Contract analysis

I. INTRODUCTION AND OVERVIEW Quorum Insurance Holdings Corp. ("Quorum" or the "Company") respectfully submits this Exhibit B in support of its Response to the Joint Demand Letter issued by the Multistate Attorney General Coalition (the "Coalition") on September 8, 2023. This Exhibit serves two principal purposes: (a) to provide the Coalition with complete copies of all consumer notification letter versions disseminat

II. CONSUMER NOTIFICATION LETTER VERSIONS A. Overview of Letter Versions In coordination with Calderwood & Harkness LLP, Quorum developed five (5) distinct notification letter versions to address the varying types of personal information compromised and to satisfy the specific legal requirements of certain jurisdictions. The development of multiple letter versions reflected Quorum's commitment to providing affected i

1. A clear description of the data security incident, including the nature of the unauthorized access and the dates during which the incident occurred;

2. An identification of the specific types of personal information involved for the particular recipient;

3. A description of the steps Quorum has taken in response to the incident, including engagement of forensic investigators, notification of law enforcement, enhanced vendor security requirements, and remediation measures;

4. Recommendations for steps the individual can take to protect themselves, including monitoring credit reports, placing fraud alerts or security freezes with credit reporting agencies, and reviewing account statements;

5. An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services, together with a unique activation code and detailed enrollment instructions;

6. Toll-free call center contact information, including hours of operation, for individuals seeking additional assistance or information. All five letter versions were finalized between August 10 and August 12, 2023, following extensive legal review by Calderwood & Harkness LLP against each applicable state's breach notification statute. Printing and mailing commenced on August 18, 2023, and was completed on Septembe

III. STATE-BY-STATE NOTIFICATION COMPLIANCE CHECKLIST A. Methodology In preparation for Quorum's notification program, Calderwood & Harkness LLP prepared a comprehensive fifty-state breach notification law survey, which was completed on June 8, 2023. This survey catalogued the statutory requirements of each jurisdiction with respect to notification triggers, timing mandates, content requirements, delivery methods, an

IV. SUMMARY OF REGULATORY NOTIFICATIONS FILED A. Regulatory Notification Table In addition to consumer notifications, Quorum filed regulatory notifications with all applicable state attorneys general and regulators, as well as with HHS-OCR. The following table summarizes the regulatory notifications filed: Note: Individual filing dates and confirmation numbers for each of the remaining 19 states and D.C. are document

V. SUPPLEMENTAL COMPLIANCE DOCUMENTATION A. Substitute Notice / Website Posting In accordance with the substitute notice provisions of applicable state breach notification statutes, Quorum posted substitute notice language on its website (www.quoruminsurance.example) beginning on August 15, 2023. The website posting was intended as a supplemental notification measure, in addition to the individualized first-class mai

VI. CONCLUSION Quorum Insurance Holdings Corp. took prompt, thorough, and comprehensive steps to notify all 318,247 affected individuals across twenty-nine (29) states and the District of Columbia following the vendor-originated data security incident at Palomar Data Solutions, Inc. The notification program was designed and executed under the direction of Calderwood & Harkness LLP and implemented through Clearfield N

1. All consumer notifications met or exceeded the timing, content, and delivery requirements of every applicable state breach notification statute, including the most restrictive thirty-day deadline imposed by Florida law.

2. All regulatory notifications were timely filed with the appropriate state attorneys general, the Connecticut Insurance Department, and HHS-OCR, with no late filings in any jurisdiction.

3. All affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services, with an estimated enrollment rate of approximately 40% as of the date of this filing.

4. A dedicated toll-free call center was established and staffed to assist affected individuals with inquiries and enrollment for a twelve-week operational window.

5. Substitute notice was posted on Quorum's website as a supplemental notification measure, and a HIPAA-required media notice was distributed to prominent media outlets serving the affected states. Quorum respectfully submits that its notification program was fully compliant with all applicable legal requirements and reflects best practices in data breach consumer notification. Quorum remains committed to cooperating