Contract analysis

1. The reported breach originated at a third-party vendor, Palomar Data Solutions, Inc., which was acting as a business associate of the Entity. The breach did not originate within the Entity's own information systems or network environment.

2. The Entity had a Business Associate Agreement in place with Palomar Data Solutions, Inc., which was incorporated within the parties' Master Services Agreement framework, and which contained provisions addressing the safeguarding of protected health information, breach notification obligations, and the use and disclosure of PHI consistent with the requirements of 45 C.F.R. § 164.314(a)(2).

3. The Entity timely filed its breach notification with the Secretary of HHS within sixty (60) days of the date on which Quorum discovered (or reasonably should have known of) the breach, as required by 45 C.F.R. § 164.408. The breach notification was filed on August 15, 2023.

4. Individual notifications to affected individuals were mailed in compliance with 45 C.F.R. § 164.404 during the period of August 18, 2023, through September 15, 2023, which was within the sixty (60) day notification window prescribed by the Breach Notification Rule.

5. The Entity provided the required media notice pursuant to 45 C.F.R. § 164.406, applicable to breaches of unsecured PHI affecting more than five hundred (500) individuals in a single state or jurisdiction. The media notice was issued on August 15, 2023.

6. The notification letters to affected individuals contained all elements required by 45 C.F.R. § 164.404(c), including: (a) a brief description of the breach, including the date of the breach and the date of discovery; (b) a description of the types of unsecured PHI involved in the breach; (c) steps individuals should take to protect themselves from potential harm resulting from the breach; (d) a brief description

7. The Entity offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all individuals affected by the breach.

8. The Entity took accountability measures with respect to its business associate, including the initiation of contractual indemnification demands and the imposition of enhanced security requirements upon the business associate.

9. The Entity represented that it is reviewing and strengthening its vendor risk management and information security programs in response to the incident, including its processes for evaluating and monitoring the security practices of its business associates. [C&H Annotation — Alan Burke: "This is the critical passage of the letter. OCR expressly credits nine distinct factors that collectively reflect Quorum's overal

1. Multistate Attorneys General Inquiry. The multistate inquiry, led by the Connecticut Attorney General's Office and joined by the attorneys general of Massachusetts, New York, and New Jersey, closed without enforcement action on November 22, 2023. The closure letter from the Connecticut AG's office confirmed that the participating states would take no further action in connection with the breach. (See C&H Matter Fi

2. Connecticut Insurance Department Inquiry. The Connecticut Insurance Department ("CID") inquiry, initiated following the breach notification submitted to CID on August 15, 2023, closed without enforcement action on November 28, 2023. The CID closure letter confirmed that the Department would take no further regulatory action in connection with the breach. (See C&H Matter File 1025-00006-REG-CID, Closure Letter date

3. HHS-OCR Breach Report Review. This OCR no-further-action letter, dated November 30, 2023, closes the third and final regulatory track. All three regulatory tracks have now closed without enforcement action, fines, penalties, consent orders, corrective action plans, or resolution agreements. This is a highly favorable outcome for Quorum. Combined with the Palomar Data Solutions settlement agreement executed on Octo

1. Business Associate Characterization. OCR's characterization of Palomar as a business associate and the breach as BA-originated is favorable and shifts primary responsibility for the underlying security failure to Palomar under the HIPAA framework. Under 45 C.F.R. § 164.314(a)(2)(i), business associates are independently required to comply with the Security Rule with respect to the electronic PHI they create, recei

2. Business Associate Agreement. The existence and terms of the BAA (incorporated as Exhibit F to the Quorum-Palomar Master Services Agreement, executed January 12, 2021) were cited as a positive factor by OCR. This reinforces the critical importance of maintaining robust, current BAA terms in all vendor agreements involving PHI. The BAA's inclusion of breach notification obligations (requiring Palomar to notify Quor

3. Timely Notification. OCR expressly credited Quorum's timely notification across all three required channels: (a) the breach report to the Secretary of HHS, filed August 15, 2023; (b) individual notification letters mailed between August 18, 2023, and September 15, 2023; and (c) media notice issued on August 15, 2023. All three notifications were completed within the sixty (60) day window required by 45 C.F.R. §§ 1

4. Notification Content. OCR confirmed that the individual notification letters met all content requirements of 45 C.F.R. § 164.404(c). This validates the C&H drafting approach, which was based on a comprehensive review of OCR guidance, prior OCR enforcement actions involving deficient notifications, and best practices in breach notification communications.

5. Credit Monitoring and Remediation. OCR expressly credited Quorum's offer of 24 months of complimentary credit monitoring and identity theft protection services to all affected individuals, as well as the vendor accountability measures (contractual indemnification demands and enhanced security requirements) taken against Palomar. The 24-month credit monitoring period exceeds the 12-month period that is more commonl

1. Client Distribution. Forward a clean (unannotated) copy of the OCR letter to Thomas R. Whitfield (General Counsel, Quorum Insurance Holdings Corp.), Jennifer Liang (Chief Privacy Officer), and David Naranjo (Chief Information Security Officer) under cover email from Kevin Ostrowski. The cover email should summarize the significance of the closure and note the key takeaways outlined in Annotation Block 2 above. Sar

2. Board Audit Committee Briefing. Include the OCR closure in the final Board Audit Committee briefing memo. The memorandum to Franklin Reeves (Chair, Audit Committee of the Board of Directors) dated November 29, 2023 (C&H Memo 1025-00006-MEM-018) should be supplemented with a brief addendum reflecting the November 30, 2023, OCR closure. Alan Burke to prepare the addendum for Kevin Ostrowski's review and transmittal.

3. Matter File Documentation. File the original OCR letter in the matter documentation under the regulatory correspondence section (C&H Matter File 1025-00006-REG-OCR). The annotated copy should be maintained in a separate subfolder designated for attorney work product. Both documents should be reflected on the privilege log.

4. No Further Response to OCR. No further response to OCR is required. The letter expressly states that no further response is necessary.

5. Implementation of Remediation Recommendations. Recommend that Quorum implement the enhanced vendor risk management and BAA provisions outlined in the Post-Incident Lessons Learned & Remediation Recommendations Memo dated November 30, 2023 (C&H Memo 1025-00006-MEM-019). The OCR letter's concluding language encouraging ongoing assessment of BAAs and vendor security practices reinforces the importance of these recomm

6. Document Retention. All breach-related documentation — including forensic reports (Graystone Digital Forensics & Incident Response report dated July 14, 2023), notification records (copies of all individual notification letters, media notice, and OCR breach report), regulatory correspondence (AG inquiry correspondence, CID inquiry correspondence, and OCR correspondence), settlement agreements (Palomar settlement a

7. Ongoing Monitoring. Monitor for any individual HIPAA complaints filed with OCR related to this breach. OCR expressly reserved the right to investigate complaints from affected individuals. While we have no reason to expect such complaints, the possibility cannot be excluded, particularly given the size of the affected population (41,203 individuals). If Quorum receives any correspondence from OCR indicating that a

1. Matter File. Save this annotated copy to Matter No. 1025-00006, Regulatory Correspondence subfolder, under the HHS-OCR designation (C&H Matter File 1025-00006-REG-OCR). File as document number OCR-003 (following the initial breach report filing as OCR-001 and the October 5 inquiry response as OCR-002).

2. Privilege Log. Add this annotated copy to the privilege log under the attorney work product category. The entry should reflect: (a) document title: "HHS-OCR No Further Action Letter — Calderwood & Harkness Internal Annotated Copy"; (b) date: December 1, 2023; (c) author: Alan Burke; (d) privilege basis: attorney work product (mental impressions, conclusions, opinions, and legal theories of counsel); (e) descriptio

3. Client Distribution — Clean Copy Only. Send a clean (unannotated) copy of the OCR letter — i.e., the letter as received from OCR, without any C&H annotations — to Thomas R. Whitfield (General Counsel, Quorum), Jennifer Liang (CPO, Quorum), and David Naranjo (CISO, Quorum). The clean copy should be transmitted under a cover email from Kevin Ostrowski. Please prepare a draft cover email for Kevin's review by 10:00 a

4. Do Not Transmit Annotated Version to Client. The annotated version of this letter — i.e., this document — must not be transmitted to the client or to any person outside of Calderwood & Harkness LLP. The annotations constitute internal attorney work product reflecting the mental impressions and legal analysis of C&H attorneys and are maintained solely within the firm's files.

5. Regulatory Notification Tracker. Update the Regulatory Notification Tracker (the master tracking spreadsheet finalized on August 25, 2023, maintained on the C&H shared drive at Matter 1025-00006/Trackers/) to reflect the OCR closure date of November 30, 2023. All three regulatory tracks should now show a status of "Closed — No Action" with the respective closure dates (AG: November 22, 2023; CID: November 28, 2023