Electronic Health Record Isolated Recovery Environment Service

Hattiesburg Clinic is seeking a hosted, subscription-based isolated recovery environment for its Epic electronic health record, including immutable backups, clean-room recovery, implementation, and ongoing testing and support.

Hattiesburg Clinic, P.A.

General

Status:Open (open)

Solicitation Identifier:4618-20261013152026 Hattiesburg

Due Date:Nov 01, 2026 06:00 PM

Posted Date:Oct 30, 2026 05:00 PM

Contract Period:1 year base + 2 × 1 year options

Type:Request for Proposal (RFP)

Level:Private

Ask AI about this solicitation

ChatGPT Claude Perplexity Grok Gemini

Original Solicitation Links

[

4618-20261013152026 Hattiesburg

]

4618-20261013152026 hattiesburg

Contact

Name:Jerry Robinson

Email:jerry.robinson@hattiesburgclinic.com

Submission Instructions

Method:Email

Email:jerry.robinson@hattiesburgclinic.com

Description

Hattiesburg Clinic seeks a hosted, subscription-based Isolated Recovery Environment (IRE) service to protect and restore its Epic electronic health record (EHR) if production systems, backups, or identity systems are compromised. The solution must provide immutable, logically isolated copies; a separate identity and management plane; a clean-room environment for malware scanning and recovery validation; and documented recovery runbooks with stated recovery point and recovery time objectives. The vendor must provide the software, hosting, storage, implementation, initial data seeding and recovery test, documentation, training, 24/7/365 monitoring, support, and recovery testing at least twice annually. The service must meet the stated security, privacy, and compliance requirements, including U.S.-based data storage, a current SOC 2 Type II report or equivalent, and execution of a HIPAA Business Associate Agreement before accessing Clinic data. The initial contract term is 12 months from service acceptance, with two optional 12-month renewal years. Proposals must include a signed cover letter, company overview and healthcare references, technical response, implementation plan, proposed RPO/RTO and service levels, completed pricing form, signed and notarized non-collusion affidavit, SOC 2 Type II report or equivalent, and sample contract and BAA if the bidder proposes its own terms. Evaluation considers technical compliance, cost, vendor experience and references, and implementation approach.

Classification Codes

NAICS518210Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

PSCDJ10Security and Compliance support delivered as a service, by subscription, or service contract. Includes support of security policies/controls, processes, measuring compliance of relevant legal/compliance requirements, and responding to security breaches. Also provides support for IT Security systems providing Continuous Diagnostics and Mitigation (CDM) for real-time Cyber Security and protection such as vulnerability scanning, managing firewalls, intrusion prevention systems, and security information and event management (SIEM). Includes Disaster Recovery (DR) services to support DR policy, process and means, dedicated failover facilities and perform DR testing.