210000000223.pdf

STATE OF MICHIGAN

ENTERPRISE PROCUREMENT

DTMB

320 S Walnut Street Lansing, MI 48933 P.O. Box 30026, Lansing, MI 48909

CONTRACT CHANGE NOTICE

CONTRACT SUMMARY

MI Choice Information System Data Base and Reports (COMPASS

INITIAL EFFECTIVE DATE INITIAL EXPIRATION DATE INITIAL AVAILABLE OPTIONS EXPIRATION DATE

BEFORE

January 7, 2021 October 1, 2023 2 - 1 Year September 30, 2025

PAYMENT TERMS DELIVERY TIMEFRAME

ALTERNATE PAYMENT OPTIONS EXTENDED PURCHASING

MINIMUM DELIVERY REQUIREMENTS

N/A

P-Card Direct Voucher (PRC) Other Yes No

7322 Newman Blvd 2 Suite 100

Dexter MI 48130

Douglas A Zimmer

734-930-0855 doug@ciminc.com

CV0029386

CENTER FOR INFORMATION

MANAGEMENT INC

C O

N

TR

A C

TO

R

Anna Krupka

517-855-8801

DTMB

Various Various krupkaa@michigan.gov

C ontract

A dm inistrator Program M anagerSTA

TE

N/ANET 45

Change Notice Number 7 to

Contract Number 210000000223

DESCRIPTION OF CHANGE NOTICE

OPTION EXTENSIONLENGTH OF OPTION LENGTH OF EXTENSION REVISED EXP. DATE

CURRENT VALUE VALUE OF CHANGE NOTICE ESTIMATED AGGREGATE CONTRACT VALUE

0 Months 58 Months September 30, 2030

$3,464,160.00 $3,858,900.00 $7,323,060.00

DESCRIPTION

Effective 11/18/2025, this Contract is extended 58 months through a useful life extension and is increased by $3,858,900.00. The revised contract expiration date is 9/30/2030.

The following amendments are incorporated into this Contract per the attached:

Contract Terms Schedule A - Statement of Work Schedule B - Pricing Schedule D - Data Security Requirements Schedule D - Exhibit 1 - HIPAA Business Associate Agreement Schedule E - Disaster Recovery Plan Schedule G - Insurance Schedule H - Transition Plan

All other terms, conditions, specifications, and pricing remain the same. Per contractor and agency agreement, DTMB Central Procurement Services approval, and State Administrative Board approval on 11/18/2025.

AGENCY NAME PHONE EMAIL

MDHHS Heather Hill 517-243-5833 HillH3@michigan.gov

DTMB John Moore 517-331-5065 MooreJ7@michigan.gov

Program Managers for

Multi-Agency and Statewide Contracts

CHANGE NOTICE NO. 7 TO CONTRACT NO. MA210000000223

Michigan.gov/MiProcurement

Change Notice 7 to Contract MA210000000223 The purpose of this Change Notice is to extend the existing Contract #210000000223 as a Useful Life Extension, and modify the Contract to include updated security requirements, contact information, and other terms and conditions described herein:

Now, therefore, the parties agree to incorporate the following changes to the Contract:

A. Modifications to the State of Michigan Contract Terms

(1) The two paragraphs in the preamble, which sets forth the parties, term, and option periods, is hereby deleted and replaced with the following

“This Software as a Service Contract (this “Contract”) is agreed to between the State of Michigan (the “State”) and Center for Information Management (“Contractor”), a MICHIGAN CORPORATION. This Contract is effective on October 1, 2020 (“Effective Date”), and unless earlier terminated, will expire on September 30, 2030 (the “Term”).

This Contract cannot be renewed.

(2) The following definitions are hereby added into Section 1. Definitions–

““Access” means (1) the ability and means to enter a restricted or locked area, room, or physical container containing State Data; or (2) the ability and means to communicate with or otherwise interact with a system, to use system resources to handle information, to gain the information or knowledge of the information the system contains, or to control system components and functions (including physical or technical controls, or having the ability to modify or bypass any or all security controls). ”

““Customization” means State-specific changes to the Service Software's underlying Source Code or structural data model changes.”

““Deliverables” means the Software, Documentation, and all other documents and other materials that Contractor is required to or otherwise does provide to the State under this Contract and otherwise in connection with any Services, including all items specifically identified as Deliverables in a Statement of Work and all Work Product. ”

““Deposit Material” refers to material required to be deposited pursuant to Section 20.”

““Digital Accessibility Standards” means the accessibility standards provided in the SOM Digital Standards, located at https://www.michigan.gov/standards. ”

““Digital Deliverables” means all Deliverables, information, and/or content created, provided, or made available by Contractor under this Contract in a digital format, including but not limited to, websites, applications, software, mobile applications, text, images, sounds, videos, controls, animations, links, and documents (including files in the following formats: PDF, word processing, presentation, and spreadsheet).”

““Offshore Resources” mean resources, including Contractor Personnel, outside of the United States or its territories.”

https://www.michigan.gov/som/footer/policies/som-applications-and-site-standards

““Operating Environment” means, collectively, the platform, environment and conditions on, in or under which the Software is intended to be installed and operate, as set forth in a Statement of Work, including such structural, functional and other features, conditions and components as hardware, operating software, system architecture, configuration, computing hardware, ancillary equipment, networking, software, firmware, databases, data, and electronic systems (including database management systems). ”

““Permitted Subcontractor” means any Subcontractor that will have Access to or have the ability to control access to State Data or both.”

““Pricing Schedule” means the schedule attached as Schedule B.”

““Solution” means Deliverables and Services singularly or in any combination thereof, as applicable, set forth in a Statement of Work.”

““State Materials” means all materials and information, including but not limited to documents, data, know-how, ideas, methodologies, specifications, software, hardware, content and technology, in any form or media, directly or indirectly provided or made available to Contractor by or on behalf of the State in connection with this Contract.”

““Third-Party Components” means all components, including open-source components, that are included in or used in connection with the Software and are specifically identified by Contractor in the Contractor’s Software Bill of Materials, in an applicable Statement of Work or elsewhere in this Contract, or as otherwise required by this Contract, including without limitation as part of the State’s Security Accreditation Process defined in Schedule D – Data Security Requirements.”

““Work Product” means everything made or created by Contractor, regardless of whether created, developed, or generated by a human, non-human, or some combination thereof, specifically and solely for the State and which is not generally available to Contactor’s other customers, that Contractor is required to, or otherwise does, provide to the State under this Contract including but not limited to Customizations, application programming interfaces, computer scripts, macros, user interfaces, reports, project management documents, forms, templates, and other State-specific documents and related materials together with all ideas, concepts, processes, and methodologies developed in connection with this Contract whether or not embodied in this Contract.”

(3) In Section 1. Definitions, the definition of “Service Software” hereby deleted and replaced with the following:

““Service Software” or “Software” means any and all software applications and any third-party or other software and Customizations, and all new versions, maintenance releases, updates, revisions, improvements and modifications of the foregoing, that Contractor provides remote access to and use of as part of the Services.”

(4) In Section 1. Definitions, the definition of “Statement of Work” is hereby deleted and replaced with the following:

““Statement of Work” means any statement of work entered into by the parties and incorporated into this Contract. The initial Statement of Work is attached as Schedule A.”

(5) In Section 1. Definitions, the definition of “User Data” is hereby deleted and replaced with the following:

““User Data” means all data, queries, prompts, information and other content of any type and in any format, medium or form, whether audio, visual, digital, screen, GUI or other, that is input, uploaded to, placed into or collected, stored, Processed, generated or output by any user, device, system or network by or on behalf of the State, including but not limited to any and all works, inventions, data, analyses, information that identifies State or State’s intended users’ devices or equipment, location information, or other information and materials resulting from any use of the Software by or on behalf of the State’s intended users under this Contract, even if not input by a user.”

(6) In Section 2.1 Services, subsection (a) is hereby deleted and replaced with the following:

“(a) the hosting, management and operation of the Service Software and other services for remote electronic access and use by the State and its Authorized Users (“Hosted Services”) as described in one or more written Statements of Work referencing this Contract, including all Specifications set forth in such Statements of Work, which, upon their execution will be attached to this Contract and by this reference are incorporated in and made a part of this Contract;”

(7) In Section 2.1 Services, subsection (f) is hereby deleted and replaced with the following:

“(f) such other services and provide any Deliverables as may be specified in this Contract.”

(8) In Section 2.2 Change Notices, subsection (a) is hereby deleted and replaced with the following:

“(a) Any modifications or changes to this Contract will be effective only if and when memorialized in a mutually agreed written change notice (“Change Notice”) signed by both Parties, provided, however, that for any Services provided on a limited basis (for example, on a per user, server, CPU or named-user basis), the State may, at any time, increase or decrease the number of its licenses hereunder subject to a corresponding forward-going adjustment of the Fees to reflect these changes in accordance with the pricing set forth in the applicable Statement of Work.”

(9) In Section 3. License Grant and Restrictions, a new subsection 3.5 is hereby added to this Contract:

“3.5 Ownership Rights in Service Software

(a) For purposes of this Section 3.5 only, the term “Service Software” does not include Customizations.

(b) Subject to the rights and licenses granted by Contractor in this Contract:

(i) Contractor reserves and retains its entire right, title, and interest in and to all Intellectual Property Rights arising out of or relating to the Service Software; and

(ii) none of the State or Authorized Users acquire any ownership of Intellectual Property Rights in or to the Service Software or Documentation as a result of this Contract.

(c) As between the State, on the one hand, and Contractor, on the other hand, the State has, reserves, and retains, sole and exclusive ownership of all right, title and interest in and to State Materials and User Data, including all Intellectual Property Rights arising therefrom or relating thereto.”

(10) In Section 3. License Grant and Restrictions, a new subsection 3.6 is hereby added to this Contract:

“3.6 Ownership Rights in Work Product. The State is and will be the sole and exclusive owner of all right, title, and interest in and to all Work Product created, developed, or generated exclusively for the State under this Contract, including all Intellectual Property Rights. In furtherance of the foregoing:

(a) Contractor will create all Work Product as work made for hire as defined in Section 101 of the Copyright Act of 1976; and

(b) to the extent any Work Product does not qualify as, or otherwise fails to be, work made for hire, Contractor hereby:

(i) assigns, transfers, and otherwise conveys to the State, irrevocably and in perpetuity, throughout the universe, all right, title, and interest in and to such Work Product, including all Intellectual Property Rights; and

(ii) irrevocably waives claims Contractor may now or hereafter have in any jurisdiction to so-called “moral rights” or rights of droit moral with respect to the Work Product.”

(11) In Section 3. License Grant and Restrictions, a new subsection 3.7 is hereby added to this Contract:

“3.7 Third-Party Components. At least 30 days prior to adding new third-party components, Contractor will provide the State with notification information identifying and describing the addition. Throughout the Term, on an annual basis, Contractor will provide updated information identifying and describing any third-party components included in the Software. Contractor is responsible for ensuring that all Third-Party Components are properly licensed for the State’s use. Contractor will utilize only currently supported versions of all third-party or open source components and will notify the State when not using the most recently published third-party and open source components”

(12) Section 7.3 Transition Responsibilities is hereby deleted and replaced in its entirety with the following:

“7.3 Transition Responsibilities. Upon termination or expiration of this Contract for any reason, Contractor must, for a period of time specified by the State (not to exceed 90 calendar days; the “Transition Period”), provide all reasonable transition assistance requested by the State, to allow for the expired or terminated portion of the Contract to continue without interruption or adverse effect, and to facilitate the orderly transfer of the Services to the State or its designees. Such transition assistance may include but is not limited to: (a) continuing to perform the Services at the established Statement of Work rates; (b) taking all reasonable and necessary measures to transition performance of the work, including all applicable Services to the State or the State’s designee; (c) taking all necessary and appropriate steps, or such other action as the State may direct, to preserve, maintain, protect, or return to the State all State Data; and (d) preparing an accurate accounting from which the State and Contractor may reconcile all outstanding accounts (collectively, the “Transition Responsibilities”). Further, Contractor will follow the transition plan attached as Schedule H. The Term of this Contract is automatically extended through the end of the Transition Period.”

(13) Section 9.1 Fees is hereby deleted and replaced in its entirety with the following:

“9.1 Fees. Subject to the terms and conditions of this Contract, the applicable Statement of Work, and the Service Level Agreement, the State shall pay the fees set forth in the applicable Statement of Work or Pricing Schedule, subject to such increases and adjustments as may be permitted pursuant to Section 9.2 (“Fees”).”

(14) In Section 10.1. Ownership, new subsections (c) and (d) are hereby added to the end of subsection(b):

“; and (c) all data made available to Contractor for the purpose of or in relation to the provision of the Solution, including but not limited to all text, sound, video, image files, or software” and (d) Work Product”.

(15) Section 10.2 Contractor Use of State Data is hereby deleted and replaced in its entirety with the following:

“10.2 Contractor Use of State Data. Contractor is provided a limited license to State Data for the sole and exclusive purpose of providing the Services, including a license to collect, process, store, generate, and display State Data only to the extent necessary in the provision of the Services. Contractor must: (a) keep and maintain State Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Contract, applicable State PSP’s, and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose State Data solely and exclusively for the purpose of providing the Services, such use and disclosure being in accordance with this Contract, any applicable Statement of Work, and applicable law; (c) not use, sell, rent, transfer, distribute, or otherwise disclose or make available State Data for Contractor’s own purposes or for the benefit of anyone other than the State without the State’s prior written consent; and (d) keep and maintain State Data in the United States. .

For the avoidance of doubt, Offshore Resources are not permitted under this Contract. This Section 10.2 survives termination or expiration of this Contract.”

(16) Section 11 Accessibility Requirements is hereby deleted and replaced in its entirety with the following:

“11. Accessibility Requirements.

11.1 All Digital Deliverables must conform to the Digital Accessibility Standards.

Throughout the Term of this Contract, Contractor must:

(a) ensure that no changes made by Contractor to any Digital Deliverables will have any adverse effect on conformance to the Digital Accessibility Standards; and

(b) comply with plans and timelines approved by the State to remediate issues and achieve conformance with the Digital Accessibility Standards in the event of any deficiencies, at its sole cost and expense.

11.2 Contractor must, upon the State’s written request, provide Digital Deliverables in one or more alternative formats and within timeframes specified by the State.

11.3 State of Michigan Digital Standards for Websites and Applications Review. Throughout the Term, Contractor must, upon request from the State, submit documentation or other information regarding accessibility and Contractor’s compliance with the Digital Accessibility Standards, including without limitation, a completed product accessibility template, including any Information Technology Industry Council Voluntary Product Accessibility Template or VPAT® and/or a description of the evaluation methods used to support the Digital Accessibility Standards conformance claims, including, if applicable, any third-party testing.

Prior to Digital Deliverables being accepted, put into production, or as otherwise required by the State, the State may conduct a review to assess accessibility and compliance with the State’s Digital Accessibility Standards and Contractor must at its sole cost and expense, remediate all issues resulting from any such review in a manner and timeframe approved in writing by the State.

11.4 Contractor must, without limiting Contractor’s obligations of indemnification as further described in this Contract, indemnify, defend, and hold harmless the State for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the State arising out of its failure to comply with the foregoing accessibility standards

11.5 Failure to comply with the requirements in this Section 11 shall constitute a material breach of this Contract.”

(17) In Section 12.1. Meaning of Confidential Information, subsection (e) is hereby deleted and replaced with the following:

“(e) publicly available when received, or thereafter became publicly available (other than through any unauthorized disclosure).”

(18) Section 12.5 Surrender of Confidential Information is hereby deleted and replaced in its entirety with the following:

“12.5 Surrender of Confidential Information. Upon termination or expiration of this Contract or a Statement of Work, in whole or in part, each party must, within 5 Business Days from the date of termination or expiration, return to the other party any and all Confidential Information received from the other party, or created or received by a party on behalf of the other party, which are in such party’s possession, custody, or control. Upon confirmation from the State, of receipt of all data, Contractor must permanently sanitize or destroy the State’s Confidential Information, including State Data, from all media including backups using National Security Agency (“NSA”) and/or National Institute of Standards and Technology (“NIST”) (NIST Guide for Media Sanitization 800-88) data sanitization methods or as otherwise instructed by the State. If the State determines that the return of any Confidential Information is not feasible or necessary, Contractor must destroy the Confidential Information as specified above. The Contractor must certify the destruction of

Confidential Information (including State Data) in writing within 5 Business Days from the date of confirmation from the State.”

(19) In Section 17.2 Software and Service Warranties, subsection (c) is hereby deleted and replaced in its entirety with the following:

“(c) as accessed and used by the State or any Authorized User in accordance with this Contract and the Specifications, the Hosted Services, Service Software, Documentation and all other Services and Deliverables provided by Contractor under this Contract will not infringe, misappropriate or otherwise violate any Intellectual Property Right or other right of any third party;”

(20) In Section 17.2 Software and Service Warranties, subsection (g) is hereby deleted and replaced in its entirety with the following:

“(g) the Contractor Systems, Service Software, and Services are and will remain free of Harmful Code and as provided by Contractor, the Service Software and Hosted Services do not and will not at any time during the Term contain any third party or open-source components that operate in such a way that it is developed or compiled with or linked to any third party or open-source components, other than Third Party Components;”

(21) Section 17.4 Work Product Representations and Warranties is hereby added to this Contract:

“17.4 Work Product Representations and Warranties: Contractor further represents and warrants to the State that:

(a) Contractor has all necessary rights, title, and/or licenses required to create, develop, or generate Work Product and to transfer all ownership rights in Work Product to the State as set forth in Section 7.

(b) Contractor has verified that no third-party intellectual property has been incorporated into any Work Product created, developed, or generated by any non-human means used by Contractor.”

(22) Section 16. Insurance, including subsection 16.1 and its subsections, is hereby deleted and replaced with the following:

“16. Insurance. Contractor must maintain the minimum insurances identified in the Insurance Schedule attached as Schedule G.”

(23) Section 20. Software Escrow, is hereby deleted and replaced with the following:

“20.1 Escrow Contract. The parties may enter into a separate intellectual property escrow agreement. Such escrow agreement will govern all aspects of Source Code escrow and release.

The cost of the escrow will be the sole responsibility of Contractor.

20.2 Deposit. Within 30 Business Days of the effective date of the escrow agreement, Contractor will deposit with the escrow agent, pursuant to the procedures of the escrow agreement, the Source Code for the Software, as well as the Documentation and names and contact information for each author or other creator of the Software. Promptly after release of any update, upgrade, patch, bug fix, enhancement, new version, or other revision to the Software, Contractor will deposit updated Source Code, documentation, names, and contact information with the escrow agent (all of which is collectively referred to herein as “Deposit Material”).

20.3 Verification. At the State’s request and expense, the escrow agent may at any time verify the Deposit Material, including without limitation by compiling Source Code, comparing it to the Software, and reviewing the completeness and accuracy of all material. If the Deposit Material does not conform to the requirements of Subsection 20.2 above:

(a) Contractor will promptly deposit conforming Deposit Material; and

(b) Contractor will pay the escrow agent for subsequent verification of the new Deposit Material. Any breach of the provisions of this Section 20 will constitute material breach of this Contract, and no further payments will be due from the State until such breach is cured, in addition to any other remedies the State may have.

20.4 Deposit Material License. Contractor hereby grants the State a license to use, reproduce, and create derivative works from the Deposit Material, provided the State may not distribute or sublicense the Deposit Material or make any use of it whatsoever except for such internal or governmental uses as necessary to maintain and support the Software. Copies of the Deposit Material created or transferred pursuant to this Contract are licensed, not sold, and the State receives no title to or ownership of any copy or of the Deposit Material itself. The Deposit Material constitutes Confidential Information of Contractor pursuant to Section 12 (Confidentiality) of this Contract (provided no provision of Subsection 12.5 calling for return of Confidential Information upon termination of this Contract will apply to the Deposit Material).”

(24) Section 22.2 Relationship of the Parties, is hereby deleted and replaced with the following:

“22.2 Relationship of the Parties. The relationship between the parties is that of independent contractors. Nothing contained in this Contract is to be construed as creating any agency, partnership, joint venture or other form of joint enterprise, employment or fiduciary relationship between the parties, and neither party has authority to contract for or bind the other party in any manner whatsoever. Nothing contained in this Contract is intended nor is to be construed as creating any requirements contract with Contractor, nor does it provide Contractor with a right of first refusal for any future work. This Contract does not restrict the State or its agencies from acquiring similar, equal, or a like Solution from other sources.”

(25) Section 22.4 Notices, is hereby deleted and replaced with the following:

“19.4. Notices. All notices, requests, consents, claims, demands, waivers and other communications hereunder, other than routine communications having no legal effect, must be in writing and addressed to the parties as follows (or as otherwise specified by a party in a notice given in accordance with this Section):

If to Contractor:

Douglas Zimmer

7322 Newman Blvd Bldg 2 Suite 100

Dexter, MI 48130 doug@ciminc.com

If to the State:

Anna Krupka

320 S. Walnut Street 2nd Floor

Lansing, MI 48933

KrupkaA@michigan.gov

Notices sent in accordance with this Section 19.4 will be deemed effectively given: (a) when received, if delivered by hand (with written confirmation of receipt); (b) when received, if sent by a nationally recognized overnight courier (receipt requested); (c) on the date received by e- mail (with confirmation of by automated receipt or electronic logs), if received during normal business hours of the recipient, and on the next business day, if received after normal business hours of the recipient; or (d) on the date received if sent by certified or registered mail, return receipt requested, postage prepaid.”

(26) Section 22.8 Amendment, Modification and Waiver is hereby deleted and replaces in its entirety with the following:

“22.8 Amendment and Modification; Waiver. This Contract may only be amended, modified or supplemented by a properly executed Change Notice signed by each party’s Contract Administrator. No waiver by any party of any of the provisions hereof is effective unless explicitly set forth in writing and signed by the party so waiving. Except as otherwise set forth in this Contract, no failure to exercise, or delay in exercising, any right, remedy, power or privilege arising from this Contract will operate or be construed as a waiver thereof; nor will any single or partial exercise of any right, remedy, power or privilege hereunder preclude any other or further exercise thereof or the exercise of any other right, remedy, power or privilege.”

(27) Section 22.12 Nondiscrimination is hereby deleted and replaced in its entirety with the following:

“22.12 Nondiscrimination. Under the Elliott-Larsen Civil Rights Act, 1976 PA 453, MCL 37.2101, et seq., the Persons with Disabilities Civil Rights Act, 1976 PA 220, MCL 37.1101, et seq., and Executive Directive 2019-09, Contractor and its subcontractors agree not to discriminate against an employee or applicant for employment with respect to hire, tenure, terms, conditions, or privileges of employment, or a matter directly or indirectly related to employment, because of race, color, religion, national origin, age, sex, height, weight, https://www.michigan.gov/whitmer/0,9309,7-387-90499_90704-486781--,00.html marital status, partisan considerations, any mental or physical disability, or genetic information that is unrelated to the person’s ability to perform the duties of a particular job or position. Breach of this covenant is a material breach of the Contract.”

(28) Section 22.13 Unfair Labor Practice is hereby deleted and replaced in its entirety with the following:

“22.13 Unfair Labor Practice. Under MCL 423.324, the State may void this Contract if the name of the Contractor, or the name of a subcontractor, manufacturer, or supplier of the Contractor, subsequently appears on the Unfair Labor Practice register compiled under

MCL 423.322.”

(29) Section 22.14 Schedules is hereby deleted and replaced with the following:

“22.14 Schedules. All Schedules and Exhibits that are referenced herein and attached hereto are hereby incorporated by reference. The following Schedules are attached hereto and incorporated herein:

Schedule A Statement of Work

Schedule B Pricing

Schedule C Service Level Agreement

Schedule D Data Security Requirements

Schedule E Disaster Recovery Plan

Schedule F

Federal Provisions Addendum

Schedule G

Insurance

Schedule H

Transition Plan

(30) Section 22.18 Entire Agreement is hereby deleted and replaced in its entirety with the following:

“22.18 Entire Agreement. This Contract, including all Statements of Work and other Schedules and Exhibits, which are hereby expressly incorporated, constitutes the sole and entire agreement of the parties to this Contract with respect to the subject matter contained herein, and supersedes all prior and contemporaneous understandings and agreements, both written and oral, with respect to such subject matter. In the event of any conflict between the terms of this Contract and those of any Schedule, Exhibit or other document, the following order of precedence governs: (a) first, this Contract, excluding its Exhibits and Schedules; (b) second, Schedule D – Data Security Requirements; (c) third, Schedule A – Statement of Work; (d) fourth, each additional Statement of Work and (e) fifth, the remaining Exhibits and Schedules to this Contract. NO TERMS ON CONTRACTORS

INVOICES, WEBSITE, BROWSE-WRAP, SHRINK-WRAP, CLICK-WRAP, CLICK-THROUGH OR

OTHER NON-NEGOTIATED TERMS AND CONDITIONS PROVIDED WITH ANY OF THE

SERVICES, OR DOCUMENTATION HEREUNDER WILL CONSTITUTE A PART OR

AMENDMENT OF THIS CONTRACT OR IS BINDING ON THE STATE OR ANY AUTHORIZED

USER FOR ANY PURPOSE. ALL SUCH OTHER TERMS AND CONDITIONS HAVE NO FORCE

AND EFFECT AND ARE DEEMED REJECTED BY THE STATE AND THE AUTHORIZED USER,

EVEN IF ACCESS TO OR USE OF SUCH SERVICE OR DOCUMENTATION REQUIRES

AFFIRMATIVE ACCEPTANCE OF SUCH TERMS AND CONDITIONS.”

B. Modifications to SCHEDULE A – Statement of Work

(1) In Section 1 DEFINITIONS, the following is hereby added to the end of the definition of Nursing Facility Transition:

“Nursing Facility Transition and Community Transition Services have the same meaning.

Going forward these services will be referred to as Community Transition Services.”

(2) The following is hereby added to the end of Section 3 PURPOSE:

The work is largely oriented to continuation of current operations that meet the needs of

MDHHS.

Services

1) Provide access to data maintained by CIM for MI Choice, Nursing Facility Transition, Clearinghouse, MI Choice waiting list, and Critical incidents reporting to MDHHS and its contracted entities

2) Transfer MI Choice and MI Choice waiting list data to the Data Warehouse weekly

3) Provide access to statewide reports including enrollment reports, quality indicators, waiting list, assessments, contact notes, and other data needed to assist with the compilation of the CMS 372 Report

4) Update and maintain NFT Portal for approval of individuals receiving transition services and prior authorization of those services

5) Update and maintain critical incident database for MI Choice, MI Health Link, and Community Transition Service programs

6) Update and maintain case review features and access to assist MDHHS and contractors in clinical quality assurance reviews

7) Update, maintain, and support Clearinghouse features for non-MSB customers to submit data for inclusion in the Data Warehouse

8) Update and maintain algorithm, software features and reports for significant support participants (SSP)

9) Process, update, and maintain Institute of Gerontology export files required by State’s interRAI agreement

10) Provide support to MDHHS staff in monitoring/discovery of issues in MDHHS systems that impact capitation payments

(3) Section 4 SPECIFIC STANDARDS is hereby deleted and replaced with the following:

4. SPECIFIC STANDARDS

IT Policies, Standards, and Procedures (PSP)

Contractors are advised that the State has methods, policies, standards and procedures that have been developed over the years. Contractors are expected to provide proposals that conform to State IT policies and standards. Contractor, and all services and deliverables provided pursuant to the Contract must comply with all applicable State IT policies and standards, the requirements of Schedule D – Data Security Requirements and Schedule E – Disaster Recovery Plan.

Look and Feel Standards

All software items provided by the Contractor must adhere to the State of Michigan Application/Site standards which can be found at https://www.michigan.gov/standards

ADA Compliance

The State is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted standards and procedures regarding accessibility requirements for websites and software applications. All websites, applications, software, and associated content and documentation provided by the Contractor as part of the Solution must comply with the Digital Accessibility Standards.”

For a Contractor Hosted Software Solution:

Definitions:

Facilities – Physical buildings containing Infrastructure and supporting services, including physical access security, power connectivity and generators, HVAC systems, communications connectivity access and safety systems such as fire suppression.

Infrastructure – Hardware, firmware, software, and networks, provided to develop, test, deliver, monitor, manage, and support IT services which are not included under Platform and Application.

Platform – Computing server software components including operating system (OS), middleware (e.g., Java runtime, .NET runtime, integration, etc.), database and other services to host applications.

Application – Software programs which provide functionality for end user and Contractor services.

https://www.michigan.gov/standards

Storage – Physical data storage devices, usually implemented using virtual partitioning, which store software and data for IT system operations.

Backup – Storage and services that provide online and offline redundant copies of software and data.

Development - Process of creating, testing and maintaining software components.

Component Matrix

Name all contractor(s) and/or subcontractor(s) including IT service providers for each contract component.

Facilities CIM and 123net (colocation services at their Southfield data center)

Infrastructure CIM

Platform CIM

Application CIM

Storage CIM

Backup CIM

Development CIM

CIM contracts with 123net for use of three data center racks and associated services for uninterruptible power supplies, redundant Internet access, equipment cooling, and overall building security systems. On rare occasions, 123net may provide remote management on servers so that CIM engineers do not need to travel to data center for simple reboots, power confirmations, and the like.

Disclosure of Permitted Subcontractors

Contractor intends to utilize the following Permitted Subcontractors:

Contractor must disclose the following for each Permitted Subcontractors listed above:

The legal business name, address, telephone number of the subcontractor(s).

123Net

A description of subcontractor’s organization and the services it will provide and information concerning subcontractor’s ability to provide the Services.

123Net is a data center operator who provides CIM with co-location services to support the Production environment of COMPASS application. They have been In business for 25 years and have three separate data centers across Michigan.

The relationship of the subcontractor to the Contractor, including any previous relationship.

CIM has a multi-year contract with 123Net to provide co-location services (three racks in their Southfield data center), hands-on services for minor server maintenance work, a dedicated high speed fiber network connection between their data center and CIM offices, and IP-based phone services.

(4) Section 6 ACCESS CONTROL AND AUTHENTICATION, is hereby deleted and replaced with the following:

6. ACCESS CONTROL AND AUTHENTICATION

The Contractor’s solution must implement identity federation with the State’s MiLogin IT Identity and Access Management (IAM) environment as described in the State of Michigan Administrative Guide (1340.00.020.08 Enterprise Identity and Access Management Services Standard (michigan.gov) .

To support federation with the SOM MILogin solution, the Contractor’s solution must support SAML, OpenID or OAuth federated identity protocols.

Solutions running within the States internally managed IT environment may be suitable for integration with the State’s Active Directory services as identified in the

1340.00.020.08 standard.

Contractor to complete migration to the new system by the end of year one of the contract extension 9/30/2026.

(5) Section 7 DATA RETENTION, is hereby deleted and replaced with the following:

7. DATA RETENTION AND REMOVAL

The State has legal obligations to retain, dispose, and retrieve State Data along with obligations to manage and secure State Data. To meet these obligations, the Solution must allow the State to:

1) retain all data for the entire length of the Contract.

2) delete its data or request the deletion of its data, even data that may be stored offline or in backups.

https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400002008-Enterprise-Identity-and-Access-Management-EIAM-Services-Standard.pdf https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400002008-Enterprise-Identity-and-Access-Management-EIAM-Services-Standard.pdf https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT-Policy/13400002008-Enterprise-Identity-and-Access-Management-EIAM-Services-Standard.pdf

3) transfer its data back to the State or to a new vendor or new solution.

4) transfer its data to the Archives of Michigan as may be required by a retention and disposal schedule.

5) retrieve data, even data that may be stored offline or in backups.

Except as otherwise stated in the Contract, Contractor will not dispose of, delete, or destroy State Data without the prior written approval of the State.

(6) In Section 14 CONTRACTOR KEY PERSONNEL, the subsection “Contractor Security Officer” is hereby deleted and replaced with the following:

Contractor Security Officer. Contractor resource who is responsible to respond to State inquiries regarding the security of the Contractor’s Solution. This person must have sufficient knowledge of the security of the Contractor Solution and the authority to act on behalf of Contractor in matters pertaining thereto. Contractor must inform the State of any change to this resource.

Contractor Security Officer

Name: Wes Tapp

Address: 7322 Newman Blvd. Bldg. 2 Suite 100

Phone: 734-930-0855

Email: wes@ciminc.com

C. Modifications to SCHEDULE B – Pricing

The following new sections: “Pricing for the 58 Month Period starting on December 1, 2025”, “Rate Card for Ancillary Professional Services starting on December 1, 2025”, and “Travel and Expenses” for pricing starting on December 1, 2025 are hereby added to Schedule B – Pricing:

Pricing for the 58 Months- Period starting on December 1, 2025

Contractor’s charges for each year starting on October 1, 2026, are detailed in the following chart and divided between Operations and Maintenance funding categories.

Total Operations Maintenance

58 Month Period starting on December 1, 2025 mailto:ben@ciminc.com

Year 1 FY26 $600,000 $120,000 $480,000 12/1/2025 - 9/30/2026 Year 2 FY27 $756,000 $151,200 $604,800 10/1/2026 - 9/30/2027 Year 3 FY28 $793,900 $158,780 $635,120 10/1/2027 - 9/30/2028 Year 4 FY29 $833,600 $166,720 $666,880 10/1/2028 - 9/30/2029 Year 5 FY30 $875,400 $175,080 $700,320 10/1/2029 - 9/30/2030 Totals $3,858,900 $771,780 $33,087,120

Rate Card for Ancillary Professional Services starting on December 1, 2025

Resource On-Shore and Off-Site

Hourly Rate Business Analyst $90 Full-Stack Developer $150 Database Administrator $150 Technical Analyst $90 Project Manager $180

Travel and Expenses

The State does not pay for overtime or travel expenses.

D. OTHER SCHEDULES

(1) SCHEDULE C – Service Level Agreement remains unchanged and in full force and effect.

(2) SCHEDULE D - Data Security Requirements is hereby deleted and replaced with the new Schedule D - Data Security Requirements attached to this Change Notice and incorporated into this Contract.

(3) SCHEDULE D – EXHIBIT 1 - HIPAA BUSINESS ASSOCIATE AGREEMENT

attached to this Change Notice is hereby added to and incorporated into this Contract.

(4) SCHEDULE E - Disaster Recovery Plan is hereby deleted and replaced with the new Schedule E – Disaster Recovery Plan is on file with DTMB Agency Services and incorporated into this Contract.

(5) SCHEDULE F – Federal Provisions Addendum remains unchanged and in full force and effect.

(6) SCHEDULE G – Insurance attached to this Change Notice is hereby added to and incorporated into this Contract.

(7) SCHEDULE H – Transition Plan attached to this Change Notice is hereby added to and incorporated into this Contract

(8) All other terms and conditions of this Contract, including all other Statements of Work and other Schedules and Exhibits, remain unchanged and in full force and effect.

SCHEDULE D – DATA SECURITY REQUIREMENTS

1. Definitions. For purposes of this Schedule, the following terms have the meanings set forth below. All initial capitalized terms in this Schedule that are not defined in this Schedule shall have the respective meanings given to them in the Contract.

“Contractor Security Officer” has the meaning set forth in Section 2 of this Schedule.

“FedRAMP” means the Federal Risk and Authorization Management Program, which is a federally approved risk management program that provides a standardized approach for assessing and monitoring the security of cloud products and services.

“FISMA” means The Federal Information Security Modernization Act of 2014 (Pub.L. No. 113-283 (Dec. 18, 2014.).

“Hosting Provider” means any Permitted Subcontractor that is providing any or all of the Hosted Services and/or Operating Environment under this Contract.

“NIST” means the National Institute of Standards and Technology.

“PCI” means the Payment Card Industry.

“PSP” or “PSPs” means the State’s IT Policies, Standards and Procedures.

“SSAE” means Statement on Standards for Attestation Engagements.

“Security Accreditation Process” has the meaning set forth in Section 6 of this Schedule

2. Security Officer. Contractor will appoint a Contractor employee to respond to the State’s inquiries regarding the security of the Solution who has sufficient knowledge of the security of the Solution and the authority to act on behalf of Contractor in matters pertaining thereto (“Contractor Security Officer”).

3. Contractor Responsibilities. Contractor is responsible for establishing and maintaining a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that is designed to:

(a) ensure the security and confidentiality of the State Data;

(b) protect against any anticipated threats or hazards to the security or integrity of the State Data;

(c) protect against unauthorized disclosure, access to, or use of the State Data;

(d) ensure the proper disposal of any State Data in Contractor’s or its subcontractor’s possession; and

(e) ensure that all Contractor Personnel comply with the foregoing.

The State has established Information Technology (IT) PSPs to protect IT resources under the authority outlined in the overarching State 1305.00 Enterprise IT Policy. In no case will the safeguards of Contractor’s data privacy and information security program be less stringent than the safeguards used by the State, and Contractor must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies.

This responsibility also extends to all service providers and subcontractors with access to State Data or an ability to impact the Solution. Contractor responsibilities are determined from the PSPs based on the services being provided to the State, the type of IT solution, and the applicable laws and regulations.

4. Acceptable Use Standard. To the extent that Contractor has access to the State’s IT environment, Contractor must comply with the State’s Acceptable Use Standard, see https://www.michigan.gov/dtmb/-/media/Project/Websites/dtmb/Law-and-Policies/IT- Policy/13400013002-Acceptable-Use-of-Information-Technology-Standard.pdf. All Contractor Personnel will be required, in writing, to agree to the State’s Acceptable Use Standard before accessing State systems or Data. The State reserves the right to terminate Contractor’s and/or subcontractor(s) or any Contractor Personnel’s access to State Systems if the State determines a violation has occurred.

5. Protection of State’s Information. Throughout the Term and at all times in connection with its actual or required performance of the Services, Contractor will:

5.1 If Hosted Services are provided by a Hosting Provider, ensure each Hosting Provider maintains FedRAMP authorization for all Hosted Services environments throughout the Term, and in the event a Hosting Provider is unable to maintain FedRAMP authorization, the State, at its sole discretion, may either a) require the Contractor to move the Software and State Data to an alternative Hosting Provider selected and approved by the State at Contractor’s sole cost and expense without any increase in Fees, or b) immediately terminate this Contract for cause;

5.2 for Hosted Services provided by the Contractor, maintain either a FedRAMP authorization or an annual SSAE 18 SOC 2 Type II audit based on State required NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.3 ensure that the Software and State Data is securely stored, hosted, supported, administered, Accessed, and backed up in the United States or its territories. The use of Offshore Resources is not permitted;

5.4 ensure that any Customization development work is performed in the United States;

5.5 ensure the data center(s) in which Software and State Data resides minimally meets Uptime Institute Tier 3 standards (https://www.uptimeinstitute.com/), or its equivalent;

https://www.michigan.gov/dtmb/policies/it-policies https://www.uptimeinstitute.com/

5.6 maintain and enforce an information security program including safety and physical and technical security policies and procedures with respect to its Processing of the State Data that complies with the requirements of the State’s data security policies as set forth in this Contract, and must, at a minimum, remain compliant with FISMA and NIST Special Publication 800-53 MOD Controls using identified controls and minimum values as established in applicable State PSPs;

5.7 Throughout the Term, Contractor must not provide any part of the Solution from the list of excluded parties in the System for Award Management (SAM) for entities excluded from receiving federal government awards for "covered telecommunications equipment or services.

5.8 provide technical and organizational safeguards against accidental, unlawful or unauthorized access to or use, destruction, loss, alteration, disclosure, encryption, transfer, commingling or processing of such information that ensure a level of security appropriate to the risks presented by the Processing of State Data and the nature of such State Data, consistent with best industry practice and applicable standards (including, but not limited to, compliance with FISMA, NIST, CMS, IRS, FBI, SSA, HIPAA, FERPA and PCI requirements as applicable);

5.9 take all reasonable measures to:

(a) secure and defend all locations, equipment, systems and other materials and facilities employed in connection with the Solution against “malicious actors” and others who may seek, without authorization, to destroy, disrupt, damage, encrypt, modify, copy, access or otherwise use Hosted Services or the information found therein; and

(b) prevent (i) the State and its Authorized Users from having access to the data of other customers or such other customer’s users of the Solution; (ii) State Data from being commingled with or contaminated by the data of other customers or their users of the Solution; and (iii) unauthorized access to any of the State Data;

5.10 ensure that State Data is encrypted in transit and at rest using FIPS validated AES encryption modules and a key size of 128 bits or higher;

5.11 ensure the Hosted Services support Identity Federation/Single Sign-on (SSO) capabilities using Security Assertion Markup…