Contract analysis

I. PURPOSE AND BACKGROUND 1.1 Purpose of This Memorandum The purpose of this memorandum is to establish binding internal protocols for the Calderwood & Harkness LLP ("C&H" or the "firm") engagement team governing the preservation of attorney-client privilege and attorney work product protection over all aspects of the forensic investigation being conducted at counsel's direction in connection with the data security i

1. Forensic Investigation Oversight: Direction and management of a third-party forensic investigation to determine the nature, scope, and impact of the compromise, including identification of the specific data elements and individuals affected;

2. Notification Compliance: Assessment and execution of notification obligations under applicable federal and state laws, including HIPAA/HITECH, state breach notification statutes, and any contractual notification provisions;

3. Regulatory Defense: Preparation for and response to any regulatory inquiries, investigations, or enforcement actions initiated by state attorneys general, the U.S. Department of Health and Human Services Office for Civil Rights ("HHS-OCR"), state insurance departments, or other regulatory bodies;

4. Vendor Accountability: Analysis of Palomar's contractual obligations to Quorum, including representations and warranties, indemnification provisions, and insurance requirements under the Master Services Agreement between Quorum and Palomar dated September 12, 2020, as amended. 1.3 Retention of Graystone Forensics LLC On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone"), a digital fo

II. GOVERNING LEGAL PRINCIPLES 2.1 Attorney-Client Privilege The attorney-client privilege protects confidential communications between an attorney and a client made for the purpose of obtaining or providing legal advice. In the context of this engagement, the privilege covers communications between Calderwood & Harkness attorneys and authorized Quorum personnel made in connection with the legal response to the Palom

III. DOCUMENT MARKING AND LABELING REQUIREMENTS 3.1 Mandatory Privilege Markings Proper and consistent privilege marking is one of the most important safeguards against inadvertent waiver. While privilege markings are not, by themselves, legally sufficient to establish privilege, they serve several critical functions: they put recipients on notice that the document is claimed as privileged; they demonstrate the sende

IV. COMMUNICATION PROTOCOLS 4.1 Authorized Communication Channels The security of communication channels is a fundamental component of privilege preservation. A privileged communication transmitted through an insecure channel may be intercepted by unauthorized third parties, potentially resulting in waiver. Moreover, the use of informal or personal communication channels makes it difficult to ensure proper marking, a

V. FORENSIC WORK PRODUCT — HANDLING AND DISTRIBUTION 5.1 Preliminary and Final Forensic Reports The forensic reports produced by Graystone constitute the core privileged work product of this engagement. These reports will contain Graystone's technical findings regarding the nature, scope, and impact of the compromise, including the identification of affected data elements, the number of individuals whose data was pot

VI. REGULATORY INTERACTIONS AND PRIVILEGE CONSIDERATIONS 6.1 Regulatory Notifications The data security incident will likely trigger notification obligations under the breach notification statutes of multiple states, HIPAA/HITECH breach notification requirements, and potentially the notification requirements applicable to entities regulated by state insurance departments. These regulatory notifications are, by their

VII. SPECIAL CONSIDERATIONS 7.1 SEC Disclosure Obligations Quorum Insurance Holdings Corp. is a publicly traded company, listed on the Nasdaq Stock Market under the ticker symbol QIHC, with an approximate market capitalization of $6.1 billion as of May 2023 and fiscal year 2022 revenue of approximately $4.82 billion. As a public company, Quorum is subject to the disclosure requirements of the Securities Exchange Act