Contract analysis

1. The Department has completed its review and is closing the inquiry without enforcement action, penalties, or consent orders.

2. The Department affirmatively finds that Quorum maintained an information security program consistent with the requirements of Conn. Gen. Stat. § 38a-999b.

3. The Department acknowledges that Quorum timely filed its cybersecurity event notification with the Department.

4. The Department credits Quorum's vendor oversight practices, including the contractual data security requirements imposed on Palomar and the enhanced security provisions formalized in MSA Amendment 3.

5. The Department notes with approval the remediation measures Quorum implemented following the incident.

6. No ongoing monitoring, reporting, or compliance verification obligations are imposed. This outcome is fully consistent with the cooperative engagement strategy that Calderwood & Harkness pursued throughout the matter, in coordination with Quorum's leadership. The closure is favorable and unqualified in all material respects. The standard reservations of general supervisory authority and the "at this time" qualifie

I. Opening — Purpose of Letter The Connecticut Insurance Department ("Department") has completed its review of the cybersecurity event reported by Quorum Insurance Holdings Corp. ("Quorum") on August 14, 2023. Quorum's initial notification was filed with the Department pursuant to Section 38a-999b of the Connecticut General Statutes, commonly referred to as the Connecticut Insurance Data Security Law. The Department

II. Summary of the Department's Findings A. Nature of the Cybersecurity Event Based on the information provided by Quorum and its counsel, the Department understands the relevant facts to be as follows. The cybersecurity event originated not within Quorum's own information systems or network environment, but within the systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party claims-processing vendor engaged

III. Formal Closure Based on its review of all information provided by Quorum and its counsel in connection with this inquiry, the Department is closing its inquiry into this cybersecurity event without further action. The Department considers this matter resolved. Nothing in this letter shall be construed as a waiver or limitation of the Department's general supervisory and examination authority under Title 38a of t

I. Overall Assessment The Connecticut Insurance Department's closure letter of November 28, 2023, represents a fully favorable outcome for Quorum Insurance Holdings Corp. The key elements of this assessment are as follows: No Enforcement Action. The Department closed its inquiry without initiating any enforcement proceeding, issuing any administrative order, or imposing any penalty or fine. No Consent Order or Agreem

II. Key Favorable Language to Preserve The following specific findings and statements in the Department's closure letter should be highlighted, preserved, and referenced in future filings, briefings, and — if appropriate — litigation or regulatory defense materials:

1. Information Security Program Compliance. "The Department finds that Quorum maintained an information security program that was consistent with the requirements of Conn. Gen. Stat. § 38a-999b." This is the Department's central compliance finding and the single most valuable statement in the letter from a defensive perspective.

2. Timely Notification. "The Department is satisfied that Quorum's August 14, 2023 notification was filed within the applicable statutory timeframe." This confirms that Quorum met its reporting obligation without deficiency.

3. Vendor Accountability Measures. The Department's detailed acknowledgment of the MSA provisions, the indemnification settlement, and the MSA Amendment 3 enhancements. These passages demonstrate that the Department reviewed and was satisfied with Quorum's approach to vendor accountability.

4. Cooperation and Professionalism. "The Department thanks Quorum and its counsel at Calderwood & Harkness LLP for their cooperation and responsiveness throughout the inquiry process. The Department appreciates the thoroughness and professionalism with which Quorum addressed the Department's questions and requests for information." This language, while procedural in nature, is useful in demonstrating that the regulat

III. Caveats and Standard Reservations The closure letter contains several standard reservations and qualifiers that are common to Department closure communications. None of these raise substantive concern: "At this time" qualifier. The phrase "without further action at this time" appears in the opening paragraph. As noted in Annotation 1, this is standard Department language. It does not reflect any continuing conce

IV. Implications for the Broader Matter The Department's closure letter has several important implications for the broader Palomar matter: Litigation Posture. This closure strengthens Quorum's position in any future litigation, including the potential consumer class action(s) that may be filed in connection with the Palomar incident. A finding by the relevant state insurance regulator that Quorum's information securi

V. Recommended Next Steps Based on the foregoing analysis, we recommend the following next steps:

1. Circulate annotated copy. This annotated copy and analysis should be circulated to Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), David Naranjo (Chief Information Security Officer), and Margaret D. Calloway (Chief Compliance Officer). Distribution should be made under cover of a privilege notice and with instructions that the annotated copy not be further distributed without prior c

2. Board Audit Committee briefing. Include this closure letter and the summary analysis in the Board Audit Committee briefing package being prepared for the November 29, 2023 matter resolution memorandum. The briefing should highlight the two regulatory closures achieved to date and the anticipated HHS-OCR determination.

3. Retain original letter. The original closure letter should be retained in the Calderwood & Harkness privileged matter file (Matter No. 1025-00006) and in Quorum's legal department files. Copies should be indexed and accessible for future reference.

4. Regulatory notification tracker. The closure should be logged in the regulatory notification tracker and confirmation log maintained by Sara Hendricks on the Calderwood & Harkness matter team. The tracker entry should reflect the date of closure (November 28, 2023), the inquiry reference number (CID-CYB-2023-04187), the identity of the examining official (Richard Nakamura), the outcome (closed, no action), and a c

5. Monitor for HHS-OCR determination. Continue to monitor for the HHS-OCR final determination, which is anticipated by November 30, 2023. Upon receipt, a similar annotated analysis should be prepared and circulated.

6. Matter closure memorandum. Upon receipt of all three regulatory closures, proceed with the preparation of the comprehensive matter closure memorandum and post-incident lessons learned deliverables. These documents will serve as the definitive internal record of the Palomar matter's regulatory dimension and will inform Quorum's ongoing information security and vendor risk management practices.

VI. Document Retention Note The original Connecticut Insurance Department closure letter dated November 28, 2023, is to be retained in the Calderwood & Harkness LLP matter file (Matter No. 1025-00006) and in Quorum Insurance Holdings Corp.'s legal department files. Both copies should be maintained indefinitely, or until such time as a formal document retention determination is made in connection with the overall matt