Section 1: RFP Scorecard — Ensemble vs. R1 vs. Conifer
Most RFP processes for full-cycle RCM outsourcing evaluate vendors on 5–8 criteria, weighted equally, scored by a committee that hasn't standardized what "good" looks like. The result is a decision driven by presentation quality and relationship comfort rather than operational rigor.
The scorecard below uses 18 weighted criteria across four categories. Each criterion includes a scoring guide (1–5 scale), suggested weight, and red flag indicators specific to Ensemble, R1, and Conifer. Customize the weights based on your organization's priorities — the defaults reflect a mid-size health system (400–800 beds) with a complex commercial payer mix.
Health systems that use weighted RFP scoring report 3.2× fewer post-contract disputes over SLA expectations versus those using equal-weight or unstructured evaluation (HFMA, 2025 Outsourcing Benchmarks).
Category A: Operational Performance (Suggested Weight: 35%)
| Criterion | Weight | What to Score (1–5) | Ensemble Red Flag |
|---|---|---|---|
| 1. Denial Rate SLA | 8% | 5 = guaranteed <5% initial denial rate with financial penalty. 1 = no SLA or >8% target. | Ensemble's standard SLA targets 6–7% — push for sub-5% with teeth |
| 2. AR Days Target | 7% | 5 = committed to <35 days AR with quarterly reporting. 1 = no target or >50 days. | Ask for AR days by payer class, not blended — blended hides commercial AR issues |
| 3. Clean Claim Rate | 6% | 5 = >97% clean claim rate with root cause reporting on rejections. 1 = no tracking. | Ensemble may report clean claims excluding specific exclusion categories — define "clean" in the contract |
| 4. Net Collection Rate | 7% | 5 = >97% net collection rate with transparent methodology. 1 = vague or self-reported. | Verify denominator: some vendors exclude bad debt and charity from net, inflating the rate |
| 5. First-Pass Resolution Rate | 7% | 5 = >90% first-pass resolution with denial root cause analytics. 1 = no tracking. | R1 leads here with AI-assisted denial prediction; Ensemble is catching up but less mature |
Category B: Technology & Integration (Suggested Weight: 25%)
| Criterion | Weight | What to Score (1–5) | Red Flag Indicator |
|---|---|---|---|
| 6. AI/Automation Tooling | 6% | 5 = production AI for coding, denial prediction, and workflow routing. 1 = manual processes only. | Ensemble's AI is narrower than R1's Cloudmed stack — evaluate specific use cases, not marketing claims |
| 7. Epic Integration Depth | 5% | 5 = certified Epic integration with bi-directional data flow. 1 = flat file extracts only. | Conifer's Epic integration is weakest of the three — critical if you're an Epic shop |
| 8. Reporting & Analytics | 5% | 5 = real-time dashboards with drill-down by payer, service line, and denial category. 1 = monthly PDF reports. | Demand a reporting demo with YOUR data schema — canned demos don't reflect implementation reality |
| 9. Interoperability & Data Standards | 5% | 5 = HL7 FHIR-native, API access to your data. 1 = proprietary format, no API. | All three vendors lag on FHIR — make data portability a contract requirement, not an RFP promise |
| 10. Cybersecurity & HIPAA Posture | 4% | 5 = SOC 2 Type II certified, HITRUST, annual pen testing. 1 = self-attested compliance only. | Ask for breach history and incident response SLA — not just certifications |
Category C: Transition & Implementation (Suggested Weight: 20%)
| Criterion | Weight | What to Score (1–5) | Red Flag Indicator |
|---|---|---|---|
| 11. Staff Retention Guarantees | 5% | 5 = guaranteed employment for existing RCM staff for 12+ months with comparable comp. 1 = no retention commitment. | Ensemble typically offers 6-month retention — negotiate for 12 months minimum with compensation floors |
| 12. Knowledge Transfer Plan | 5% | 5 = documented 90-day knowledge transfer with payer-specific SOPs and shadow period. 1 = no formal plan. | The #1 cause of post-transition denial spikes is lost payer-specific institutional knowledge |
| 13. Go-Live Timeline | 5% | 5 = phased go-live over 6–9 months with parallel processing. 1 = big-bang cutover with no parallel. | Ensemble's typical timeline is 4–6 months — too fast for complex payer mixes. Push for parallel processing. |
| 14. Reference Clients (Similar Profile) | 5% | 5 = 3+ reference clients with similar bed count, payer mix, and Epic environment. 1 = no comparable references. | Ask references about Year 2 performance, not just go-live. Transition metrics always look better than stabilized ops. |
Category D: Commercial Terms (Suggested Weight: 20%)
| Criterion | Weight | What to Score (1–5) | Red Flag Indicator |
|---|---|---|---|
| 15. Pricing Structure Transparency | 5% | 5 = fully transparent % of net collections with no hidden fees. 1 = blended fee with undisclosed surcharges. | Ensemble's typical fee: 2–4% of net collections. Get the fee schedule in writing — "approximately" is not a number. |
| 16. Incentive Alignment | 5% | 5 = shared-risk model with upside/downside tied to performance. 1 = flat fee regardless of results. | If the vendor makes the same money whether your net collections go up or down, the incentives are broken |
| 17. Termination Terms | 5% | 5 = termination for convenience with 180 days notice, capped wind-down fees. 1 = 2-year lock-in with punitive exit fees. | Ensemble's standard term is 5–7 years with auto-renewal — negotiate a 3-year initial with renewal options |
| 18. Change-of-Control Provisions | 5% | 5 = termination right if vendor ownership changes (PE buyout, merger). 1 = no change-of-control clause. | Critical in today's market — PE activity in RCM is at an all-time high. If Ensemble gets acquired, you need an exit right. |
Score each vendor 1–5 on each criterion. Multiply by the weight. Sum for a weighted total. A vendor scoring below 3.5 weighted average on any single category should trigger a deeper diligence cycle on that category before you proceed. Don't let a strong technology score compensate for weak commercial terms — they're different risk categories.
Section 2: Contract Red Flags Checklist
The RFP process tells you what a vendor promises. The contract tells you what they're actually obligated to deliver. These are the 14 specific contract provisions that most health systems either miss, under-negotiate, or accept at face value — and the ones most likely to create problems 12–24 months post-signature.
Auto-Renewal Notice Window
What to look for: Most outsourcing contracts auto-renew for successive 1–2 year terms unless you provide written notice of non-renewal. The notice window is typically 180 days — sometimes 270 days. Miss the window by one day and you're locked in for another term.
What to negotiate: Reduce the notice window to 90 days. If they won't move off 180, require that Ensemble send you a written reminder 30 days before the notice deadline. Calendar this internally the day you sign — don't rely on the vendor reminder.
Performance Threshold Floors
What to look for: SLA targets that are set below your current internal baseline. If your current denial rate is 5.2% and the contract sets the SLA at 7%, you've just given the vendor permission to perform worse than you already do — and call it compliant.
What to negotiate: Every SLA threshold must be at or above your trailing 12-month performance on that metric. Document your current baseline as an exhibit to the contract. Require that SLA targets improve by at least 0.5% annually for the first 3 years.
Re-Insourcing Penalty Clauses
What to look for: Fees or penalties triggered if you decide to bring operations back in-house before the contract term expires. Some contracts include a "re-insourcing fee" equal to 6–12 months of management fees — essentially a golden handcuff.
What to negotiate: Eliminate re-insourcing penalties entirely, or cap them at 3 months of fees. If the vendor is delivering value, you won't leave. If they're not, a penalty shouldn't be the reason you stay.
Staff Non-Solicit Terms
What to look for: Clauses that prohibit you from hiring your own former employees who transferred to the vendor during the outsourcing. Standard non-solicit periods range from 12–24 months after contract termination.
What to negotiate: Limit the non-solicit to 6 months post-termination. Exclude any employees who were originally your staff before the outsourcing (they should always be recruitable by you). Include a "buyback" provision: you can hire any transferred employee at any time by paying a placement fee equal to 1 month of their salary.
Data Portability & System Access on Termination
What to look for: Vague language about data return timing, format, and cost. "Vendor will return client data within a reasonable timeframe" is not a data portability clause — it's a negotiating position the vendor will exercise when you're trying to leave.
What to negotiate: Full data export within 60 days of termination notice in HL7 FHIR or mutually agreed flat file format. Cost capped at actual direct costs (no extraction premium). Continued system access through the transition period. Certified destruction of your data within 90 days post-transition.
SLA Measurement Methodology
What to look for: The contract says "denial rate" but doesn't define whether that means initial denials, final denials after appeal, technical denials, clinical denials, or some subset. Similarly, "collected" can mean cash collected, net of contractual adjustments, or net of bad debt — each produces a materially different number.
What to negotiate: Define every metric in a measurement methodology exhibit attached to the contract. Include: calculation formula, data source, reporting frequency, exclusion criteria (if any), and dispute resolution process for measurement disagreements.
Change-of-Control Provisions
What to look for: What happens if Ensemble gets acquired, merges, or undergoes a PE buyout? Without a change-of-control clause, a new owner inherits your contract and can restructure the service delivery model — different staff, different technology, different priorities — with no obligation to maintain current service levels beyond what's in the contract.
What to negotiate: Termination for convenience (no penalty) if Ensemble undergoes a change of control. Alternatively: a 12-month price freeze and service level guarantee post-change-of-control, with a termination right if either is breached.
Audit Rights
What to look for: Limited audit rights that restrict you to reviewing vendor-prepared reports, using vendor-selected auditors, on the vendor's timeline. This is not an audit — it's a book report.
What to negotiate: Right to engage an independent third-party auditor (at your expense) annually. Vendor must provide full access to claims data, coding decisions, workflow logs, and denial management outcomes. If audit identifies error rates exceeding 3%, vendor remediates within 60 days and credits demonstrable revenue impact.
Scope Creep & Out-of-Scope Fees
What to look for: Charges for work the vendor considers "out of scope" that you assumed was included. Common examples: payer enrollment management, credentialing support, appeals beyond a certain volume threshold, custom reporting.
What to negotiate: A comprehensive scope exhibit listing every included service. Any service not explicitly listed as excluded is included. Out-of-scope work requires a written change order with pre-approved pricing before work begins.
Indemnification & Liability Caps
What to look for: Liability caps that limit the vendor's total exposure to 12 months of fees — meaning even catastrophic coding errors or compliance failures have a capped financial consequence for the vendor.
What to negotiate: Carve out regulatory penalties, HIPAA breaches, and gross negligence from the liability cap. The cap should apply to routine operational issues, not to events that could trigger CMS enforcement or OIG scrutiny.
Exclusivity Clauses
What to look for: Language that prevents you from engaging other vendors for any RCM services during the contract term — even for specialized functions (e.g., workers' comp, complex denials, out-of-state Medicaid) that the primary vendor handles poorly.
What to negotiate: Carve out the right to use specialized vendors for specific service lines or payer types. The outsourcing vendor should be your primary partner, not your only option.
Force Majeure Scope
What to look for: Overbroad force majeure definitions that include "technology failures," "staffing shortages," or "vendor system outages" — events that are within the vendor's control and should not excuse non-performance.
What to negotiate: Limit force majeure to genuine externalities: natural disasters, government orders, pandemic declarations. Vendor IT failures, staffing issues, and subcontractor problems are not force majeure events.
Subcontracting Rights
What to look for: The right for the vendor to subcontract portions of your RCM to third parties (often offshore) without your consent. Your contract is with Ensemble — not with an unnamed BPO in another country.
What to negotiate: Prior written consent for any subcontracting. If offshore resources are used, require disclosure of location, data security protocols, and the right to audit subcontractor facilities. Include a right to terminate the subcontracting arrangement if quality issues arise.
Governing Law & Dispute Resolution
What to look for: Contracts that specify the vendor's home jurisdiction for disputes and require binding arbitration (which typically favors the party that uses arbitration more frequently — the vendor).
What to negotiate: Governing law in your state. Mediation as a first step, with the option for litigation (not just arbitration) if mediation fails. Preserve your right to seek injunctive relief in court for urgent matters (data breaches, compliance violations).
Section 3: Build vs. Buy Calculator Framework
The outsourcing decision ultimately comes down to one question: does the vendor's fee structure deliver enough operational improvement to justify the cost premium over running RCM internally? The math is straightforward — but most health systems don't do it rigorously because the inputs are scattered across departments and the assumptions are easy to fudge.
Here's the framework. Plug in your numbers.
Step 1: Calculate Your Current Internal RCM Cost
| Input | Your Number | Notes |
|---|---|---|
| Total RCM FTE count | _______ | Include billing, coding, AR follow-up, denials, patient access, credentialing |
| Fully loaded cost per FTE | $_______ | Salary + benefits + overhead (typically $55K–$85K depending on market) |
| Total annual RCM labor cost | $_______ | FTE count × fully loaded cost |
| Technology costs (annual) | $_______ | EHR RCM modules, clearinghouse fees, denial management tools, reporting |
| Total internal RCM cost | $_______ | Labor + technology |
| Annual net patient revenue | $_______ | This is your denominator |
| Internal cost as % of NPR | _______% | Typical range: 3.5–6% for in-house operations |
Step 2: Calculate the Ensemble Cost Model
| Input | Ensemble Typical | Notes |
|---|---|---|
| Base management fee | 2–4% of net collections | Varies by scope, volume, and payer complexity. Get exact % in writing. |
| Performance tier (if applicable) | +0.25–0.75% above baseline | Some Ensemble contracts include a performance bonus above a net collection threshold |
| Implementation/transition fee | $1–3M (one-time) | Covers knowledge transfer, system integration, parallel processing, staff transition |
| Annual out-of-scope fees (estimated) | $200K–$500K | Custom reporting, scope additions, ad hoc projects — budget for this |
Step 3: Break-Even Analysis
If Ensemble charges 3% of net collections and your internal cost is 4.5% of NPR, outsourcing appears to save 1.5 percentage points. But that ignores transition costs, performance risk during the 6–12 month stabilization window, and the management overhead of governing a vendor relationship. The real break-even requires Ensemble to deliver a net collection rate improvement of at least 0.5–1.0% above your current baseline — after accounting for all costs.
| Scenario | Calculation | Outcome |
|---|---|---|
| Base case: No performance improvement | Ensemble fee (3% of NPR) vs. internal cost (4.5% of NPR) | Saves ~1.5% of NPR — but only if transition costs amortize over 3+ years |
| Pessimistic: Performance dip during transition | 6–12 months at 1–2% lower net collections + transition costs ($1–3M) | Year 1 is almost always net negative. Budget for it. |
| Optimistic: Net collection rate improves 1%+ | 1% improvement on $500M NPR = $5M annual uplift, less 3% fee ($15M) vs. internal ($22.5M) | Outsourcing pays for itself by Year 2 — but only if the improvement is real and sustained |
Hidden Cost Checklist
These costs are real but almost never included in the vendor's ROI projections. Budget for all of them.
- Transition costs: $1–3M depending on complexity. Includes system integration, parallel processing, travel, project management.
- Staff severance/transfer costs: If employees don't transfer to the vendor, you're paying severance. If they do transfer, you may owe retention bonuses or transition payments.
- Knowledge documentation: Your institutional knowledge about payer-specific rules, denial workflows, and escalation paths needs to be documented before handoff. This costs staff time — a lot of it.
- Vendor governance overhead: You'll need 1–3 FTEs dedicated to managing the vendor relationship — contract compliance, SLA monitoring, escalation management. This is a permanent cost for the life of the contract.
- System integration: Epic interfaces, data feeds, reporting connections. Often underestimated by 2–3× in vendor proposals.
- Performance stabilization dip: Expect net collections to decline 1–2% during the first 6–12 months. On $500M NPR, that's $5–10M in temporary revenue impact.
- Re-insourcing cost (if it fails): If you need to bring operations back in-house, the rebuild cost is typically 1.5–2× what you saved by outsourcing. Factor this into your risk calculation.
For most health systems with internal RCM costs between 3.5–5% of NPR and net collection rates above 95%, the financial case for full-cycle outsourcing is marginal. The decision is more often driven by operational capacity constraints (can't hire enough skilled staff), strategic priorities (focus capital on clinical operations), or performance stagnation (denial rates rising with no internal path to fix them). If the financial case alone doesn't clearly pencil out, be honest about the real driver — it changes what you negotiate for.
Section 4: Pre-Signature Audit Checklist
Before you sign any full-cycle outsourcing agreement, complete every item on this checklist. This is not optional due diligence — it's your baseline protection. Every item you skip is a data point you'll wish you had when the first SLA dispute surfaces 12 months from now.
A. Staff Inventory
- Complete FTE census: Name, role, department, hire date, compensation band for every RCM employee who will be affected by the transition.
- Critical knowledge holders identified: Which 10–15 individuals hold institutional knowledge about payer-specific rules, denial workflows, or escalation paths that isn't documented anywhere?
- Retention risk assessment: Which staff are likely to leave rather than transfer? What's the impact if they do? Do you have documentation of what they know?
- Transfer terms documented: For employees transferring to the vendor — compensation match commitment, benefits continuity, title equivalency, non-solicit terms, and return-hire rights.
B. Payer Relationship Documentation
- Payer contact directory: Key contacts at your top 10 payers — provider relations, claims escalation, medical director for appeals, contract manager.
- Contract terms summary: For each major payer contract — effective dates, fee schedule basis, termination notice requirements, dispute resolution contacts.
- Escalation path documentation: How do you currently escalate a stuck claim or disputed denial with each major payer? Who do you call? This is institutional knowledge that walks out the door.
- Payer-specific billing rules: Unique requirements by payer — timely filing limits, prior auth requirements, medical necessity documentation standards, appeal formats.
C. Knowledge Documentation
- Denial workflow SOPs: Step-by-step documentation of how your team currently handles denials — by denial type, by payer, by service line. If this isn't written down, it needs to be before the vendor touches anything.
- Payer-specific rules database: Every payer-specific rule, workaround, or exception your team has learned through experience. This is your most valuable operational asset — document it exhaustively.
- Appeal templates and success data: Which appeal letter templates have the highest overturn rates? Which payer medical directors respond to which arguments? Document the playbook.
- Coding exception log: Specific coding scenarios where your team has learned — through trial, error, and payer feedback — what works and what doesn't. CPT/ICD-10 combinations that trigger denials, modifier usage patterns, documentation requirements.
D. System Access Audit
- Login inventory: Every system login, portal credential, and application access required for RCM operations — Epic, payer portals, clearinghouse, eligibility verification, prior auth tools.
- Access ownership map: Who owns each login? What happens to access when employees transfer to the vendor? Who controls credential rotation?
- Epic access plan: Specific Epic roles and security profiles needed by the vendor. How will Epic access be provisioned, monitored, and revoked? Who approves Epic access changes?
- Payer portal access transition: How will payer portal credentials be transferred or shared? Some payers prohibit third-party access — identify these before signing.
E. Baseline Performance Snapshot
- Trailing 12-month KPIs: Net collection rate, denial rate (initial + final), days in AR (overall + by payer class), clean claim rate, first-pass resolution rate, cost to collect — all documented with methodology.
- Payer-level performance: Break out every KPI by your top 10 payers. Blended metrics hide payer-specific problems — and payer-specific successes the vendor will take credit for.
- Denial root cause analysis: Current top 10 denial reasons by volume and by dollar impact. This becomes your baseline for measuring whether the vendor actually improves denial management or just repackages existing performance.
- Seasonal and trend data: Monthly KPI trends for the trailing 24 months. Establish whether performance is improving, declining, or flat — so you can distinguish vendor impact from pre-existing trends.
The baseline performance snapshot is your single most important pre-signature deliverable. It's the foundation of every future SLA dispute, performance review, and renewal negotiation. If the vendor improves your denial rate from 6.1% to 5.3%, you need to prove that your rate was 6.1% when they started — not the 7.5% they'll claim it was. Document everything. Timestamp it. Have your CFO sign off. Attach it as a contract exhibit.