Contract analysis

I. Executive Summary This memorandum analyzes the California-specific breach notification obligations arising from the Palomar Data Solutions, Inc. ("Palomar") vendor-originated data security incident affecting Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The incident, which is the subject of ongoing privileged legal analysis and incident response, resulted in the unauthorized access to and exfiltrati

II. Background A. The Security Incident On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the Vireo Health IT (Managed File Transfer) appliance operated by Palomar Data Solutions, Inc., Quorum's third-party claims-processing vendor. The exploitation of this vulnerability allowed the threat actor to gain unauthorized access to Palomar's network environme

III. Analysis Under Cal. Civ. Code § 1798.82 (California Data Breach Notification Law) A. Covered Entity / Applicability California's data breach notification statute, Cal. Civ. Code § 1798.82, applies to "a person or business that conducts business in California, and that owns or licenses computerized data that includes personal information." The statute imposes notification obligations on two categories of entities

IV. Analysis Under the California Confidentiality of Medical Information Act (CMIA) A. Applicability of the CMIA The California Confidentiality of Medical Information Act, Cal. Civ. Code §§ 56–56.37 ("CMIA"), establishes comprehensive protections for the confidentiality of medical information in California. The CMIA governs the use, disclosure, and security of "medical information" by specific categories of entities,

1. Identification of medical information types: The letter should specifically identify the types of medical information involved, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims. The description should be sufficiently specific to allow the individual to understand the nature of the medical information that was accessed and

2. Characterization of the incident under CMIA: The letter should describe the unauthorized access and exfiltration as an "unauthorized disclosure of medical information" within the meaning of the CMIA. This language aligns the notification with the CMIA's statutory framework and demonstrates Quorum's acknowledgment of the medical information dimension of the breach.

3. CMIA rights advisory: The letter should advise affected individuals of their rights under the CMIA, including the right to bring a civil action for nominal damages of $1,000 (and up to $5,000) and actual damages under Cal. Civ. Code § 56.36(b). While including this information in the notification letter is not expressly required by statute, it is consistent with transparent and good-faith notification practices an

4. Cross-reference with HIPAA notification: For individuals who are also subject to HIPAA-compliant notification (which is being provided simultaneously pursuant to 45 C.F.R. § 164.404(c)), the California notification letter should be drafted to satisfy both the California § 1798.82 content requirements and the HIPAA notification content requirements. The letter should reference the HIPAA-compliant notification being

V. Interplay with the California Consumer Privacy Act (CCPA) A. CCPA Breach Context The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 ("CPRA"), Cal. Civ. Code §§ 1798.100–1798.199.100, establishes comprehensive consumer privacy rights and obligations for businesses that collect and process the personal information of California residents. While the CCPA is principally a priv

VI. Recommended Notification Plan for California A. Notification to Affected California Individuals Quorum will provide direct written notification via first-class mail to all 38,206 affected California residents. The notification will be executed by Clearfield Notification Services LLC under its engagement agreement with Quorum. Three versions of the California-specific notification letter will be prepared to addres

1. General PII version: For California residents whose compromised data includes PII only (names, dates of birth, Social Security numbers, and driver's license numbers), without financial or medical data elements. This version will describe the compromised data categories and provide guidance on identity protection measures, including fraud alerts, credit freezes, and monitoring of financial accounts and credit repor

2. Financial data version: For the subset of California residents whose compromised data includes PII plus financial information (bank account numbers, payment card numbers). This version will include all content from the General PII version, plus additional guidance specific to financial account monitoring, reporting unauthorized transactions, and contacting financial institutions to place holds or request replaceme

3. PHI / Medical information version: For the subset of California residents whose compromised data includes PII plus medical/health information (health conditions, diagnosis codes, treatment information from workers' compensation and health-related claims). This version will include all content from the General PII version, plus CMIA-appropriate language describing the medical information compromised, advising of ri

VII. Key Risk Considerations and Open Items The following items represent key risk considerations and o