College of Veterinary Medicine Electronic Medical Record System Q+A

40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 1 of 56 REQUEST FOR PROPOSAL RFP#719682 College of Veterinary Medicine Electronic Medical Record System Revised RFP Timeline RFP Re-Open Date: July 6, 2023 Deadline for Respondent Questions to MSU: July 19, 2023 Written RFP Response Due Date: August 2, 2023, 3:00 pm Eastern Product Demonstrations August 21 - August 25, 2023 Estimated Contract Award September 4, 2023 Original RFP Timeline RFP Issue Date: February 2, 2023 Deadline for Respondent Questions to MSU: February 15, 2023 Written RFP Response Due Date: March 8, 2023, 3:00 pm Eastern Product Demonstrations March 20 – March 24 2023 Estimated Contract Award April 7, 2023 RFP Contact Name: Michael Ezzo Email: ezzomich@msu.edu Phone: (517) 432-7315 DESCRIPTION: Michigan State University (the “University” or “MSU”) is soliciting proposals through this Request for Proposal (“RFP”) for the

purpose of procuring an electronic medical record software (EMR) for its College of Veterinary Medicine. The requested services are more thoroughly described under the Scope of Work Section of this RFP. Firms intending to respond to this RFP are referred to herein as a “Respondent” or “Supplier.” 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 2 of 56 PROPOSAL INSTRUCTIONS 1. PROPOSAL PREPARATION. The University recommends reading all RFP materials prior to preparing a proposal, particularly these Proposal Instructions. Respondents must follow these Proposal Instructions and provide a complete response to the items indicated in the table below. References and links to websites or external sources may not be used in lieu of providing the information requested in the RFP within the proposal. Include the Respondent’s company name in the header of all documents submitted with your proposal. Document Description Response Instructions Cover Page Provides RFP title and number, important dates, and contact information for MSU Informational Proposal Instructions Provides RFP instructions to Respondents Informational Respondent Information Sheet Company and Contact Information, and Experience Respondent must complete and submit by proposal deadline Scope of Work Describes the intended scope of work for the RFP Respondent must complete and submit by proposal deadline Pricing Pricing for goods and services sought by the University through this RFP Respondent must complete and submit by proposal deadline Master Service Agreement Provides legal terms for a contract awarded through this RFP Deemed accepted by Respondent unless information required in Section 8, Master Service Agreement is submitted by proposal deadline 2. EXPECTED RFP TIMELINE. Activity Date Issue RFP July 6, 2023 Deadline for Respondent Questions to MSU July 19, 2023 RFP Response Due August 2, 2023, 3:00 pm Eastern Product Demonstrations August 21 - August 25, 2023 Estimated Contract Award September 4, 2023 3. CONTACT INFORMATION FOR THE UNIVERSITY. The sole point of contact for the University concerning this RFP is listed on the Cover Page. Contacting any other University personnel, agent, consultant, or representative about this RFP may result in Respondent disqualification. 4. QUESTIONS. Respondent questions about this RFP must be submitted electronically by email to the contact listed on the cover page of this RFP. In the interest of transparency, only written questions are accepted. Answers to all questions will be sent to Respondents via email. Submit questions by 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 3 of 56 referencing the following: (i) Question Number, (ii) Document Name, (iii) Page Number, and (iv) Respondent Question. Please refer to Section 2 above for the deadline to submit questions. 5. MODIFICATIONS. The University may modify this RFP at any time. Modifications will be sent via email. This is the only method by which the RFP may be modified. 6. DELIVERY OF PROPOSAL. The Respondent must submit its proposal, all attachments, and any modifications or withdrawals electronically via email to the contact listed on the cover page of this RFP. The price proposal should be saved separately from all other proposal documents. The Respondent should submit all documents in a modifiable (native) format (examples include, but are not limited to: Microsoft Word or Excel and Google Docs or Sheets). In addition to submitting documents in a modifiable format, the Respondent may also submit copies of documents in PDF. Respondent’s failure to submit a proposal as required may result in disqualification. The proposal and attachments must be fully uploaded and submitted prior to the proposal deadline. Do not wait until the last minute to submit a proposal. The University may not allow a proposal to be submitted after the proposal deadline identified in the Cover Page, even if a portion of the proposal was already submitted. 7. EVALUATION PROCESS. The University will convene a team of individuals from various Departments within MSU to evaluate each proposal based on each Respondent’s ability to provide the required services, taking into consideration the overall cost to the University. The University may require an oral presentation of the Respondent's proposal; conduct interviews, research, reference checks, and background checks; and request additional price concessions at any point during the evaluation process. The following criteria will be used to evaluate each proposal: Criteria Proposed application’s ability to meet the Applications Requirements section of this RFP Overall Cost to the University University’s evaluation of the proposed implementation plan, including time and cost to launch and time, cost, and complexity of developing interfaces Reporting and analytics capabilities University’s evaluation of the proposed application’s security University’s evaluation of the proposed application’s digital accessibility Acceptance of proposed Master Service Agreement (MSA) Michigan Based Business 8. MASTER SERVICE AGREEMENT. The University strongly encourages strict adherence to the terms and conditions set forth in the Master Service Agreement. The University reserves the right to deem a proposal non-responsive for failure to accept the Master Service Agreement. Nevertheless, the Respondent may submit proposed changes to the Master Service Agreement in track changes (i.e., visible edits) with an explanation of the Respondent’s need for each proposed change. Failure to include track changes with an explanation of the Respondent’s need for the proposed change constitutes the Respondent’s acceptance of the Master Service Agreement. General statements, such as “the Respondent reserves the right to negotiate the terms and conditions,” may be considered non- responsive. 9. CLARIFICATION REQUEST. The University reserves the right to issue a Clarification Request to a Respondent to clarify its proposal if the University determines the proposal is not clear. Failure to respond to a Clarification Request timely may be cause for disqualification. 10. RESERVATIONS. The University reserves the right to: 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 4 of 56 a. Disqualify a Respondent for failure to follow these instructions. b. Discontinue the RFP process at any time for any or no reason. The issuance of an RFP, your preparation and submission of a proposal, and the University’s subsequent receipt and evaluation of your proposal does not commit the University to award a contract to you or anyone, even if all the requirements in the RFP are met. c. Consider late proposals if: (i) no other proposals are received; (ii) no complete proposals are received; (iii) the University received complete proposals, but the proposals did not meet mandatory minimum requirements or technical criteria; or (iv) the award process fails to result in an award. d. Consider an otherwise disqualified proposal, if no other proposals are received. e. Disqualify a proposal based on: (i) information provided by the Respondent in response to this RFP; or (ii) if it is determined that a Respondent purposely or willfully submitted false or misleading information in response to the RFP. f. Consider prior performance with the University in making its award decision. g. Consider total-cost-of-ownership factors (e.g., transition and training costs) when evaluating proposal pricing and in the final award. h. Refuse to award a contract to any Respondent that has outstanding debt with the University or has a legal dispute with the University. i. Require all Respondents to participate in a Best and Final Offer round of the RFP. j. Enter into negotiations with one or more Respondents on price, terms, technical requirements, or other deliverables. k. Award multiple, optional-use contracts, or award by type of service or good. l. Evaluate the proposal outside the scope identified in Section 7, Evaluation Process, if the University receives only one proposal. 11. AWARD RECOMMENDATION. The contract will be awarded to the responsive and responsible Respondent who offers the best value to the University, as determined by the University. Best value will be determined by the Respondent meeting the minimum requirements and offering the best combination of the factors in Section 7, Evaluation Process, and price, as demonstrated by the proposal. The University will email a Notice of Award to all Respondents. A Notice of Award does not constitute a contract, as the parties must reach final agreement on a signed contract before any services can be provided. 12. GENERAL CONDITIONS. The University will not be liable for any costs, expenses, or damages incurred by a Respondent participating in this solicitation. The Respondent agrees that its proposal will be considered an offer to do business with the University in accordance with its proposal, including the Master Service Agreement, and that its proposal will be irrevocable and binding for a period of 180 calendar days from date of submission. If a contract is awarded to the Respondent, the University may, at its option, incorporate any part of the Respondent’s proposal into the contract. This RFP is not an offer to enter into a contract. This RFP may not provide a complete statement of the University’s needs, or contain all matters upon which agreement must be reached. Proposals submitted via email are the University’s property. 13. FREEDOM OF INFORMATION ACT. Respondent acknowledges that any responses, materials, correspondence or documents provided to the University may be subject to the State of Michigan Freedom of Information Act (“FOIA”), Michigan Compiled Law 15.231 et seq., and may be released to third parties in compliance with FOIA or any other law. 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 5 of 56 RESPONDENT INFORMATION SHEET Please complete the following Information Sheet in the space provided: Information Sought Response Contact Information Respondent’s sole contact person during the RFP process. Include name, title, address, email, and phone number. Person authorized to receive and sign a resulting contract. Include name, title, address, email, and phone number. Respondent Background Information Legal business name and address. Include business entity designation, e.g., sole proprietor, Inc., LLC, or LLP. What state was the company formed in? Main phone number Website address DUNS# AND/OR CCR# (if applicable): Number of years in business and number of employees Legal business name and address of parent company, if any Has your company (or any affiliates) been a party to litigation against Michigan State University? If the answer is yes, then state the date of initial filing, case name and court number, and jurisdiction. Experience Describe relevant experiences from the last 5 years supporting your ability to successfully manage a contract of similar size and scope for the services described in this RFP. Experience 1 Company name Contact name Contact role at time of project Contact phone Contact email 1. Project name and description of the scope of the project 2. What role did your company play? 3. How is this project experience relevant to the subject of this RFP? Start and end date (mm/yy – mm/yy) Status (completed, live, other – specify phase) Experience 2 Company name Contact name Contact role at time of project Contact phone 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 6 of 56 Contact email 1. Project name and description of the scope of the project 2. What role did your company play? 3. How is this project experience relevant to the subject of this RFP? Start and end date (mm/yy – mm/yy) Status (completed, live, other – specify phase) Experience 3 Company name Contact name Contact role at time of project Contact phone Contact email 1. Project name and description of the scope of the project 2. What role did your company play? 3. How is this project experience relevant to the subject of this RFP? Start and end date (mm/yy – mm/yy) Status (completed, live, other – specify phase) 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 7 of 56 SCOPE OF WORK Please address each of the sections below in a written response, which can be completed on a separate sheet (using the same section headings). 1. Background. Michigan State University (MSU) is requesting proposals for an electronic medical record software (EMR) for its College of Veterinary Medicine (CVM). The request for proposal (RFP) process outlined in this document will be used to find a partner whose vision is aligned with CVM’s, and who will work with the department to create, deploy, and continue to enhance the capabilities envisioned. MSU College of Veterinary Medicine (CVM) is the only Veterinary College within the state. The College’s mission statement is “Learn, Discover, Heal, Protect”, and the College has a strong pedigree in scholarly activity, research, and teaching. The Veterinary Medical Center (VMC) serves as the teaching hospital for approximately 115 DVM students and 40 LVT students each year, as well as providing care for over 30,000 cases per annum. Within this arena clinical research projects serve not only to drive advances in veterinary medicine and surgery but also contribute to translational research. The MSU CVM community is organized into the Office of the Dean, four biomedical science departments, the Veterinary Technology Program, two clinical sciences departments, and two service units. The service units include the Veterinary Diagnostic Laboratory (VDL), and the VMC. The VMC has two hospitals and FY21 had roughly 30,000 patient visits. The VMC provides administrative, operational, quality, compliance, billing, and technical support to the hospitals. MSU CVM is governed by representatives from each of the departments and service units, the Office of the Dean, and the provost’s office. MSU’s Veterinary Medical Center has 19 departments as follows: Entity Description Anesthesia and Pain Management Our Anesthesia and Analgesia service collaborates with all other services to provide anesthesia and pain management for large and small animals, local and regional anesthesia and analgesia, injectable and inhalant anesthesia, mechanical ventilation, and sedation for complex standing surgeries for large animals. Behavior The Behavior Service at the MSU Veterinary Medical Center focuses on treating pets exhibiting disruptive or destructive behaviors, such as aggression, anxiety, or house soiling. Our veterinary behaviorist can help owners prepare for life changes that involve pets, and can also diagnose underlying medical conditions contributing to problem behaviors. Camelid and Farm Animal Services Cows, pigs, sheep, goats, camels, alpacas, llamas, and more are welcome at our Large Animal Clinic for the best in animal health and welfare. We offer emergency and surgical treatments, as well as disease diagnostics, treatment, and prevention. Cardiology The Cardiology Service at the MSU Veterinary Medical Center focuses on the diagnosis and treatment of heart and vascular disorders in companion animals. The service provides medical cardiology and cardiovascular surgery, as well as minimally invasive transvenous procedures and those done via thoracoscopic exams. We also provide consulting services for large animals. Dermatology The Dermatology Service focuses on the diagnosis and management of skin- related problems for your animal. Patients typically visit us for acute and chronic 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 8 of 56 ear infections, tumors, and masses, atopic dermatitis, autoimmune skin diseases, cancer of the skin, cysts, and other tumors of the skin, chronic bacterial and fungal skin diseases, congenital skin diseases, drug reactions of the skin, environmental allergies, food allergies, hair loss disorders, hormonal skin diseases, insect hypersensitivities, nail disorders, parasitic skin diseases, and skin manifestations of systemic disease. Diagnostic Imaging/Radiology The Diagnostic Imaging Service at the MSU Veterinary Medical Center provides consultation and imaging services for our specialists at Michigan State. Our diagnostic imaging services support surgical and therapeutic procedures, including interventional radiology. Equine Services The MSU Equine Service is a leader in equine disease research and application of research findings in the clinical setting to improve the lives of horses. The MSU Large Animal Clinic is equipped with full service triage facilities, radiography, MRI, CT, ultrasonography, endoscopy/gastroscopy, arthroscopy and 4 operating rooms with induction and recovery suites. Internal Medicine Internists specialize in the management of patients that have disorders that are complicated to diagnose or to treat, or multi-system disease processes, or conditions that are not responding to treatment as expected. Our patients may be seriously ill and require hospitalization. Our team works closely with all other VMC services, as well as the MSU Veterinary Diagnostic Laboratory to provide our patients with the highest quality of care. Interventional Radiology The Interventional Radiology (IR) Service at the MSU Veterinary Medical Center uses advanced imaging techniques including ultrasound, fluoroscopy, CT, and MRI to guide the delivery of materials for diagnostic and therapeutic purposes. This minimally invasive approach to treatment facilitates shorter hospital stays, decreased pain, and a more rapid return to function. The MSU IR program is one of only two formal IR services in the country. Neurology Service The Neurology Service at the MSU Veterinary Medical Center offers a multidisciplinary approach to the diagnosis and treatment of neurological conditions that affect the brain, spinal cord, inner ear, and vertebrae, as well as muscles and nerves. The Veterinary Medical Center has a state-of-the-art neurosurgical suite and advanced surgical equipment. Common Disorders treated by the Neurology Service include: Congenital diseases (e.g., atlantoaxial subluxation, hydrocephalus, Chiari-like malformation), degenerative disc disease (intervertebral disc herniation/”slipped disc”), encephalitis (infectious and non- infectious), seizure disorders, spinal and brain cancers/tumors, traumatic spinal and brain injuries, vascular conditions (ischemic infarcts or “strokes”). Oncology The Oncology Service works with owners and their veterinarians to diagnose and treat pets with cancer. We offer the most advanced oncologic treatments for your pet, including but not limited to, immunotherapy, nuclear therapy (I131), radiation therapy, and target chemotherapy. Ophthalmology The Comparative Ophthalmology Service at the MSU Veterinary Medical Center is dedicated to research, education, and clinical practice for large, small, domestic, wild, and zoo animals. Our Hospital service is run by three board- certified clinicians and supported by our three residents and licensed veterinary technician. Our team uses the most advanced equipment to diagnose and treat regular, unique, and emergency eye conditions. Orthopedic Surgery The Orthopedic Surgery Service at the MSU Veterinary Medical Center is made up of world-renowned surgeons who employ the best treatments and technologies to serve our patients through our Trauma, Revision and, Joint Replacement Centers. As the only academic institution in the United States that offers comprehensive total joint replacement for all major joints — hip, elbow, 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 9 of 56 knee, and ankle — we provide the highest quality of service and care while closely collaborating with our Emergency, Anesthesia, Diagnostic Imaging, and Rehabilitation Services. Pharmacy Our services are provided to meet the unique needs of our animal patients; the treatment requirements of the clinical faculty – including interns, residents, and fellows; and, the educational needs of the Doctor of Veterinary Medicine and Veterinary Technology students of the College of Veterinary Medicine. Primary Care The Primary Care Service provides routine health care, including physical examinations, wellness care for all life stages, vaccinations, and treatment of minor injuries or illnesses. Services offered through Primary Care include: Wellness care for all life stages, vaccinations, microchipping, diagnosis and primary management of common diseases, treatment of minor injuries and illnesses, health certificates, behavior assessment, nutritional assessment, dental care counseling and referral for dental care, referrals and consultations for surgery, specialty care, or emergency/critical care through the MSU Veterinary Medical Center, and referrals for palliative care. Rehabilitation Service and Integrative Medicine Rehabilitation aids in the healing and mobility of pets and athletes through individualized treatment plans. At the Dr. Elwood and Linda Collins Rehab Center, our team focuses on the whole patient while providing personalized care and consideration to any injury, illness or objective. Our services include: Acupuncture, athletic performance enhancement, conditioning, electrical stimulation, geriatric care, hydrotherapy, massage and stretching, neurologic retraining, orthopedic therapy, pain management, surgery prep and recovery, therapeutic laser, weight loss and maintenance Integrative medicine, including acupuncture, herbal and other integrative treatments can provide pain relief, improve performance and overall health. Soft Tissue Surgery The Soft Tissue Surgery Service consists of a highly trained team of faculty, surgery residents, interns, surgical fellows, and senior students. The team undertakes many different types of surgery, including large tumor removal, advanced airway surgery, all types of hernias, major intestinal and abdominal procedures, attenuation of portosystemic shunts and other vascular anomalies, repair of congenital defects, such as cleft palates, all types of urinary surgeries, extensive wound management, skin flaps, and free skin grafting. We perform a number of procedures thoracoscopically and laparoscopically, through 1-3 very small incisions. These procedures are usually routine spays, removal of retained testes, gastropexies, liver biopsies, and removal of the gall bladder. Veterinary Social Work The Veterinary Social Work Service at the MSU Veterinary Medical Center offers emotional support to clients when they need it most. Veterinary social workers provide short-term, one-on-one counseling for a variety of situations, such as: Counseling during difficult treatments, such as chemotherapy, emotional support during difficult decisions, support during the euthanasia process We also provide referrals to resources in our clients’ communities. Zoo and Wildlife Service The Zoo and Wildlife Service provides care to hundreds of animals across the state of Michigan, both in zoos and in the wild. 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 10 of 56 SAMPLE PROCESS 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 11 of 56 SITE VOLUMES Category Statistic Total annual caseload 30,000 Annual number of unique patients that will have a patient health record 20,000 per annum Total estimated number of technicians and clinicians who would be using the system (regardless of application(s)) 200 Total estimated number of students using the system 460 Estimated number of users who may be using the system concurrently (regardless of applications) 150 Sites 3 (VMC, TCDP training center, ambulatory) Definitions: Category Definition of Unit Caseload A case is one registered visit (example: an oncology patient with 5 sessions of chemotherapy would count as 5 cases) Providers Using the System Clinicians (DVMs), Technicians (LVTs), Veterinary Assistants, DVM and LVT students, admin/lab Site A physical location at which licenses will be used MSU CVM: VISION AND PROJECT GOALS MSU CVM’s enterprise vision is to: • Promote safer and better coordinated patient care; • Gain efficiencies in provider documentation, coding, and billing; • Improve referring veterinarian and client access to health information; • Improve student education by exposing them to current technology. • Improve data analysis and collection for improved and more efficient research As a public facing service unit, the VMC does not receive state funding and thus has to operate in a fiscally responsible manner to delivery excellence in service to 3 key customer groups: animal owner, referring veterinarian, and student. The veterinary landscape has changed rapidly over the last decade with advances in treatment modalities, the advent of telemedicine, and the rapid growth in e-learning to name a few. The expectations of our customer base have changed and continue to evolve. 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 12 of 56 Integration of administrative and clinical systems also needs to be enhanced as we are held more accountable for the costs of care. Transparency on the cost of care decisions at the point of care will facilitate that accountability. We need analytics that will help us manage clinician performance per various quality measures not only retroactively but also proactively. Implementation of a new EMR will enable MSU CVM to remain at the forefront of education, service, and research. It will enable us to effectively prepare students for their future and the industry that they will join as professionals. It will enable us to deliver excellence in customer service to animal owners and referring veterinarians. It will enable us to effectively undertake clinical research programs. The solution we implement will integrate with a revised curriculum that engages students with clinical material across all 4 years of their studies. At the same time it will be able to enroll patients in clinical trials and have the ability to deliver “business intelligence” to analyze data, be that research outcomes or fiscal analysis. Very simply, the EMR system project’s goal is to implement a fully integrated health record incorporating efficient clinical documentation, robust practice management, and intrinsic quality reporting in order to provide exceptional patient care, clinical research, and medical education. MSU CVM: CURRENT INFORMATION TECHNOLOGY STATE MSU’s IT Environment is primarily a virtualized environment that utilizes products from VMware to share physical resources. The backend infrastructure services the needs of many large groups including academic and administrative units. Networking: The CVM partners with MSU IT to operate a standardized enterprise network. We utilize products from Juniper, Cisco, and Palo Alto Networks. Our network offers flexibility, scalabilty, and resiliency for any enterprise use case. Storage: MSU IT operates a shared services data center. MSU IT has standardized on Qumulo enterprise storage appliances. These appliances are configured redundantly across two enterprise data centers and have capacity up to 50 petabytes. 2. Supplier Preferences a. Michigan Based Business i. To be considered, respondent is to provide evidence of State of Incorporation and/or Michigan based operations 3. General Requirements a. It is the intent to award this contract for a period of three (3) years with subsequent renewal options with the agreement of both parties b. All personnel from potential bidders, or the selected supplier, shall be required to follow the MSU Community Compact for the prevention of the spread of COVID-19. More information can be found at: https://msu.edu/together-we-will/ 4. Application Requirements a. Software Functional Requirements i. MSU is seeking a remote/cloud hosted application if possible b. Security Assessment https://msu.edu/together-we-will/ 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 13 of 56 i. Respondents are required to submit a HECVAT (Higher Education Community Vendor Assessment Tool) as part of their proposal for MSU’s review 1. HECVAT Form can be found at: https://www.ren-isac.net/hecvat/index.html ii. The HECVAT is the standard security document used by MSU IT Security. If a respondent is unable to submit a HECVAT, they shall be required to submit other industry accepted documentation of their security controls and process for evaluation by MSU. c. Digital Accessibility i. The University is required to comply with the Americans with Disabilities Act of 1990 (ADA) and has adopted a formal policy regarding accessibility requirements for websites and software applications. Supplier’s software must comply, where relevant, with level AA of the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.0 Level AA. ii. Suppliers are required to submit a Voluntary Product Accessibility Template (VPAT) as part of their proposal for MSU’s review. 1. Additionally, suppliers are free to submit any 3rd Party Accessibility Evaluations completed on their product for University’s consideration iii. As part of MSU’s review of product accessibility, MSU may request access to a test or sample environment d. Non-production Test Environment i. MSU seeks, but does not require a non-production test environment to be available for MSU use 5. Technical Support a. Supplier shall provide ongoing technical support of the system for the duration of the agreement i. MSU seeks solution which includes unlimited telephone and online technical support 24 hours per day, 7 days per week ii. At a minimum, technical support shall be available 7 am to 12 am (midnight) daily 6. Implementation and Training Plan a. MSU desires to implement this system as soon as practicable. i. Suppliers shall include in their proposal an implementation plan which incorporates the University’s need to on-board, pilot and roll out to the University by this date ii. As part of the implementation, supplier shall conduct training on product 1. Supplier shall outline training plan and assets as part of their proposal iii. If respondent proposes any travel costs as part of their implementation plan, all travel shall be reimbursed at actual cost and shall be subject to MSU’s Travel Reimbursement Policy set forth at http://www.ctlr.msu.edu/COTravel/ReimbursementChart.aspx. 7. Written Proposals a. As part of their written proposals, respondents should provide an overview of the proposed application’s features and capabilities in the below areas of interest. 1. VENDOR AND PRODUCT PROFILE 1.1 General a. Provide information regarding your business. If any contractors would be used for MSU projects, provide the following information for both your company and each contractor. https://www.ren-isac.net/hecvat/index.html http://www.ctlr.msu.edu/COTravel/ReimbursementChart.aspx 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 14 of 56 1.2 Market Data a. Number of years as an EMR vendor b. Number of live sites categorized by: i. Specialty Care (referral hospitals) ii. Primary Care c. Number of live sites for academic purposes d. Number of new EMR installations over the last 3 years e. What is the percentage of vendor-provided installs vs. outsourced to third party companies? f. Breakdown of sites by specialty g. Size of existing user base h. Does the product has a Michigan presence? If so, # of install sites by specialty and size; list of Michigan reference sites i. What is the current implementation timeframe when using only vendor-supplied resources? j. Number and percentage of practices in 2021 that did not get installed: i. Six (6) months after signing contract? ii. Nine (9) months after signing contract? iii. Twelve (12) months after signing contract? k. How many organizations have de-installed any vendor systems over the past two (2) years? Please specify which systems and why. l. What is your EMR customer retention for the years 2016, 2015, and 2014 as measured by: i. Sites ii. Users by site iii. Total users m. Total FTEs: i. 2021 Total FTEs ii. 2021 Healthcare FTEs iii. 2022 Total FTEs iv. 2022 Healthcare FTEs n. Revenue information: i. 2021 Total Revenue ii. 2021 Revenue in Healthcare iii. 2021 HER Product-Based Revenue iv. 2021 Total Profit v. 2021 R&D Spend on EMR Product o. Explain how your company is planning to meet the increase in demand for your EMR product (including implementation, training, and support) over the next five (5) years. 1.3 Additional Information a. Do you have training sites for customers? b. Describe training options (train-the-trainer, # hours all staff) c. Has your company acquired, been acquired, merged with other organizations, or had any “change in control” events within the last five (5) years? (If yes, please provide details.) d. Does your company use resellers to distribute your product(s)? If yes, please answer the following: i. What is your reseller structure? ii. Who are your resellers who are authorized to sell within Michigan? e. If no, please answer the following: i. What is your distribution and sales structure? 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 15 of 56 f. Please provide information on any outstanding lawsuits or judgments within the last five (5) years. Please indicate any cases to which you cannot respond as they were settled with a non-disclosure clause. 2. TRAINING AND TESTING 2.1 Training/Testing – All Phases (Selection through Post Go-Live) a. Describe any development / training environment. b. Specify if this development environment will be provided before or after a contract is signed. i. Will access be granted to development / training environment for testing during upgrades and during training processes? c. Describe online video training available, including: i. Recorded modules / workflow training courses ii. Recorded interactive “many-to-one” training sessions iii. Quick Reference or tips & tricks videos iv. Trial demonstration of EMR d. Describe online web based training available, including: i. Interactive training activity with screenshots and instructions to give clinic exposure of EMR selected before core training e. Describe facilitator / consultant led training sessions available, including: i. Module training sessions ii. Workflow training sessions (clinician, technician, student, front office, etc.) iii. One-on-one training sessions with consultant iv. Describe your training personnel (i.e. background, position, medical credentials) v. Vendor-directed demo (i.e. Web Ex training on-site, etc.) f. Describe training documents available (identify format of documentation), including: i. Training manuals ii. Quick reference guides that focus on specific tasks iii. Online printable training documentation iv. Upgraded training guide v. Describe when these documents are modified and how quickly they are made available to the customer after product changes occur g. Is practice / specialty specific training offered? h. What is created by vendor vs. customer? i. Creating specialized templates for efficient documentation ii. Creating favorites / shortcuts within the product iii. Does the product have customizable preferences? i. Will a workflow assessment be completed by the vendor? i. Will a document be sent to be completed by the clinic? ii. Will vendor complete on-site workflow assessment? iii. Is there an additional cost for workflow assessment? j. Describe Super User training, including: i. Will super users be trained by vendor? ii. Remote or on-site training provided? k. Describe on-site training, including: i. How many days does are provided for on-site training? ii. Will Go-Live be scheduled shortly after initial staff training? iii. What is the consultant / provider ratio during training? iv. Will trainers complete a readiness assessment before Go-Live? v. Will clinic be provided with on-site demos before and after contract is signed? 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 16 of 56 vi. Will office be trained on hardware if purchased through the vendor before Go-Live training? l. Describe costs related to training, including: i. Describe training options included in contract agreement. ii. Will additional costs be incurred by clinic for training? m. Contractually, can users access the live EMR system prior to Go-Live for build or “pilot” purposes? 2.2 Go-Live Training & Support a. Describe support for Go-Live, including: i. Will vendor staff be on-site during “Go Live” timeframe? ii. What will be the vendor’s role during “Go Live”? (a) Trainer (b) Technical b. Describe post Go-Live training and support, including: i. After “Go-Live”, who (i.e. support team implementation manager, etc.) will be available to answer questions, issues, and/or training requests? ii. If original implementation team, how long before this level of service is transferred to “normal” support team? iii. Will a post Go-Live assessment be completed after a specified amount of time by the vendor? iv. How will clinic be notified of upgrades when they are released and who is responsible for installing these updates (dates, training, documentation, etc.)? 2.3 Other Training a. Describe other training services offered, including: i. What other companies have you partnered with to provide training services on your behalf? Please provide their contact information. (a) If their work is done on your behalf, do you warrant their work as if it was your own? 3. IMPLEMENTATION 3.1 Implementation Roadmap Using your experience of past implementations, and best practices, provide a high-level implementation work plan (major applications / tasks / activities and dependencies) covering the implementation of the solution proposed. Detail your planning, assumptions, and the rationale for your recommended implementation roadmap. If your implementation roadmap includes applications that are still under development, please make sure to identify the dependencies specifically. In developing your roadmap, please note the following assumptions outlined by MSU VMC: a. Assuming the selection schedule is respected and a contract can be signed by April 2023, we are planning to start detailed planning and core team training activities in May or June 2023. The implementation plan as well as training, training materials, go live and go live support should account for a period of 3-6 months where we will need to map data and plan workflow changes. b. An enterprise model of the new IT solution will be first planned and designed. We envision that it will be a significant endeavor given the objective of standardizing rules, 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 17 of 56 processes, and workflows across the CVM enterprise. The enterprise model build and test should cover all in-scope applications. c. The proposed implementation roadmap must allow MSU CVM entities to meet current quality metrics. d. If the solution is to allow CVM to respond to the anticipated evolution of the current care delivery and payment system, it must be deployed quickly. e. If additional software development is needed to address the needs of a given service type, the implementation schedule should be such that these developments are made prior to the implementation. f. A “big bang” approach is considered whereby all core applications go live simultaneously or near simultaneously. Potential implementation approaches that balance the risks inherent with a big bang approach and the desire to minimize operational disruptions will be considered. g. The intent is to deploy the solution over multiple services simultaneously to verify integration design across multiple care settings early in the implementation process. h. Please provide recommendations for abstracting or bulk loading data from paper charts into the EMR. 3.2 Implementation Resources a. Define vendor’s and MSU VMC’s responsibilities clearly, with recommended hours per month by FTE role for all participants throughout the implementation. List the types and numbers of resources and general descriptions of responsibilities for each. Please provide two staffing model examples of comparable clients. b. The Veterinary Health IT industry seems to be short of experienced resources, and that is likely to remain so for the next few years. This is very much a concern for MSU VMC, for both the implementation and any co-development initiative. Please outline how you would propose to alleviate this concern. 4. PROCESS RECOMMENDATIONS Our hope is to partner with a vendor with strong knowledge of industry best practices. Small Animal Emergency represents a large percentage of our business and touches nearly every area of operation. Using Section 1.4, Sample Process Map: Small Animal Emergency, describe how your product: a. will complement our current process, or b. can improve upon our current process. 5. VENDOR SUPPORT AND SLA a. Do you offer multiple support programs? Please provide a detailed list of each and provide your standard SLA for each program under Schedule E. b. What are your support statistics, including: i. Number of support calls ii. Percentage of resolutions at each severity level c. Define the Support Structure (tiered approach, client assigned 1 point of contact, etc.) d. What is your availability and practice for meetings to discuss EMR issues and concerns? e. When is customer support available? i. Preferred method of contact (phone call, email, etc.)? ii. Where is your customer support staff located? Are they ‘off-shore’? iii. What are your normal hours of support and what time zone is support available? iv. How is after hours support handled? 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 18 of 56 v. Will someone be on-call at all times? f. Describe your problem / resolution process, including: i. Response time expectations for all levels of severity ii. Average time to close tickets by severity level iii. Escalation process iv. Severity level system v. Issue / resolution tracking system vi. Test system vs. live system g. Explain who has ownership of the following: i. Data ii. Software iii. Enhancements or customizations paid for by customer iv. Hardware v. Servers vi. Workstations h. Describe your additional fee-based services. i. Describe your online support (Knowledgebase, InfoCenter, etc.). j. Describe your support staff’s certifications (i.e. HDI, SCP). k. Is remote assistance an option for workstation and server issues? l. Describe your enhancement request model m. Do you have a user forum for practices to see help from peers and share ideas? n. Do you have regional and national user conferences? o. Describe your ongoing maintenance program. p. Describe your upgrade process, including: i. Will customer get to choose which upgrades they want? ii. Frequency of upgrades? iii. How long can a customer delay an upgrade without losing support? iv. Will training be provided for new functionality? q. Describe testing, including: i. Will customer get a chance to test the product in a test environment? ii. Will customer get access to test scripts from vendor? iii. Will customer have an opportunity to parallel test with vendor or conduct Acceptance Testing? iv. End to End Testing? r. Describe the way product enhancement requests are handled, including: i. If customer wants to add an enhancement, what is the process? ii. Are there additional costs for an enhancement? iii. How soon will customer be able to view, test, and use enhancement? iv. How will upgrades work with new enhancement? v. Will all other customers get the enhancement one customer has paid for? vi. How will the company stay up-to-date on changes to accreditation and industry standards, including AVMA and AAHA? 6. CONTRACT TERMS AND VENDOR GUARANTEES a. Will the customer be allowed to make payments based upon milestones with a significant portion of the fees not payable until Go-Live? b. Describe the vendor’s responsibility when: i. Problem resolution is not met by a certain time based on severity level of the problem or issue. ii. Upgrades cause problems (cause accreditation criteria to no longer be met or critical workflows to break). 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 19 of 56 iii. Training is not conducted in agreed upon timeframe and/or the training materials are not adequate or delivered per contract deliverables. iv. Implementation is not completed by vendor in the agreed upon timeframe due to issues related to the vendor (staffing conflicts, software problems, etc.). v. Incompatibility issues arise between hardware (which meets agreed upon specifications) and approved software. vi. Promised product functionality does not exist at all times of implementation. vii. Hardware is damaged during transport if purchased through vendor or while vendor is on site during installation. viii. Data is corrupt during the course of normal use and operation of the product. ix. SLAs are not met. c. Accreditation: i. Are the modules necessary to meet accreditation objectives included in the attached pricing, or are they sold separately at an additional cost? ii. Do you have a guarantee the product will meet the current standards and future standards? d. Will you agree to a cap on price increases? For how long? e. How long will you guarantee to provide maintenance (or other support) for this product? f. What is the process that you will follow when “sunsetting” this product? g. Will you escrow the source code for this product? h. Will you agree to negotiate a standard form contract for use by MSU clients, including (potential future) satellite clinics? 7. REPORTING CAPABILITIES a. Describe any ability to create custom reports. b. Describe any ad hoc reporting capabilities available to users. c. Provide a list of standard reports (no customization) which the customer may run at Go Live to meet accreditation requirements. i. Please provide images of particularly useful reports. d. Can report information be exported to CSV or comma text delimited format? 8. SECURITY FEATURES 8.1 General Security a. List the security reports the product provides at Go Live to meet all auditing and privacy reporting needs. b. Describe any remote tools you offer the provider to access patient data (e.g. iPhone) and how these devices / data may be secured if the provider loses their device or a breach is suspected. c. Describe the product’s ability to create new security rights / roles based on new workflows or enhancements (e.g. customer-developed content such as notes or departmental flowsheets. d. Describe all physical location(s) of the data. e. Describe your data use policy. f. Identify any data storage limits. g. Describe the process for MSU to be provided with all data at the conclusion of service. h. Describe the data removal process upon conclusion of service. 8.2 Identity and Access Management 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 20 of 56 a. Describe the authentication and single sign on (SSO) integration options for the solution. b. Describe the authorization integration options for the solution. c. Describe how the solution establishes and configures roles. Identify pre-defined role definitions and configurable role capabilities. 9. LICENSING a. Describe how the product is licensed. b. Are licenses purchased per user? c. Define “user” if it relates to the licensing model (i.e. FTE, all clinical staff, etc.) i. How does the system licensing account for residents, part time clinicians, and midlevel providers? ii. Can user licenses be reassigned when a workforce member leaves? d. Describe your license structure for students, if different. e. If licensing is determined per workstation, do handheld devices count toward this licensing? f. Is system access based on individual licensing, concurrent, or both? g. What does each license actually provide? h. For modular systems, does each module require a unique license? i. In concurrent licensing systems, when are licenses released by the system (i.e. when the workstation is idle, locked, or only when the user logs off)? 10. INFRASTRUCTURE AND TECHNOLOGY 10.1 For Software as a Service (SaaS) products, please answer the below questions: a. Do you provide direct SaaS solutions or require third party vendor participation? b. How are support issues handled? c. Does a third party vendor host any part of your product and/or data? d. Does your product require or recommend a firewall on the client side? If yes, what is the recommended manufacturer / model? e. Can the product be securely accessed from any location with an Internet / broadband connection? What are the security requirements for remote users (non-office users)? f. What are the minimum bandwidth requirements? g. List all security enhancements which must be accommodated on client workstations (e.g. Internet sites trusted, active x controls enabled, Dot Net versions supported, registry modifications, etc.). h. Does the product support any of the following external devices: i. USB Devices ii. Scanners (manufacturer / model) iii. Flatbed iv. Handheld (i.e. Barcode, PDA, BlackBerry Devices, etc.) v. Card Readers (i.e. Smart Card, Security) vi. Other Input Devices i. What are the workstation requirements? i. Manufacturer / Model ii. Processor iii. Storage iv. Memory v. Operating system j. Does the product require any type of client (i.e. Citrix, clientware, Cisco VPN, etc.)? k. What local software dependencies are needed on the client accessing the product? 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 21 of 56 l. Require ODBC driver or SQL application on workstations? m. How is data saved and stored? n. How will the customer be able to download and distribute the patient’s health record? o. How will the customer be able to upload patient-provided records (either paper or electronic format (radiology, medical records, lab data, etc.))? p. Can data be exported in CSV or comma text delimited format? q. Does product allow reports to be created? Ad hoc reporting option? Please provide a list of standard reports (no customization) which the customer may run to meet accreditation requirements. r. How often is routine maintenance performed on remote system including: i. Backups ii. Updates iii. Performance monitoring and enhancements s. What is the recommended contingency strategy or disaster recovery plan in the event internet service is lost and customer is unable to access your system and application? t. Do you have normal “downtime” windows for system backup and maintenance? Is access to the product affected? u. How is data gathered during Internet outages? Is it uploaded into the system when Internet is restored? If so: i. Is this process done manually or automatically? ii. How do we verify information has been uploaded? v. In the event access to your site is unavailable, what steps will you take to notify the customer of progress towards resolving the issue? What steps should the customer take during this time? w. In the past two (2) years, how many outages have you experienced due to your own infrastructure problems? x. Do you have redundant Internet providers? y. Is there a test environment for the customer to use? z. What are the network infrastructure requirements? 10.2 Integration a. Identify the integration tools and technologies available to integrate with MSU clinical, academic, and research applications and databases. b. Identify the third party tools and services necessary to implement integrations with all compliance and university systems. c. Describe the conversion and integration data requirements and frequency for maintaining up-to-date information. 10.3 Data Management a. Provide a data model and dictionary for the solution. b. Describe how key business entities are managed to ensure an authoritative system of record. c. Describe how the solution minimizes duplication of transactional data. d. Describe how the solution ensures key business entities support MSU globally defined unique identifiers. e. Describe how the solution decouples data from other ties of the application. f. Describe the information lifecycle of data in the solution from creation to rendering to archival processes. g. Describe the migration capabilities of data between environments facilitated by your product. h. Describe the data configurability available in the system. 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 22 of 56 i. Describe how the data can be incorporated into MSU’s Enterprise Data Warehouse (MSU EDW). 10.4 Hosting, Availability, and Performance a. Describe the hosting options for your solution (e.g. software-as-a-service (SaaS), private cloud, local on premises, single/multi tenant). b. Describe the hosting requirements and options for the solution. c. Identify all third party software that is required in order to have a fully functional solution. d. Provide historical statistics on the availability and performance of the solution and services. e. Describe how availability and performance are monitored and disruptions to services communicated proactively. f. Describe how performance testing can be conducted on the solution. g. Describe the environments provided and supported for the solution (e.g. DEV, TEST, QA, PROD). 8. Required Documents for RFP Submission a. Written overview of proposed software offering, including the specific areas of interest of Section 7 b. Respondent Information Sheet c. Signed Pricing Proposal d. Implementation Plan e. HECVAT, Full Version f. VPAT, preferred i. Other 3rd Party Accessibility Evaluation, optional g. Master Service Agreement (if requesting redlines) 9. Product Demonstrations a. Based on the written proposals and documents submitted per this RFP, and at its sole discretion, MSU intends to identify a short list of suppliers who will be scheduled for product demonstrations to the University b. MSU shall provide a standard agenda and set of demonstration guidelines (most likely patient scenarios and data to demonstrate) to short-listed suppliers and request that the selected suppliers demonstrate how these activities would be executed in a demonstration environment. c. To help ensure the success of demonstrations, please provide a typical agenda, including timeline, that you feel allows you to best demonstrate your product. 10. Payment Terms a. Invoice payment terms for the agreement resulting from this RFP shall be 2.75% 10, NET 30 from date of receipt of invoice. i. Failure to accept these payment terms may result in a respondent being deemed non- responsive. 11. Invoicing a. Invoice Submissions i. Each invoice is to be billed on a separate sheet of paper 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 23 of 56 ii. Each invoice must be billed within 30 days after the completion of the stated work iii. All invoices are to be emailed or mailed to MSU Accounts Payable. Do not mail or email invoices to Administration Building or MSU Client, they will not be paid and will delay receipt of payment iv. If invoicing for reimbursement of travel expenses, receipts for actual travel costs shall be provided as supporting documentation along with the invoice v. More information on MSU invoice submission requirements can be found at: https://upl.msu.edu/finance-analytics/accounts-payable/submitting- invoices/index.html b. Invoice Requirements i. Every invoice must show 1. Company Name 2. University Purchase Order Number 3. Itemized/Breakdown of costs being invoiced https://upl.msu.edu/finance-analytics/accounts-payable/submitting-invoices/index.html https://upl.msu.edu/finance-analytics/accounts-payable/submitting-invoices/index.html 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 24 of 56 PRICING In order to more accurately compare proposals, bidders shall return a pricing proposal per the below. Failure to return a signed version of this form may result in a bidder being disqualified. In addition to this form, bidders are free to also include other pricing information they feel would be of interest to the University (i.e. options, pricing breakdown, etc.). Bidders may indicate a dollar value for each cost (including $0 / no charge) or that cost is “included” in other costs. One Time Fees (Required) Total Cost USD One time implementation fees: Training fees: Consulting fees: Hardware: Software: Hardware installation: Application software: Conversion / initial data feed: Other (detail): Initial Year Costs (License, Use , Access, etc.) Total Cost USD License fees for all users: License fees for each additional provider: Please provide the pricing algorithm used to calculate this cost: Ongoing Annual Costs (Maintenance, Support, License, etc.) Total Cost USD Software maintenance & support: Hardware maintenance & support: Interface maintenance: Upgrade / major release schedule and costs: Other (detail): Five (5) Year Cost of Ownership Total Cost USD Please indicate the estimated TCFO (total cost of ownership) for the product over a 5 year period. Itemize all on-going costs. Optional Costs Total Cost USD Optional Training: Other: 40FOR07 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 25 of 56 The signature below confirms that this proposal is valid for 180 days after the due date. Supplier Signature: Name: Title: Date: 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 26 of 56 MASTER SERVICE AGREEMENT (Software as a Service and Externally Hosted Applications) This Master Services Agreement (this “Agreement”) is agreed to between Michigan State University (the “University”) and [INSERT COMPANY NAME] (“Supplier”), a [INSERT STATE & ENTITY STATUS, E.G., A MICHIGAN CORPORATION OR A TEXAS LIMITED LIABILITY COMPANY]. This Agreement is effective on [MONTH, DAY, YEAR] (“Effective Date”), and unless earlier terminated, will expire on [MONTH, DAY, YEAR] (the “Term”). This Agreement may be renewed for up to three (3) additional two (2) year periods. Renewal must be by written notice from the University and will automatically extend the Term of this Agreement. 1. Definitions. “Accept” or ““Acceptance” has the meaning set forth in Section 4.2(b). “Action” has the meaning set forth in Section 17.1. “Administrative Users” means an individual authorized by the University with log-in rights to access and use the administrative features of the Service Software in accordance with the terms of this Agreement and the Documentation, subject to the maximum number of Administrative Users specified in the Statement of Work. “Agreement” has the meaning set forth in the preamble. “Agreement Administrator” is the individual appointed by each party to (a) administer the terms of this Agreement, and (B) approve and execute any Change Notices under this Agreement. Each party’s Agreement Administrator will be identified in the Statement of Work. “Availability Requirement” has the meaning set forth in Section 5. “Business Day” means a day other than a Saturday, Sunday or University Holiday. “Change Notice” has the meaning set forth in Section 2.2. “Confidential Information” has the meaning set forth in Section 14.1. “Documentation” means all generally available documentation relating to the Services, including all user manuals, operating manuals and other instructions, specifications, documents and materials, in any form or media, that describe any component, feature, requirement or other aspect of the Services, including any functionality, testing, operation or use thereof. “DR Plan” has the meaning set forth in Section 16.1. “Effective Date” has the meaning set forth in the preamble. “End User” means all public facing individuals and other Persons who access or use the Service Software as a customer of the University. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 27 of 56 “Fees” has the meaning set forth in Section 8.1. “FERPA” has the meaning set forth in Section 10. “Force Majeure Event” has the meaning set forth in Section 21.1. “HIPAA Rules” has the meaning set forth in Section 11. “Law” means any statute, law, ordinance, regulation, rule, code, order, constitution, treaty, common law, judgment, decree or other requirement or rule of any federal, state, local or foreign government or political subdivision thereof, or any arbitrator, court or tribunal of competent jurisdiction. “Loss” means all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs or expenses of whatever kind, including reasonable attorneys’ fees and the costs of enforcing any right to indemnification hereunder and the cost of pursuing any insurance providers. “Losses” has a correlative meaning. “PCI DSS” has the meaning set forth in Section 13.1. “PII” has the meaning set forth in Section 9.3. “Person” means an individual, corporation, partnership, joint venture, limited liability company, governmental authority, unincorporated organization, trust, association or other entity. “Process” means to perform any operation or set of operations on any data, information, material, work, expression or other content, including to (a) collect, receive, input, upload, download, record, reproduce, store, organize, combine, log, catalog, cross-reference, manage, maintain, copy, adapt, alter, translate or make other improvements or derivative works, (b) process, retrieve, output, consult, use, disseminate, transmit, submit, post, transfer, disclose or otherwise provide or make available, or (c) block, erase or destroy. “Processing” and “Processed” have correlative meanings. "RPO" or "Recovery Point Objective" means the maximum amount of potential data loss in the event of a disaster. "RTO" or "Recovery Time Objective" means the period of time to fully restore the Services in the case of a disaster. “Reject” or “Rejection” has the meaning set forth in Section 4.2(b). “Representatives” means a party’s employees, officers, directors, consultants, legal advisors and, with respect to Supplier, Supplier’s Subcontractors. “RFP” means the University’s request for proposal designed to solicit responses for Services under this Agreement. “Service Level Agreement” means the service level agreement attached as Schedule B to this Agreement, setting forth Supplier’s obligations with respect to the hosting, management and operation of the Service Software. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 28 of 56 “Service Software” means any and all software applications and any third- party or other software, and all new versions, updates, revisions, improvements and modifications of the foregoing, that Supplier provides remote access to and use of as part of the Services. “Services” has the meaning set forth in Section 2.1. “Specifications” means the specifications for the Services set forth in the Statement of Work and, to the extent consistent with and not limiting of the foregoing, the Documentation. “Statement of Work” means the statement of work, attached as Schedule A to this Agreement, which details the Service Software and the corresponding Services that Supplier is providing under this Agreement. “Subcontractor” means a third-party engaged by Supplier that performs any Services under this Agreement. “Supplier” has the meaning set forth in the preamble. “Supplier Personnel” means all employees and agents of Supplier, all Subcontractors and all employees and agents of any Subcontractor, involved in the performance of Services. “Supplier Service Manager” has the meaning set forth in Section 2.6. “Support Service Level Requirement” has the meaning set forth in Section 3. “Term” has the meaning set forth in the preamble. “Transition Period” has the meaning set forth in Section 7.3. “Transition Responsibilities” has the meaning set forth in Section 7.3. “University” has the meaning set forth in the preamble. “University Data” has the meaning set forth in Section 9.1. “University Service Manager” has the meaning set forth in Section 2.8. “University Systems” means the information technology infrastructure, including the computers, software, databases, electronic systems (including database management systems) and networks, of the University or any of its designees. “User Data” means any and all information reflecting the access or use of the Services by any End User, including any end user profile, visit, session, impression, click-through or click-stream data and any statistical or other analysis, information or data based on or derived from any of the foregoing. 2. Services. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 29 of 56 2.1 Services. Throughout the Term and at all times in connection with its actual or required performance under this Agreement, Supplier will, in accordance with all terms and conditions set forth in this Agreement and the Statement of Work, provide to the University the following services (“Services”): (a) the hosting, management and operation of the Service Software and other services for remote electronic access and use by the University, its Administrative Users, and End Users as described in the Statement of Work; (b) maintain the Availability Requirement set forth in the Service Level Agreement, attached as Schedule B to this Agreement; (c) provide the maintenance and support services set forth in the Service Level Agreement, attached as Schedule B to this Agreement; (d) implement and maintain the security requirements set forth in Section 15 to this Agreement; (e) maintain a DR plan in accordance with Section 16 of this Agreement; and (f) such other services as may be specified in the Statement of Work. 2.2 Change Notices. Any modifications or changes to the Services will be effective only if and when memorialized in a mutually agreed written change notice (each, a “Change Notice”) signed by both Parties, provided, however, that for any Services provided on a limited basis (for example, on a per-user or named-user basis), the University may, at any time, increase or decrease the number of its licenses hereunder subject to a corresponding forward-going adjustment of the Fees to reflect these changes in accordance with the pricing set forth in the Statement of Work. 2.3 Compliance with Laws. Supplier must comply with all applicable Laws as they concern this Agreement, including by securing and maintaining all required and appropriate visas, work permits, business licenses and other documentation and clearances necessary for performance of the Services. 2.4 Compliance with MSU Policies. Supplier must comply, where applicable, with written MSU policies, which are available at: https://upl.msu.edu/procurement/supplier-resources/policies- for-suppliers/index.html. 2.5 Subcontracting. Supplier must notify the University in writing if it subcontracts any Services, in whole or in part, to a Subcontractor. Suppliers use of Subcontractors is subject to the following: (a) Supplier must ensure each Subcontractor complies with all relevant terms of this Agreement, including all provisions relating to University Data or other Confidential Information of the University, and will have in place written agreements with any such Subcontractor which ensures such compliance; (b) Supplier will remain responsible and liable for any and all: (i) performance required hereunder, including the proper supervision, coordination and performance of the Services; and (ii) acts https://upl.msu.edu/procurement/supplier-resources/policies-for-suppliers/index.html https://upl.msu.edu/procurement/supplier-resources/policies-for-suppliers/index.html 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 30 of 56 and omissions of each Subcontractor (including, such Subcontractor’s employees and agents, who, to the extent they are involved in providing any Services, are deemed Supplier Personnel) to the same extent as if such acts or omissions were by Supplier; and (c) any noncompliance by any Subcontractor or its employees or agents with the provisions of this Agreement or the Statement of Work will constitute a breach by Supplier. 2.6 Supplier Service Manager. Supplier will, subject to the prior written approval of the University, appoint a Supplier employee to serve as a primary contact with respect to the Services who will have the authority to act on behalf of Supplier in matters pertaining to the receipt and processing of support requests (the “Supplier Service Manager”). The University may request a change in the Supplier Service Manager if the level of service is not adequate to meet the University’s needs. 2.7 Management and Payment of Supplier Personnel. (a) Supplier is solely responsible for the payment of Supplier Personnel, including all fees, expenses and compensation to, by or on behalf of any Supplier Personnel and, if applicable, the withholding of income taxes and payment and withholding of social security and other payroll taxes, unemployment insurance, workers’ compensation insurance payments and disability benefits. (b) Supplier may be required to perform criminal background checks of its Personnel pursuant to the MSU Contractor Criminal Background Check Requirements Policy (“CBC Policy”), available at https://upl.msu.edu/common/documents/criminal-back-ground-check.pdf. If Supplier is subject to the CBC Policy, Supplier must sign and deliver the Contractor Certification for Criminal Background Checks to University prior to the provision of any Services. University reserves the right to audit compliance with the CBC Policy requirements and may require further documentation of compliance from Supplier. Non-compliance with the Policy is considered a material breach of this Agreement, which may result in a termination for cause. 2.8 University Project Manager. The University will appoint and, in its reasonable discretion, replace, a University employee to serve as the primary contact with respect to implementation of the Services and ongoing service requests (the “University Service Manager”). 3. License Grant and Restrictions. 3.1 Supplier License Grant. Supplier hereby grants to the University a nonexclusive, royalty-free, irrevocable (except as provided herein) right and license during the Term and such additional periods, if any, as Supplier is required to perform Services under this Agreement, to access and use the Services, including in operation with other software, hardware, systems, networks and services, for the University’s business purposes, including for Processing University Data. 3.2 License Restrictions. The University will not: (a) rent, lease, lend, sell, sublicense, assign, distribute, publish, transfer or otherwise make the Services available to any third party, except as expressly permitted by this Agreement or in the Statement of Work; or (b) use or authorize the use of the Services or Documentation in any manner or for any purpose that is unlawful under applicable Law. 4. Service Preparation, Testing and Acceptance. https://upl.msu.edu/common/documents/criminal-back-ground-check.pdf 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 31 of 56 4.1 Service Preparation. Promptly upon the parties’ execution of this Agreement and the Statement of Work, Supplier will take all steps necessary to make the Services procured thereunder ready and available for the University’s use in accordance with the Statement of Work and this Agreement, including any applicable milestone date or dates set forth in the Statement of Work. 4.2 Testing and Acceptance. (a) When Supplier notifies the University in writing that the Services are ready for use in a production environment, the University will have thirty (30) days (or such other period as may be agreed upon by the Parties in writing) from receipt of the notice to test the Services to determine whether they comply in all material respects with the requirements of this Agreement and the Specifications. (b) Upon completion of the University’s testing, the University will notify Supplier of its acceptance (“Accept” or “Acceptance”) or, if it has identified any noncompliance with the Specifications, rejection (“Reject” or “Rejection”) of the Services. If the University Rejects the Services, the University will provide a written list of items that must be corrected. On receipt of the University’s notice, Supplier will promptly commence, at no additional cost or charge to the University, all reasonable efforts to complete, as quickly as possible and in any event within twenty (20) days (or such other period as may be agreed upon by the Parties in writing) from receipt of the University’s notice, such necessary corrections, repairs and modifications to the Services to bring them into full compliance with the Specifications. (c) If any corrective measures are required under Section 4.2(b), upon completion of all such measures, Supplier will notify the University in writing and the process set forth in Section 4.2(a) and Section 4.2(b) will be repeated; provided that if the University determines that the Services, as revised, still do not comply in all material respects with the Specifications, the University may, in its sole discretion: (i) require the Supplier to repeat the correction process set forth in Section 4.2(b) at no additional cost or charge to the University; or (ii) terminate this Agreement for cause. (d) The parties will repeat the foregoing procedure until the University Accepts the Services or elects to terminate this Agreement as provided in Section 4.2(c)(ii) above. If the University so terminates this Agreement, Supplier must refund to the University all sums previously paid to Supplier within ten (10) Business Days of the University’s written notice of termination, and the University will be relieved of all obligations thereunder. 5. Service Availability. Supplier will make the Services available, as measured over the course of each calendar month during the Term, in accordance with the provisions set forth in the Service Level Agreement, attached as Schedule B to this Agreement (the “Availability Requirement”). 6. Support and Maintenance Services. Supplier will provide maintenance and support services in accordance with the provisions set forth in the Service Level Agreement, attached as Schedule B to this Agreement (the “Support Service Level Requirement”). 7. Termination, Expiration and Transition. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 32 of 56 7.1 Termination for Cause. In addition to any right of termination set forth elsewhere in this Agreement: (a) The University may terminate this Agreement for cause, in whole or in part, if Supplier: (i) endangers the security of University Systems or University Data; (ii) becomes insolvent, petitions for bankruptcy court proceedings, or has an involuntary bankruptcy proceeding filed against it by any creditor; or (iii) breaches any of its material duties or obligations under this Agreement. Any reference to specific breaches being material breaches within this Agreement will not be construed to mean that other breaches are not material. (b) If the University terminates this Agreement under this Section 7.1, the University will issue a termination notice specifying whether Supplier must: (a) cease performance immediately, or (b) continue to perform for a specified period. If it is later determined that Supplier was not in breach of this Agreement, the termination will be deemed to have been a termination for convenience, effective as of the same date, and the rights and obligations of the parties will be limited to those provided in Section 7.2. (c) The University will only pay for amounts due to Supplier for Services accepted by the University on or before the date of termination, subject to the University’s right to set off any amounts owed by the Supplier for the University’s reasonable costs in terminating this Agreement. Supplier must promptly reimburse to the University any Fees prepaid by the University prorated to the date of such termination. Further, Supplier must pay all reasonable costs incurred by the University in terminating this Agreement for cause, including administrative costs, attorneys’ fees, court costs, and transition costs. 7.2 Termination for Convenience. The University may terminate this Agreement in whole or in part, upon thirty days advance written notice, without penalty and for any reason. The termination notice will specify whether Supplier must: (a) cease performance immediately, or (b) continue to perform in accordance with Section 7.3. If the University terminates this Agreement for convenience, the University will pay all reasonable costs for University approved Transition Responsibilities, and will forfeit any prepaid fees for the Services (provided such fees do not span more than one calendar year). 7.3 Transition Responsibilities. Upon termination or expiration of this Agreement for any reason, Supplier must, for a period of time specified by the University (not to exceed 90 calendar days; the “Transition Period”), provide all reasonable transition assistance requested by the University, to allow for the expired or terminated portion of the Agreement to continue without interruption or adverse effect, and to facilitate the orderly transfer of the Services to the University or its designees. Such transition assistance may include but is not limited to: (a) continuing to perform the Services at the established Fees; (b) taking all reasonable and necessary measures to transition performance of the work, including all applicable Services to the University or the University’s designee; (c) taking all necessary and appropriate steps, or such other action as the University may direct, to preserve, maintain, protect, or return to the University all University Data; and (d) preparing an accurate accounting from which the University and Supplier may reconcile all outstanding accounts (collectively, the “Transition Responsibilities”). The Term of this Agreement is automatically extended through the end of the Transition Period. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 33 of 56 7.4 Effect of Termination. Upon and after the termination or expiration of this Agreement for any or no reason: (a) Supplier will be obligated to perform all Transition Responsibilities specified in Section 7.3; (b) Supplier will, without charge and without any conditions or contingencies whatsoever (including but not limited to the payment of any fees due to Supplier), provide to University an extract of University Data in the format specified by the University; and (c) Supplier will (i) return to the University all documents and tangible materials (and any copies) containing, reflecting, incorporating, or based on the University’s Confidential Information; (ii) permanently erase the University’s Confidential Information from its computer systems; and (iii) certify in writing to the University that it has complied with the requirements of this Section 7.4(c), in each case to the extent such materials are not required by Supplier for Transition Responsibilities, if any. 7.5 Survival. The rights, obligations and conditions set forth in this Section 7.5 and Section 1 (Definitions), Section 7.3 (Effect of Termination; Data Retention), Section 9 (University Data), Section 14 (Confidentiality), Section 15 (Security), Section 17.1 (Indemnification), Section 18 (Limitations of Liability), Section 19 (Representations and Warranties), Section 20 (Insurance) and Section 23 (General Provisions), and any right, obligation or condition that, by its express terms or nature and context is intended to survive the termination or expiration of this Agreement, survives any such termination or expiration hereof. 8. Fees and Expenses. 8.1 Fees. Subject to the terms and conditions of this Agreement, the Statement of Work, and the Service Level Agreement, the University shall pay the fees set forth in the Statement of Work, subject to such increases and adjustments as may be permitted pursuant to Section 8.2 (“Fees”). 8.2 Fees during Option Years. Supplier’s Fees are fixed during the initial period of the Term. Supplier may increase Fees for any renewal period by providing written notice to the University at least sixty (60) calendar days prior to the commencement of such renewal period. An increase of Fees for any renewal period may not exceed three percent (3%) of the Fees effective during the immediately preceding twelve (12) month period. No increase in Fees is effective unless made in compliance with the provisions of this Section 8.2. 8.3 Responsibility for Costs. Supplier is responsible for all costs and expenses incurred in or incidental to the performance of Services, including all costs of any materials supplied by Supplier, all fees, fines, licenses, bonds, or taxes required of or imposed against Supplier, and all other of Supplier’s costs of doing business. 8.4 Taxes. The University is exempt from state sales tax for direct purchases and may be exempt from federal excise tax, if Services purchased under this Agreement are for the University’s exclusive use. Upon request, the University will provide Supplier with a Tax Exemption Letter evidencing the same. 8.5 Invoices. Supplier will invoice the University for Fees in accordance with the requirements set forth in the Statement of Work, including any requirements that condition the rendering of invoices and 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 34 of 56 the payment of Fees upon the successful completion of milestones. Supplier must submit each invoice via such delivery means and to such address as are specified by the University in the Statement of Work. Each separate invoice must: (a) clearly identify the Agreement and Purchase Order to which it relates, in such manner as is required by the University; (b) list each Fee item separately; (c) include sufficient detail for each line item to enable the University to satisfy its accounting and charge-back requirements; (d) for Fees determined on a time and materials basis, report details regarding the number of hours performed during the billing period, the skill or labor category for such Supplier Personnel and the applicable hourly billing rates; (e) include such other information as may be required by the University as set forth in the Statement of Work; and 8.6 Payment Terms. Invoices are due and payable by the University, in accordance with the University’s standard payment procedures, which is 30 days after receipt of invoice, provided the University determines that the invoice was properly rendered. 8.7 University Audit of Supplier. University shall have access to and the right to examine and copy any directly pertinent books, documents, papers, and records of Supplier involving transactions related to this Agreement until the expiration of three (3) years after final payment hereunder. Supplier further agrees to promptly furnish, when requested by University, such books, documents, and records of Supplier as are necessary to verify the accuracy of the amounts invoiced to University against any past or current goods and services provided by Supplier. If any audit discloses an overpayment by University or a discrepancy in the amount invoiced by Supplier against the goods and services actually provided by Supplier, Supplier will promptly reimburse University within thirty (30) days of University’s notification to Supplier of any such overpayment, rectify such discrepancy, or both, and further pay University a fee equal to 25% of the amount of any overpayment. 8.8 Payment Does Not Imply Acceptance. The making of any payment or payments by the University, or the receipt thereof by Supplier, will in no way affect the responsibility of Supplier to perform the Services in accordance with this Agreement, and will not imply the University’s Acceptance of any Services or the waiver of any warranties or requirements of this Agreement, including any right to service credits under the Service Level Agreement. 8.9 Payment Disputes. The University may withhold from payment any and all payments and amounts the University disputes in good faith, pending resolution of such dispute, provided that the University: (a) timely renders all payments and amounts that are not in dispute; (b) notifies Supplier of the dispute prior to the due date for payment, specifying in such notice: 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 35 of 56 (i) the amount in dispute; and (ii) the reason for the dispute set out in sufficient detail to facilitate investigation by Supplier and resolution by the parties; (c) works with Supplier in good faith to resolve the dispute promptly; and (d) promptly pays any amount determined to be payable by resolution of the dispute. Supplier shall not withhold or delay any Services or fail to perform any other services or obligations hereunder by reason of the University's good faith withholding of any payment or amount in accordance with this Section 8.9 or any dispute arising therefrom. 8.10 Service Level Credits. Supplier acknowledges and agrees that any credits assessed under the Service Level Agreement: (a) is a reasonable estimate of and compensation for the anticipated or actual harm to the University that may arise from not meeting the Availability Requirement, which would be impossible or very difficult to accurately estimate; and (b) may, at the University’s option, be credited or set off against any Fees or other charges payable to Supplier under this Agreement or be payable to the University upon demand. Credits may not exceed the total amount of Fees that would be payable for the relevant service period in which the credits are assessed. 8.11 Right of Set-off. Without prejudice to any other right or remedy it may have, the University reserves the right to set off at any time any amount then due and owing to it by Supplier against any amount payable by the University to Supplier. 9. University Data. 9.1 Ownership. The University’s data includes any and all data collected, used, processed, stored, or generated in connection with the Services that originates from the University, its Administrative Users, or End Users, including any User Data (collectively, “University Data”). University Data is and will remain the sole and exclusive property of the University and all right, title, and interest in the same is reserved by the University. This Section 9.1 survives termination or expiration of this Agreement. 9.2 Supplier Use of University Data. At all times, University Data will be treated as Confidential Information. Supplier is provided a limited license to University Data for the sole and exclusive purpose of providing the Services, including a license to collect, process, store, generate, and display University Data only to the extent necessary in the provision of the Services. Supplier must: (a) keep and maintain University Data in strict confidence, using such degree of care as is appropriate and consistent with its obligations as further described in this Agreement and applicable law to avoid unauthorized access, use, disclosure, or loss; (b) use and disclose University Data solely and exclusively for the purpose of providing the Services, such use and disclosure being in accordance with this Agreement, the Statement of Work, and applicable law; and (c) not use, sell, rent, transfer, distribute, or otherwise disclose or make available University Data for Supplier’s own purposes or for the benefit of anyone other than the University without the University’s prior written consent. This Section 9.2 survives termination or expiration of this Agreement. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 36 of 56 9.3 Loss or Compromise of Data. In the event of any act, error or omission, negligence, misconduct, or breach on the part of Supplier that compromises or is suspected to compromise the security or confidentiality of University Data or the physical, technical, administrative, or organizational safeguards put in place by Supplier that relate to the protection of the security and confidentiality of University Data, Supplier must, as applicable: (a) notify the University as soon as practicable but no later than forty-eight (48) hours of becoming aware of such occurrence; (b) cooperate with the University in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by the University; (c) in the case of personally identifiable information (“PII”), at the University’s sole election, (i) with approval and assistance from the University, notify the affected individuals who comprise the PII as soon as practicable but no later than is required to comply with applicable law; or (ii) reimburse the University for any costs in notifying the affected individuals; (d) in the case of PII, and if required by law, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law; (e) perform or take any other actions required to comply with applicable law as a result of the occurrence; (f) pay for any costs associated with the occurrence, including but not limited to any costs incurred by the University in investigating and resolving the occurrence, including reasonable attorney’s fees associated with such investigation and resolution; (g) without limiting Supplier’s obligations of indemnification as further described in this Agreement, indemnify, defend, and hold harmless the University for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the University in connection with the occurrence; (h) be responsible for recreating lost University Data in the manner and on the schedule set by the University without charge to the University; and (i) provide to the University a detailed plan within ten (10) calendar days of the occurrence describing the measures Supplier will undertake to prevent a future occurrence. The University will have the option to review and approve any notification sent to affected individuals prior to its delivery. Notification to any other party, including but not limited to public media outlets, must be reviewed and approved by the University in writing prior to its dissemination. This Section 9.3 survives termination or expiration of this Agreement. 10. FERPA Compliance. University is a qualifying educational agency or institution under the U.S. Family Educational Rights and Privacy Act (“FERPA”). To the extent Supplier or its personnel have access to data protected by FERPA, Supplier acknowledges that for the purposes of this Agreement it is designated as a “school official” with “legitimate educational interests” in such data and associated metadata, as defined under FERPA and its implementing regulations, and agrees to abide by the limitations and requirements imposed on school officials under those regulations. Supplier agrees to use such data only for the purpose of fulfilling its duties under this Agreement, and will not monitor, share, or disclose any such data to any third party except as provided for in this Agreement, as required by law, or as authorized in writing by University. Supplier specifically agrees not to use any data for purposes of targeted advertising. 11. ADA Compliance. The University is required to comply with the Americans with Disabilities Act of 1990 (ADA), and has adopted a formal policy regarding accessibility requirements for websites and software applications. Supplier’s Service Software must comply, where relevant, with level AA of the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.0. 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 37 of 56 12. HIPAA Compliance. The University and Supplier must comply with all obligations under the Health Insurance Portability and Accountability Act of 1996, and the Health Information Technology for Economic and Clinical Health Act, and any amendments or implementing regulations thereof, (collectively, the "HIPAA Rules"). University and Supplier will enter into a separate Business Associate Agreement, if reasonably necessary to keep the University and Supplier in compliance with the HIPAA Rules. 13. PCI Compliance. 13.1 Supplier shall at all times, for as long as Supplier impacts the security of the University’s cardholder data environment, or stores, processes, handles or transmits cardholder data in any manner or in any format on behalf of the University, comply with all applicable requirements of the current version of the Payment Card Industry Data Security Standard (“PCI DSS”) for cardholder data that is prescribed by the Payment Card Industry Security Standards Council, as it may be amended from time to time. The most current versions of the PCI DSS requirements documentation are available at the PCI Security Standards Council website, https://www.pcisecuritystandards.org/. 13.2 Supplier must be designated by Visa as a Level 1 Supplier and be listed in Visa’s Global Registry of service providers. Service providers that self-assess their PCI compliance are not eligible to become a PCI Supplier for the University. Supplier shall validate compliance with PCI DSS as required, and shall have provided appropriate documentation to the University before the Agreement is signed and upon request by the University thereafter, at least annually, for as long as services are provided. Validation instructions and documentation are available at the PCI Security Standards Council website, https://www.pcisecuritystandards.org/. Supplier must notify the University of any failure to comply with the PCI-DSS requirements. 13.3 Supplier acknowledges and agrees that cardholder data may only be used for assisting in completing a card transaction, for fraud control services, for loyalty programs, or as specifically agreed to by the card associations or as required by applicable law. Supplier is solely responsible for the security of cardholder data in its possession, or in the possession of a third-party retained by Supplier. In the event of unauthorized access to cardholder data which occurs during the access, storage, processing, or transmission of cardholder data by the Supplier, or by a third-party retained by Supplier, Supplier shall immediately notify the University, which shall not be more than forty-eight (48) hours after becoming aware of such unauthorized access. 13.4 In the event of unauthorized access to cardholder data which occurs during access, storage, processing, or transmission of cardholder data by the Supplier, or by a third-party retained by Supplier, Supplier will pay all fees, cost escalations, assessments, tariffs, penalties or fines that may be imposed under the Card Association Rules. Supplier further agrees to pay all other expenses that may be incurred by the University related to such unauthorized access. 13.5 Without limiting Supplier’s obligations of indemnification as further described in this Agreement, Supplier must indemnify, defend, and hold harmless the University for any and all claims, including reasonable attorneys’ fees, costs, and incidental expenses, which may be suffered by, accrued against, charged to, or recoverable from the University in connection with unauthorized access to cardholder data https://www.pcisecuritystandards.org/ https://www.pcisecuritystandards.org/ 40FOR10 | Release date: 04/14/22 | This document is uncontrolled when printed or saved. | Page 38 of 56 which occurs during access, storage, processing, or transmission of cardholder data by the Supplier, or by a third-par