Description
The NIH is issuing a Request for Information (RFI) to gather technical and business details from vendors capable of delivering a “Leave‑Behind” data‑extraction platform for healthcare partners. The solution must securely extract, provenance‑track, de‑identify, and token‑link patient data from EMR, lab, pharmacy, imaging, and other clinical systems, while remaining on‑site at the partner’s facility after contract completion. Vendors are asked to describe capabilities, COTS vs. custom components, pricing models, prior federal and healthcare experience, and security compliance (HIPAA Business Associate, encryption, audit logging, etc.). Responses are due September 22, 2026.
• Provide detailed technical approach for durable, on‑site extraction technology.
• Explain data provenance, immutable timestamps, and audit trails.
• Outline de‑identification (45 CFR §164.514(b)) and privacy‑preserving record linkage (PPRL).
• Describe handling of metadata (SNOMED CT, LOINC, ICD‑10, RxNorm, etc.) without loss.
• Show security posture: HIPAA BA, SIEM‑compatible logs, TLS 1.2/1.3, VM‑level encryption.
• Offer performance estimates for baseline, 2×, and 5× workloads.
• Submit business information: capability matrix, pricing, relevant experience, company size.