Empanelment of Teleradiology Aggregators

1. Introduction and Background

Tata Memorial Hospital (TMH), a premier oncology centre under the Department of Atomic Energy, Government of India, caters to a high volume of patients from across the country. While TMH continues to strengthen its in-house radiology services, the overall footfall often results in prolonged waiting times or repeated travel for patients seeking timely diagnostic imaging. In order to address this gap and ensure that patients receive quality CT and MRI scans closer to home, TMH intends to empanel qualified teleradiology aggregators who can onboard and manage a network of radiology centres across India.

Through this EOI, TMH seeks aggregators capable of providing a secure, compliant, scalable technology platform for receiving DICOM scans from empaneled centres and transferring them seamlessly into TMH’s PACS for interpretation by TMH radiologists. The patient will continue to pay at TMH as per TMH’s Schedule of Charges, TMH will reimburse the aggregator based on service-wise charges specified in Annexure-II, and the aggregator will thereafter settle payments with the imaging centres as per their internal arrangements.

The intent of this initiative is to provide patients with convenience, reliability and quality, without exposing TMH or its patients to any material, social, financial, legal or data-security risks.

2. Objectives

The objectives of empanelling teleradiology aggregators are to:

· Offer patients timely and accessible diagnostic imaging services without compromising on quality or cost.

· Enable TMH to seamlessly receive CT and MRI images from remote centres into its PACS, while maintaining complete data privacy and role-based access control.

· Ensure compliance with the Digital Personal Data Protection Act (DPDPA) 2023, including secure processing and transfer of personal data.

· Establish a standardised, secure workflow between TMH, the aggregator, and the radiology centres without additional burden to patients.

3. Scope of Work for the Aggregator

The aggregator will be responsible for providing an integrated service that combines technology, network management, compliance, coordination, and service quality. The aggregators shall function as the single point of contact for TMH for all operational, financial, administrative, and technical matters related to the outsourcing of scans referred specifically to them. In fulfilling these responsibilities, the aggregators will:

· Manage and maintain a network of radiology centres that meet the eligibility criteria specified in Annexure-I.

· Conduct all due diligence, maintain compliance-related documentation, and continuously monitor service quality.

· Handle all communication with empanelled centres, ensuring that TMH does not need to engage directly with individual facilities.

· Manage end-to-end financial settlements with the centres without any involvement of TMH.

The aggregator shall also:

· Ensure the availability, security, and reliability of the cloud platform used for the receipt and transmission of DICOM images.

· Maintain full compliance with the DPDP Act, including:

o encryption of sensitive personal data,

o complete auditability and access logs,

o strict role-based access control, and

o prohibition of any unauthorised retention of TMH patient data.

In addition, the aggregator will:

· Coordinate appointment scheduling and related logistics for TMH patients.

· Offer patient self-booking, mobile applications, or automated interfaces, wherever feasible.

Before formal empanelment, a Proof of Concept (POC) will be undertaken to ensure that the aggregator’s technology platform, workflows, operational readiness, and security posture meet TMH’s standards.

4. Functional Workflow

Once a patient consents to undergo a scan at an external centre, the following process will be followed:

· TMH will generate the required requisition and demographic details through its HIS.

· These details will be securely transmitted to the aggregator’s platform via approved APIs.

o the scan is performed as per imaging protocols established or recommended by TMH, and

o timelines mutually agreed upon in the agreement are adhered to.

After completion of the scan:

· The imaging centre will upload the DICOM images to the aggregator’s cloud platform.

· The aggregator will securely transmit these images to TMH’s PACS through a push or pull mechanism that complies with DICOM standards.

· The scan images shall ordinarily be transmitted to TMH within 12 hours of scanning. This timeline may be extended to 48 hours in special circumstances.

· TMH radiologists/ teleradiologists will interpret the images, and the resulting reports will form part of the TMH EMR.

· It must be noted that the reporting of scans shall not be in the scope of the aggregator or the scan centre.

· The reporting radiologists/ teleradiologists identified by TMH, will evaluate the quality of the image at the time of reporting. The payment to the aggregator shall be subject to good reportable quality images meeting TMH protocol requirements only.

Throughout the process:

· Sensitive personal data must remain encrypted.

· Access shall be strictly governed by role-based access controls.

· Every access event must be fully logged to maintain auditability and compliance.

5. Technical, Security and Compliance Requirements

The aggregator must deploy a secure, scalable and compliant architecture that ensures uninterrupted service, data protection and integration with TMH’s systems. The key requirements include:

1. Data Protection and DPDP Compliance

The aggregator shall submit an affidavit affirming compliance with the Digital Personal Data Protection Act 2023. The platform must incorporate data minimisation, purpose limitation, access governance, and breach-notification protocols as required by applicable law.

2. Data Localisation

All processing, storage and transmission infrastructure, must be located within India.

The aggregator shall not keep any back-up data of the scans of TMH referred patients.

The scan centres may keep a backup of 15-30 days as per their regular practice.

3. Secure Transmission & Encryption

All data transmissions must use strong encryption (TLS 1.2/1.3). Any stored data, including transient or cached files, must be encrypted at rest (AES-256 or higher).

4. Role-Based Access Control (RBAC)

Access to patient information, images, logs or workflows must be strictly role-based, with configurable privilege levels.

5. Audit Logging

Every system access, login, upload, download, modification or administrative action must be logged and retained for at least 180 days.

6. Integration Requirements

The aggregator must provide RESTful APIs, DICOM interfaces, and integration support to ensure smooth interoperability with TMH’s HIS and PACS systems. TMH will provide an integration workstation within its network to facilitate development and testing.

7. Security Validation

The aggregator must undergo VAPT by a CERT-IN empanelled agency and share results. TMH retains the right to audit the overall systems at any time.

6. Empanelment Criteria

Aggregators responding to this EOI should have:

· A registered office in India and at least three years of operational presence.

· A scalable and production-ready platform capable of handling large volumes safely.

· Willingness to sign contracts, NDAs, and indemnity agreements as required by TMH.

The aggregator must also be prepared to meet all criteria for onboarding individual radiology centres as per Annexure-I.

7. Evaluation Process

A Technical Evaluation Committee comprising members from the Departments of Radiodiagnosis, IT, Medical Superintendent’s Office, General Administration and Accounts will evaluate the EOI responses. Evaluation will be based on:

· Technical architecture, data-flow and compliance robustness

· Security measures, certifications and adherence to DPDP

· Quality of proposed workflow

· Network strength and ability to rapidly onboard centres

· Financial sustainability and operational readiness

· Results of the POC

· Past performance, if applicable

Only those aggregators who successfully complete the POC to the satisfaction of TMH will be eligible for empanelment and signing of the Agreement.

8. Payment Terms

· Patients will make payments directly to TMH, as per the existing TMH Schedule of Charges.

· TMH will make monthly payments to the aggregator, based on:

o the service-wise charges specified in Annexure-II, and

o reconciliation and verification through TMH systems.

· The aggregator will be solely responsible for remunerating the imaging centres within its network.

· TMH shall have no financial liability or direct payment obligations toward any individual imaging centre.

9. Legal and Contractual Clauses

9.1 Contract Period

The period of agreement should be 2 years from the date of signing the agreement by both the parties.

9.2 Intellectual Property

All intellectual property in TMH systems, shall remain the exclusive property of TMH. The aggregator shall have no rights over such IP except for limited usage for the duration of the agreement.

The ownership of all TMH referred patient data shall remain with TMH.

9.3 Non-Disclosure Agreement (NDA)

The aggregator shall sign an NDA covering confidentiality of TMH data, patient information, internal workflows, technology, and evaluation details.

9.4 Indemnification

The aggregator shall indemnify TMH against any claims, damages, penalties, data breaches, negligence, medico-legal disputes arising from services provided by the aggregator or by any empanelled scan centre.

9.5 Dispute Resolution

Any dispute arising out of the agreement shall be resolved amicably; failing which, the matter shall be referred for arbitration under the Arbitration and Conciliation Act, 1996. The venue of arbitration shall be Mumbai.

9.6 Force Majeure

Neither party shall be liable for failure to perform obligations caused by events beyond reasonable control, such as natural disasters, cyber-attacks, riots or government restrictions.

9.7 Amendments

No amendment to the agreement shall be binding unless made in writing and mutually agreed upon.

9.8 Governing Law

The agreement shall be governed by the laws of India, with courts in Mumbai having exclusive jurisdiction.

9.9 Conflict of Interest

The aggregator shall disclose any conflict of interest at the time of submission and throughout the contract period.

9.10 Non-Commitment

This EOI does not obligate TMH to award a contract or enter into an agreement with any respondent. TMH reserves the right to accept or reject any or all proposals without assigning reasons.

9.11 Termination

TMH reserves the right to terminate the agreement with due notice in cases of non-performance, breach of security, violation of DPDP Act, failure to meet SLA, misconduct, or any circumstance adversely affecting patient care or institutional reputation.

10. Submission Requirements

Interested aggregators must submit a formal EOI containing:

· Company overview, registrations, and operational profile

· Technical architecture, API design, security model, and data-flow diagrams

· Compliance statement for DPDP and security standards

· Proposed workflow for managing scan centres

· Details of network strength and plan for pan-India coverage

· Affidavit confirming DPDP Act compliance (Annexure-III)

· Any relevant experience or case studies

· Acceptance of key conditions outlined in this EOI

TMH may seek clarifications or presentations before proceeding to the POC stage.

Annexure I: Technical Requirements

TATA MEMORIAL CENTRE

TATA MEMORIAL HOSPITAL

Expression of Interest (EOI) for Empanelment of Teleradiology Aggregators for Tata Memorial Hospital Patients TMH and TMC Units.

Description of Item

Centre credentials

Imaging protocol and reporting

(CD: preferred CD-DICOM data)

Procedure charges

Other Requirements

Patient Privacy and Confidentiality

Termination Clause

Annexure-II

Applicable Rates for Payment by TMH to Aggregator if Scan is done at an outside empanelled centre

Schedule of Charges for Scan at outside empanelled centre

Service Code

Annexure-III

Affidavit for Compliance with the Digital Personal Data Protection Act, 2023

I, __________________________________________________, authorised signatory of _________________________________ (Name of Organisation), hereby affirm that our organisation, its systems, its personnel and its technology infrastructure comply with the provisions of the Digital Personal Data Protection Act, 2023, including requirements regarding lawful processing, secure handling, storage limitation, consent management, role-based access control, breach notification and protection of personal data of TMH patients.

I declare that the information provided is true and correct to the best of my knowledge.

(Signature, Name, Designation, Seal, Date)