Running a telehealth program at scale, Part 6: the telehealth infrastructure RFP
A launch-stage evaluation asks how fast and how cheap. A scale-stage evaluation asks whether the platform can carry a thousand encounters a month across thirty states without you noticing. Part 6 of our series for programs at scale is the RFP that asks the second set of questions.
Lithos StaffEvaluate telehealth infrastructure at scale across six sections. Clinical: licensure coverage by state today, turnaround measured at the 90th percentile, protocol governance, escalation and live-visit handling, NP supervision structure. Pharmacy: network breadth, states shippable, cold chain, redundancy, routing logic. Technology: API completeness, webhooks for every event, full export, sandbox fidelity, idempotency, uptime history. Compliance: BAA terms, SOC 2 status and date, audit log export, consent versioning, EPCS, LegitScript posture. Commercial: pricing model against your twelve-month volume, minimums, tiers, exit terms, data return. Migration: whether it is a defined path with clinician re-establishment and wave cutover, or a favor. Score every answer as demonstrated, documented, or promised; weight coverage, exports, and pricing shape highest; and ask references the questions vendors cannot answer for themselves.
Ask for evidence, not descriptions
Every platform describes itself well. The RFP’s job is to convert descriptions into things you can verify: a demonstration, a document, a reference, a contract clause. Structure each question so the answer is one of those, and score accordingly. Below are the six sections, the questions that matter at volume, and what a strong answer looks like.
1. Clinical
| Question | Strong answer |
|---|---|
| In which states do you have licensed clinicians today, and how many per state? | A current matrix, not “all fifty available.” Coverage for your patient-state mix demonstrated. |
| What was your turnaround from intake to decision last month, median and 90th percentile, by encounter type? | Numbers from their system, with the distribution. |
| How are protocols written, reviewed, and versioned? Who is the medical director? | Named clinical leadership; dated protocol versions you can read. |
| How do red flags escalate, and how are live-visit requirements handled by state? | Configured escalation lanes; a scheduling path, not “the clinician decides.” |
| What is the NP-to-physician supervision structure, state by state? | Collaborating-physician arrangements documented for the states you sell in. |
| How does capacity scale when our volume doubles? | A network provisioned as capacity, with examples of prior scaling. |
2. Pharmacy
| Question | Strong answer |
|---|---|
| Which pharmacies are in the network, and which states can each ship to? | A list with licensure footprints. |
| How is an order routed to a pharmacy? | A rule — state, medication, cold chain, capacity — not a single default partner. |
| What is the cold-chain process and the exception rate? | Packaging, carriers, weekend handling, and a number. |
| What happens when a pharmacy has an outage or backlog? | Automatic re-routing to a second pharmacy in the same state footprint. |
| How do you handle compounded medications, beyond-use dates, and 503A versus 503B sourcing? | Clear policy; see our 503A vs 503B guide. |
3. Technology
| Question | Strong answer |
|---|---|
| Is every resource available through the API — patients, encounters, orders, prescriptions, insurance, prior authorizations, documents? | Documentation you can read before signing; sandbox credentials at kickoff. |
| Which events are delivered as webhooks? | Every encounter, order, and prior-authorization state change, signed, with documented retry and replay behavior. |
| Can we export every record we own through the API, at any time, including after termination? | Yes, demonstrated on a sample. |
| Does the sandbox simulate clinician decisions and fulfillment, including failures? | Yes, with outcomes you can trigger. |
| How are retries and duplicates handled? | Idempotency keys on writes; event IDs on webhooks. |
| What is the uptime history and the incident communication process? | A status page with history; a written process. |
4. Compliance
| Question | Strong answer |
|---|---|
| Is a BAA standard, and what are its terms on breach notification and subcontractors? | Standard at onboarding; terms in writing. |
| What is your SOC 2 status, and when was the last report? | A dated Type II report under NDA, or an honest “in progress” with a date. |
| Can we export the audit log — every access and clinical decision — ourselves? | Yes, through the API. |
| How are consents versioned and tied to state requirements? | Versioned records with timestamps, re-capture on change. |
| How is EPCS handled, and how do you follow DEA telemedicine rules? | Identity-proofed prescribers, two-factor at signing, a written policy. |
| What is your LegitScript posture and how do you support ours? | Certified where applicable; documentation you can reuse. |
5. Commercial
| Question | Strong answer |
|---|---|
| What is the pricing model, and what is our effective cost per encounter at 500, 1,000, and 2,000 a month? | A model you can plug your volumes into, with per-encounter cost that declines. |
| Are there minimums, tiers, or per-member fees? | None that outrun your growth; anything that exists disclosed up front. |
| What are the notice period, exit terms, and data-return obligations? | Terms in writing: a defined contract term, rates locked at execution, termination-for-cause language, and full data export on exit. |
| What changes in price when we add a category or a state? | Nothing structural. |
Model the answers against your own twelve-month volume forecast using the unit economics framework. The right shape is a small fixed line and a variable line that falls with volume; see the pricing models guide for the four models and their traps.
6. Migration
| Question | Strong answer |
|---|---|
| Have you migrated a live patient base at our scale, and how? | A defined playbook — export audit, parallel run, clinician re-establishment, state waves, rollback — with references. |
| How are existing prescriptions handled? | Re-established by your clinicians against each patient’s refill date, never ported. |
| What do you need from us, and what is the timeline to the first state? | A specific list; three to four weeks to first cutover. |
| What is the rollback plan if a wave underperforms? | Held open until the wave clears a refill cycle. |
Include this section even if you may stay. It tells you how the vendor thinks about patients, and a written migration plan is leverage in your current renewal.
Scoring
Rate every answer on one scale: demonstrated (you saw it work, or read the document), documented (in writing and contractual), or promised (said in a meeting). Then weight. The items you cannot fix after signing weigh most: state coverage today, data export, pricing shape, and pharmacy redundancy. The items you can influence — support tooling, dashboards — weigh least. A vendor with excellent demos and promised coverage should score below one with demonstrated coverage and plain dashboards.
Red flags
- Turnaround quoted as an average, or not quoted.
- Coverage “available in all fifty states” without a matrix of who is licensed where today.
- Exports that go through support.
- Compliance evidence described but not shown.
- Pricing that does not decline with volume, or minimums under your run rate.
- A migration described in the singular.
What to ask references
Ask for references at your volume, not launch-stage customers, and ask them what the vendor cannot answer for itself: their 90th-percentile turnaround last month; how long the last new state took to open; whether they have pulled a full export and what was in it; what happened during the vendor’s last incident and how they heard about it; whether pricing changed as they grew; and what they would ask if they were doing this again.
Here is how Lithos answers the six sections, so you can hold us to it. Clinical: a network of licensed providers (MDs, DOs, NPs, PAs and RDs) with multi-state licensure covering all 50 states, AI-prepared async consultations, and state-by-state oversight and board filings handled. Pharmacy: prescriptions route to your preferred pharmacy or through Lithos’s direct pharmacy partners. Technology: REST API plus webhooks, a hosted real-time ops dashboard branded for you, sandbox credentials at technical kickoff, and your clinical and operational data exportable at any time. Compliance: HIPAA-compliant infrastructure, a BAA signed at onboarding, SOC 2 Type II in progress. Commercial: no setup fee and no monthly platform fee; a per-visit price ($45 async and $70 sync on pay as you go) that falls automatically as monthly volume grows, with an optional volume commitment for a flat rate from month one; usage-based add-ons with no minimums; medication at pharmacy cost plus a small flat fee on mail-order orders; and you bill patients through your own merchant account. Migration: a defined path with provider re-establishment and state-by-state waves. Details are on the security page and in the docs; bring the RFP to a working session.
Frequently asked questions
What should a telehealth platform RFP include?
Six sections: clinical coverage and turnaround, pharmacy network and routing, API and data access, compliance evidence, commercial terms modeled against your volume, and migration support. Ask for demonstrations and documents rather than descriptions wherever possible.
What are red flags when evaluating telehealth infrastructure?
Turnaround quoted as an average with no percentile; state coverage described as available on request; exports that require a support ticket; compliance evidence you cannot see; pricing that does not decline with volume; and a migration described as something they have done once.
How should we score telehealth vendor responses?
Rate each answer as demonstrated (you saw it work or read the document), documented (it is in writing and contractual), or promised (it was said). Weight state coverage, data export, and pricing shape most heavily, because those are the things you cannot fix after signing.
What should we ask a telehealth vendor’s references?
Their turnaround at the 90th percentile last month, how long a new state took to open, whether they have pulled a full export, what happened during the vendor’s last incident, and whether pricing changed as they grew. References at your volume, not launch-stage customers.
Should the RFP include a migration section if we are not sure we will switch?
Yes. The migration answers tell you how the vendor thinks about live patients — and having the migration plan written down is leverage with your current vendor even if you stay.
Get the Journal by email
Our best guides on building compliant telehealth programs — a couple a week, unsubscribe any time.
Put a medical practice behind your product
Book a call and we'll scope your program together, or get free sandbox access and start building.