This site is published by Medrecords AI, which makes 1 of the products it covers. We say which one wherever it appears. How we handle that.

Medical Record Review Software

RFP questions for medical record review software: a copyable list

By Ahmed Jemaa, Co-Founder and CEO of Medrecords AI. Updated .

Short answer: send every shortlisted vendor the same 64 questions in 8 sections: company, records and output, verification, security and BAA, data handling, access, pricing and contract, and support. Ask for written answers, score them on a 0 to 2 scale, and treat any "no" on a must-have as a fail.

Limits: Vendor facts come from each vendor's own website, read on 2026-11-12; we haven't run every product, and prices, terms and security claims change, so get them in writing before you sign.

How to use this list

A hospital can paste the list into its RFP template. A practice can send it as 1 email. Either way, 3 rules make the answers usable:

  1. Same questions, same order, every vendor. Otherwise you compare sales decks, not answers.
  2. Answers in writing, from someone who can commit. A demo answer is not a contract term. Ask that key answers be attached to the order form.
  3. Delete what you don't need. A solo IME physician can drop SSO and SCIM; a hospital can't. A shorter list gets better answers.

The questions marked (must) are the ones we'd treat as pass or fail for physician work. The features page explains why each feature matters, and the security page explains the BAA items.

The list: 64 questions in 8 sections

1. Company and product

  1. What is the legal name of the company that will sign the contract, and where is it registered?
  2. Which customers is the product built for: physicians, hospitals, insurers, law firms or others? What share of your customers are physicians or health systems?
  3. Does the product form medical opinions, or only organize and summarize records for a clinician who forms them? (must)
  4. Which parts of the work are done by software and which, if any, by people? Where are those people located?
  5. What changed in the product in the last 6 months, and how do you tell customers about changes to models or output?
  6. Can you name 2 current customers of a similar size and type who will take a reference call?

2. Records and output

  1. What file types do you accept (PDF, TIFF, Word, images, DICOM, EHR exports)?
  2. What is the maximum pages and file size per case, and per upload? (must)
  3. How do you handle scanned, faxed, rotated and handwritten pages? Do you list pages you couldn't read? (must)
  4. How do you detect duplicate pages, and do you show which pages were treated as duplicates? (must)
  5. What outputs do you produce: chronology, summary, medication list, diagnosis list, missing records, gaps in care, billing summary, report draft?
  6. Can the output follow our report template, and can every line be edited?
  7. How do you flag records that are referenced but not in the file? (must)
  8. Can we add records to a finished case without starting over, and how are repeats of earlier pages handled?
  9. What export formats do you support, and do page links survive export? (must)
  10. Do you read existing Bates numbers or add your own?

3. Verification and quality

  1. Does every line of output cite a source page, and does the citation open that page? (must)
  2. What happens when a question has no answer in the file? Please show an example. (must)
  3. How do you measure errors and omissions, on which files, and checked by whom? Please share the method, not just a number.
  4. Is any output reviewed by a person before we see it? If so, by whom and with what credentials?
  5. Can we see which model version produced a given output?
  6. Is there a log of our edits to the output, and can we restore an earlier version?
  7. How do you tell us when a model change could affect output we already relied on?
  8. Can we run a trial on our own closed file before signing? How many pages and days? (must)

4. Security and BAA

  1. Will you sign a BAA before the first upload? Please attach your standard BAA. (must)
  2. List every subcontractor that creates, receives, stores or transmits our records, including AI model providers and hosting. Does each hold an agreement with you carrying the same restrictions? (must)
  3. Do you have a SOC 2 report? Type 1 or Type 2, which period, and can we read it under NDA?
  4. How is data encrypted at rest and in transit?
  5. When was your last penetration test, by whom, and can we see a summary?
  6. How many days after discovery will you notify us of a breach? (must)
  7. Have you had a reportable breach in the last 3 years?
  8. Do you carry cyber insurance, and with what limit?

5. Data use, location and deletion

  1. Do our records, outputs or anything derived from them train, tune or evaluate any model? Is the answer in the contract? (must)
  2. Does your BAA allow you to de-identify our data and use it? For what?
  3. In which countries are records stored and processed, including by AI model providers and backups?
  4. How long do you keep uploads, outputs and logs after we delete a case or close the account?
  5. Can our users delete a case themselves, and does that include backups?
  6. At the end of the contract, how do we export everything, in what format, and how do you confirm deletion in writing? (must)
  7. Can your staff open our cases? When, who approves it, and is that access logged?
  8. Do you offer a private cloud or on-premise option if our policy requires it?

6. Users and access

  1. Is MFA available and can we require it for every user? (must)
  2. Do you support SSO with our identity provider, and at what plan or price?
  3. Do you support automated user provisioning and removal?
  4. Can we limit each user to specific cases and roles? (must)
  5. Is there an access log we can export, showing who opened which case and when?
  6. Can we share a case or export with an outside party without giving them an account?
  7. Is there an API? Self-serve or by request, and what does it cost?
  8. Can the product connect to our case management or claims system?

7. Pricing and contract

  1. What is the billing unit (page, credit, case, seat, month), and what exactly counts as 1 unit? (must)
  2. Are duplicate pages billed? (must)
  3. Please price 12 months at our expected volume, at half that volume and at double it.
  4. List every fee outside the unit price: setup, BAA, SSO, support tier, rush, storage, extra users.
  5. Do unused credits, pages or allowance expire?
  6. Is there a minimum commitment, minimum term or auto-renewal? What is the cancellation notice?
  7. Can prices change during the term, and with how much notice?
  8. Are we charged for failed runs, reprocessing or edits?

8. Support and rollout

  1. How long from signature to first case?
  2. Who trains our users, and is training included?
  3. What support channels and hours do you offer, and is there a response time commitment?
  4. What is your uptime commitment, and what happens if you miss it?
  5. Where do we see system status and incident history?
  6. How do we report an error in the output, and how fast do you respond?
  7. What happens to our data and access if your company is acquired or closes?
  8. What will we know at 30 days that tells us the rollout is working?

What a good answer looks like, for the 8 that decide most deals

QuestionGood answerWeak answer
17: page citation on every line"Yes; every line links to the page, here is an export showing it""Citations are available for key findings"
18: no answer in the fileAn example where the tool says it couldn't find it"Our AI is highly accurate"
10 and 50: duplicatesA count of duplicates shown per case, and a clear billing rule"Our AI cleans up the file"
25: BAA before uploadThe BAA attached to the reply"Available on request" after the trial starts
26: subcontractorsA named list, with AI model providers included"Leading cloud and AI partners"
33: training on your data"No, and it is in section X of the BAA""You can opt out in settings"
38: exit and deletionExport format, deletion deadline, written confirmation"We follow industry standards"
51: 12-month price at 3 volumes3 numbers with every fee includedA per-page rate and "let's talk"

How to score the replies

Score each answer 0, 1 or 2: 0 for no answer or a refusal, 1 for a partial or verbal-only answer, 2 for a complete written answer with evidence. Any 0 on a (must) question removes the vendor, whatever the total.

Then weight by section to fit your setting. A solo physician might weight records and verification double. A hospital security team will weight sections 4 and 5 double. Don't let the total hide a single failing must-have; a vendor that scores 110 of 128 but won't name its AI subcontractors is still out.

Finally, compare the written answers with what you saw in your trial. If a vendor wrote "every line cited" and your trial found uncited lines, believe the trial.

Questions about writing an RFP for record review software

How long should vendors get to answer?

1 to 2 weeks is normal for written answers. A vendor that can't answer the security and pricing sections within 2 weeks will be slow on support too.

Should I send the RFP before or after the trial?

Send the security section before any trial with real records, and the rest during the trial. That way the trial tests the written answers.

Can I use this list for an outsourced review service?

Mostly. Drop the access and API questions, and add questions on reviewer credentials, turnaround, rush fees and who signs the work product.

Is this list legal advice?

No. It is a buyer's checklist. Have counsel review the BAA and contract terms your organization signs.