Mandolin contracting: what are the typical steps (NDA, security review, BAA, MSA/SOW) and timelines?

Most specialty-drug leaders don’t have time to guess how a new vendor will get through legal, security, and procurement. You need a clear view of the contracting path, who needs to be involved, and how long each gate typically takes so you can plan around go-live, staffing, and budget cycles.

Below is a practical, operator-level walkthrough of Mandolin’s typical contracting process — from NDA to security review to BAA and MSA/SOW — plus realistic timelines so you can map this to your own internal approvals.

---

At-a-Glance: Typical Mandolin Contracting Stages & Timelines

Here’s the high-level flow most organizations follow with Mandolin:

1. Exploration & Fit (1–2 weeks)

   • Workflow discovery and volume modeling
   • Early IT/compliance consultation
   • Commercial ballpark (so no one is surprised later)

2. Mutual NDA (1–5 business days)

   • Allows sharing of non-public operational details, PHI-adjacent examples, and security documentation

3. Security & Compliance Review (2–4 weeks, in parallel with legal)

   • Security questionnaire (HITRUST-style, SOC, HIPAA controls, data handling)
   • Review of Mandolin’s architecture, logging, and access controls
   • Clarification calls between Mandolin’s security team and your IT/InfoSec

4. Business Associate Agreement (BAA) (1–3 weeks)

   • Defines HIPAA roles, permitted uses, safeguards, breach notification
   • Typically runs in parallel with MSA review once security comfort is established

5. Master Services Agreement (MSA) (2–4 weeks)

   • Commercial terms, responsibilities, data ownership, SLAs, indemnification
   • Almost always the longest single gate due to legal redlines

6. Statement(s) of Work (SOWs) (3–10 business days)

   • Site/line-of-business specific scope (e.g., infusion intake + BV + PA)
   • Volume assumptions, timelines, pricing, performance expectations

7. Internal Approvals & Signatures (variable: 1–3 weeks)

   • Executive, legal, compliance, finance approvals
   • eSignature routing and purchase order (if required)

From first serious conversation to fully executed contracts, most organizations land in the 6–10 week range, depending on legal complexity and how quickly stakeholders can review.

---

Why the Mandolin Contracting Flow Looks This Way

Mandolin isn’t a light-weight widget or dashboard. It’s a healthcare SaaS platform of AI agents that does real, PHI-intensive back-office work:

• Reading referrals, faxes, lab reports, and clinical notes
• Navigating payer portals for benefits and prior auth
• Making outbound calls to payers and interpreting remits
• Producing logged, traceable actions that affect billing and revenue

Because the system operates directly in your PHI workflows and financial infrastructure, your legal, compliance, and security teams rightly demand a higher bar. The contracting sequence below is designed to give them that assurance without dragging projects out for quarters.

---

Stage 1: Exploration & Fit (1–2 weeks)

Goal: Confirm that Mandolin can execute your specialty-drug workflows end-to-end and that the economics make sense before anyone burns cycles on redlines.

What typically happens:

• Workflow mapping:
  Intake → EHR entry → benefits verification → out-of-pocket estimates (with site-specific fee schedules, GPO/340B pricing, co-pay assistance) → medical policy review → prior auth submission → claims statusing & appeals.

• Volume and complexity assessment:

  • Documents/day (referrals, labs, clinical notes, faxes)
  • Current minutes per document / Rx
  • Backlog days and denial rates
  • Number of payers and portals your team lives in

• Outcome modeling:
  Using benchmarks from prior customers (e.g., 24x speed increase, under-2-hour turnaround, 0-day backlog), Mandolin helps you estimate the operational and financial impact in your environment.

Key outputs:

• A clear problem statement tied to metrics:
  • “We spend ~20 minutes per referral and wait up to 3 days to get into the EHR.”
  • “We carry a 4-day backlog on benefits investigations.”
• A draft view of which workflows and sites to include in the first SOW.
• Early alignment that Mandolin can work without new integrations, operating in portals, fax, and phone where the work already happens.

Once you’re comfortable on fit and outcomes, you move to documentation.

---

Stage 2: Mutual NDA (1–5 business days)

Goal: Enable deeper, candid conversations about real workflows, PHI-adjacent scenarios, and internal infrastructure.

Why it matters for a platform like Mandolin:

• To understand your actual referral formats, fax workflows, and portal usage, Mandolin needs to see real examples (with identifiers masked or limited as needed), not just a sanitized SOP.
• Security and compliance teams want to review detailed architecture and operational controls that aren’t shared publicly.

Typical flow:

1. Template selection:

   • Most organizations start from their own NDA; Mandolin also has a standard form.
   • Legal teams confirm mutual confidentiality and permitted use of shared information.

2. Light legal review:

   • Typically focused on definition of confidential information, term, and carve-outs.

3. Signature:

   • Usually via eSignature and completed within a week.

Once the NDA is signed, security and legal reviews can proceed with full detail.

---

Stage 3: Security & Compliance Review (2–4 weeks)

Goal: Give your IT/InfoSec and compliance leaders confidence that Mandolin is a HIPAA-aware, logged, traceable, and secure platform for PHI-intensive workflows.

This stage often runs in parallel with early BAA/MSA discussions.

What your teams typically review:

• Architecture & data flows

  • How Mandolin ingests information (referrals, faxes, EHR exports, etc.)
  • Where data is processed and stored
  • How AI agents are constrained and supervised

• Security controls

  • Access management, encryption in transit and at rest
  • Application and infrastructure security practices
  • Monitoring, logging, and incident response procedures

• Compliance posture

  • How HIPAA and similar regulatory requirements are handled
  • How all AI agent actions are logged and traceable, down to specific steps taken in payer portals, faxes, and phone calls
  • How audit trails are exposed to you for internal and external reviews

Typical artifacts exchanged:

• Your security questionnaire (Mandolin completes it)
• Mandolin’s security and privacy documentation
• Architecture diagrams or narratives
• Follow-up Q&A calls with Mandolin’s technical and security leaders

Timeline drivers:

• How quickly your IT/InfoSec team can review
• Whether this goes through a vendor risk committee or steering group
• Any required demos of activity logs or monitoring capability

When your security leaders are comfortable with Mandolin’s controls and traceability, legal and compliance teams tend to move faster on the BAA.

---

Stage 4: Business Associate Agreement (BAA) (1–3 weeks)

Goal: Define how Mandolin processes PHI and set clear HIPAA boundaries, safeguards, and responsibilities.

Because Mandolin’s AI agents operate directly in PHI-heavy workflows (reading referrals, handling benefits verification data, interacting with payers, interpreting remits), the BAA is central.

Typical topics covered:

• Roles and responsibilities:

  • Your organization as Covered Entity
  • Mandolin as Business Associate

• Permitted uses & disclosures of PHI:

  • Using PHI to execute the back-office workflows you define (intake through claims and appeals)
  • Restrictions on secondary use

• Safeguards and logging:

  • Commitment to appropriate technical and administrative safeguards
  • Maintenance of detailed logs of AI agent activity for audit purposes

• Breach notification & incident handling:

  • Timelines for notification
  • Cooperation expectations in response and remediation

How it intersects with other documents:

• Usually attached to or referenced by the MSA, but reviewed by compliance/privacy teams alongside legal.
• Can move in parallel once security teams confirm comfort with Mandolin’s controls.

Timeline drivers:

• Whether you use your BAA template or Mandolin’s
• Complexity of internal privacy policies and regional regulations
• Number of stakeholders who must sign off (Privacy Officer, Compliance, Legal)

---

Stage 5: Master Services Agreement (MSA) (2–4 weeks)

Goal: Set the overarching legal and commercial framework for your relationship with Mandolin — the “rules of the road” under which future SOWs will sit.

Because the MSA governs risk, data, and long-term obligations, it’s usually the most heavily redlined document.

Core areas the MSA typically covers:

• Scope of services (at a high level):
  AI agents performing end-to-end specialty-drug back-office work: intake, benefits verification, out-of-pocket estimation, prior auth, and claims statusing/appeals.

• Data ownership & use:

  • You retain ownership of your data
  • Mandolin’s rights to use data to deliver services and improve the platform, subject to privacy and BAA terms

• Service levels and support:

  • Expectations for uptime and responsiveness
  • Definitions of “incident” and “outage” in an AI-agent context

• Compliance & auditability:

  • Commitment that all agent actions are logged and auditable
  • Support for your internal audits, payer reviews, and external assessments

• Risk allocation:

  • Indemnification
  • Limitation of liability
  • Insurance coverage

Timeline drivers:

• Whether you start from Mandolin’s standard MSA or your own paper
• How many cycles your legal team needs for risk language (indemnities, caps, SLAs)
• Involvement of procurement/vendor management committees

This step can often be shortened if you define early “must-haves” and “nice-to-haves” and focus redlines on the former.

---

Stage 6: Statements of Work (SOWs) (3–10 business days)

Goal: Translate your operational reality into a contract-ready, measurable scope of work.

Because Mandolin is about workflows, not widgets, SOWs are written to match the actual processes your team is paying Mandolin’s AI agents to execute.

What a typical SOW includes:

• Workflows covered:

  • e.g., “Referral intake and EHR entry for ambulatory infusion center locations A, B, and C”
  • “Benefits verification, out-of-pocket estimation, and prior auth packaging for all buy-and-bill biologics”
  • “Claims statusing and first-level appeal preparation for top 10 commercial payers”

• Volumes & assumptions:

  • Documents/day or prescriptions/month
  • Expected growth in patient volume
  • Current and target metrics (e.g., minutes per document, backlog days)

• Deliverables and expectations:

  • Turnaround expectations (e.g., “end-to-end intake and EHR entry within 2 hours in >X% of cases”)
  • Logged, traceable actions for payer portal work, fax submissions, and calls

• Pricing construct:

  • Per-document, per-Rx, per-patient, or per-site pricing
  • Minimums or tiers based on volume

• Implementation & go-live plan:

  • Milestones from kick-off to production
  • Training and validation periods
  • How success will be measured in the first 30–90 days

Timeline drivers:

• How quickly your operations leaders can finalize which sites and drugs are in scope
• Internal alignment on “phase 1” versus “later phases”
• Any approvals needed for specific pricing models or performance commitments

Well-structured SOWs make it easy to bolt on new sites or workflows later with minimal additional legal negotiation.

---

Stage 7: Internal Approvals & Signatures (1–3 weeks)

Goal: Align all internal stakeholders and make the decision official.

Even with all terms negotiated, this stage can drag if you don’t plan for it.

Typical internal approvals include:

• Operations leaders (infusion center, specialty pharmacy, access services)
  • Confirming workflows and staffing assumptions
• Finance & FP&A
  • Validating ROI, budget alignment, and FTE impact based on metrics like:
    • Documents/day throughput
    • Minutes per Rx
    • Patient volume capacity
• Legal & Compliance
  • Final sign-off on MSA, BAA, and SOWs
• IT/InfoSec
  • Confirming security and integration posture is acceptable
• Executive sponsor(s)
  • Often the COO, VP of Operations, or SVP of Specialty Services

Signature mechanics:

• Most Mandolin customers use eSignature with a clearly mapped signer list.
• If your organization requires a purchase order, add time for procurement and vendor setup.

---

How to Shorten Overall Timelines

From my experience running these processes on the provider side, the difference between a 6-week and a 12-week contracting cycle usually comes down to:

1. Parallelization vs. serial steps

   • Run security review, BAA, and MSA in parallel once the NDA is signed.
   • Draft SOWs while legal is still working the MSA language.

2. Early stakeholder inclusion

   • Bring IT/InfoSec, Compliance, Finance, and Operations into conversations early so their questions are addressed before documents hit their desks.
   • Share the intended workflows and metrics (backlog days, minutes per document, denial rates) upfront so everyone sees the same ROI story.

3. Clear “non-negotiables” list

   • Have your legal team articulate their non-negotiable positions on liability caps, indemnity, and PHI handling before redlines start.
   • Mandolin can then align on solutions without multiple rework cycles.

4. Pre-structured SOW templates

   • Mandolin can provide SOW templates tailored to ambulatory infusion or specialty pharmacy workflows, so your team is editing instead of writing from scratch.

---

What Happens After Signing

Once the NDA, security review, BAA, MSA, and SOW(s) are executed:

• Implementation kickoff

  • Joint project team formed (operations, IT, Mandolin implementation)
  • Confirm workflows, milestones, and reporting cadences

• Configuration & validation

  • AI agents are trained on your specific referral formats, payer mix, and policy nuances
  • Test runs in parallel with current-state processes to validate accuracy and timing

• Go-live & measurement

  • Backlog reduction, time-to-EHR, time-to-PA, and denial avoidance are tracked
  • Examples from prior customers:
    • 20 minutes per document → ~3 minutes
    • Up to 3 days to EHR → under 2 hours
    • 4-day prescription backlog → 0-day backlog
    • Ability to scale to 4,500+ patients/month while refocusing outsourced roles

The same emphasis on logged, traceable actions that drives comfort in contracting carries forward into operations and audits.

---

Final Verdict: How to Think About Mandolin’s Contracting Path

If you’re evaluating Mandolin to automate your specialty-drug back office, plan for a contracting journey that’s:

• Structured: NDA → security review → BAA/MSA → SOWs → sign-off
• Parallelized: Security, legal, and operations discussions moving together, not in sequence
• Compliance-forward: Clear HIPAA and security posture anchored by logged, auditable AI agent actions
• Operator-centric: SOWs written in the language of real workflows—intake, benefits verification, prior auth, claims—not abstract “automation” projects

Most organizations can go from serious evaluation to signed agreements in 6–10 weeks, with faster paths when stakeholders are aligned and documents move in parallel.

If you’re ready to see what this looks like against your own referral volume, payer mix, and backlog numbers, the next move is simple:

Get Started