Fixed price RFP for healthcare software in 2026: buy discovery first

TL;DR

A fixed price RFP for healthcare software, issued before anyone has run discovery, asks vendors to price a product nobody has defined yet. Early estimates can miss by 4x either way, so bids come back padded or headed for change orders. For grant-funded and research buyers in 2026, the better structure has two phases: a small paid discovery, then a fixed build price set from its output.

• Since October 1, 2025, federal grant rules allow micro-purchases up to $15,000, enough for a typical discovery in our records.
• 2 CFR 200 permits time and materials with a ceiling price, and requires independent estimates before proposals above $350,000.
• A vendor that drafts your build specification can be barred from bidding on it, so compete both phases once, up front.
• In our records, the first paid engagement came to under 5% of the build contract that followed.

Why fixed price before discovery breaks healthcare budgets

A fixed price is a promise about scope. Before discovery, no scope exists.

Construx's cone of uncertainty puts estimates at the initial concept stage at up to 4x high or 4x low, narrowing to 1.6x only once requirements and UI design are complete. A vendor bidding fixed price at that stage can price near the top of the range, or price low and recover the gap through change orders. Neither fits a grant budget.

Flyvbjerg and Budzier's study of 1,471 IT projects found an average cost overrun of 27%, and one project in six overran by about 200% on average.

Our pipeline shows how this starts. One research nonprofit's RFP read "Type of Contract: Fixed Price," with management approval at each stage. Its study team had done no formative research yet, and the scope changed mid-solicitation. A nonprofit set a $275,000-$300,000 ceiling and a firm deadline, and answered "No" when asked if high-level ranges were acceptable. A federally funded research team wanted a quote within a week, under a $200,000 cap. Our notes on another buyer read: "they do not have a detailed specs and design, yet they demand a detailed project plan / timeline from us."

The higher thresholds that make paid discovery easy to buy

Since October 1, 2025, federal grant recipients work with higher procurement thresholds. HUD's notice PIH 2026-08 confirms the micro-purchase threshold rose from $10,000 to $15,000 and the simplified acquisition threshold from $250,000 to $350,000.

That changes the math for a healthcare app on a federal award. Under 2 CFR 200.320, a purchase up to $15,000 needs no competitive quotes if you document that the price is reasonable. Up to $350,000, simplified acquisition asks for quotes from an adequate number of qualified sources instead of a formal solicitation.

Two limits apply. The threshold counts the aggregate amount of the procurement, so discovery must be a real deliverable, not a slice of the build cut to fit. And your written procedures may set lower limits.

What 2 CFR 200 allows for software contracts

Fixed price is often treated as the only safe choice for federal money. The rules leave more room.

• Sealed bids end in a firm fixed price to the lowest bidder, and 200.320(b)(1) makes "a complete, adequate, and realistic specification" a condition for using them.
• Competitive proposals "may result in either a fixed-price or cost-reimbursement contract," per 200.320(b)(2).
• 2 CFR 200.318(j) permits time and materials after a determination that no other type is suitable, with "a ceiling price that the contractor exceeds at its own risk."
• Above $350,000, 2 CFR 200.324 requires a cost or price analysis that starts with independent estimates made before proposals arrive.
• 2 CFR 200.319(b) excludes contractors that draft specifications or statements of work from competing on those procurements.

The last two lines are the case for discovery and the trap inside it. Discovery gives you the independent estimate. But a discovery vendor that writes the build statement of work may lose the right to bid on the build.

Federal contracts follow the same logic: the overhauled FAR Part 16 ties firm fixed price to "clearly defined functional or detailed specifications."

How we built this guide

• Regulatory points come from the eCFR text of 2 CFR 200 as of October 2026 and federal threshold guidance.
• Buyer examples come from RFPs and account notes in our pipeline, quoted as written, with buyers unnamed.
• Any group of our own data with fewer than three data points is not published.
• This is operational guidance, not legal advice. Your grants office and counsel decide how your award's terms apply.

One disclosure. Mercury Development sells discovery and build work and has built custom software since 1999, so read our recommendations as a vendor's.

Three contract structures at a glance

Phase 1: what a paid discovery must deliver

Discovery is a product with a price and acceptance criteria. A healthcare discovery that can carry a fixed build price ends with:

• A ranked backlog, split into must-have and later, with each item sized.
• User roles and permissions, including study team and admin rights.
• A data flow map that marks where protected health information lives and which HIPAA safeguards apply to it.
• Clickable prototypes of the screens your approvers will judge.
• Integration and device assumptions in writing, each one named.
• An assumptions register listing everything the build price depends on.
• A fixed build price, or a range narrow enough to cap.

Our PPM medical billing engagement started this way: expert interviews and a documented workflow came before any software specification.

Phase 2: from discovery output to a fixed build price

Once the backlog and data flows are on paper, fixed price stops being a guess. The vendor can price each backlog item and tie every assumption to a change process.

Ask for the price in a shape your approvers can use:

• A fixed price per milestone, tied to a demo your team accepts.
• The assumptions register attached to the contract, so every change has a named trigger.
• A change reserve held by you, outside the vendor's price.
• Payment on accepted milestones, not on calendar dates.

Stage approvals, which many research buyers require, fit here: each milestone becomes a stage your management signs off.

Our own published pricing follows the same split. For AI agents, the one service with prices on our site, discovery sprints start at $25,000 and production builds typically range from $80,000 to $400,000.

To give the build phase a price shape the board can read, use our template for scenario pricing for healthcare software.

How to word a two-phase RFP

The answer to 200.319(b) is one competition for both phases. Select a vendor on approach and discovery price, and price the build at the gate. Language that does this:

• "Phase 1 is a fixed-price discovery with the deliverables listed in Attachment A. Proposers must price Phase 1 in full."
• "Phase 2 will be priced per milestone at the end of Phase 1, not to exceed $[ceiling]."
• "The recipient may decline Phase 2 and owns all Phase 1 deliverables."
• "Proposers must state the assumptions behind any Phase 2 estimate and the evidence that would change it."
• "Evaluation weighs approach, relevant healthcare experience and Phase 1 price."

Ask your grants office whether this counts as one procurement. If not, the discovery vendor steps aside and its output goes to a separate competition.

When the budget ceiling or the deadline cannot move

Many grant budgets are fixed. Fix the budget and let scope move inside it. A ceiling announced in the RFP becomes the price, because serious bids converge on it. Our estimate for that $275,000-$300,000 nonprofit RFP landed inside the band. So publish the ceiling and ask vendors what they would ship for it, ranked by priority.

Deadlines tied to funding work the same way. Fix the date, rank the backlog, and agree up front which items drop if the date holds. For NIH awards, the final budget period can be extended once by up to 12 months, though remaining funds alone do not justify it. Ask early.

Most of the dates that slip in these programs sit on the client side, as our breakdown of healthcare software project delays shows.

Why penalty clauses raise the price

Some buyers try to make an undefined fixed price safe with penalties, delay discounts or one-sided acceptance terms. We have met each in healthcare negotiations. They move risk onto the vendor on paper, and the vendor prices it in: more contingency hours, narrower assumptions, or no bid at all. Our own fixed-bid hourly rates already sit above our time and materials rates for the same roles, before any contingency.

The protection you want comes from acceptance criteria and milestone payments. A vendor paid only for accepted demos has every reason to finish.

How fixed price, time and materials and a dedicated team compare across a whole build is in our guide to healthcare software engagement models.

What our healthcare pipeline records show

Our own numbers, counted by hand from healthcare deal records.

Around 80% of the grant-funded and nonprofit healthcare opportunities in those records arrived with at least one hard constraint set before discovery: a budget ceiling, a fixed-price contract type or a clock that could not move.

Where we estimated a separate analysis, design or proposal phase for a healthcare client, the price ran from $2,000 to $40,000, with a median of $6,750. That median sits well under the $15,000 micro-purchase threshold.

Where a paid first engagement led to a build contract, the first engagement came to under 5% of the build that followed.

For the research RFP above, scope stayed too open to price at all. We said implementation could not be estimated responsibly without a separate discovery phase.

Where the two-phase model falls short

Opinion, stated plainly. Two phases cost calendar time. A discovery plus a second approval round can collide with a funding clock.

Discovery also cannot settle what only users can answer. It can plan formative research, not replace it.

And discovery buys a plan, not a product. If the build budget sits far below what the plan costs, you learn it early, and the answer is usually a smaller first release. Our 1in4 app for a nonprofit in fertility and family support shipped community features and personal tracking tools in one Flutter app.

Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline, estimate and contract records behind this article's pricing figures sit in the operations he oversees.

Send us your draft RFP before it goes out

Share your draft RFP or scope, the funding source, and any ceiling or date that cannot move. We will reply with how we would split it into discovery and build, and which assumptions would drive the build price.