Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the applicability of the HIPAA Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D (§§ 164.400–164.414), to the subset of individuals whose protected health information ("PHI") was compromised in the vendor-originated data security incident at Palomar Data Solutions, Inc. ("Palomar"). This analysis is limited to the HIPAA-specific notif

II. Background and Factual Summary A. The Incident On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability affecting the GoAnywhere MFT (Managed File Transfer) appliance operated by Palomar Data Solutions, Inc. The GoAnywhere MFT appliance is a widely used enterprise file transfer platform, and CVE-2023-0669 was publicly disclosed as a zero-day vulnerability in early

III. Legal Framework — HIPAA Breach Notification Rule A. Statutory and Regulatory Authority The HIPAA Breach Notification Rule derives its statutory authority from the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), enacted as part of the American Recovery and Reinvestment Act of 2009. Section 13402 of the HITECH Act, codified at 42 U.S.C. § 17932, establishes the requirement th

IV. Notification Obligations A. Notification to Individuals (45 C.F.R. § 164.404)

1. Timing. Under 45 C.F.R. § 164.404(b), a covered entity must provide written notification to each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of a breach. The notification must be provided without unreasonable delay and in no case later than 60 calendar days from the date of discovery of the breach. The "date of discovery" of a

2. Content Requirements (45 C.F.R. § 164.404(c)) The individual breach notification must include, to the extent possible, the following elements as set forth in 45 C.F.R. § 164.404(c)(1): (A) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known. (B) A description of the types of unsecured PHI that were involved in the breach, such as whether full

3. Method of Notification Under 45 C.F.R. § 164.404(d)(1), the primary method of individual notification is written notification by first-class mail to the last known address of the affected individual. The notification may alternatively be provided by email if the individual has agreed to receive electronic notice. For the 41,203 PHI-affected individuals, notification will be sent by first-class mail through Clearfi

1. Timing — Breaches Affecting 500 or More Individuals Under 45 C.F.R. § 164.408(b), for breaches of unsecured PHI affecting 500 or more individuals, the covered entity must provide notification to the Secretary of HHS contemporaneously with the individual notifications required under § 164.404, and without unreasonable delay and in no case later than 60 days from the date of discovery of the breach. The PHI subset i

2. Method of Notification Notification to the Secretary of HHS is filed electronically via the HHS Breach Notification Portal, accessible at https://ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf. The portal provides a structured online submission form that collects the required information about the breach. The portal submission requires the following information: • Name and contact information of the covered entity

3. Content of HHS-OCR Notification We recommend that the HHS-OCR portal submission include the following information: • Covered Entity: Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103; EIN 06-4832197 • Contact Person: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.; with outside counsel contact: Kevin Ostrowski, Partner, Calderwood & Harkness LLP • Busines

1. Trigger. Under 45 C.F.R. § 164.406(a), a covered entity must provide notice to prominent media outlets serving a state or jurisdiction if a breach of unsecured PHI affects more than 500 residents of that state or jurisdiction. In this case, the PHI subset includes 41,203 individuals across 29 states and the District of Columbia. The total affected population (across all data categories, not limited to PHI) include

2. Timing and Method Media notice must be provided without unreasonable delay and no later than 60 days from the date of discovery of the breach. The notice must be provided to "prominent media outlets" serving the affected state or jurisdiction. HHS has not defined "prominent media outlets" with specificity, but the term is generally understood to encompass major newspapers, television stations, wire services, and o

3. Content. The media notice must include the same content elements required for individual notifications under 45 C.F.R. § 164.404(c), as described in Section IV.A.2 above. The notice should be drafted in a brief, factual format consistent with press release or public notice conventions. The media notice should include: • A description of the incident, including the approximate dates of the breach and discovery • A

V. Interaction with State Breach Notification Obligations The HIPAA breach notification requirements operate in parallel with, and do not preempt, state breach notification laws. Under HIPAA's general preemption framework (45 C.F.R. § 160.203), HIPAA preempts contrary state laws, but state laws that are "more stringent" than the HIPAA requirements are not preempted. State breach notification laws, to the extent they

VI. Applicable Exceptions and Defenses A. Encryption Exception Under 45 C.F.R. § 164.402, the HIPAA breach notification requirements apply only to "unsecured PHI" — PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through encryption or destruction consistent with HHS guidance. If the PHI at issue had been encrypted in accordance with NIST standards at the time of the exfi

Section 164.402(1)(i) provides that certain unintentional acquisitions, accesses, or uses of PHI by employees or persons acting under the authority of a covered entity or business associate are excluded from the definition of "breach," provided the acquisition, access, or use was made in good faith and within the scope of authority, and the PHI is not further used or disclosed in an impermissible manner. This excepti

VII. Recommended Actions and Timeline Based on the analysis set forth in this memorandum, we recommend that Quorum proceed with the following actions on the timeline specified below: This timeline is subject to adjustment based on developments in the forensic analysis, regulatory inquiries, or law enforcement engagement. Any material changes should be coordinated with Kevin Ostrowski and communicated to the Quorum te

VIII. Risk Assessment and Potential HHS-OCR Enforcement Considerations The filing of a breach notification with HHS-OCR for a breach affecting 41,203 individuals will be publicly posted on the HHS Breach Portal and may attract the attention of HHS-OCR enforcement personnel. HHS-OCR routinely reviews large-breach notifications and may open a compliance review or investigation, particularly for breaches of this magnitu