Scope
Use this skeleton to buy software that monitors controlled-substance transactions and flags possible diversion: dispensing-cabinet, EHR, pharmacy-system and wholesaler data in, scored alerts and an audit trail out. Paste the requirement lines into your own RFP, replace the bracketed values, and require the evidence column as an attachment, not a promise. Do not accept "available on request" for any of it.
The 12 requirement sections
Data sources
Requirement: The system shall ingest [dispensing cabinet, EHR administration, pharmacy dispensing, wholesaler receipt, waste] records at least every [60 minutes] and report any feed that is late or incomplete.
Evidence: A field-level data dictionary and a live feed-health screen from a current customer.
Diversion scoring
Requirement: Each score shall show the inputs, weights and peer group behind it, and the customer shall be able to read every rule.
Evidence: Written methodology, the false-positive rate on a customer's data, and how that rate was measured.
Alert workflow
Requirement: Every alert shall have an owner, a due date, a disposition code and a required note before it can be closed.
Evidence: A recorded walkthrough of one alert from creation to closure, including reassignment.
Audit trail
Requirement: The system shall log every view, edit, export and rule change with user, time and prior value, and no user shall be able to delete log entries.
Evidence: A sample log export and the technical description of how tampering is prevented.
Role-based access
Requirement: Access shall be assigned by role and by site, and a pharmacist shall be unable to view or close an alert about themselves.
Evidence: The role matrix and a demonstration of the self-alert block.
Reporting
Requirement: Reports shall state their date range, denominator and exclusions, and export with the underlying records.
Evidence: Five sample reports and the definition of each metric.
Integration
Requirement: The vendor shall integrate with [named systems and versions] without customer-side custom code.
Evidence: Three reference customers running the same pairings, with contact details.
Validation
Requirement: The vendor shall supply a validation package and re-validate after every release that changes scoring.
Evidence: A prior validation report, test cases with results and the release history for the last 24 months.
Support
Requirement: The vendor shall respond to a severity-one defect within [4 hours] and give a written root cause.
Evidence: The support contract, actual response-time figures for the last four quarters and an escalation chart.
Training
Requirement: The vendor shall train investigators and administrators, and re-train after material changes.
Evidence: The curriculum, hours per role and a competency check.
Security
Requirement: Data shall be encrypted in transit and at rest, and the vendor shall report a breach within [72 hours].
Evidence: A current independent security audit report (SOC 2 Type II or equivalent), the pen-test summary and the subprocessor list.
Exit and portability
Requirement: On termination the vendor shall return all records, alerts, notes and audit logs in an open format within [30 days] and then certify deletion.
Evidence: The export schema and one real export, with its record counts matched to the source system.
Scoring rubric (1-5)
- 1 - No capability, or a claim with no evidence.
- 2 - Partial capability; the rest is on the roadmap.
- 3 - Meets the requirement; evidence supplied, not tested.
- 4 - Meets it, and you confirmed it in a demo on your own data.
- 5 - Meets it, confirmed on your data and by a reference customer.
Weight sections before you read any response. Score each section alone, and treat any 1 in sections 4, 5, 11 or 12 as disqualifying.
Three questions that expose a weak vendor
- "Show me an alert your system raised that turned out to be wrong, and what you changed afterwards." A vendor with no wrong alerts has not measured.
- "Export everything for one site, today, in a format I can open without your software." Hesitation here predicts the exit problem.
- "Which of your customers can I call that has used it through a DEA or board inspection?" A vendor with none has not been tested where it matters.