Position Closed: REQUEST FOR PROPOSAL (RFP) National Health Data Repository System Software Development Services

This Position is Closed

REQUEST FOR PROPOSAL (RFP) National Health Data Repository System Software Development Services

Sorry, this position is no longer available. The job posting has expired and we are not accepting new applications at this time.

Looking for other opportunities? Check out our current job openings to find your next career opportunity.

Browse Available Jobs

Job Details

This job is closed. Contact details have been hidden and applications are no longer accepted.

REQUEST FOR PROPOSAL (RFP) National Health Data Repository System Software Development Services

Hire Type Consultancy firm only

Proposal Submission Deadline: June 19, 2026, 5:00 PM

Contact Person: Wegayehu Madebo

Contact Email: wm•••••@••••••.org

Expected project duration: 4 months(July 1 - October 30)

DOCUMENT CONTROL

Version	Date	Description
1.0	April 2, 2026	Initial Release

1. INTRODUCTION & EXECUTIVE SUMMARY

1.1 Purpose of RFP

Project HOPE (hereinafter referred to as “the Client” or “Organization”) is soliciting proposals from qualified software development companies for the design, development, implementation, and support of a National Health Data Repository System.

This Request for Proposal (RFP) outlines the requirements, specifications, and expectations for the proposed system. Vendors are invited to submit comprehensive proposals demonstrating their capability to deliver a robust, scalable, and secure solution that meets our organizational needs.

1.2 Executive Summary

The Organization requires a modern, enterprise-grade document management platform to:

Centralize the storage and management of research papers, abstracts, reports, and other academic/business documents
Enable secure document sharing with granular access controls
Implement role-based access control with approval workflows for document access requests
Provide powerful search capabilities across document content and metadata
Support future integration with AI/ML systems for advanced document processing

The system must be built using open-source technologies only (no proprietary licensed software) and follow a scalable modular monolith architecture that can evolve into microservices if needed.

2. PROJECT OVERVIEW

2.1 Project Description

The National Health Data Repository and Sharing System shall serve as the Organization’s centralized platform for:

Document Storage & Management
- Secure storage of research papers, abstracts, technical documents, reports, and datasets
- Version control with complete revision history
- Metadata management and categorization
- Support for multiple file formats (PDF, DOCX, XLSX, PPTX, images, etc.)
Access Control & Security
- Role-based access control (RBAC) with predefined and custom roles
- Document-level access permissions
- Access request and approval workflows
- Integration with organizational identity provider
Search & Discovery
- Full-text search across document content
- Advanced filtering and faceted search
- Tag-based navigation and categorization
Collaboration & Sharing
- Secure document sharing with internal and external users
- Expiring access links
- Notification system for relevant activities
Compliance & Audit
- Comprehensive audit logging of all activities
- Compliance reporting capabilities
- Data retention policy enforcement

3. SCOPE OF WORK

3.1 In-Scope

The following items are within the scope of this project:

3.1.1 Software Development

#	Deliverable	Description
1	Backend Application	Modular monolith application with all business logic
2	Frontend Application	Web-based user interface (responsive design)
3	Database Design & Implementation	Schema design, implementation, and optimization
4	API Development	RESTful APIs for all system functions
5	Integration Layer	Integration with identity provider, email, storage
6	Search Engine Integration	Full-text search implementation
7	Workflow Engine	Approval workflow implementation
8	Notification System	Email and in-app notifications
9	Audit & Logging System	Comprehensive activity logging

3.1.2 Infrastructure & DevOps

#	Deliverable	Description
1	Infrastructure as Code	Kubernetes manifests, Helm charts, or equivalent
2	CI/CD Pipeline	Automated build, test, and deployment pipeline
3	Monitoring & Alerting Setup	Prometheus, Grafana dashboards, alert rules
4	Logging Infrastructure	Centralized logging setup (ELK or equivalent)
5	Backup & Recovery	Automated backup procedures and recovery scripts

3.1.3 Documentation

#	Deliverable	Description
1	Technical Architecture Document	Detailed system architecture documentation
2	API Documentation	OpenAPI/Swagger specifications
3	Database Documentation	data dictionary, schema documentation
4	Deployment Guide	Step-by-step deployment procedures
5	Operations Manual	System administration and operations guide
6	User Manual	End-user documentation
7	Security Documentation	Security architecture and procedures

3.1.4 Quality Assurance

#	Deliverable	Description
1	Test Strategy & Plans	Comprehensive testing approach
2	Unit Tests	Minimum 80% code coverage
3	Integration Tests	API and integration test suites
4	Performance Tests	Load and stress testing
5	Security Testing	Vulnerability assessment and penetration testing
6	UAT Support	User acceptance testing support

3.1.5 Training & Knowledge Transfer

#	Deliverable	Description
1	Administrator Training	System administration training
2	Developer Training	Technical training for maintenance team
3	End-User Training	User training sessions or materials
4	Knowledge Transfer Sessions	Handover sessions with documentation

4. FUNCTIONAL REQUIREMENTS

4.1 User Management Module

4.1.1 User Account Management

Req ID	Requirement	Priority
UM-001	System shall integrate with external Identity Provider (Keycloak/LDAP/SAML) for user authentication	Critical
UM-002	System shall support Single Sign-On (SSO) via OAuth2/OIDC protocols	Critical
UM-004	System shall allow administrators to view and manage user accounts	High
UM-005	System shall support user account status management (active, suspended, deactivated)	High
UM-006	System shall capture and display user profile information (name, email, department, etc.)	Medium

4.1.2 Role Management

Req ID	Requirement	Priority
UM-010	System shall provide predefined roles: Administrator, Uploader, Reviewer, Viewer, Guest	Critical
UM-011	System shall allow administrators to create custom roles	Medium
UM-012	System shall support assignment of multiple roles to a single user	High

4.1.3 Organization & Group Management

Req ID	Requirement	Priority
UM-020	System shall support organizational hierarchy (Organizations → Departments → Groups)	High
UM-021	System shall allow users to belong to multiple groups	High
UM-022	System shall support group-based access permissions	High
UM-023	System shall allow administrators to manage group membership	High

4.2 Document Management Module

5.2.1 Document Upload & Storage

Req ID	Requirement	Priority
DM-001	System shall allow authorized users to upload documents	Critical
DM-002	System shall support file formats: PDF, DOCX, XLSX, PPTX, TXT, RTF, images (JPG, PNG, TIFF)	Critical
DM-003	System shall support configurable maximum file size (default: 500MB)	High
DM-004	System shall support chunked/resumable uploads for large files	High
DM-005	System shall generate and verify file checksums for integrity	High
DM-006	System shall extract and store file metadata automatically	High

4.2.2 Document Metadata & Classification

Req ID	Requirement	Priority
DM-010	System shall require mandatory metadata: Title, Document Type, Abstract/Description	Critical
DM-011	System shall support custom metadata fields per document type	Medium
DM-012	System shall support document categorization (hierarchical categories)	High
DM-013	System shall support document tagging with user-defined tags	High
DM-014	System shall support document types: Research Paper, Abstract, Thesis, Report, Dataset, Other	High
DM-016	System shall support author attribution (single and multiple authors)	High

4.2.3 Version Control

Req ID	Requirement	Priority
DM-020	System shall maintain version history for all documents	Critical
DM-021	System shall auto-increment version numbers on new uploads	High
DM-022	System shall allow users to view and download previous versions	High

4.2.4 Document Lifecycle

Req ID	Requirement	Priority
DM-030	System shall support document status workflow: Draft → Pending Review → Published → Archived	Critical
DM-031	System shall allow document owners to submit documents for review	High
DM-032	System shall notify reviewers when documents are pending approval	High
DM-033	System shall allow reviewers to approve, reject, or return documents with comments	High
DM-035	System shall support soft delete with recovery capability	High
DM-036	System shall support permanent deletion with appropriate authorization	High

4.3 Access Control Module

5.3.1 Document Access Levels

Req ID	Requirement	Priority
AC-001	System shall support document access levels: Public, Internal, Restricted, Confidential	Critical
AC-002	Public documents shall be accessible to all authenticated users	High
AC-003	Internal documents shall be accessible to users within the same organization	High
AC-004	Restricted documents shall require explicit access grants	Critical
AC-005	Confidential documents shall require multi-step approval for access	Critical

4.3.2 Access Permissions

Req ID	Requirement	Priority
AC-010	System shall support permission levels: View, Download, Edit, Full Control	Critical
AC-011	System shall allow document owners to grant access to individual users	High
AC-012	System shall allow document owners to grant access to groups	High
AC-013	System shall support time-limited access (expiring permissions)	High
AC-014	System shall allow document owners to revoke access at any time	High
AC-015	System shall support access inheritance from categories/folders	Medium

4.3.3 Access Request Workflow

Req ID	Requirement	Priority
AC-020	System shall allow users to request access to restricted documents	Critical
AC-021	System shall require justification text for access requests	High
AC-022	System shall route access requests based on document access level	Critical
AC-023	System shall auto-approve requests for Public and Internal (same org) documents	High
AC-024	System shall route Restricted document requests to document owner	Critical
AC-025	System shall route Confidential document requests through multi-step approval	Critical
AC-026	System shall notify approvers of pending access requests	High
AC-027	System shall allow approvers to approve, reject, or delegate requests	High
AC-028	System shall notify requesters of approval decisions	High
AC-030	System shall maintain complete audit trail of access requests	High

4.4 Workflow Engine Module

5.4.1 Workflow Definition

Req ID	Requirement	Priority
WF-001	System shall support configurable workflow templates	High
WF-002	System shall support sequential and parallel approval steps	High
WF-003	System shall allow administrators to create and modify workflow templates	High
WF-004	System shall support workflow triggers based on document events	Medium

4.4.2 Workflow Execution

Req ID	Requirement	Priority
WF-010	System shall create workflow instances when triggered	High
WF-011	System shall track workflow instance status and progress	High
WF-012	System shall support workflow actions: Approve, Reject, Return, Delegate, Escalate	High
WF-013	System shall enforce step deadlines with reminders and escalation	Medium
WF-014	System shall allow workflow cancellation by authorized users	Medium
WF-015	System shall maintain workflow history for audit purposes	High

4.5 Search Module

4.5.1 Search Capabilities

Req ID	Requirement	Priority
SR-001	System shall provide full-text search across document content	Critical
SR-002	System shall search document metadata (title, abstract, authors, tags)	Critical
SR-003	System shall support Boolean search operators (AND, OR, NOT)	High
SR-004	System shall support phrase search using quotation marks	High
SR-005	System shall support wildcard search	Medium
SR-006	System shall return results ranked by relevance	High
SR-007	System shall highlight search terms in results	Medium
SR-008	System shall support search within specific fields	Medium

4.5.2 Filtering & Facets

Req ID	Requirement	Priority
SR-010	System shall provide faceted search/filtering	High
SR-011	System shall support filtering by document type	High
SR-012	System shall support filtering by category	High
SR-013	System shall support filtering by tags	High
SR-014	System shall support filtering by date range	High
SR-015	System shall support filtering by author	Medium
SR-016	System shall support filtering by access level	Medium

4.5.3 Search Features

Req ID	Requirement	Priority
SR-020	System shall provide search autocomplete/suggestions	Medium
SR-022	System shall only return results user has access to view	Critical

4.6 Notification Module

4.6.1 Notification Channels

Req ID	Requirement	Priority
NT-001	System shall send notifications via email	Critical
NT-002	System shall provide in-app notifications	High
NT-003	System shall support webhook notifications for external integrations	Low

4.6.2 Notification Events

Req ID	Requirement	Priority
NT-010	System shall notify when access request is received	High
NT-011	System shall notify when access request is approved/rejected	High
NT-012	System shall notify when document is shared with user	High
NT-013	System shall notify when approval action is required	High

4.7 Audit & Compliance Module

4.7.1 Audit Logging

Req ID	Requirement	Priority
AU-001	System shall log all user authentication events	Critical
AU-002	System shall log all document operations (create, read, update, delete)	Critical
AU-003	System shall log all document downloads	Critical
AU-004	System shall log all access grant and revocation events	Critical
AU-005	System shall log all access request and approval events	Critical
AU-006	System shall log all administrative actions	Critical
AU-007	System shall capture actor, action, resource, timestamp, and context for all logs	Critical
AU-008	System shall capture IP address and user agent for all actions	High
AU-009	System shall store audit logs in immutable/append-only storage	High
AU-010	System shall retain audit logs per configurable retention policy	High

4.7.2 Audit Reporting

Req ID	Requirement	Priority
AU-020	System shall provide audit log search and filtering interface	High
AU-021	System shall support audit reports by user	High
AU-022	System shall support audit reports by document	High
AU-023	System shall support audit reports by action type	High
AU-024	System shall support audit reports by date range	High
AU-025	System shall support export of audit reports (CSV, PDF)	Medium
AU-026	System shall provide dashboard with audit statistics	Medium

4.8 Administration Module

5.8.1 System Configuration

Req ID	Requirement	Priority
AD-001	System shall provide administrative dashboard	High
AD-002	System shall allow configuration of system-wide settings	High
AD-003	System shall allow configuration of document types and categories	High
AD-004	System shall allow configuration of workflow templates	High
AD-005	System shall allow configuration of notification templates	Medium
AD-006	System shall allow configuration of file size and type restrictions	High
AD-007	System shall allow configuration of retention policies	Medium

4.8.2 System Monitoring

Req ID	Requirement	Priority
AD-010	System shall display system health status	High
AD-011	System shall display storage usage statistics	High
AD-012	System shall display user activity statistics	Medium
AD-013	System shall display document statistics	Medium
AD-014	System shall provide performance metrics dashboard	Medium

5. TECHNICAL REQUIREMENTS

5.1 Architecture Requirements

5.1.1 Architecture Pattern

Req ID	Requirement	Priority
AR-001	System shall be built as a Modular Monolith architecture	Critical
AR-002	System shall be designed with clear module boundaries for future microservices extraction	High
AR-003	System shall implement Domain-Driven Design (DDD) principles	High


AR-006	System shall be stateless for horizontal scalability	Critical

5.1.2 Recommended Module Structure

The system shall be organized into the following modules:

Module	Responsibility
User Management	User profiles, roles, permissions, groups
Document Management	Document CRUD, versions, metadata, categories
Access Control	Document permissions, access requests
Workflow Engine	Approval workflows, workflow instances
Storage	File storage abstraction (MinIO integration)
Search	Full-text search (OpenSearch integration)
Notification	Email, in-app, webhook notifications
Audit	Logging, compliance reporting
Shared Kernel	Common utilities, domain events, base classes

5.2 Technology Stack Requirements

5.2.1 Mandatory Open-Source Technologies

Component	Required Technology	Version
Runtime	Java	17 LTS or 21 LTS
Framework	Spring Boot	3.x
Database	PostgreSQL	15 or 16
Object Storage	MinIO	Latest stable
Search Engine	OpenSearch	2.x
Message Queue	RabbitMQ	Latest stable
Caching	Redis	7.x
Identity Management	Keycloak	22.x or later
Container Runtime	Docker	Latest stable
Orchestration	Kubernetes	1.27+
API Gateway	Kong (OSS) OR Traefik	Latest stable
Monitoring	Prometheus + Grafana	Latest stable
Logging	ELK Stack OR OpenSearch + Fluentd	Latest stable

5.2.3 Frontend Technology

Component	Requirement
Framework	Modern JavaScript framework (React, Vue.js)
State Management	Appropriate for chosen framework
UI Component Library	Open-source (Material UI, Ant Design, etc.)
Build Tool	Webpack, Vite, or equivalent
CSS	Modern CSS with preprocessor (SCSS/LESS) or CSS-in-JS

5.3 Integration Requirements

5.3.1 Authentication Integration

Req ID	Requirement	Priority
INT-001	System shall integrate with Keycloak for authentication	Critical
INT-002	System shall support OAuth2 / OpenID Connect protocols	Critical
INT-004	System shall support JWT token-based authentication for APIs	Critical
INT-005	System shall support integration with existing LDAP/AD (via Keycloak)	High

5.3.2 External System Integration

Req ID	Requirement	Priority
INT-010	System shall provide RESTful APIs for all functionality	CriticalSystem shall provide storage for document embeddings (pgvector or similar)
INT-011	System shall provide OpenAPI/Swagger documentation	High
INT-012	System shall support API versioning	High
INT-013	System shall provide webhook capabilities for external notifications	Medium
INT-014	System shall support SMTP integration for email notifications	High

5.3.3 Future AI/ML Integration Readiness

Req ID	Requirement	Priority
INT-020	System shall provide APIs for document content extraction	High
INT-021
INT-022	System shall provide storage for document embeddings (pgvector or similar)	Medium
INT-023	System shall provide batch export APIs for ML training data	Medium
INT-024	Architecture shall support future semantic search capabilities	Medium

5.4 Data Requirements

6.4.1 Database Design

Req ID	Requirement	Priority
DB-001	System shall use schema-per-module approach for data isolation	High
DB-002	System shall implement database migrations using Flyway or Liquibase	High
DB-003	System shall use UUIDs for primary keys	High
DB-004	System shall implement soft delete for recoverable entities	High
DB-005	System shall implement audit columns (created_at, updated_at, created_by, updated_by)	High
DB-006	System shall use appropriate indexes for query optimization	High

5.4.2 Data Storage

Req ID	Requirement	Priority
DB-010	Documents shall be stored in MinIO object storage	Critical
DB-011	Document metadata shall be stored in PostgreSQL	Critical
DB-012	Search indexes shall be maintained in OpenSearch	Critical
DB-013	System shall maintain referential integrity between database and object storage	High
DB-014	System shall support storage quotas per user/organization	Medium

5.5 API Requirements

6.5.1 API Design

Req ID	Requirement	Priority
API-001	APIs shall follow RESTful design principles	Critical
API-002	APIs shall use JSON for request/response payloads	Critical
API-003	APIs shall implement proper HTTP status codes	High
API-004	APIs shall implement pagination for list endpoints	High
API-005	APIs shall implement filtering and sorting capabilities	High
API-006	APIs shall implement rate limiting	High
API-007	APIs shall be versioned (URL path versioning: /api/v1/)	High
API-008	APIs shall implement HATEOAS principles where appropriate	Low

6.5.2 API Security

Req ID	Requirement	Priority
API-010	APIs shall require authentication (except public endpoints)	Critical
API-011	APIs shall implement authorization checks	Critical
API-012	APIs shall validate all input data	Critical
API-013	APIs shall sanitize output data	Critical
API-014	APIs shall implement CORS policies	High
API-015	APIs shall be protected against common vulnerabilities	Critical

5.6 DevOps Requirements

5.6.1 CI/CD Pipeline

Req ID	Requirement	Priority
DO-001	System shall have automated CI/CD pipeline	High
DO-002	Pipeline shall include automated code quality checks	High
DO-003	Pipeline shall include automated unit test execution	High
DO-004	Pipeline shall include automated integration test execution	High

DO-006	Pipeline shall include automated container image building	High
DO-007	Pipeline shall support multiple environments (dev, staging, production)	High
DO-008	Pipeline shall support rollback capabilities	High

5.6.3 Containerization

Req ID	Requirement	Priority
DO-020	All application components shall be containerized	Critical
DO-021	Container images shall follow security best practices	High

6. NON-FUNCTIONAL REQUIREMENTS

6.1 Performance Requirements

Req ID	Requirement	Target	Priority
PF-001	Page load time	< 3 seconds (90th percentile)	High
PF-002	API response time (simple operations)	< 500ms (95th percentile)	High
PF-003	API response time (complex operations)	< 2 seconds (95th percentile)	High
PF-004	Search response time	< 2 seconds (95th percentile)	High

PF-006	Concurrent users	Support minimum 500 concurrent users	High

6.2 Scalability Requirements

Req ID	Requirement	Priority
SC-001	System shall support horizontal scaling of application tier	Critical
SC-002	System shall support database read replicas	High
SC-003	System shall support distributed object storage	High
SC-004	System shall support search cluster scaling	High

6.3 Security Requirements

6.3.1 Authentication & Authorization

Req ID	Requirement	Priority
SE-001	System shall enforce strong password policies (via Keycloak)	Critical
SE-002	System shall support multi-factor authentication (via Keycloak)	High
SE-003	System shall implement session timeout (configurable)	High
SE-004	System shall lock accounts after failed login attempts	High
SE-005	System shall enforce role-based access control	Critical
SE-006	System shall implement principle of least privilege	Critical

6.3.2 Data Security

Req ID	Requirement	Priority
SE-010	All data in transit shall be encrypted (TLS 1.2+)	Critical
SE-011	Sensitive data at rest shall be encrypted	Critical
SE-012	Document storage shall be encrypted	Critical
SE-013	Database connections shall be encrypted	Critical
SE-014	API keys and secrets shall be stored securely (vault/secrets manager)	Critical
SE-015	PII data shall be protected per applicable regulations	Critical

6.3.3 Application Security

Req ID	Requirement	Priority

SE-021	Application shall implement input validation	Critical
SE-022	Application shall implement output encoding	Critical
SE-023	Application shall protect against SQL injection	Critical
SE-024	Application shall protect against XSS attacks	Critical
SE-025	Application shall protect against CSRF attacks	Critical
SE-026	Application shall implement security headers	High
SE-027	Application shall undergo security testing before release	Critical

6.3 Reliability Requirements

Req ID	Requirement	Priority
RL-001	System shall implement graceful degradation	High
RL-002	System shall implement circuit breaker patterns	High
RL-003	System shall implement retry mechanisms with exponential backoff	High
RL-004	System shall handle failures gracefully with appropriate error messages	High
RL-005	System shall implement health check endpoints	High
RL-006	System shall implement automated alerting for failures	High

6.4 Compatibility Requirements

Req ID	Requirement	Priority
CP-001	Web application shall support Chrome (last 2 versions)	High
CP-002	Web application shall support Firefox (last 2 versions)	High
CP-003	Web application shall support Safari (last 2 versions)	High
CP-004	Web application shall support Edge (last 2 versions)	High
CP-005	APIs shall be backward compatible within same major version	High
CP-006	System shall support deployment on major cloud providers or on-premises	High

7. DELIVERABLES

7.1 Software Deliverables

#	Deliverable	Description	Format
1	Source Code	Complete source code for all components	Git Repository
2	Backend Application	Compiled/packaged backend application	Docker Images
3	Frontend Application	Built frontend application	Docker Images
4	Database Scripts	Schema, migrations, seed data	SQL/Migration files
5	Infrastructure Code	Kubernetes manifests/Helm charts	YAML/Helm
6	CI/CD Pipeline	Pipeline configuration files	Platform-specific
7	Configuration Templates	Environment configuration templates	YAML/Properties

7.2 Documentation Deliverables

#	Deliverable	Description	Format
1	Technical Architecture Document	System architecture, component design, data flow	PDF/Word
2	API Documentation	Complete API reference with examples	OpenAPI/Swagger
3	Database Documentation	ERD, data dictionary, schema documentation	PDF/Word
4	Deployment Guide	Step-by-step deployment instructions	PDF/Word
5	Operations Manual	System administration, monitoring, troubleshooting	PDF/Word
6	User Manual	End-user documentation with screenshots	PDF/Word

7.3 Training Deliverables

#	Deliverable	Description	Format
1	Administrator Training	System administration training materials	Slides + Hands-on
2	Developer Training	Technical training for development team	Slides + Hands-on
3	End-User Training	User training materials	Slides + Video
4	Training Recordings	Recorded training sessions	Video files

About the Company

Project HOPE The poeple to people health foundation Inc.

We believe in a universal right to be healthy and thrive, and we envision a world where everyone has...

View Company Profile