071B6600132.pdf

STATE OF MICHIGAN PROCUREMENT

Department Technology, Management and Budget Central Procurement Services 320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

Change Notice Number 25 to Contract Number MA071B6600132C

C O

N

TR

A C

TO

R

Bamboo Health, Inc.

9901 Linn Station Rd

Louisville KY 40223

Haley Alder

502-815-5568 halder@bamboohealth.com

VS0265200

ST

A

TE

Pr og ra m

M an ag er

Various Various

C on tr ac t A dm in is tr at or Angela Wright DTMB

517-899-4646

WrightA33@michigan.gov

CONTRACT SUMMARY

Prescription System for electronic monitoring and reporting

INITIAL EFFECTIVE DATE

September 15, 2016

INITIAL EXPIRATION DATE

September 15, 2019

INITIAL AVAILABLE OPTIONS

5 - 1 Year

EXPIRATION DATE

BEFORE

June 8, 2029

PAYMENT TERMS

Net 45

DELIVERY TIMEFRAME

N/A

ALTERNATE PAYMENT OPTIONS

P-Card Direct Voucher (PRC) Other

EXTENDED PURCHASING

Yes No

MINIMUM DELIVERY REQUIREMENTS

N/A

DESCRIPTION OF CHANGE NOTICE

OPTION LENGTH OF OPTION EXTENSION LENGTH OF EXTENSION

REVISED EXP. DATE

CURRENT VALUE

$33,356,836.03

VALUE OF CHANGE NOTICE

$0.00

ESTIMATED AGGREGATE CONTRACT VALUE

$33,356,836.03

DESCRIPTION

Please note the Program Manager or Contract Administrator may have changed, and are reflected on this Change Notice.

Effective March 15, 2026 the parties add the following language to the Contract:

Accessibility Requirements.

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites, applications, content, and electronic documents. Due to a change in the law, the State is required to comply with specific accessibility standards for websites, applications, content and documents.

Starting 4/24/2026, throughout the Term, all websites, applications, software, content, and electronic documents, including but not limited to mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet), created, provided, or made available by the Contractor under this Contract, must comply with WCAG 2.1 Level AA."

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval. All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

CHANGE NOTICE NO. 25 TO CONTRACT NO. MA071B6600132C

Program Managers for

Multi-Agency and Statewide Contracts

AGENCY NAME PHONE EMAIL

LARA Cole Thelen 517-388-8350 ThelenC10@michigan.gov

DTMB Jes Golka 517-899-7256 GolkaJ@michigan.gov

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Prescription System for electronic monitoring and reporting

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

September 15, 2016 September 14, 2019 2 - 24 Months June 8, 2029

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

9901 Linn Station Rd

Louisville KY 40223

Haley Alder

502-815-5568 halder@bamboohealth.com

VS0265200

Bamboo Health, Inc.

C O

N

TR

A C

TO

R

Mecca Martin

517-230-5694

DTMB

Various Various

MartinM42@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANet 45

Change Notice Number 24

Contract Number MA071B6600132C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$33,356,836.03 $0.00 $33,356,836.03

DESCRIPTION

Effective 1/31/2025, this contract will utilize $73,000.00 previously added to the contract. The following amendment is incorporated into this Contract per the attached Statement of Work to enhance the Michigan Automated Prescription System (MAPS) by introducing MOUD (Medication for Opioid Use Disorder) alerts to patient reports.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

AGENCY NAME PHONE EMAIL

DTMB Katy Stevenson 517-899-7234 StevensonK1@michigan.gov

DTMB Jes Golka 517-899-7256 GolkaJ@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 24 TO CONTRACT NO. MA071B6600132C

MICHIGAN DEPARTMENT OF TECHNOLOGY,

MANAGEMENT AND BUDGET

IT SERVICES

STATEMENT OF WORK

Project Title:

MAPS – Medication for Opioid Use Disorder (MOUD) Prompts

Period of Coverage:

01/01/2025 – 12/31/2025

Requesting Department:

Licensing and Regulatory Affairs/Bureau of Professional Licensing

Date:

12/23/2024

Agency Project Manager:

Haley Winans

Phone:

517-335-3652

DTMB Project Manager: Stu Willard

Phone:

517-526-5410

BACKGROUND: Patients who experience interruptions in Medication for Opioid Use Disorder (MOUD) treatment may face an increased risk of negative health outcomes, including overdose.

By displaying an indicator on patient MAPS reports to providers and their delegates, this enhancement offers valuable insights that may support timely interventions to improve patient care and continuity of treatment.

PROJECT OBJECTIVE: The project objective is to enhance MAPS for end users by introducing MOUD alerts to patient reports.

IN SCOPE:

• For the purpose of this project, MOUD is defined as Buprenorphine (excluding

Buprenorphine prescribed for pain management), Methadone, and/or Naltrexone as reported to MAPS, Michigan’s Prescription Monitoring Program (PMP). Bamboo Health current considers a Buprenorphine dispensation as MOUD if it corresponds to a GCN (the clinical indication value provided by First Data Bank) related to MOUD. This methodology is subject to change based on industry advancements and data integrity.

• Provide a solution to identify patients who experience a gap in MOUD dispensation submissions to the PMP.

• Ability to generate email alerts to prescribers and their delegates when their patient experiences a gap in MOUD.

• Ability to display the MOUD Prompt as an alert to the prescriber and active delegates on the user’s AWARxE Dashboard.

• Ability to display the MOUD Prompt as an indicator on the Patient Report in both AWARxE and Gateway.

Bamboo Health will provide the ability for the State MAPS Administrator to configure several settings for the MOUD Prompt. The available configurations will include:

• Configuration 1: Consecutive days without MOUD medication refill

• Configuration 2: Drug category = MOUD

• Configuration 3: Alert expiration days

• Configuration 4: Role Permissions

• Configuration 5: Date Sold or Date Filled.

OUT OF SCOPE: Any requests that are not explicitly outlined under “In Scope” will be considered out of scope and may be subject to new estimates, additional fees, change of delivery timeline, and new change order.

The ‘generate report’, ‘report history’, and ‘select patients’ functionalities are out of scope (as seen for the Prescriber and Dispenser Thresholds clinical alert).

DELIVERABLES:

Service Price

Setup and implementation of MOUD Prompts, and annual maintenance and operation of feature.

$13,000.00 (one-time implementation fee) $60,000.00 (annual maintenance and operation fee)

(One-time implementation fee and Year 1 of coverage billed by 8/31/2025)

TOTAL $73,000.00

PROJECT DEPENDENCY: This project is dependent on a fully-executed Interagency Agreement between the Michigan Department of Health and Human Services (MDHHS) and the Department of Licensing and Regulatory Affairs (LARA) to cover fees associated to this project through MDHHS’ CDC MODA grant.

SPECIFIC DEPARTMENT STANDARDS:

Agency standards, if any, in addition to DTMB standards.

PAYMENT SCHEDULE:

NOTE: Payment to be based upon:

• Satisfactory acceptance of each Deliverable

Payment will be made on a deliverables basis and subsequent annual basis. DTMB will pay VENDOR upon receipt of properly completed invoice(s) which shall be submitted to the billing address on the State issued purchase order not more often than monthly. DTMB Accounts Payable area will coordinate obtaining Agency and DTMB Project Manager approvals. All invoices should reflect actual work completed by payment date and must be approved by the Agency and DTMB Project Manager prior to payment. The invoices shall describe and document to the State’s satisfaction a description of the work performed, the progress of the project, and fees. When expenses are invoiced, receipts will need to be provided along with a detailed breakdown of each type of expense.

Payment shall be considered timely if made by the DTMB within forty-five (45) days after receipt of properly completed invoices.

EXPENSES:

The State will NOT pay for any travel expenses, including hotel, mileage, meals, parking, etc.

PROJECT CONTACTS:

The designated Agency Project Manager is:

Haley Winans Licensing and Regulatory Affairs Bureau of Professional Licensing WinansH@michigan.gov 517-335-3652

The designated DTMB Project Manager is:

Stu Willard Department of Technology, Management and Budget Agency Services for Licensing and Regulatory Affairs WillardS@michigan.gov 517-526-5410

LOCATION OF WHERE THE WORK IS TO BE PERFORMED:

Most of the activities related to this project will be performed out of the vendor’s offices located in Louisville, KY. Portions of the work may be done in the vendor’s other office locations.

It is anticipated that certain major milestones and planning meetings with various stakeholders will occur in locations selected by LARA’s PMP, MAPS. It is Bamboo Health’s intent and expectation to perform its duties and functions in any location as may be warranted if it has a direct impact on the overall success of the project.

EXPECTED CONTRACTOR WORK HOURS AND CONDITIONS:

Deliverables based payments.

Work hours are not to exceed eight (8) hours a day, forty (40) hours a week. Normal working hours of 8:00 am to 5:00 pm are to be observed unless otherwise agreed to in writing.

No overtime will be permitted.

mailto:WinansH@michigan.gov mailto:WillardS@michigan.gov

Department of Technology, Management, and Budget 320 S. Walnut Street 2nd Floor Lansing, MI 48933

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Prescription System for electronic monitoring and reporting

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

September 15, 2016 September 14, 2019 2 - 24 Months June 8, 2029

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

9901 Linn Station Rd

Louisville KY 40223

Haley Alder

502-815-5568 halder@bamboohealth.com

VS0265200

Bamboo Health, Inc.

C O

N

TR

A C

TO

R

Mecca Martin

5172305694

DTMB

Various Various

MartinM42@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANet 45

Change Notice Number 23

Contract Number MA071B6600132C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

$33,356,836.03 $0.00 $33,356,836.03

DESCRIPTION

Effective 9/5/2024, the following item: ICPSR Extracts to UofM is removed from this Contract, per the attached Schedule F- Pricing.

All other terms, conditions, specifications and pricing remain the same. Per contractor and agency agreement, and DTMB Central Procurement Services approval.

DTMB Katy Stevenson 517-899-7234 StevensonK1@michigan.gov

Program Managers for

CHANGE NOTICE NO. 23 TO CONTRACT NO. MA071B6600132C

Michigan.gov/MiProcurement

SCHEDULE F - PRICING

Table A - Subscription License Model Subscription

Based

- Product Name*

Frequency of Billing

Amount to Be Billed Coverage Period

PMP AWARxE Quarterly $103,387.50 to be invoiced in January/April/July/October

Previous calendar quarter

Enterprise NarxCare

Quarterly $114,000 to be invoiced in January/April/July/October

Previous calendar quarter

Statewide Gateway

Quarterly $225,000 to be invoiced in January/April/July/October

Previous calendar quarter

Advanced Analytics

Quarterly $7,500 to be invoiced in January/April/July/October

Previous calendar quarter

Section 5042 Reporting

Annually $150,000.00 to be invoiced in September

Previous fiscal year

ICPSR Extracts to UofM

Quarterly $1,250 to be invoiced in January/April/July/October

Previous calendar quarter

Mandatory Use Model

Quarterly $5,000 to be invoiced in January/April/July/October

Previous calendar quarter

Prescriber Report Cards

Quarterly $12,500 to be invoiced in January/April/July/October

Previous calendar quarter

Wholesale Data Collection and Risk Assessment Dashboard

Quarterly $31,250 to be invoiced in January/April/July/October

Previous calendar quarter

Overdose Death Data Overlay

Annually $1,500.00 to be invoiced upon completion of each overlay file

Each overlay file

Update and Confirm

Quarterly $3,750 to be invoiced in January/April/July/October

Previous calendar quarter

• All licensing above is Enterprise Licensing – Unlimited Number of Users

StevensonK1 Cross-Out

StevensonK1 Cross-Out

StevensonK1 Cross-Out

Department of Technology, Management, and Budget

525 W. ALLEGAN ST., LANSING, MICHIGAN 48913

P.O. BOX 30026 LANSING, MICHIGAN 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

Prescription System for electronic monitoring and reporting

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

September 15, 2016 September 14, 2019 2 - 12 Months June 8, 2024

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

9901 Linn Station Rd

Louisville KY 40223

Haley Alder

502-815-5568 halder@bamboohealth.com

VS0265200

Bamboo Health, Inc.

C O

N

TR

A C

TO

R

Jeremy Lyon

(517) 230-2858

DTMB

Various Various lyonj5@michigan.gov

STA

TE

C ontract

A dm inistrator Program M anager

N/ANet 45

Change Notice Number 22

Contract Number MA071B6600132C to

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

June 8, 2029

$20,856,836.03 $12,500,000.00 $33,356,836.03

DESCRIPTION

Effective 06/04/2024, the parties add $12,500,000.00, extend this Contract to 6/8/2029 with additional options through 6/8/2034, and fully restate the Contract per the attached documentation. All other terms, conditions, specifications, and pricing remain the same. Per contractor, agency, DTMB Central Procurement and State Administrative Board approval on 6/4/2024.

DTMB Jason Wymer 517-256-1014 WymerJ@michigan.gov

Program Managers for

CHANGE NOTICE NO. 22 TO CONTRACT NO. MA071B6600132C

Change Notice 22 to Contract #071B6600132

The purpose of this Change Notice 22 to Contract #071B6600132 is to extend the Contract as a Useful Life Extension and modify the Contract to include updated security requirements, contact information, and other terms and described herein.

Now, therefore, the parties agree to incorporate the following changes to the Contract:

1. Modifications to the Contract Terms.

1.1 The two paragraphs in the preamble, which sets forth the parties, term, and option periods, is hereby deleted and replaced with the following:

“This Software as a Service Contract is agreed to between the State of Michigan and Bamboo Health, Inc. This Contract is effective on 06/04/2024 , and unless earlier terminated, will expire on 06/04/2029 .

This Contract may be renewed for up to 5 additional 1 year period(s). Renewal must be by written notice from the State and will automatically extend the Term of this Contract.”

1.2 The following definitions are hereby added into Section 1. Definitions:

““Access” means when an individual: (1) enters a restricted or locked area, room, container, or system containing State Data; or (2) obtains, acquires, receives, examines, uses, controls (including maintaining physical or technical controls, or having the ability to modify or bypass security controls), or gains knowledge of State Data, by physical, electronic, or any other methods.”

““Approved Third-Party Components” means all Third Party Components that are specifically identified by Contractor in the Contractor’s bid response to the RFP, in an applicable Statement of Work or elsewhere in this Contract, or as otherwise required by this Contract, including without limitation as part of the State’s Security Accreditation Process defined in Schedule B – Data Security Requirements.”

““Digital Accessibility Standards” means the accessibility standards provided in the SOM Digital Standards, located at https://www.michigan.gov/standards.”

““Initial ULE Period” means the period beginning on 06/04/2024 and ending on 06/03/2029.”

““Permitted Subcontractor” means any Subcontractor that will have Access to or have the ability to control access to State Data or both.”

https://www.michigan.gov/som/footer/policies/som-applications-and-site-standards

““Service Level Credits” has the meaning set forth in Section 6.4(d).”

““Third-Party Components” means all components. including open-source components, developed and/or provided to Contractor by a third-party that are included in or used in connection with the Hosted Services and Service Software.”

““Unauthorized Removal” has the meaning set forth in Subsection 2.6(a).”

““Unauthorized Removal Credit” has the meaning set forth in Subsection 2.6(c).”

1.3 In Section 1. Definitions the definition of “Statement of Work” is hereby deleted and replaced with the following:

““Statement of Work” means any statement of work entered into by the parties and incorporated into this Contract. The initial Statement of Work is attached as Schedule A.”

1.4 In Section 2.1 Services, subsection (a) is hereby deleted and replaced with the following:

“(a) the hosting, management and operation of the Service Software and other services for remote electronic access and use by the State and its Authorized Users (“Hosted Services”) as described in one or more written Statements of Work referencing this Contract, including all Specifications set forth in such Statements of Work, which, upon their execution will be attached to this Contract and by this reference are incorporated in and made a part of this Contract;”

1.5 In Section 2.2 Change Notices, the following subsection (c) is hereby added:

““(c) This Contract may not be amended or modified in any way, except by a properly signed Change Notice. Notwithstanding the foregoing, no subsequent Statement of Work or Change Notice executed after the Effective Date will be construed to amend this Contract unless it specifically states its intent to do so and cites the section or sections amended.”

1.6 In Section 2.4 Subcontracting, subsection (e)(ii) is hereby deleted and replaced with the following:

“(ii) Reserved.”

1.7 In Section 2.5 Contractor Personnel, subsection (c)(ii) is hereby deleted and

“(ii) prior written consent provided by Contractor as set forth in Section 2.6(a);

or.”

1.8 In Section 2.6 Unauthorized Removal of Key Personnel, subsection (a) is hereby deleted and replaced with the following:

“(a) Contractor will not remove any Key Personnel from their assigned roles on this Contract without the prior written consent of the State. Further, for any Project Manager or Subject Matter Expert identified as Key Personnel, if the State consents in writing to the removal of such Project Manager or Subject Matter Expert, Contractor will provide a replacement prior to their removal.

Such replacement will: 1) meet the applicable requirements set forth in the Key Personnel Resume Requirements set forth in the Statement of Work; 2) have the skillsets of an equivalent level and ability to the personnel they are replacing; and 3) be subject to the State’s prior written approval, which will not be unreasonably withheld. Any other Key Personnel will be replaced on a commercially reasonable timeline. The Contractor’s removal of Key Personnel without the prior written consent of the State, and for any Project Manager or Subject Matter Expert, an approved replacement person, is an unauthorized removal (“Unauthorized Removal”). An Unauthorized Removal does not include replacing Key Personnel for reasons beyond the reasonable control of Contractor, including any event set forth in Section 2.5(c).”

1.9 In Section 2.7 Management and Payment of Contractor Personnel, the following subsection (c) is hereby added:

“(c) The State, in its sole discretion, may also perform background checks on Contractor Personnel. Any such checks, made pursuant to this Contract, will be reasonably related to the work of Contractor under this Contract and/or required by law. Pursuant to Michigan law, all agencies subject to IRS Pub. 1075 are required to ask the Michigan State Police to perform fingerprint background checks on all employees, including Contractor and subcontractor employees, who may have access to any database of information maintained by the federal government that contains confidential or personal information, including, but not limited to, federal tax information. Further, pursuant to Michigan law, any agency described above is prohibited from providing Contractors or subcontractors with the result of such background check. For more information, please see Michigan Public Act 427 of 2018.”

1.10 In Section 3. License Grant and Restrictions, a new subsection 3.6. Third-

Party Components is hereby added:

“3.6. Third-Party Components. Throughout the Term, on a quarterly basis, Contractor will provide the State with Contractor’s software bill of materials which contains updated information identifying and describing any Third-Party Components included in the Hosted Services or Service Software. Contractor is responsible for ensuring that all Approved Third-Party Components are properly licensed for the State’s use.”

1.11 In Section 5. Service Availability and Service Availability Credits, subsection (a) is hereby deleted and replaced with the following:

“(a) Availability Requirement. Contractor will make the Hosted Services Available, as measured over the course of each calendar month during the Term and any additional periods during which Contractor does or is required to perform any Hosted Services (each such calendar month, a “Service Period”), at least 99.9% of the time, excluding only the time the Hosted Services are not Available solely as a result of one or more Exceptions (the “Availability Requirement”). “Available” means the Hosted Services are available and operable for access and use by the State and its Authorized Users over the Internet in material conformity with the Specifications. “Availability” has a correlative meaning. The Hosted Services are not considered Available in the event of a material performance degradation or inoperability of the Hosted Services, in whole or in part. The Availability Requirement will be calculated for the Service Period as follows:

(Actual Uptime – Total Minutes in Service Period Hosted Services are not Available Due to an Exception) ÷ (Scheduled Uptime – Total Minutes in Service Period Hosted Services are not Available Due to an Exception) x 100 = Availability;”

1.12 In Section 5.5. Remedies for Service Availability Failures, the table in subsection (a) is hereby deleted and replaced with the following table:

Availability Credit of Fees ≥99.9% None <99.9% but ≥99.0% 15% <99.0% but ≥95.0% 35% <95.0% 100%

1.13 In Section 6.1. Support Service Responsibilities, subsection (b) is hereby

“(b) Provide unlimited telephone and online support twenty-four (24) hours per day, seven (7) days per week, three-hundred-sixty-five (365) days per year (“24x7x365”);”

1.14 In Section 6.4. Support Service Level Requirements, the table in subsection (b) is hereby deleted and replaced with the following table:

Support Request Classification

Service Level Metric

(Required Response

Time)

Service Level Metric

(Required

Resolution Time)

Service Level Credits

(For Failure to Respond to any Support Request

Within the Corresponding

Response Time)

Service Level Credits

(For Failure to Resolve any

Support Request Within the

Corresponding Required

Resolution Time)

Critical Service Error One (1) hour Two (2) hours Five percent (5%) of the Fees for the month in which the initial Service Level Failure begins and five percent (5%) of such monthly Fees for each additional hour or portion thereof that the corresponding Service Error is not responded to within the required response time

Time to resolve a Critical Service Error will be considered downtime and included in Availability SLA covered in 1.12 above.

High Service Error Two (2) hours Four (4) hours Three percent (3%) of the Fees for the month in which the initial Service Level Failure begins and three percent (3%) of such monthly Fees for each additional hour or portion thereof that the corresponding Service Error is not responded to within the required response time

Time to resolve a High Service Error will be included in Availability SLA covered in 1.12 above.

Medium Service Error

Twenty-four (24) hours

Forty-Eight (48) hours

N/A N/A

Low Service Error Two (2) Business Days

Five (5) Business Days

N/A N/A

1.15 In Section 6.4. Support Service Level Requirements, the following subsection (d) is hereby added:

“(d) Support Service Level Credits. Failure to achieve any of the Support Service Level Requirements for Critical and High Service Errors will constitute a Service Level Failure for which Contractor will issue to the State the corresponding service credits set forth in Subsection 6.4 (b) (“Service Level Credits”) in accordance with payment terms set forth in the Contract.”

1.16 In Section 7.4. Effect of Termination, subsection (a) is hereby deleted and

“(a) Contractor will be obligated to perform all Transition Responsibilities specified in Section 7.3 and in Schedule G (Transition Plan).”

1.17 Section 8.1. Fees, is hereby deleted and replaced with the following:

“8.1 Fees. Subject to the terms and conditions of this Contract and the applicable Statement of Work, including the provisions of this Section 8, the State shall pay the fees set forth in the applicable Statement of Work or Pricing Schedule, subject to such increases and adjustments as may be permitted pursuant to Section 8.2 (“Fees During Option Years”).”

1.18 Section 8.2. Fees During Option Years, is hereby deleted and replaced with the following:

“8.2 Fees During Option Years. Contractor’s Fees are fixed during the Initial ULE Period. After the Initial ULE Period, Contractor may increase Fees for any renewal period by providing written notice to the State at least sixty (60) calendar days prior to the commencement of such renewal period. An increase of Fees for any renewal period may not exceed three percent (3%) of the Fees effective during the immediately preceding twelve (12) month period. No increase in Fees is effective unless made in compliance with the provisions of this Section 8.2.

1.19 Section 8.3. Administrative Fee and Reporting is hereby deleted and

“8.3 Reserved.”

1.20 Section 8.7. Payment Terms is hereby deleted and replaced with the following:

“8.7 Payment Terms. Contractor shall invoice the State pursuant to the requirements set forth in the applicable Statement of Work and/or Pricing Schedule. Invoices are due and payable by the State, in accordance with the State’s standard payment procedures as specified in 1984 Public Act no. 279, MCL 17.51, et seq., within forty-five (45) calendar days after receipt, provided the State determines that the invoice was properly rendered. The State will only disburse payments under this Contract through Electronic Funds Transfer (EFT).

Contractor must register with the State at http://www.michigan.gov/SIGMAVSS to receive electronic fund transfer payments. If Contractor does not register, the State is not liable for failure to provide payment.”

1.21 In Section 8.8. State Financial Audits of Contractor, subsection (a) is hereby deleted and replaced with the following:

“(a) Pursuant to MCL 18.1470, the State or its designee may audit Contractor to verify compliance with this Contract. Contractor must retain and provide to the State or its designee and the auditor general upon request, all financial and accounting records related to this Contract through the Term of this Contract and for 3 years after the latter of termination, expiration, or final payment under this Contract or any extension (“Financial Audit Period”), provided that the State: (a) provides Contractor with at least fifteen (15) days prior notice of any audit, and

(b) conducts or causes to be conducted such audit in a manner designed to minimize disruption of Contractor’s normal business operations. For the avoidance of doubt this audit does not include information pertaining to Contractor’s cost of doing business, or third party (e.g. customer) data. If an audit, litigation, or other action involving the records is initiated before the end of the Financial Audit Period, Contractor must retain the records until all issues are resolved. Nothing in this section shall limit the constitutional or statutory authority of the auditor general.”

1.22 In Section 9.1. Ownership, the following subsection (c) is hereby added to the end of subsection(b):

“; and (c) all data made available to Contractor for the purpose of or in relation to the provision of the Solution, including but not limited to all text, sound, video, image files, or software.”

1.23 In Section 9.2. Contractor Use of State Data, the following subsection (d) is hereby added to the end of subsection(c):

“; and (d) keep and maintain State Data in the United States.”

1.24 In Section 9.5. Loss or Compromise of Data, subsection (a) is hereby

“(a) notify the State as soon as practicable but no later than 24 hours of becoming aware of such occurrence, even if law enforcement has informed Contractor that notification to the public must be delayed;”

1.25 Section 9.7. ADA Compliance, is hereby deleted and replaced with the following:

“9.7 ADA Compliance. The Services, including without limitation the Service Software, will be compliant with the accessibility standards provided in the Digital Accessibility Standards . If the standards set forth in the Digital Accessibility Standards change during the Term, Contractor will maintain the new standard.”

1.26 In Section 10.1. Meaning of Confidential Information, subsection (e) is hereby deleted and replaced with the following:

“(e) publicly available when received, or thereafter became publicly available (other than through any unauthorized disclosure).”

1.27 Section 10.5. Surrender of Confidential Information upon Termination, is hereby deleted and replaced with the following:

“10.5 Surrender of Confidential Information upon Termination. Upon termination or expiration of this Contract or a Statement of Work, in whole or in part, each party must, within five (5) Business Days from the date of termination, return to the other party any and all Confidential Information received from the other party, or created or received by a party on behalf of the other party, which are in such party’s possession, custody, or control. Upon confirmation from the State, of receipt of all data, Contractor must permanently sanitize or destroy the State’s Confidential Information, including State Data, from all media including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. If the State determines that the return of any Confidential Information is not feasible or necessary, Contractor must destroy the Confidential Information as specified above. The Contractor must certify the destruction of Confidential Information (including State Data) in writing within 5

Business Days from the date of confirmation from the State. If the State determines that the return of any Contractor Confidential Information is not feasible, the State must destroy the Confidential Information and certify the same in writing within five

(5) Business Days from the date of termination to the Contractor.”

1.28 Section 11. Security, including all subsections, is hereby deleted and replaced with the following:

“11. Security. Throughout the Term and at all times in connection with its actual or required performance of the Services hereunder, Contractor will maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State’s Confidential Information that comply with the requirements of the State’s data security policies as set forth in Schedule B to this Contract.”

1.29 In Section 12.1. Redundant Hosting and Connectivity, subsection (d) is hereby deleted and replaced with the following:

“(d) have the ability to provide the Hosted Services in accordance with this Contract and the Specifications during the performance of routine and remedial maintenance or any outage or failure of the primary system fails. Contractor will operate, monitor and maintain, or ensure that one is operated, monitored and maintained on its behalf, such mirror system so that it may achieve a Recovery Point Objective (RPO) of (1) hours, and a Recovery Time Objective (RTO) of (24 hours in the event of any failure of the Hosted Services to be Available.

1.30 In Section 12. Redundancy, Data Backup and Disaster Recovery, the following new subsections 12.3. Data Storage and 12.4 Data Restoration are hereby added:

“12.3 Data Storage. Contractor will provide sufficient storage capacity to meet the needs of the State at no additional cost. Substantial modifications to the scope may result in additional fees however any such changes to fees will be effective only if and when memorialized in a mutually agreed and properly executed written Change Notice.

12.4 Data Restoration. If the data restoration is required due to the actions or inactions of the Contractor or its subcontractors, Contractor will promptly notify the State and complete actions required to restore service to normal production operation. If requested, Contractor will restore data from a backup upon written notice from the State. Contractor will restore the data within one (1) Business Day of the State’s request. Contractor will provide data restorations at its sole cost and expense.”

1.31 In Section 15.1 Authority and Bid Response, the following subsection (h) is hereby added to the end of subsection (g):

“; and (h) Contractor is neither currently engaged in nor will engage in the boycott of a person based in or doing business with a strategic partner as described in 22 USC 8601 to 8606.

1.32 In Section 15.2 Sofware and Service Warranties, the following subsection

(l) is hereby added to the end of subsection(k):

“; and (l) as provided by Contractor, the Service Software and Hosted Services do not and will not at any time during the Term contain any third party or open-source components that operate in such a way that it is developed or compiled with or linked to any third party or open-source components, other than Approved Third Party Components.

1.33 Section 16. Insurance, including subsection 16.1 and its subsections, is hereby deleted and replaced with the following:

“16. Insurance. Contractor must maintain the minimum insurances identified in the Insurance Schedule attached as Schedule H.

1.34 Section 19.4 Notices, is hereby deleted and replaced with the following:

“19.4. Notices. All notices, requests, consents, claims, demands, waivers and other communications hereunder, other than routine communications having no legal effect, must be in writing and addressed to the parties as follows (or as otherwise specified by a party in a notice given in accordance with this Section):

If to Contractor:

Bamboo Health, Inc.

9901 Linn Station Road Suite 500 Louisville, KY 40223 legal@bamboohealth.com

If to the State:

Jeremy Lyon 320 S Walnut Street Lansing, MI, 48933 mailto:legal@bamboohealth.com

LyonJ5@michigan.gov

Notices sent in accordance with this Section 19.4 will be deemed effectively given:

(a) when received, if delivered by hand (with written confirmation of receipt); (b) when received, if sent by a nationally recognized overnight courier (receipt requested); (c) on the date received by e- mail (with confirmation of by automated receipt or electronic logs), if received during normal business hours of the recipient, and on the next business day, if received after normal business hours of the recipient; or (d) on the date received if sent by certified or registered mail, return receipt requested, postage prepaid.”

1.35 Section 19.5. Extended Purchasing Program is hereby deleted and replaced with the following:

“19.5 Reserved.”

1.36 Section 19.7 Entire Agreement, is hereby deleted and replaced with the

“Entire Agreement. This Contract, including all Statements of Work and other Schedules and Exhibits, constitutes the sole and entire agreement of the parties to this Contract with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, both written and oral, with respect to such subject matter. In the event of any conflict between the terms of this Contract and those of any Schedule, Exhibit or other document, the following order of precedence governs: (a) first, this Contract, excluding its Exhibits and Schedules; (b) second, Schedule B – Data Security Requirements; (c) third, Schedule F – Pricing; (d) fourth, Schedule A – Statement of Work; (d) fifth, each additional Statement of Work and (e) sixth, the other Exhibits and Schedules to this Contract expressly incorporated into this Contract. NO TERMS ON

CONTRACTOR’S INVOICES, ORDERING DOCUMENTS, WEBSITE, BROWSE-

WRAP, SHRINK-WRAP, CLICK-WRAP, CLICK-THROUGH OR OTHER NON-

NEGOTIATED TERMS AND CONDITIONS PROVIDED WITH ANY OF

THESERVICES, OR DOCUMENTATION HEREUNDER WILL CONSTITUTE A

PART OR AMENDMENT OF THIS CONTRACT OR IS BINDING ON THE STATE

OR ANY AUTHORIZED USER FOR ANY PURPOSE. ALL SUCH OTHER TERMS

AND CONDITIONS HAVE NO FORCE AND EFFECT AND ARE DEEMED

REJECTED BY THE STATE AND THE AUTHORIZED USER, EVEN IF ACCESS

TO OR USE OF SUCH SERVICE OR DOCUMENTATION REQUIRES

AFFIRMATIVE ACCEPTANCE OF SUCH TERMS AND CONDITIONS.”

1.37 Section 19.14 Nondiscrimination, is hereby deleted and replaced with the

“19.14 Nondiscrimination. Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., and Executive Directive 2019-09, Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex, height, weight, marital status, partisan considerations, any mental or physical disability, or genetic information that is unrelated to the person’s ability to perform the duties of a particular job or position.

Breach of this covenant is a material breach of the Contract.”

1.38 Section 19.15 Unfair Labor Practice, is hereby deleted and replaced with the following:

“19.15 Unfair Labor Practice. Under MCL 423.324, the State may void this Contract if the name of the Contractor, or the name of a subcontractor, manufacturer, or supplier of the Contractor, subsequently appears on the Unfair Labor Practice register compiled under MCL 423.322.

1.39 Section 19.16 Schedules is hereby deleted and replaced with the following:

“19.16 Schedules. All Schedules and Exhibits that are referenced herein and attached hereto are hereby incorporated by reference. The following Schedules and Exhibits are attached hereto and incorporated herein:

Schedule A Statement of Work

Schedule B Data Security Requirements

Schedule C Data Backup Plan Schedule D Data Conversion Plan Schedule E Business Continuity and Disaster Recovery Plan

Schedule F Pricing Schedule G Transition Plan Schedule H Insurance Schedule I Federal Provisions Addendum https://www.michigan.gov/whitmer/0,9309,7-387-90499_90704-486781--,00.html

2. Modifications to SCHEDULE A – Statement of Work

2.1 Section 1.103 ENVIRONMENT, is hereby deleted and replaced with the following:

“ 1.103 ENVIRONMENT

The links below provide information on the State’s Enterprise information technology (IT) policies, standards and procedures which includes security policy and procedures, eMichigan web development, and the State Unified Information Technology Environment (SUITE).

Contractor is advised that the State has methods, policies, standards and procedures that have been developed over the years. Contractor‘s system must conform to State IT policies and standards. All services and products provided must comply with all applicable State IT policies and standards, of which the publicly available ones are at: https://www.michigan.gov/dtmb/policies/it-policies.

The State’s security environment includes:

• DTMB Identity and Access Management

• MDTMB Single Login.

• DTMB provided SQL security database.

• Secured Socket Layers.

• SecureID (State Security standard for external network access and high risk Web systems)

MDTMB requires that its single - login security environment be used for all new client-server software development. Where software is being converted from an existing package, or a client-server application is being purchased, the security mechanism must be approved in writing by the State’s Project Manager and MDTMB Office of Enterprise Security.

SOM IT Environment Access

To the extent Contractor needs to access a State environment, Contractor must access State environments using one or more of the following methods:

• State provided VDI (Virtual Desktop Infrastructure) where compliant.

• State provided and managed workstation device.

• Contractor owned and managed workstation maintained to all State policies and standards.

• Contractor required interface with State Systems which must be maintained in compliance with State policies and standards as set forth in Schedule E – Data Security Requirements.

https://www.michigan.gov/dtmb/policies/it-policies

Contractor will not access State environments or State Systems from locations outside the United States or the jurisdiction territories of the United States.

ADA Compliance Contractor shall comply with and adhere to the Digital Accessibility Standards , including any more specific requirements set forth in an applicable Statement of Work.

eMichigan Web Application Development All software items provided by the Contractor must adhere to the State of Michigan Application/Site standards which can be found at https://www.michigan.gov/standards.

The State Unified Information Technology Environment (SUITE):

The Contractor employees will not have access to the State of Michigan’s network or IT resources for this project. Data will be pushed from the State to an Contractor-owned resource that is governed by a comprehensive set of policies and standards that adhere to HIPAA and NIST 800-53 control frameworks.

Identity and Access Management

The Contractor solution will provide a substitute to the SOM IT Identity and Access Management (IAM) environment (Milogin) as described in the State of Michigan Digital Strategy and Authoritative Policy below:, IAM consist of the following and is left for the purpose of ensuring the requirement of the substitue:

Authoritative Policy 1335 Information Technology Access Control Policy

Standard Number 1335.00.07 Identity, Credentialing, and Access Management Standard

Technical Procedure 1335.00.07.01Michigan Identity, Credentialing, and Access Management (MICAM) Procedure Under Review

Definitions For a Contractor Hosted Software Solution:

https://www.michigan.gov/standards http://www.michigan.gov/documents/dmb/1335_193161_7.pdf?20140815123131 http://www.michigan.gov/documents/dmb/1335_193161_7.pdf?20140815123131 http://inside.michigan.gov/dtmb/wr/psp/Documents/1335.00.07%20Identity%2C%20Credentialing%2C%20and%20Access%20Management.pdf http://inside.michigan.gov/dtmb/wr/psp/Documents/1335.00.07%20Identity%2C%20Credentialing%2C%20and%20Access%20Management.pdf http://inside.michigan.gov/dtmb/wr/psp/Documents/1335.00.07%20Identity%2C%20Credentialing%2C%20and%20Access%20Management.pdf

• Facilities – Physical buildings containing Infrastructure and supporting services, including physical access security, power connectivity and generators, HVAC systems, communications connectivity access and safety systems such as fire suppression.

• Infrastructure – Hardware, firmware, software, and networks, provided to develop, test, deliver, monitor, manage, and support IT services which are not included under Platform and Application.

• Platform – Computing server software components including operating system (OS), middleware (e.g., Java runtime, .NET runtime, integration, etc.), database and other services to host applications.

• Application – Software programs which provide functionality for end user and Contractor services.

• Storage – Physical data storage devices, usually implemented using virtual partitioning, which store software and data for IT system operations.

• Backup – Storage and services that provide online and offline redundant copies of software and data.

• Development - Process of creating, testing and maintaining software components.

Component Matrix

Name all contractor(s) and/or subcontractor(s) providing each contract component.

Facilities AWS Infrastructure AWS, New Relic, SumoLogic Platform AWS Application AWS Storage AWS Backup AWS Development MKS Vision Group

Disclosure of Subcontractors Contractor intends to utilize the following Subcontractors and Permitted Subcontractors:

New Relic is a Subcontractor.

AWS, SumoLogic, and MKS Vision Group are Permitted Subcontractors.

Contractor must disclose the following for each subcontractor:

The legal business name, address, telephone number of the subcontractor(s).

Amazon Web Services, Inc.

410 Terry Avenue North Seattle, WA 98109-5210

A description of subcontractor’s organization and the services it will provide and information concerning subcontractor’s ability to provide the Services.

Cloud hosting provider

The relationship of the subcontractor to the Contractor, including any previous relationship.

Cloud provider subcontractor(s).

Sumo Logic 855 Main St., Suite 100 Redwood City, CA 94063

1-800-LOG-SUMO

A description of subcontractor’s organization and the services it will provide and information concerning subcontractor’s ability to provide the Services.

Application logging and SIEM vendor.

The relationship of the subcontractor to the Contractor, including any previous

SaaS vendor subcontractor(s).

New Relic, Inc.

188 Spear St. Suite 100 San Francisco, CA 94105

(888) 643-8776

A description of subcontractor’s organization and the services it

Application monitoring vendor will provide and information concerning subcontractor’s ability to provide the Services.

The relationship of the subcontractor to the Contractor, including any previous

SaaS vendor.

subcontractor(s).

MKS Vision 6309 Fern Valley Pass, Suite 103 Louisville, KY 40228

(502) 749-9992

A description of subcontractor’s organization and the services it will provide and information concerning subcontractor’s ability to provide the Services.

Development staffing partner.

The relationship of the subcontractor to the Contractor, including any previous

Subcontractor

Data Retention and Removal

The Hosted Services must allow the State to retain all data for the entire length of the Contract. The Hosted Services must allow the State to delete, purge, or archive data, even data that may be stored off-line or in backups. The Hosted Services must allow the State to retrieve data, even data that may be stored off-line or in backups. Contractor will only dispose of, delete, or purge data as may be provided for in this Contract or with the prior written approval of the State.

Notwithstanding any provision in this Contract, if for any reason the State informs Contractor in writing that any data previously approved and/or scheduled for deletion or purging must not be deleted or purged, Contractor must ensure that such data is not deleted or purged until the State notifies the Contractor in writing that the data may be re-identified for future deletion and/or purging. The State must be able to access, retrieve, and/or use any data prior to it actually being deleted or purged.

2.2 In Section 1.201 CONTRACTOR STAFF, ROLES, AND RESPONSIBILITIES, subsection A. Contractor Staff – Key Personnel, the tables containing the Resource Name, Address, Email, and Phone information for the for the Contractor Security Officer, Project Manager/Single Point of Contact, Technical Subject Matter Expert and Client Relationship Manager (CRM) / Contractor Service Manager roles are hereby deleted and replaced with the following information:

Resource Name Brian Oldham Role Contractor Security Officer Key Personnel Yes Address 9901 Linn Station Rd

Louisville, KY 40223 Email broldham@bamboohealth.com Phone 502-815-5656

Resource Name Haley Alder Role Project Manager/Single Point of Contact Key Personnel Yes Address 9901 Linn Station Rd

Louisville, KY 40223 Email Halder@bamboohealth.com

Role Technical Subject Matter Expert Key Personnel Yes Address 9901 Linn Station Rd

Louisville, KY 40223

Role Client Relationship Manager (CRM) /

Contractor Service Manager Key Personnel Yes Address 9901 Linn Station Rd

Louisville, KY 40223

2.3 In Section 1.201 CONTRACTOR STAFF, ROLES, AND RESPONSIBILITIES, a new subsection C. Offshore Resources is hereby added after subsection B.4.

Additional Security and Background Check Requirements:

“C. Offshore Resources. Access to State Data by Offshore Resources is prohibited under this contract.

2.4 In Section 1.202 STATE STAFF, ROLES, AND RESPONSIBILITIES, the tables containing the Name, Agency/Division, and/or Title information for the State Project Manager, Subject Matter Experts, and Contract Administrator roles are hereby deleted and replaced with the following information:

State…