Contract analysis

1. Purpose of Website Posting / Substitute Notice. This website posting is intended to satisfy substitute notice requirements under applicable state data breach notification statutes that permit or require conspicuous website posting as a form of substitute notice. In certain jurisdictions, substitute notice by conspicuous website posting is authorized where direct written notice is not feasible for certain affected

2. Cross-Reference to State-by-State Notification Matrix. The determination of which states permit or require substitute notice via conspicuous website posting was made by reference to the state-by-state notification matrix prepared by Calderwood & Harkness LLP, dated August 1, 2023, and maintained in the Matter No. 1025-00006 work files. That matrix identifies the specific statutory provisions in each of the 29 affe

3. Supplement to Direct Written Notification. This website posting supplements, and does not replace, the direct written notifications being mailed to all 318,247 identified affected individuals through Clearfield Notification Services LLC. Direct written notification remains the primary method of notice for all identified affected individuals. The website posting serves as an additional form of notice to reach any i

4. Duration of Posting. This posting should remain on Quorum's corporate website (prominently linked from the homepage) for a minimum of ninety (90) days from the date of initial posting (i.e., through at least November 13, 2023), or such longer period as required by applicable state law. The drafting team should consult the state-by-state notification matrix to confirm that no jurisdiction requires a longer posting

5. Approval. This language was reviewed and approved by Kevin Ostrowski (Responsible Partner) and Alan Burke (Lead Associate), Calderwood & Harkness LLP, Matter No. 1025-00006, on August 14, 2023. Final client approval from Quorum Insurance Holdings Corp. (General Counsel, David Whitfield) is pending as of the date of this draft.

6. Coordination with Communications Strategy. Timing of the website posting must be coordinated with BrightPath Consulting Group Inc. (contact: Meredith Ashford, Senior Vice President, Crisis Communications) to ensure alignment with the broader communications strategy for the incident, including any media inquiries, employee communications, and regulator interactions. The posting should not go live until BrightPath h

7. Call Center Readiness. Prior to the posting going live on Quorum's website, the drafting team must confirm with Clearfield Notification Services LLC (contact: Jerome Tillman, Director of Client Services) that the dedicated toll-free call center is fully operational, staffed with trained representatives, and prepared to handle the anticipated call volume that may result from the public posting. The call center must

8. Toll-Free Number. The toll-free number included in this posting (1-855-407-2291) should be confirmed with Clearfield Notification Services LLC prior to publication. If the number changes or is not yet activated, the posting must be updated accordingly before going live. END OF INTERNAL DRAFTING NOTES — NOT FOR PUBLICATION