Contract analysis

I. Executive Summary This memorandum constitutes Calderwood & Harkness LLP's ("Calderwood & Harkness" or the "Firm") third periodic briefing to the Audit Committee of the Board of Directors (the "Audit Committee") on the status of the Company's response to the vendor-originated data breach involving Palomar Data Solutions, Inc. This briefing follows the Initial Incident Report presented on May 11, 2023, and the Foren

II. Status of Consumer Notifications A. Notification Mailing Completion All consumer notification letters have been printed and mailed to the full population of affected individuals. Mailings were executed on a rolling basis commencing August 18, 2023, and concluding September 15, 2023 — a mailing window of approximately 28 calendar days. The total number of individuals notified is 318,247, spanning 29 states and the

1. General PII Version. This version was sent to the broadest population of affected individuals whose compromised information included names, dates of birth, Social Security numbers, and driver's license numbers. This version constituted the majority of all notification mailings.

2. Enhanced Financial Information Version. This version was sent to the 84,619 individuals whose compromised information also included financial account data, specifically bank account numbers and/or payment card numbers. This version included enhanced disclosures regarding the potential for financial fraud and recommended additional protective steps, including monitoring of bank and credit card statements.

3. HIPAA-Compliant PHI Version. This version was sent to the 41,203 individuals whose compromised information included protected health information, including health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims. This version was drafted to comply with the content requirements of 45 C.F.R. § 164.404(c) and included a description of

III. Status of Regulatory Notifications A. Summary of Filings All regulatory notifications required under applicable state breach notification statutes and federal law have been filed and confirmed received by the applicable regulatory authorities. Filings were submitted on a rolling basis between August 14 and August 25, 2023. Calderwood & Harkness carefully tracked each jurisdiction's applicable notification deadli

IV. Multistate Attorney General Inquiry A. Receipt of Joint Demand Letter On September 8, 2023, Quorum received a joint demand letter from a multistate attorney general coalition comprising 29 states (the "Multistate Coalition" or the "Coalition"). The letter was issued on the joint letterhead of the lead states and was signed by the following lead representatives: • Connecticut Attorney General's Office — Consumer P

V. Connecticut Insurance Department Inquiry A. Background. The Connecticut Insurance Department (the "Department") opened an inquiry into the incident following receipt of Quorum's notification filing on August 14, 2023 under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b. The inquiry is being handled by Richard Nakamura, Examiner, Financial Analysis Division, Cybersecurity Unit. This inquir

VI. HHS Office for Civil Rights (HHS-OCR) Inquiry A. Background. The Company's HIPAA breach notification was filed with HHS-OCR Region I (Boston regional office) on August 15, 2023, consistent with the reporting requirements of 45 C.F.R. § 164.408, which requires covered entities to notify HHS of breaches of unsecured protected health information affecting 500 or more individuals without unreasonable delay and in no

VII. Palomar Data Solutions — Vendor Indemnification Negotiations A. Contractual Basis Quorum's indemnification claim against Palomar is grounded in Section 12.2 of the Master Services Agreement dated November 12, 2019, between Quorum and Palomar (the "MSA"), as amended by Amendment 1 (effective March 8, 2021) and Amendment 2 (effective September 15, 2022). Section 12.2 provides that Palomar shall indemnify, defend,

1. Failure to Patch CVE-2023-0669. Palomar failed to apply the available patch for CVE-2023-0669, a critical remote code execution vulnerability in the GoAnywhere MFT file transfer platform, within the 30-day critical vulnerability patching window required by Section 3.2(a) of Exhibit D (Data Security Exhibit), as amended by Amendment 2 (effective September 15, 2022). The Graystone Forensics investigation confirmed t

2. Late Breach Notification. Palomar discovered anomalous activity on its network on April 18, 2023, but did not notify Quorum until April 21, 2023. This delay of approximately 72 hours exceeded the 48-hour notification requirement set forth in Section 9.4 of the MSA by approximately 24 hours. This late notification delayed Quorum's ability to initiate its own incident response, engage counsel, and begin the forensic

VIII. Insurance Coverage Update A. Primary Policy — Atlas Mutual Insurance Company Quorum maintains a cyber liability insurance policy with Atlas Mutual Insurance Company under Policy No. CYB-2023-041587. The claim arising from the Palomar data security incident has been assigned Claim No. CYB-CLM-2023-05892. The key terms of the policy are as follows: • Per-Occurrence Limit: $15,000,000 • Self-Insured Retention (SIR

IX. Crisis Communications Update BrightPath Consulting Group Inc. ("BrightPath") continues to manage the external and internal communications strategy related to the incident under the direction of Managing Director Meredith Ashford. BrightPath was retained on May 9, 2023, and has been instrumental in managing the Company's public messaging and internal employee communications throughout the incident response. Extern

X. SEC Disclosure Considerations Calderwood & Harkness previously provided Quorum's General Counsel, Thomas R. Whitfield, with a written analysis dated July 19, 2023, addressing the Company's SEC disclosure obligations in connection with the data security incident. That analysis addressed the requirements of Item 1.05 of Form 8-K, which was adopted by the SEC in July 2023 and requires registrants to disclose material

XI. Upcoming Milestones and Action Items The following is a summary of the key upcoming milestones and action items for each workstream:

1. Multistate Attorney General Inquiry. Await response from the 29-state Coalition to Calderwood & Harkness's October 13, 2023 submission. Prepare supplemental information if requested by the Coalition. Continue cooperative engagement with the goal of achieving closure without enforcement action. No response deadline is currently pending.

2. Connecticut Insurance Department Inquiry. File Supplemental Submission (anticipated on or about October 20, 2023) providing additional information regarding Quorum's vendor oversight program, the Palomar MSA security provisions, and post-incident remediation measures. Target closure of the inquiry upon the Department's satisfactory review of all submitted materials.

3. HHS Office for Civil Rights Inquiry. Await HHS-OCR's completion of its review of the October 5, 2023 submission and any additional requests for information. Target a determination of no further action based on the strength of Quorum's HIPAA compliance and notification efforts.

4. Palomar Indemnification Negotiations. Finalize the revised settlement term sheet upon receipt of Palomar's counterproposals. Negotiate to resolution. Execute a settlement agreement and MSA Amendment 3 incorporating enhanced security provisions. Target resolution before year-end 2023.

5. Insurance Coverage. Prepare and submit a proof of loss and final cost summary to Atlas Mutual Insurance Company once total incident response costs are finalized. Coordinate with Atlas Mutual regarding subrogation rights in connection with any Palomar settlement.

6. Credit Monitoring and Call Center. Continue monitoring credit monitoring enrollment rates and call center operations through the planned 12-week window (expected conclusion on or about November 10, 2023). Evaluate whether any extension is warranted based on call volume and enrollment activity.

7. Board Reporting. The next Audit Committee briefing is anticipated following resolution of the multistate AG inquiry and the Palomar settlement, expected in late November 2023. Calderwood & Harkness will provide interim updates to Mr. Whitfield as material developments occur, and Mr. Whitfield will communicate those updates to the Audit Committee as appropriate.

XII. Assessment and Recommendation Overall Assessment. The overall trajectory of this matter remains favorable. All regulatory engagements to date have been constructive in tone, and no enforcement action, fine, penalty, or corrective action plan has been threatened or commenced by any regulator. The consumer notification process has been completed in its entirety, and the credit monitoring and call center operations