Referral management RFP: 40 questions to ask vendors (with template)

Referral management demos are optimized to look good. Every vendor will show you a clean queue, a happy patient text thread, and a dashboard with green numbers. What a demo cannot show you is whether the fax parser survives a handwritten cover sheet, whether the EHR integration writes status back or just reads, or whether "implementation" means four weeks or four quarters.

An RFP fixes that, but only if the questions are specific enough that vague answers stand out. "Do you integrate with Epic?" invites a yes. "Which Epic interfaces do you use, what data flows each direction, and how many clients run it in production today?" invites either evidence or squirming, and both are useful.

Below is a complete 40-question bank you can paste into your RFP document, followed by how to run the process, what good versus evasive answers look like on the hardest questions, and how to score responses. It pairs with our referral management software buyers guide for the overall selection journey and our broader guide to evaluating healthcare AI vendors if AI capability claims are central to your shortlist.

Before you send it: scope the RFP

An RFP works only when every vendor answers against the same facts. Open your document with a one-page scope statement covering:

• Your organization: specialties, number of sites, EHR(s) and versions, payer mix highlights
• Monthly referral volume, inbound and outbound, including fax and phone volume
• The workflows in scope: intake, document handling, scheduling, patient outreach, prior auth, eligibility, tracking, reporting
• Your current state pain: where referrals stall or leak today
• Required timeline and decision date

If you are still deciding whether you need the full workflow or just visibility, settle that before the RFP goes out; our comparison of referral management vs referral tracking walks through that decision. Multi-site organizations should also state how much workflow variation exists across sites, since that drives both configuration effort and pricing; our guide to evaluating referral automation for multi-site organizations covers those questions in depth.

The 40-question bank

Copy these directly. Require written answers, and state that answers become part of the contract exhibit for the winning vendor. That single sentence noticeably improves answer quality.

Section A: Intake and document handling (questions 1-5)

1. Through which channels can referrals enter the system (fax, direct message, portal, EHR order, phone, email), and which of those are processed automatically versus manually by your staff or ours?
2. How does the system extract structured data (patient demographics, insurance, diagnosis, requested service) from unstructured faxes and attachments, and what is your measured extraction accuracy in production?
3. What happens to a referral the system cannot confidently parse? Describe the exception queue, who works it, and typical exception rates.
4. How are duplicate referrals and updated versions of the same referral detected and merged?
5. How does the system identify missing information (demographics, insurance, clinical notes) and what does it do to chase it down?

Section B: EHR integration (questions 6-10)

6. List the EHRs you integrate with in production today, and for our EHR specifically, name the integration method (native API, HL7 v2, FHIR, marketplace app, RPA/screen automation).
7. For our EHR, what data flows in each direction? Specifically: do referral status, appointment, and document updates write back into the patient chart automatically?
8. How many clients currently run this exact integration in production, and can we speak to two of them?
9. What does the integration cost, who pays any EHR-vendor-side fees, and who maintains the interface after EHR version upgrades?
10. If our EHR connection goes down, what does the workflow degrade to, and how are users notified?

Section C: Scheduling and patient outreach (questions 11-15)

11. Can the system schedule patients directly into our EHR schedule (not a shadow calendar), and how does it respect provider-specific scheduling rules?
12. What outreach channels are supported (call, text, email), in which languages, and what is automated versus performed by human agents?
13. How quickly after a referral is received is the first patient contact attempt made, and how is that measured?
14. Describe the escalation path when a patient does not respond: how many attempts, over what period, through which channels, and when does a human take over?
15. What no-show reduction results can you document in production, with the client and measurement method named?

Section D: Prior authorization and eligibility (questions 16-20)

16. Does the platform verify insurance eligibility before scheduling, and is that check real-time or batch?
17. Which parts of prior authorization does the system automate: determining whether auth is required, compiling documentation, submitting, checking status, and handling responses?
18. What are your measured first-pass approval rates and average turnaround times in production, and how do you measure them?
19. How does the system track payer-specific auth requirements as they change, and who maintains that ruleset?
20. When an authorization is denied, what does the workflow do next, and what appeal support exists?

Section E: Analytics and reporting (questions 21-25)

21. Which metrics does the platform track out of the box: referral-to-appointment conversion, time to first contact, time to scheduled, completion rate, leakage, aging by stage?
22. Can we see performance by site, by provider, by referral source, and by payer without exporting to a spreadsheet?
23. How is a "completed" referral defined in your reporting, and can we adjust that definition?
24. What data can we export, in what formats, and is full export available at no charge during and after the contract?
25. Show us the report a practice administrator would use in a Monday morning huddle. What does it take to build a custom version?

Section F: Security and compliance (questions 26-30)

26. Will you sign a Business Associate Agreement, and can we review your standard BAA now?
27. What third-party security attestations do you hold (for example SOC 2 Type II or HITRUST), and can you share the current report under NDA?
28. Where is PHI stored and processed, is it encrypted at rest and in transit, and do any subprocessors (including AI model providers) receive PHI? List them.
29. Describe role-based access controls, audit logging, and how we would investigate a specific user's access to a specific patient record.
30. Describe your breach notification process and your incident history over the past three years.

Section G: Implementation and support (questions 31-35)

31. Provide your standard implementation plan with phases, durations, and the named roles you staff versus the roles you expect us to staff, including estimated hours for our team.
32. What is your median (not best-case) time from contract signature to first live referral for organizations our size?
33. How is training delivered, how long until a new coordinator is productive, and what materials exist for staff we hire later?
34. What are your support hours, channels, and response-time commitments by severity, and are any support tiers a paid upgrade?
35. Who is our named post-go-live contact, and how often will we review performance together in the first year?

Section H: Pricing and contract (questions 36-40)

36. State your pricing model (per-user, per-site, per-referral, usage-based, enterprise) and quote a 3-year all-in total at our stated volume, including implementation, integration, training, and support.
37. What contract terms do you offer (month-to-month versus annual versus multi-year), and what are the price escalators in years two and three?
38. What exactly happens at termination: data export format, transition support, and any fees?
39. Which items in your quote are one-time versus recurring, and which are estimates that could change after discovery?
40. What performance commitments will you put in the contract (go-live date, uptime, support response), and what remedies apply if you miss them?

How to run the RFP process

1. Shortlist 3-5 vendors using public information and analyst-style roundups such as our review of the best referral management software. More than five multiplies your evaluation labor without improving the decision.
2. Send the scope statement and the 40 questions with a firm written-response deadline, typically two to three weeks.
3. Score written answers before any demo. This ordering matters: demos anchor evaluators emotionally, and written answers read very differently after a charismatic demo.
4. Run scripted demos. Send finalists your own scenario script (a messy faxed referral, an unresponsive patient, a denied auth) and require the demo to follow it in the live product, not slides.
5. Check references and ask for production evidence. Two references per finalist minimum, at organizations resembling yours, plus at least one metric walkthrough from a real deployment.
6. Negotiate with the answers. The winning vendor's RFP responses go into the contract as an exhibit. Anything they claimed in writing, they can commit to in writing.

Good versus evasive answers on the hardest questions

A few of the 40 questions do most of the separating. Here is what strong and weak answers look like on each.

Question 7 (EHR writeback). A good answer names the interfaces and the exact fields written back, and offers a client running it today. An evasive answer says "we have a robust integration ecosystem" or describes reading data while staying vague about writing it. If status updates do not write back, your staff will re-key them forever; treat read-only integrations as a different, cheaper category of product.

Question 13 (time to first contact). A good answer is a number with a measurement method: for reference, Linear Health's automated outreach makes first contact in ~5 min, against a manual industry baseline of 3-7 days. An evasive answer is "immediately" or "same day" with no definition of when the clock starts. Ask whether the clock starts at referral receipt or at coordinator triage; the difference is often days.

Question 18 (prior auth metrics). A good answer quotes rates with denominators and scope ("first-pass approval across N submissions in these specialties, measured this way"). An evasive answer quotes a glossy percentage with no denominator, or pivots to a roadmap. Metrics without denominators are marketing, not evidence.

Question 28 (PHI and subprocessors). A good answer lists subprocessors by name, including any AI model providers, and describes the data protection terms with each. An evasive answer is "we are fully HIPAA compliant," which is a posture, not an architecture. Vendors handling PHI well tend to answer this question with specifics and without discomfort.

Question 32 (median time to go-live). A good answer distinguishes median from best-case and states what your team must staff. An evasive answer quotes the fastest deployment ever achieved. Whatever number they give, ask the references question 8 produced whether it matched their experience.

Question 36 (3-year all-in pricing). A good answer is a single table with every line item. An evasive answer is a per-unit teaser rate with "final pricing after discovery." Some post-discovery adjustment is normal; refusal to model a total at your stated volume is not. For the pricing models you will encounter and how to normalize them, see how much referral management software costs.

Scoring responses

Keep scoring boring and mechanical, agreed before any answers arrive:

• Score each of the 40 answers 0-3: 0 for no answer or non-answer, 1 for a claim without evidence, 2 for a specific answer, 3 for a specific answer with production evidence or a reference attached.
• Weight sections to your priorities. Most organizations weight EHR integration and implementation highest, because those are where failed projects fail.
• Have at least three scorers (operations lead, IT, and a working coordinator) score independently before discussing. Coordinators reliably catch workflow fictions the other two miss.
• Disqualify on floor criteria, not totals: no BAA, no production reference on your EHR, or refusal to answer the pricing question as asked should end a candidacy regardless of the other 39 scores.

The bottom line

A referral management RFP is not paperwork; it is the only phase of the purchase where you control the information flow instead of the vendor. Forty specific, numbered questions across intake, integration, scheduling, prior auth, analytics, security, implementation, and pricing will surface which vendors run real production workflows and which run good demos. Require written answers first, score them before demos, verify with scripted scenarios and references, and put the winning answers in the contract. The vendors that welcome this process are the ones you want; start from the referral coordination software capabilities that map to it.

FAQ

Sources

• ONC/ASTP, on interoperability and electronic exchange of referral information, healthit.gov
• CMS, on payer interoperability and prior authorization requirements shaping vendor capabilities, cms.gov
• MGMA, on practice operations benchmarks useful for RFP scope statements, mgma.com