Contract analysis

I. Purpose and Background The purpose of this memorandum is to establish a comprehensive protocol for the retention, organization, classification, and protection of all documents generated, received, or collected during Calderwood & Harkness LLP's ("C&H") representation of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from Palomar Data Solutions,

II. Document Categories and Classification Framework All documents generated, received, or collected during the C&H engagement have been organized into ten (10) discrete categories for purposes of retention, privilege classification, and future retrieval. Each category is described in detail below, together with the applicable privilege or confidentiality designation. The classification framework is intended to facil

1. Initial Incident Assessment Memo (May 8, 2023) — C&H's preliminary legal assessment of the incident and Quorum's potential exposure across regulatory, litigation, and contractual dimensions.

2. Cyber-Insurance Coverage Analysis Memo (May 9, 2023) — Analysis of Quorum's available coverage under the Atlas Mutual primary policy and Pinnacle excess layer, including assessment of policy exclusions, notice requirements, and anticipated coverage positions.

3. Contractual Analysis Memo on Palomar MSA (May 12, 2023) — Detailed analysis of Palomar's obligations under the Master Services Agreement (including Sections 9.4, 12.2, and 14.2), breach of contract theories, and the contractual indemnification framework. 4. 50-State Breach Notification Law Survey (June 8, 2023) — Comprehensive survey of breach notification requirements across all 50 states and the District of Colu

5. SEC Disclosure Analysis Memo (July 19, 2023) — Assessment of Quorum's disclosure obligations under applicable SEC rules and guidance, including analysis of materiality and recommended disclosure language.

6. Notification Trigger Analysis Memo (July 20, 2023) — Multi-jurisdictional analysis determining which state notification statutes were triggered by the categories of data compromised, the number of affected individuals per state, and the applicable notification deadlines.

7. HIPAA Breach Notification Analysis Memo (July 22, 2023) — Analysis of Quorum's notification obligations under the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, with respect to the 41,203 individuals whose PHI was compromised.

8. CT Insurance Data Security Law Analysis Memo (July 22, 2023) — Analysis of Quorum's obligations under Connecticut's Insurance Data Security Law (Conn. Gen. Stat. § 38a-38 et seq.) and the Connecticut Insurance Department's regulatory expectations.

9. NY SHIELD Act Compliance Memo (July 23, 2023) — Assessment of compliance obligations under the New York Stop Hacks and Improve Electronic Data Security Act (N.Y. Gen. Bus. Law § 899-aa) and the reasonable safeguards requirements thereunder.

10. California CCPA/CMIA Analysis Memo (July 24, 2023) — Analysis of Quorum's obligations and potential private right of action exposure under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) and the Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.).

11. Negotiation Strategy Memo (August 28, 2023) — C&H's recommended negotiation strategy for the Palomar indemnification settlement, including analysis of Quorum's leverage, target settlement range, and proposed deal structure.

12. Summary of Settlement Terms Memo (October 28, 2023) — Post-execution summary and legal analysis of the Palomar settlement agreement and MSA Amendment 3, with assessment of the recovery achieved relative to total incident costs. Category 2 also includes C&H's annotations, comments, marginal notes, and internal analyses on documents received from third parties. Specific examples include C&H's annotations on the mul

1. Graystone Scope of Work & Investigation Plan (May 7, 2023) — The initial scope document and investigation plan approved by C&H and Quorum, defining the parameters of Graystone's forensic analysis.

2. Graystone Preliminary Forensic Findings Memo (June 2, 2023) — Graystone's interim findings memo identifying initial indicators of compromise, the attack vector (CVE-2023-0669 exploitation), the approximate intrusion timeline, and preliminary data exposure assessment.

3. Graystone Final Forensic Report (July 14, 2023) — Graystone's comprehensive final report documenting the complete forensic investigation, including confirmed attack methodology, intrusion timeline, data exfiltration analysis, affected data categories, affected individual counts by state, and remediation recommendations.

4. C&H Analysis of Preliminary Findings (June 5, 2023) — C&H's legal analysis of Graystone's preliminary findings, including assessment of notification trigger implications and initial litigation exposure.

5. C&H Summary & Legal Analysis of Final Forensic Findings (July 18, 2023) — C&H's comprehensive legal analysis of Graystone's final report, including assessment of regulatory notification obligations, litigation exposure, and settlement leverage vis-à-vis Palomar. In addition to the foregoing deliverables, Category 3 includes all underlying forensic data, disk images, log files, network traffic captures, malware sam

I. Category 9: Engagement and Administrative Materials Category 9 encompasses the administrative and engagement-related documents that establish the framework for C&H's representation and the various third-party engagements undertaken in connection with the incident response. While many of these documents are not themselves privileged in the traditional sense, they provide the foundational documentation that supports

III. Privilege Log Requirements A. Obligation to Maintain a Privilege Log Quorum must maintain a comprehensive privilege log identifying all documents withheld from production on the basis of attorney-client privilege, work product doctrine, common interest privilege, or any combination thereof. The maintenance of an accurate and complete privilege log is essential to the preservation of Quorum's privilege rights. A

1. Document Date — The date the document was created, transmitted, or received.

2. Author(s) — The name(s) and title(s) of all individuals who authored or drafted the document.

3. Recipient(s) — The name(s) and title(s) of all individuals to whom the document was addressed or transmitted.

4. CC/BCC Parties — The name(s) and title(s) of all individuals who were copied (whether by carbon copy or blind carbon copy) on the communication.

5. Document Type — The format of the document (e.g., email, memorandum, letter, report, presentation, spreadsheet, annotation, draft, etc.).

6. Subject / Description — A brief, non-privileged description of the document's subject matter, sufficient to permit a reviewing court or opposing party to assess the privilege claim without revealing the substance of the privileged communication. Care should be taken to describe the document in terms that do not disclose the legal advice, mental impressions, conclusions, or legal theories reflected therein.

7. Privilege Basis Asserted — The specific privilege or protection asserted as the basis for withholding the document. Available designations include: (a) Attorney-Client Privilege ("AC"); (b) Attorney Work Product — Fact Work Product ("WP-F"); (c) Attorney Work Product — Opinion Work Product ("WP-O"); (d) Common Interest Privilege ("CI"); or (e) any combination thereof (e.g., "AC / WP-O" for a document that is both

8. Redaction Notes — Where a document is produced in redacted form rather than withheld in full, a description of the basis for each redaction and the privilege or protection asserted. The distinction between opinion work product and fact work product is important and should be carefully maintained in the privilege log. Opinion work product—reflecting the mental impressions, conclusions, opinions, and legal theories

IV. Document Retention Periods A. Minimum Retention Periods All documents in Categories 1 through 10 as described in Section II above shall be retained for a minimum period of seven (7) years from December 1, 2023 (the date of matter closure), meaning that no documents may be destroyed or deleted prior to December 1, 2030, at the earliest. The seven-year minimum retention period is established to accommodate the long

1. Litigation: If any litigation (including class action complaints, individual lawsuits, or third-party claims) is commenced against Quorum or any related party in connection with the Palomar data security incident before the expiration of the seven-year retention period, all documents in all categories must be retained until the litigation is fully resolved, all appeals are exhausted or the time for appeal has expi

2. Regulatory Proceedings: If any regulatory proceeding, governmental investigation, or administrative enforcement action is commenced or re-opened in connection with the incident before the expiration of the retention period, the same extended retention obligations apply.

3. Arbitration: If any arbitration proceeding is commenced (e.g., under the MSA's dispute resolution provisions) before the expiration of the retention period, the same extended retention obligations apply.

4. Reasonable Anticipation: If, at any time before the expiration of the retention period, Quorum has a reasonable basis to anticipate that litigation, regulatory action, or arbitration may be commenced—even if no formal proceeding has yet been initiated—all documents must be preserved and the legal hold maintained. The determination of whether litigation or regulatory action is reasonably anticipated should be made

1. No documents may be destroyed without prior written approval from Quorum's General Counsel (currently Thomas R. Whitfield, or his successor in that role). This requirement is absolute and applies to all document categories, whether privileged or non-privileged, and whether maintained in physical or electronic form.

2. Pre-destruction legal review: Before any documents are approved for destruction, Quorum should engage C&H or successor counsel to confirm that no pending or reasonably anticipated matters require continued preservation of any portion of the document set. Counsel should review the current litigation, regulatory, and contractual landscape and provide a written opinion that destruction may proceed.

3. Complete and irreversible destruction: All destruction must be conducted in a manner that ensures the complete and irreversible elimination of the documents and data. For physical documents, this means secure cross-cut shredding by a certified document destruction vendor, with a certificate of destruction retained in the legal department's files. For electronic records, this means certified data wiping using metho

4. Destruction log: A log should be maintained documenting the date of destruction, the categories and volume of documents destroyed, the method of destruction, the identity of the individual who approved the destruction, and the identity of the vendor or personnel who performed the destruction.

V. Segregation and Storage of Privileged Materials A. Physical Documents All physical documents bearing privilege markings or classified as privileged under the framework established in Section II above should be stored in a secure, access-restricted location within Quorum's legal department at the Company's headquarters: Quorum Insurance Holdings Corp. Legal Department 400 Constitution Plaza, Suite 2200 Hartford, CT

1. Written confirmation of data handling: C&H shall obtain written confirmation from Dr. Nolan Briggs, as the lead forensic investigator and a principal of Graystone, confirming that all final privileged deliverables (including the Scope of Work & Investigation Plan, Preliminary Forensic Findings Memo, Final Forensic Report, and all underlying forensic data, images, logs, and analyst notes) have been transmitted to C

2. Retained copies: Graystone should confirm in writing whether it has retained copies of any final privileged deliverables beyond its own internal working files. If Graystone has retained copies, it should confirm that such copies are maintained under the same confidentiality and privilege protections established by the Outside Counsel Retention Letter dated May 5, 2023, and that access to such copies is restricted

3. Destruction practices: C&H shall obtain written confirmation from Dr. Briggs regarding Graystone's data retention and destruction practices for this engagement, including the timeline for destruction of any retained copies of privileged deliverables and working files, and the methods of destruction employed by Graystone.

VI. Inadvertent Disclosure and Clawback Procedures A. Clawback Protocol In the event of inadvertent disclosure of privileged materials to any third party—including but not limited to opposing counsel Catherine Langford at Mercer, Haight & Dunlop LLP, regulators, insurers (outside the scope of the Common Interest Agreement), potential class action plaintiffs or their counsel, or any other party—the following clawback

1. Immediate notification: The individual who discovers the inadvertent disclosure must immediately notify Kevin Ostrowski (Responsible Partner, C&H) and Thomas R. Whitfield (General Counsel, Quorum) by telephone and email. Time is of the essence in asserting clawback rights, and any delay in notification may prejudice Quorum's position.

2. Demand for return or destruction: C&H will promptly issue a written demand to the recipient of the inadvertently disclosed materials, demanding the immediate return or destruction of all copies of the inadvertently disclosed materials and of any notes, summaries, or derivative materials created from the disclosed materials. The demand will assert that the disclosure was inadvertent, that the privilege has not been

3. Documentation of circumstances: The circumstances of the inadvertent disclosure must be documented in detail, including: the date and time the disclosure was discovered; the identity of the individual who made the disclosure; the identity of the recipient(s); the method of disclosure (e.g., email, physical production, file sharing); the specific documents or communications disclosed; and the steps taken to prevent

4. Assertion of non-waiver: C&H will assert on behalf of Quorum that the inadvertent disclosure does not constitute a waiver of the attorney-client privilege or work product protection, and that Quorum has taken all reasonable steps to prevent disclosure and has promptly taken reasonable steps to rectify the error. The legal standard governing inadvertent disclosure of privileged materials in federal proceedings is s

1. Immediate forwarding: Any request—whether in the form of a subpoena, civil investigative demand, discovery request, Freedom of Information Act ("FOIA") request, state public records request, informal regulatory request, or any other type of demand—must be immediately forwarded to Thomas R. Whitfield and to Calderwood & Harkness (Kevin Ostrowski) upon receipt.

2. No production without privilege review: No documents may be produced or made available to the requesting party without prior privilege review by C&H or successor counsel. This prohibition applies regardless of whether the request appears to seek only non-privileged materials, as inadvertent production of privileged documents can result from an incomplete or hurried review.

3. Privilege log preparation: Where a document request requires the production of documents and Quorum intends to withhold certain documents on privilege grounds, C&H will prepare or update the privilege log to identify all withheld documents, in accordance with the log requirements set forth in Section III.B above.

4. Timely response: Quorum should work with C&H to ensure that any response to a third-party request is made within the applicable deadline, including by seeking extensions of time where necessary to conduct a thorough privilege review.

VII. Specific Considerations for Pending or Anticipated Matters While all regulatory tracks have been closed without enforcement action and the Palomar settlement has been executed, several categories of potential future proceedings warrant specific consideration in the context of document retention and privilege preservation. A. Potential Class Action Litigation Although no class action has been filed as of the date