Contract analysis

I. BACKGROUND AND SUMMARY OF THE INCIDENT A. Quorum's Business and Relationship with Palomar Data Solutions Quorum Insurance Holdings Corp. is a top-25 United States insurance holding company, as measured by direct premiums written. Through its network of operating subsidiaries, Quorum is licensed to conduct insurance business in all fifty states, the District of Columbia, and Puerto Rico. Quorum offers a diversified

II. FORENSIC INVESTIGATION AND SCOPE OF PHI COMPROMISE A. Forensic Investigation Timeline The forensic investigation conducted by Graystone Forensics, under the direction of Calderwood & Harkness, proceeded on an expedited timeline given the significance of the incident and the potential involvement of PHI and other sensitive personal information. Graystone commenced its forensic analysis immediately upon engagement

III. HIPAA BREACH NOTIFICATION COMPLIANCE A. Notification to HHS-OCR Quorum filed its breach notification with the U.S. Department of Health and Human Services, Office for Civil Rights, Region I (Boston), on August 15, 2023, pursuant to 45 C.F.R. § 164.408, which requires covered entities to notify the Secretary of HHS following the discovery of a breach of unsecured PHI. For breaches affecting 500 or more individual

1. A brief description of what happened, including the date of the breach and the date of discovery of the breach. The letter described the unauthorized access to Palomar's systems beginning on or about March 14, 2023, the exfiltration of data files over the period through April 18, 2023, the discovery of the incident by Palomar on April 18, 2023, and Palomar's notification to Quorum on April 21, 2023.

2. A description of the types of unsecured PHI that were involved in the breach, including, as applicable, health conditions, diagnosis codes (ICD codes), and treatment information derived from workers' compensation and health-related claims files, along with the individual's name, date of birth, Social Security number, and (where applicable) driver's license number and financial account information.

3. Any steps the individual should take to protect himself or herself from potential harm resulting from the breach, including recommendations to monitor financial accounts and explanation of benefits statements for unauthorized activity, to consider placing fraud alerts or security freezes on credit files with the three major credit reporting agencies, and to remain vigilant for signs of identity theft or medical id

4. A brief description of what Quorum is doing to investigate the breach, mitigate harm to individuals, and protect against further breaches, including Quorum's engagement of forensic investigators, the offering of complimentary credit monitoring and identity theft protection services, and the implementation of enhanced data security measures with its business associate.

5. Contact procedures for individuals to ask questions or learn additional information, including a dedicated toll-free telephone number for a call center operated by Clearfield Notification Services LLC specifically to handle inquiries related to this incident. The call center was staffed with trained representatives prepared to answer questions about the incident, assist individuals with enrollment in credit monito

6. Contact information for the U.S. Department of Health and Human Services, Office for Civil Rights, including the HHS-OCR complaint hotline telephone number and website address, as required by 45 C.F.R. § 164.404(c)(1)(vi). A copy of the consumer notification letter (PHI version) is attached hereto as Enclosure 1. In addition to the notification letters, all 41,203 PHI-affected individuals (as well as the broader p

IV. QUORUM'S HIPAA COMPLIANCE PROGRAM Quorum recognizes that a comprehensive and well-maintained HIPAA compliance program is essential to the protection of PHI and to meeting its obligations as a covered entity under the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. Quorum maintains a robust compliance program that addresses all required elements of the HIPAA regulatory framework. The following is

V. POST-INCIDENT REMEDIATION MEASURES Quorum has undertaken significant remediation measures in the wake of this incident, directed both at holding Palomar accountable for its failures and at strengthening Quorum's own vendor risk management and incident response capabilities. These measures are designed to mitigate the risk of similar incidents in the future and to enhance the overall security posture of Quorum's bu

1. Cash Payment: Palomar agreed to make a lump-sum cash payment of $4,200,000 to Quorum, payable within forty-five (45) days of execution of the settlement agreement, in partial satisfaction of Quorum's indemnification claims.

2. Fee Reduction: Palomar agreed to an eighteen (18) month fee reduction of eight percent (8%), applied to all fees payable by Quorum to Palomar under the MSA during the eighteen-month period commencing on November 1, 2023. Based on the current annual contract value, this fee reduction represents effective savings to Quorum of approximately $1,956,000 over the eighteen-month period.

3. Independent Security Assessment: Palomar agreed to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's systems and security practices. The selection of the independent assessor is subject to Quorum's prior written approval. The results of each annual assessment are to be shared with Quorum, and Palomar is required to develop and im

4. Enhanced Security Measures: Palomar agreed to implement enhanced patch management capabilities and to deploy endpoint detection and response ("EDR") technology across all systems that process, store, or transmit Quorum data, with implementation to be completed within ninety (90) days of the execution of the settlement agreement. The total effective recovery from Palomar under the settlement agreement is $6,156,000

1. Accelerated Patch Management: The timeline for patching critical-severity vulnerabilities has been reduced from thirty (30) days to fourteen (14) days from the date a vendor patch is made available. For vulnerabilities that are under active exploitation (as determined by CISA, vendor advisories, or industry threat intelligence sources), patching must be completed within seventy-two (72) hours, or compensating cont

2. Endpoint Detection and Response: Palomar is required to deploy and maintain endpoint detection and response ("EDR") technology on all systems within its environment that process, store, or transmit Quorum data. EDR solutions must be managed and monitored on a 24/7 basis.

3. Quarterly Vulnerability Scanning: Palomar is required to conduct quarterly vulnerability scans of all systems within its environment that process, store, or transmit Quorum data, using industry-standard vulnerability scanning tools. Scan results, together with Palomar's remediation plans and timelines, must be provided to Quorum within fifteen (15) business days of each quarterly scan.

4. Annual Independent Security Assessment: As described above, Palomar is required to undergo an annual independent security assessment at Palomar's sole expense, with results shared with Quorum and remediation plans implemented within defined timelines.

5. Expedited Incident Notification: The timeline for Palomar to notify Quorum of a security incident has been reduced from forty-eight (48) hours to twenty-four (24) hours from the time Palomar becomes aware of an incident that may involve Quorum data. A summary of the enhanced data security provisions set forth in MSA Amendment 3 is attached hereto as Enclosure 5. C. Quorum Internal Remediation In addition to the ve

VI. CONSUMER PROTECTION MEASURES Quorum has taken substantial steps to protect the interests of the individuals affected by this breach and to mitigate the potential for harm. As described in Section III.B above, all 41,203 individuals whose PHI was compromised received HIPAA-compliant individual notification letters containing all required elements under 45 C.F.R. § 164.404(c). In recognition of the broader scope of

VII. COST SUMMARY AND INSURANCE COVERAGE Quorum has incurred significant costs in connection with its response to this incident. The following is a summary of the total incident response costs incurred as of the date of this letter: Quorum maintains a comprehensive cyber-liability insurance program that responded to this incident. The structure of Quorum's cyber-liability insurance tower is as follows: Primary Policy

VIII. COOPERATION AND ONGOING COMMITMENT Quorum Insurance Holdings Corp. remains firmly committed to full and transparent cooperation with the U.S. Department of Health and Human Services, Office for Civil Rights, in connection with this inquiry and any further review OCR may deem appropriate. Quorum takes its obligations as a covered entity under HIPAA with the utmost seriousness and is dedicated to the protection o

IX. CONCLUSION In summary, the breach of unsecured PHI that is the subject of this inquiry originated entirely within the network environment of Quorum's third-party business associate, Palomar Data Solutions, Inc., due to Palomar's failure to timely apply a vendor-issued patch for a known critical vulnerability (CVE-2023-0669) in its GoAnywhere MFT file transfer appliance. The threat actor exploited this vulnerabili