Contract analysis

I. EXECUTIVE SUMMARY AND PURPOSE 1.1 Purpose of Survey Calderwood & Harkness LLP has prepared this 50-State Breach Notification Law Survey at the direction of Thomas R. Whitfield, General Counsel, and Jennifer Liang, Chief Privacy Officer, of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), in connection with a data security incident originating from Quorum's third-party claims-processing vendor, Palomar

Section II: Analytical Framework. This section discusses the key definitional and structural issues common across state breach notification statutes, including the distinction between "risk-of-harm" and "strict trigger" states, timing requirements, content requirements, the applicability of notification obligations to vendor-originated breaches, encryption safe harbors, and the interaction between state notification

Section III: State-by-State Analysis. This section provides an individualized analysis of the breach notification statutes of all fifty states and the District of Columbia, organized alphabetically. Each state entry follows a standardized format addressing twelve analytical categories, as described in the introduction to Section III.

Section IV: Comparative Summary Tables. This section presents comparative tables summarizing key statutory requirements across all jurisdictions, organized by topic area, including timing requirements, attorney general notification obligations, content requirements, credit monitoring mandates, substitute notice provisions, and private right of action availability.

Section V: States of Particular Concern for This Incident. This section identifies and discusses the states that present the greatest compliance challenges or litigation exposure for Quorum based on the size of the affected population, the stringency of the applicable requirements, and the likely regulatory attention.

Section VI: Recommendations and Next Steps. This section sets forth Calderwood & Harkness's recommendations regarding notification planning, credit monitoring, substitute notice, and ongoing compliance monitoring. Appendix A: Comparative Matrix. This appendix cross-references a separate spreadsheet document (to be finalized upon completion of affected-individual identification) providing a detailed comparative matrix

II. ANALYTICAL FRAMEWORK 2.1 Common Statutory Elements Despite significant variation in detail and scope, the fifty state breach notification statutes and the District of Columbia's statute share a common structural framework built around several core statutory elements. Understanding these common elements is essential to navigating the state-by-state analysis that follows in Section III. Definition of "Breach" or "S

III. STATE-BY-STATE ANALYSIS This section provides an individualized analysis of the breach notification statutes of all fifty states and the District of Columbia. Each state entry follows a standardized format addressing twelve analytical categories:

2. Trigger Definition (acquisition vs. access; risk-of-harm qualifier, if any)

3. Definition of "Personal Information" (data elements covered)

4. Applicability to This Incident (based on compromised data types)

5. Timing Requirement (fixed deadline and/or "most expedient time" standard)

6. Content Requirements (prescribed elements for consumer notice)

7. AG / Regulator Notification (required? threshold? timing?)

8. Substitute Notice (conditions and method)

9. Credit Monitoring / Identity Theft Protection (mandatory offer? duration?)

10. Private Right of Action (availability and scope)

11. Penalties for Noncompliance

12. Special Notes / Particularities The survey provides full detail for the ten states most likely to have the largest affected populations based on Quorum's policyholder geographic footprint, as well as the District of Columbia. Abbreviated entries are provided for the remaining states, covering all twelve analytical categories in summary form. All entries contain sufficient detail to support notification planning a