Contract analysis

1. Internal kick-off call. I would like to schedule a call early the week of September 11 with you, Jennifer, David Naranjo, and Priya Deshmukh to discuss our response strategy in detail. We will prepare a detailed strategy memo in advance of that call so that our discussion can be focused and productive.

2. Engagement scope expansion. This multistate AG inquiry, combined with the pending Connecticut Insurance Department engagement and the HHS-OCR inquiry, warrants formally expanding the scope of Calderwood & Harkness's engagement to encompass regulatory defense. I will send a scope expansion letter separately; you should expect to receive that on or about September 10.

3. Strategy memorandum. Alan Burke and the team will prepare a comprehensive strategy memo analyzing the demand letter point by point, identifying the key themes and sensitivities, and recommending our approach for the response. We are targeting delivery of that memo by September 11, 2023.

4. Document and information gathering. Tom and Jennifer, I would ask that you begin assembling the key internal documents we will need to prepare the response. Specifically, we will need Quorum's information security program documentation; vendor risk management policies and all Palomar oversight records from Priya Deshmukh's files; the complete Palomar MSA document set, including the original MSA, Amendment 1 dated

5. Response timeline. We will target submission of the formal response by the October 13 deadline. The response will likely include several exhibits, including a detailed incident timeline, consumer notification letter samples, a vendor accountability summary, and an overview of Quorum's information security program.

6. Board notification. Tom, I recommend that you brief Franklin Reeves, as Chair of the Audit Committee, on this development at your earliest opportunity. We are happy to assist you in preparing a concise update for that conversation.

7. Insurance notification. We should consider whether it is appropriate at this time to notify Atlas Mutual Insurance Company — Paul Enriquez is our contact there — that regulatory defense costs may be incurred in connection with this multistate inquiry. Regulatory defense costs are covered under Policy No. CYB-2023-041587 in excess of the $2,500,000 self-insured retention. Rachel Bernstein will take the lead on coor

8. Crisis communications. I would suggest coordinating with Meredith Ashford at BrightPath Consulting Group to ensure we have a media response framework in place in the event the multistate inquiry generates press attention. At this stage, the inquiry itself is not public, and I do not expect immediate media interest, but prudent preparation is warranted. Tom, Jennifer — I want to be clear that while this is a seriou