Radiology Information System Vendors: How to Choose the Right One

Who should be on the selection team?

A RIS touches every role in the operation, so a decision made by one department tends to be reopened by another. Name one decision owner, then give each of these a vote on the criteria it knows best:

• Operations. Owns the list of what is broken, the business case and the final recommendation.

• Front desk and scheduling leads. Score the scheduling, intake and patient communication demos, in the room and clicking, not watching.

• IT and interfaces. Own the integrations, the security review, hosting and data migration.

• A radiologist or medical director. Scores the reading workflow, reporting and follow-up handling.

• Insurance verification, authorizations and billing. Scores eligibility at scheduling, the authorization worklist, estimates, and how charges, codes and authorization numbers reach the claim.

• Finance. Owns total cost, contract terms and payback.

• A lead technologist from each modality. Scores the worklist, procedure codes and exam status at the scanner.

• Your mammography coordinator, if you perform mammography. Scores lay letters, recalls and the outcomes audit data.

Ask a referring practice or two what they need from you; order entry and result delivery are their whole experience of your RIS. Agree on the criteria and their weights before the first demo. Weights set after the demos tend to drift toward the vendor the loudest voice preferred.

What are the steps to evaluate RIS vendors?

1. 1

   Write down what is actually broken.

   Not "we need a new RIS" but "scheduling takes three calls" or "claims reject on missing demographics." That list is your scorecard.

2. 2

   Score against your list, not the feature matrix.

   Every vendor will tick every box. Ask each to demonstrate your three worst problems, live, and score them on the scorecard below.

3. 3

   Interrogate the integrations.

   Which standard, which direction, who maintains it, what is the support path when it breaks, and can you speak to a customer running that exact interface.

4. 4

   Call references you found yourself.

   Ask what went wrong in conversion and how the vendor responded, how long support tickets actually take, which interfaces they run, and whether they would sign again. Ask for one client that had a hard go-live. Then visit a live site on a busy morning and ask the schedulers what they work around.

5. 5

   Get the after-sale in writing.

   Implementation scope, training, data migration responsibility, support hours, and what happens if go-live slips. Ask how long it takes to train a new scheduler on the system; with turnover, you pay that every year.

How do you build a RIS evaluation scorecard?

A RIS evaluation scorecard turns your list of what is broken into weighted criteria, agreed before the first demo. Score each finalist from 1 to 5 on every criterion once it has run your scenario; each criterion contributes weight × score ÷ 5, so totals are out of 100. The default weights suit a multi-site outpatient group: workflow fit 15, integrations 15, then 10 each for patient engagement, AI and automation, multi-site standardization, insurance, authorization and charges, implementation and conversion, and total cost and contract, and 5 each for reporting and vendor stability. Change them to match your list.

Have the people who own each criterion score it, then compare totals. A gap of a few points is a tie: break it on the criteria you weighted highest, and on the references. Print it and give a copy to every finalist, including us. A vendor who will not run your scenario before you score it has already answered the workflow fit row.

Add a row for anything on your list the defaults miss, such as the radiologists’ reading and dictation workflow, mammography and MQSA, or what referring offices see. A single-site center can fold multi-site standardization into workflow fit and raise the weight of implementation and support.

Does the system remove re-keying, or just move it?

Most radiology information system demos look alike, because most vendors demonstrate the same screens. The difference shows up in the seams between them.

A single outpatient exam touches registration, scheduling, insurance verification, the modality worklist, the report and the claim. Each step is a chance to re-key a name, a date of birth, an accession number or an order code. A system that removes two of those steps and adds one elsewhere has relocated the work rather than removed it.

What should you count during the demo?

Ask each vendor to run your scenario rather than theirs, and count these as they happen.

• How many times a demographic field is typed after the order arrives.

• Where the accession number is created, and which system owns it.

• Whether the modality receives the scheduled procedure electronically.

• Which fields the billing claim pulls automatically, and which a coder retypes.

Then put a clock on it. Time each finalist’s path from a faxed order to a booked appointment, and ask for the same measurement from a named site that runs it today. Good looks like this: the order is read once, matched to the existing patient, and only the fields the system is unsure of reach a person, each with the reason.

Which standards should you make radiology information system vendors name?

"Integrates with your PACS and EHR" is a marketing sentence. The specification underneath it names a standard, a direction, and a party who maintains the interface. Ask for all three in writing, for every endpoint.

What does each standard actually do?

• HL7 v2 carries registration, orders and results between systems. HL7 International lists among its benefits that it "provides a framework for negotiations of what is not in the standard". Two conformant systems still have to build and agree on an interface.

• FHIR is HL7's newer specification, built on reusable Resources, commonly exchanged over a RESTful API. HL7 notes you do not have to use REST to use Resources, so "supports FHIR" is not a specification either.

• DICOM Modality Worklist lets the scanner query scheduled procedure information instead of the technologist typing it at the console. It removes the most re-keying at the scanner.

• DICOM Modality Performed Procedure Step, shortened to MPPS, sends state back. The modality reports whether a step is in progress, completed or discontinued. A completed step updates the exam status without anyone clicking complete; a discontinued one tells the information system to reschedule or cancel it. Check each scanner’s DICOM conformance statement for MPPS support.

• IHE XDS-I.b governs image sharing between affiliated organizations. The source publishes a DICOM manifest to a repository, while the images stay at the source.

For every named interface, ask which direction it runs, whether it is live or batched, and who builds it. Then ask who maintains it after go-live, and how a corrected order, a cancelled exam or a merged patient record reaches PACS and billing. Those corrections, not the routine messages, are where interfaces get tested.

How should you test a vendor’s AI claims?

Every RIS vendor now demonstrates AI. Three questions separate what is running from what is planned.

• Is it live for clients today? Ask for the sites running it and what changed there, not the roadmap date.

• What does it do when it is unsure? Ask to see the exception list: which cases it handed to a person, and why. A system that guesses quietly moves the error downstream, to the claim or to the patient.

• Is every correction logged? You should be able to see what the system did, what staff changed and when, for your own audit and for tuning.

Score the answers in the AI and automation row, and weight that row by how much of your list of problems it would actually fix.

What should you check on insurance, authorization and billing?

Many outpatient denials start before the patient arrives, so the front end of the revenue cycle belongs in the evaluation, not after it. Ask each finalist to show, on your payer mix:

• Eligibility at scheduling. Checked when the exam is booked and again before the day of service, with the result on the scheduler’s screen.

• Authorizations as a worklist. Which exams need one by payer and procedure, sorted by appointment date, with status, the authorization number and its approved dates and procedure codes recorded against the order. Your staff, or your authorization partner, still obtains it; the system’s job is to make sure nothing reaches the scanner without one.

• Protocol changes caught. When the radiologist protocols a without-contrast order as with-and-without, the procedure code no longer matches the authorization. Ask how the system flags that before the scan.

• Estimates. A patient estimate at scheduling and, for uninsured or self-pay patients, the good faith estimate that 45 CFR 149.610 requires.

• Charges reconciled. How the procedure code, modifiers, diagnosis codes and authorization number reach the billing system or billing company, and a daily report of completed exams that have no charge.

What changes for multi-site and enterprise groups?

Large imaging groups and networks run the same evaluation and the same scorecard, then add five checks that only show up once there is more than one site. Score them under multi-site standardization, and raise its weight if you grow by acquisition:

• Standard work across sites. One set of protocols, prep instructions and scheduling rules, with local exceptions that are controlled rather than improvised.

• Central scheduling. A call center or scheduling hub that can book any site, from the same view of capacity.

• Acquisitions. How quickly a newly acquired center on a different system can move onto the platform, and who does the work.

• Governance. Who can change templates, rules and interfaces, and how each change is logged.

• Cross-site reporting. The same report for every site, without a spreadsheet in between.

What should a RIS do for breast imaging and MQSA?

If you perform mammography, the Mammography Quality Standards Act adds obligations that the RIS should carry, rather than a spreadsheet beside it.

What does MQSA require of the facility?

Under 21 CFR 900.12(c)(2), the facility must give each patient a summary of the mammography report in lay terms within 30 calendar days of the exam. When the assessment is “Suspicious” or “Highly Suggestive of Malignancy,” the summary is due within 7 calendar days of the final interpretation. The summary includes an assessment of breast density. Under 900.12(f), the facility follows up the disposition of every positive mammogram, correlates pathology results with the interpreting physician’s report, and analyzes the results at least once every 12 months, including positive predictive value, cancer detection rate and recall rate. Under 900.12(c)(4), the facility keeps the original mammograms and reports for the longest of 5 years, 10 years if the patient has no further mammograms there, or any period State or local law sets, and transfers them within 15 calendar days of a patient’s request. Your mammography history has to survive a RIS conversion intact.

What should each vendor show you?

• BI-RADS and density as data, not text. Ask how the assessment and density category reach the RIS from your dictation or reporting system, and what happens when a radiologist addends the report and changes the assessment.

• Lay summaries on time. Generated with the density statement and tracked against the 30-day and 7-day limits.

• Recalls and positive results tracked. Each BI-RADS 0 recall followed to a booked exam, and each Suspicious or Highly Suggestive result followed to its outcome. The audit’s recall rate counts every BI-RADS 0.

• Audit data from the system. Outcome and pathology data for the medical outcomes audit, without a separate log.

What does the total cost actually include?

The license or subscription is the number that gets quoted first and matters least. Ask every finalist to price the whole program in one document, including the lines that are hard to estimate, and to price interfaces per endpoint rather than as a bundle.

The two lines that are hardest to quote, migration and training, are the two that decide whether the project lands. A single quoted figure for "integration" also hides how many separate interfaces you are actually buying, which is why the count of endpoints belongs in the quote. Remember the other end of each interface: your PACS, EHR, dictation, billing and clearinghouse vendors may charge their own fees to build or change their side, and those never appear in the RIS quote.

Should you consider open source?

Open source removes the license line and adds a staffing line: interface engineering, upgrades, security evidence and round-the-clock support become yours. For a center that does not employ developers, that is rarely the cheaper option.

To estimate payback on your own volumes before a sales call, try our ROI calculator.

What should the implementation plan show before you sign?

Ask each finalist for a sample implementation plan from a client your size, and check it covers:

• Mock conversions. At least one full trial conversion of your data, validated by your staff against real records, before the live one.

• Modality-by-modality testing. Every scanner pulling the worklist with the right procedure codes and returning status, tested on the actual equipment.

• Cutover, not parallel running. Entering every exam in two systems is rarely sustainable at outpatient volumes. Most groups cut over on a weekend with a defined freeze on the old system, and multi-site groups often go site by site.

• Go/no-go criteria agreed in advance. What must pass before go-live, and who can call a delay. A vendor that will postpone when testing fails is protecting you.

• A lighter go-live week. Fewer slots, extra staff at the front desk and on the phones, and vendor staff on site.

• Referring offices told in advance. New fax numbers, order forms, portal logins and how results will arrive.

• Downtime practiced. Paper forms, a printed schedule and a tested routine for re-entering what happened during an outage.

What should you demand of any vendor on HIPAA?

Three HIPAA obligations bear directly on which vendor you pick, rather than on how you operate once the system is in. Each one is answerable in writing before you sign, and a vendor who will not answer them in writing has told you something. All three belong in your RFP.

Will the vendor sign a business associate agreement?

A covered entity may let a vendor create, receive, maintain or transmit protected health information only if it obtains satisfactory assurances that the vendor will safeguard it, documented in a written contract. That is 45 CFR 164.502(e). HHS treats IT vendors and cloud providers that hold electronic PHI as business associates. A hosted RIS vendor is in scope, and so is its hosting provider, as the vendor’s subcontractor under an agreement the vendor signs with it. Ask the vendor to confirm that agreement exists.

45 CFR 164.504(e)(2) sets out the required contents. Among other things, the agreement must require the vendor to:

• report breaches of unsecured PHI to you;

• bind its own subcontractors to the same terms;

• return or destroy the PHI it still holds at termination, keeping no copies, or, where that is not feasible, extend the agreement’s protections to what it keeps.

That last clause protects your patients’ data when you leave. It does not give you a usable copy of it. The export format, fee and timeline need their own contract terms, covered below.

What should you ask about the vendor's risk analysis?

The Security Rule makes risk analysis a required implementation specification, not an optional one. It calls for an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic PHI, at 45 CFR 164.308(a)(1)(ii)(A). Business associates carry that obligation themselves. Ask when the vendor last completed one, what it covered, and who performed it.

Your own analysis has to cover the new system too. NIST SP 800-66r2 puts all electronic PHI an organization creates, receives, maintains or transmits in scope, so a hosted RIS belongs in your analysis before it holds live patient data.

What does the vendor commit to when the system is down?

The contingency plan standard at 45 CFR 164.308(a)(7) requires a data backup plan, a disaster recovery plan and an emergency mode operation plan. Ask for recovery point and recovery time objectives as contract terms, and when the plan was last tested. Then ask the operational questions: how planned maintenance is scheduled and announced, how the front desk sees the day’s schedule during an outage, how scanners keep working without the worklist, and how exams, accession numbers and charges are reconciled once the system is back.

How does your data get in, and how would it get out?

Migration is often the schedule risk on a RIS project, for a structural reason. DICOM gives images a shared information model that every archive stores. No equivalent standard is stored natively by every RIS, so orders, reports, scanned documents and billing history have to be mapped from one database to another.

A University of Chicago team’s report on replacing both its RIS and its PACS archive, published in the Journal of Digital Imaging in 2000, found that its DICOM-organized image archives could be transferred with full fidelity, though slowly. The RIS replacement required extensive labor to translate data between dissimilar information models, and some data were inevitably lost.

What should you settle before you sign?

• Which records migrate, which are archived read-only, and which are abandoned.

• How open work converts: future appointments, open orders, pending authorizations, unsigned reports and open mammography recalls, and who checks each one on cutover weekend.

• How referring provider records, fax numbers and result-delivery preferences convert, so reports keep reaching the right office on day one.

• Who performs the migration, who validates it, and against which sample of real records.

• The export format you can demand at any time, and whether it covers report text and scanned documents rather than demographics alone.

• Whether the vendor is a developer of certified health IT. The information blocking regulations at 45 CFR Part 171 reach three kinds of actor: health care providers (which includes you), developers of certified health IT, and health information networks or exchanges.

• The fee for a full data extract, stated as a number in the contract.

• Renewal terms: the contract length, the cap on renewal increases and the notice period.

• The uptime commitment and support response times, written into the contract rather than a brochure.

• Every capability from the demo that your decision depends on, written into the statement of work.