors

Vendor Fit Accuracy Security Regulatory Integration TCO Implementation Usability Viability Score /100 Result
A 4 4 4 3 5 3 4 4 3 77 Shortlisted
B 5 5 2 4 3 4 4 5 4 80 Disqualified (security below 3)
C 3 3 4 4 3 5 3 3 5 71 Shortlisted (6 points behind A)

Vendor B has the highest total and the best demo, and still loses. A and C go to the shadow pilot. That is why the security gate is published before any demo: it stops a strong product with weak data handling from winning on presentation.

25 vendor questions to paste into your RFP

Scope

  1. Which single metric will your product move in our hospital, by how much in 90 days, and from what baseline?
  2. Which departments, sites and user roles are included in the price you quote?
  3. Name two hospitals of similar size where the product is live today, and let us choose who we speak to.

Data

  1. What data do you need, in what format, and can we start from CSV or Excel exports before any integration?
  2. Where is our data stored and processed (country and cloud region), and who are your sub-processors?
  3. Is our data, or anything derived from it, used to train or improve any model? Is zero data retention set up with your AI providers?
  4. How do we export all our data at exit, in what format, and within how many days?

Accuracy

  1. What error or edit rate has the product shown on data like ours, and how was it measured?
  2. Will you run on our anonymised sample before contract, and then a 2-week shadow pilot?
  3. How does performance differ by language, age group, sex and department?
  4. How are errors shown to users, and how does a clinician or staff member correct them?

Security

  1. Which controls are in place today: encryption in transit and at rest, role- and branch-level permissions, SSO or MFA, audit-log retention period?
  2. Which certifications or independent audits do you hold today (not planned), and what are the report dates?
  3. How quickly will you notify us of a security incident, so we can meet our reporting deadlines (in India, CERT-In within 6 hours and the Data Protection Board report within 72 hours)?
  4. Do patient identifiers ever reach a third-party AI model? Show the data flow.

Regulation

  1. Is any feature a medical device under CDSCO, SFDA or MOHAP rules? Provide the intended-use statement and registration status.
  2. How does the product support our DPDP obligations: notices, consent, access, correction and erasure requests, and grievance handling?
  3. Which national platforms are live in production with your product today (ABDM/ABHA, NHCX, NPHIES, Malaffi, NABIDH)?

Commercials

  1. What is the pricing unit (per user, per bed, per site, per minute or per note), and what triggers a price change?
  2. What is the 5-year total cost, including implementation, integration, training and support?
  3. What service levels apply (uptime, support response times), and what credits apply when they are missed?
  4. What are the exit terms, notice period and data-return obligations?

Viability

  1. How many hospitals pay for this product today, and what share renewed last year?
  2. What on your 12-month roadmap affects us, and what are you retiring?
  3. Who owns our account, and who will be on site during go-live?

Tip for regulated features: if any shortlisted product diagnoses, treats or informs clinical decisions, read our CDSCO guide to software as a medical device and attach your AI governance policy to the RFP.

The RFP timeline: 8 weeks to a signed contract

  1. Week 1 — RFI. Send a two-page RFI to 6–10 vendors; shortlist 3–4.
  2. Week 2 — RFP issued. Send the problem, environment, rules, 25 questions and scorecard.
  3. Weeks 3–4 — Written answers. One clarification call per vendor, same questions for all.
  4. Week 5 — Demo on your data. Each vendor runs on the same anonymised sample.
  5. Weeks 6–7 — Shadow pilot. The top one or two vendors run alongside current work; nothing they produce is acted on without review.
  6. Week 8 — Score and negotiate. Score with a cross-functional panel; negotiate with the shortlisted vendor.
  7. Day 90 after go-live — Review. Compare the metric to the baseline and the target written into the contract.

Pilot success thresholds: agree them before the pilot

Set thresholds from your own baseline and write them into the pilot letter. Examples by category:

AI category Measure Example threshold to agree
AI medical scribe Share of notes signed with minor or no edits Agreed % of notes accepted, per department
Hospital CRM Enquiries captured across channels All website, chatbot, call and walk-in enquiries logged
Voice agent After-hours calls answered and resolved Agreed % resolved without staff; handoff time
Analytics KPIs reproduced exactly from your exports Every pilot KPI matches your manual calculation
Training (LMS) Mandatory course completion Agreed % completion for pilot departments

Common RFP mistakes

  • Starting with a category, not a problem. "We need an AI scribe" invites feature lists; "doctors spend two hours a day on notes" invites evidence.
  • Letting demos set the rules. Publish weights and the security gate first.
  • Accepting vendor-chosen data. Every accuracy claim should be re-run on your anonymised sample.
  • Pricing year 1 only. Ask for 5-year cost, price-increase caps and exit costs.
  • Forgetting internal effort. Data extracts, WhatsApp Business verification, staff training and change management cost your team time; put them in the plan.
  • No review date. Without a written 90-day review, nobody checks whether the metric moved.

FAQ

Frequently asked questions

What should a healthcare AI RFP include?

Seven parts: the problem as a measurable number with a baseline, your systems and data environment, the rules vendors must meet, 25 identical written questions, a published weighted scorecard, a test plan (demo on anonymised data plus a 2-week shadow pilot), and commercial terms including 5-year cost and exit rights.

How do you score AI vendors fairly?

Publish the criteria, weights and 1–5 rubric before any demo, use a cross-functional panel (clinical, IT, finance, quality), score written answers and pilot results separately from presentations, and apply a security gate so a weak score on data handling disqualifies regardless of the total.

What is the difference between an RFI, RFP and RFQ in healthcare?

An RFI gathers information to build a shortlist. An RFP asks shortlisted vendors to answer identical questions and propose a solution and price. An RFQ asks only for prices against a fixed specification. Hospital AI purchases usually need an RFI followed by an RFP.

How many vendors should a hospital shortlist?

Three or four for the RFP, and one or two for the shadow pilot. More than four makes fair scoring and demos on your own data hard to run.

How long does an AI RFP take from issue to contract?

About eight weeks: one for the RFI, one to issue the RFP, two for written answers, one for demos on your data, two for a shadow pilot, and one to score and negotiate.

Can we share patient data with vendors during an RFP?

Share only anonymised or synthetic samples before contract. Under India's DPDP Act the hospital stays responsible for data it shares, so any identifiable data should wait until a data processing agreement is signed.

Do we need a separate RFP for each AI tool?

Use one RFP per problem. If one vendor's suite covers several problems, score each problem separately and check that later products run on the same tenant, users and data without a new implementation.

Which contract clauses matter most for AI software?

Data ownership and no-training terms, sub-processor list and hosting region, incident notification timelines, accuracy and service levels with credits, notice of model changes, audit rights, price-increase caps, and data export at exit in a usable format.

Sources

This template is a practical starting point, not legal advice. Have your legal and compliance teams review the final RFP and contract.

Portrait of Mohammed Jamil Nasir

Written by

Mohammed Jamil Nasir

Founder – Product & Technology, Surgy Health

14+ years in Product, Design & Tech · PGC AI/ML, IIT-Guwahati · Global MBA, SP Jain · BE-CSE

Mohammed Jamil Nasir leads product and technology at Surgy Innovation Labs Private Limited, building AI-first, seamless healthcare products for hospitals and healthcare networks across India and the GCC. He writes about healthcare AI, accreditation, and clinical operations.

Connect on LinkedIn

Keep reading

More on Healthcare AI

Hand-picked next reads that build on this article, so you can go deeper before you decide.

Browse all Healthcare AI articles
View all articles →