Contract analysis

I. Executive Summary The purpose of this memorandum is to summarize and analyze the final forensic investigation report issued by Graystone Forensics LLC ("Graystone") on July 14, 2023 (the "Final Forensic Report" or "Report"), and to provide a comprehensive legal analysis of the implications for Quorum Insurance Holdings Corp. ("Quorum") arising from the data security incident originating at Palomar Data Solutions,

1. State-by-State Breach Notification Triggers — Analysis of notification obligations across all 29 affected states and the District of Columbia, including statutory deadlines, regulatory notice requirements, and content specifications;

2. HIPAA Breach Notification Obligations — Analysis of the notification requirements under the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.400–414) for the subset of 41,203 individuals whose PHI was compromised;

3. Recommended Notification Timeline — A proposed schedule for both consumer and regulatory notifications designed to satisfy all applicable statutory deadlines;

4. Vendor Indemnification Posture Against Palomar — Analysis of Quorum's contractual rights under the MSA to seek full indemnification from Palomar for all costs arising from the incident, including identification of Palomar's specific contractual breaches;

5. Cyber-Insurance Coverage Considerations — Analysis of coverage under Quorum's cyber-insurance tower, including the Atlas Mutual Insurance Company primary policy and the Pinnacle Surplus Lines Insurance Corp. excess policy, and coordination with vendor recovery efforts. Based on the findings summarized herein, Calderwood & Harkness recommends that Quorum proceed immediately to finalize consumer notification letters

II. Summary of Final Forensic Findings The following section summarizes the key findings of the Graystone Final Forensic Report dated July 14, 2023. This summary is intended to provide sufficient technical context for the legal analysis in Sections III through VI. The full Graystone Report is available for review in the Calderwood & Harkness secure document repository (Matter No. 1025-00006, Document ID GF-FINAL-0714

III. Legal Analysis — State Breach Notification Obligations A. Overview of Notification Trigger Analysis The confirmed data types compromised in the Palomar incident — Social Security numbers, driver's license numbers, financial account numbers, and protected health information — trigger breach notification obligations in all 29 states where affected residents reside, as well as the District of Columbia. Calderwood &

1. Connecticut. Connecticut is Quorum's headquarters state and has the largest affected population at 52,114 individuals. Connecticut's breach notification framework imposes obligations through two separate statutory frameworks, both of which apply to Quorum. General Breach Notification Statute: Conn. Gen. Stat. § 36a-701b. This statute requires any person who conducts business in Connecticut and who, in the ordinary

2. New York New York has the second-largest affected population at 47,831 individuals. New York's breach notification obligations are governed by the New York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act), codified at N.Y. Gen. Bus. Law § 899-aa. The SHIELD Act requires notification to affected individuals "in the most expedient time possible and without unreasonable delay." The statute does not im

3. California. California has the third-largest affected population at 38,206 individuals. California's breach notification statute is codified at Cal. Civ. Code § 1798.82. Because more than 500 California residents are affected by this breach, Quorum is required to notify the California Attorney General in addition to affected individuals. The AG notification must include a sample copy of the notification letter sen

4. Texas. Texas has the fourth-largest affected population at 29,477 individuals. Texas's breach notification statute requires notification to affected individuals "as quickly as possible" and also requires notification to the Texas Attorney General if more than 250 Texas residents are affected by a single breach. Given that 29,477 Texas residents are affected, the AG notification obligation is clearly triggered. The

5. Florida. Florida has the fifth-largest affected population at 22,913 individuals. Florida's Information Protection Act of 2014 (Fla. Stat. § 501.171) imposes one of the more aggressive notification deadlines in the country, requiring notification to affected individuals within 30 days of the determination that a breach has occurred, or within 30 days of the date the entity reasonably should have known of the breac

6. Additional States with Large Affected Populations The following states also have significant affected populations and warrant particular attention in the notification planning process: Pennsylvania (18,640 affected residents). Pennsylvania's breach notification statute (73 Pa. Stat. § 2303) requires notification to affected individuals "without unreasonable delay." The statute also requires notification to the Pen

IV. Legal Analysis — HIPAA Breach Notification Obligations A. Applicability As confirmed by the Graystone Final Forensic Report, 41,203 individuals had protected health information ("PHI") compromised in the Palomar security incident. The compromised PHI includes health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related claims processed by Palomar on behalf of

V. Legal Analysis — Vendor Indemnification Posture Against Palomar Data Solutions A. Contractual Framework The relationship between Quorum Insurance Holdings Corp. and Palomar Data Solutions, Inc. is governed by a Master Services Agreement ("MSA") executed November 12, 2019, with a five-year term expiring November 11, 2024. Under the MSA, Palomar provides claims processing, data management, and related services to Qu

1. Failure to Patch Critical Vulnerabilities (Exhibit D Violation) Exhibit D (Data Security), as amended by Amendment 2 (September 15, 2022), sets forth Palomar's obligations regarding the maintenance of its information security program. Among the requirements in Exhibit D is the following provision: "Service Provider shall apply security patches and updates for critical and high-severity vulnerabilities to all syste

2. Late Breach Notification (Section 9.4 Violation)

Section 9.4 (Security Incident Notification) of the MSA provides: "Service Provider shall notify Client in writing within forty-eight (48) hours of discovering any Security Incident that affects or is reasonably likely to affect Client Data. Such notification shall include all known details regarding the nature and scope of the Security Incident, the data affected, and the remedial measures taken or planned." As esta

VI. Legal Analysis — Cyber-Insurance Coverage Considerations A. Coverage Tower Summary Quorum maintains a cyber-insurance program consisting of a primary layer and an excess layer, structured as follows: The claim arising from the Palomar security incident was filed with Atlas Mutual Insurance Company on May 8, 2023, and assigned Claim No. CYB-CLM-2023-05892. The claim was filed through Quorum's insurance broker, San