Contract analysis

From: Kevin Ostrowski <kostrowski@calderwoodharkness.com> To: "Thomas R. Whitfield" <twhitfield@quoruminsurance.com> Cc: Jennifer Liang <jliang@quoruminsurance.com> Subject: Multistate Attorney General Inquiry — Closure Letter Received (No Enforcement Action)

I am pleased to report that we received this morning the closure letter from the multistate attorney general coalition regarding its inquiry into the Palomar Data Solutions data breach. The 29-state coalition has closed its investigation without taking any enforcement action against Quorum Insurance Holdings Corp. The closure letter, dated today, is signed on behalf of the coalition by AAG Diane Marchetti of the Conn

For context, the following is a brief recap of the timeline of this engagement:

- **September 8, 2023:** Joint demand letter received from the 29-state coalition, led by the Connecticut and New York Attorneys General. - **October 13, 2023:** Calderwood & Harkness submitted a comprehensive written response on Quorum's behalf, accompanied by Exhibits A through D (incident timeline and remedial measures; consumer notification samples and compliance checklist; Palomar vendor accountability summary;

The closure letter contains several noteworthy elements that reflect favorably on Quorum's response:

- The coalition acknowledged the **vendor-originated nature** of the breach, recognizing that it originated at Palomar Data Solutions and not within Quorum's own systems or infrastructure. - The letter specifically recognized Quorum's **timely and comprehensive consumer notification program**, noting that 318,247 individuals across 29 states and the District of Columbia were notified between August 18 and September 1

I should note, as you will see in the attached letter, that the closure includes standard reservation-of-rights language stating that the closure does not constitute an approval of Quorum's data security practices and does not preclude future action if new information arises. This is boilerplate language included in virtually all multistate AG closure letters and is not a cause for concern.

While this closure is a significant milestone, two regulatory matters remain open. We expect both to close favorably in the near term:

1. **Connecticut Insurance Department inquiry** — This inquiry is being handled by Examiner Richard Nakamura in the Financial Analysis Division, Cybersecurity Unit. We submitted the initial response on September 22, 2023, and supplemental information on October 20, 2023. We have received no follow-up requests and anticipate closure shortly.

2. **HHS-OCR inquiry (Region I, Boston)** — This inquiry relates to the HIPAA breach notification for the 41,203 individuals whose protected health information was compromised. We submitted our response on October 5, 2023. We also anticipate closure of this matter without further action.

We will promptly advise you when closures are received on either of these remaining tracks.

This is a very favorable outcome. The multistate coalition encompassed all 29 states where affected individuals reside, and its closure without enforcement action eliminates the most significant remaining regulatory exposure arising from the Palomar breach. The result reflects the strength of Quorum's incident response across multiple dimensions: the vendor-originated nature of the breach, timely notifications that m

Notably, the Palomar settlement — the $4,200,000 cash payment plus the 18-month 8% fee reduction totaling approximately $6,156,000 in effective recovery — and the enhanced security measures under MSA Amendment 3 were among the key factors cited by the coalition in reaching its determination. These measures demonstrated to the AGs that Quorum took the breach seriously and held its vendor accountable.

- We will prepare a detailed analysis memorandum for distribution to the team early next week (we are targeting Monday, November 27). - I recommend that this development be included in the next briefing to the Board Audit Committee and Chairman Franklin Reeves. We are happy to assist in preparing materials for that presentation. - We will continue to monitor the Connecticut Insurance Department and HHS-OCR tracks and

This is a strong result, and it reflects the quality of Quorum's incident response and the collaborative effort across your team. The speed and thoroughness with which Quorum acted — from notification through remediation and vendor accountability — made a meaningful difference in the outcome. Please do not hesitate to reach out if you would like to discuss by phone at your convenience, including over the holiday week

**Kevin Ostrowski** Partner, Privacy & Data Security Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 (202) 555-4718 kostrowski@calderwoodharkness.com

Calderwood & Harkness Matter No. 1025-00006

Attachment: Multistate AG Closure Letter (November 22, 2023) (PDF)

*CONFIDENTIALITY NOTICE: This email message, including any attachments, is a confidential attorney-client privileged communication and/or attorney work product. It is intended solely for the use of the individual(s) to whom it is addressed. If you are not an intended recipient, you are hereby notified that any review, disclosure, copying, distribution, or use of this communication or any of its contents is strictly p