Contract analysis

I. INTRODUCTORY STATEMENT AND PURPOSE Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), a covered entity under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations at 45 C.F.R. Parts 160 and 164, hereby submits this notification to the Secretary of Health and Human Services (the "Secretary") pursuant to Section 13402 of the Health Informati

II. IDENTIFICATION OF THE COVERED ENTITY Full Legal Name: Quorum Insurance Holdings Corp. Principal Business Address: 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Entity Type: Quorum is a Delaware corporation, incorporated under the laws of the State of Delaware and publicly traded on the Nasdaq Stock Market under the ticker symbol "QIHC." The Company is subject to reporting obligations under the Securities

III. IDENTIFICATION OF THE BUSINESS ASSOCIATE INVOLVED The breach at issue originated within the network environment of Quorum's business associate, Palomar Data Solutions, Inc. The following information identifies the business associate and describes the nature of the contractual relationship between Quorum and Palomar. Business Associate Name: Palomar Data Solutions, Inc. ("Palomar") Principal Business Address: 710

IV. DESCRIPTION OF THE BREACH — NATURE AND CIRCUMSTANCES A. Discovery and Timeline The following timeline sets forth the key events associated with the breach, from the date of initial unauthorized access through the completion of the forensic investigation and identification of affected individuals: Date Breach Treated as discovered for HIPAA Purposes: In accordance with 45 C.F.R. § 164.404(a)(2), the breach was tre

V. TYPES OF UNSECURED PROTECTED HEALTH INFORMATION INVOLVED The PHI compromised in the breach pertains to 41,203 individuals who are policyholders or claimants under Quorum's workers' compensation and health-related insurance claims lines. These individuals' claims data was processed by Palomar Data Solutions, Inc. on behalf of Quorum in connection with claims administration for Quorum's personal lines division. The

VI. NUMBER OF INDIVIDUALS AFFECTED Total number of individuals whose unsecured protected health information was breached: 41,203 These 41,203 PHI-affected individuals are a subset of the total population of 318,247 individuals across 29 states and the District of Columbia whose personally identifiable information was compromised in the breach. Geographic Distribution: The PHI-affected individuals reside in multiple s

VII. STEPS INDIVIDUALS SHOULD TAKE TO PROTECT THEMSELVES Quorum is advising all affected individuals, including all 41,203 individuals whose PHI was compromised, to take the following steps to protect themselves from potential harm resulting from the breach:

1. Monitor Health-Related Statements and Records. Affected individuals should carefully review their explanation of benefits ("EOB") statements, medical records, and insurance claims for any unauthorized or suspicious activity, including claims for services or treatments they did not receive, unfamiliar provider names, or other irregularities that may indicate unauthorized use of their health information. Any suspici

2. Review Credit Reports. Affected individuals should obtain and carefully review their credit reports from each of the three major credit reporting agencies — Harborview Enterprises, Penrose Group, and Penmark Enterprises — for accuracy and for any evidence of unauthorized accounts, inquiries, or other activity. Under federal law, individuals are entitled to one free credit report from each of the three agencies eve

3. Consider Fraud Alerts or Security Freezes. Affected individuals should consider placing an initial fraud alert on their credit files with each of the three major credit reporting agencies. An initial fraud alert is free and lasts for one year, and it requires creditors to take reasonable steps to verify the identity of anyone seeking credit in the individual's name. Alternatively, individuals may consider placing

4. Report Suspected Identity Theft. Affected individuals should report any suspected identity theft or unauthorized use of their personal or health information to their local law enforcement agency and to the Federal Trade Commission ("FTC"). Reports to the FTC can be filed online at www.identitytheft.gov or by calling 1-877-438-4338. Individuals may also report concerns to their state attorney general's office.

5. Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services. Quorum is offering all affected individuals, including all 41,203 PHI-affected individuals, complimentary 24-month credit monitoring and identity theft protection services through Clearfield Notification Services LLC. Enrollment details and activation codes are included in the individual notification letters being mailed to affected

6. Contact the HHS Office for Civil Rights. Affected individuals who believe that their health information privacy rights have been violated may file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Complaints may be filed online at www.hhs.gov/hipaa/filing-a-complaint, by mail to the Office for Civil Rights at the appropriate regional office, or by calling (800) 368-1019.

7. Remain Vigilant for Unsolicited Communications. Affected individuals should remain vigilant for any unsolicited communications — whether by mail, email, telephone, or text message — that request personal, financial, or health information. Such communications may be attempts at phishing, social engineering, or other forms of fraud. Individuals should not provide personal or health information in response to unsolic

VIII. STEPS QUORUM HAS TAKEN IN RESPONSE TO THE BREACH A. Investigation and Forensic Response Immediately upon receiving notification from Palomar Data Solutions on April 21, 2023, Quorum activated its incident response plan and convened its Incident Response Team, consisting of senior representatives from the Legal, Information Security, Privacy, Compliance, and Communications departments. The Incident Response Team

IX. CONTACT INFORMATION Quorum's Designated Contact for this Notification: Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Telephone: (860) 555-4200 Email: jliang@quorumholdings.com Outside Counsel Contact: Kevin Ostrowski, Partner Calderwood & Harkness LLP Privacy & Data Security Practice Group 1700 K Street NW, Suite 900 Washington, D.C. 200

X. REGULATORY NOTIFICATIONS TO OTHER ENTITIES In addition to this notification to the Secretary of Health and Human Services, Quorum has filed or is in the process of filing breach notifications with the following state regulatory authorities, in accordance with the applicable state breach notification statutes: All notifications to state regulatory authorities are being made in accordance with the requirements of th

XI. ENCLOSURES AND SUPPORTING MATERIALS The following documents are enclosed with this notification for the Office for Civil Rights' review: Enclosure A: Copy of the HIPAA-compliant consumer notification letter (PHI version) being mailed to the 41,203 individuals whose protected health information was compromised in the breach. This letter contains all elements required by 45 C.F.R. § 164.404(c), including a descript

XII. CERTIFICATION AND SIGNATURE The undersigned hereby certifies, on behalf of Quorum Insurance Holdings Corp., that the information provided in this notification is true, complete, and accurate to the best of the undersigned's knowledge, information, and belief, formed after reasonable inquiry. Quorum Insurance Holdings Corp. acknowledges its continuing obligation to cooperate with the Office for Civil Rights and t