MEMORANDUM
PRIVILEGED & CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
December 1, 2023
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
FROM: Alan Burke, Lead Associate, Calderwood & Harkness LLP
RE: Document Retention and Privilege Log Protocol — Palomar Data Solutions Security Incident Matter (C&H Matter No. 1025-00006)
CC: Kevin Ostrowski, Responsible Partner, Calderwood & Harkness LLP Sara Hendricks, Working Associate, Calderwood & Harkness LLP
Right-click to update Table of Contents
I. Purpose and Background
The purpose of this memorandum is to establish a comprehensive protocol for the retention, organization, classification, and protection of all documents generated, received, or collected during Calderwood & Harkness LLP's ("C&H") representation of Quorum Insurance Holdings Corp. ("Quorum" or the "Company") in connection with the data security incident originating from Palomar Data Solutions, Inc. ("Palomar"). This protocol is intended to serve as the definitive guide for Quorum's legal department and C&H personnel in managing the documentary record of this engagement going forward.
C&H Matter No. 1025-00006 was opened on May 4, 2023, and the engagement was formally concluded as of the date of this memorandum, December 1, 2023, yielding a total engagement duration of approximately 212 days, or roughly seven months. During this period, C&H provided legal counsel and representation to Quorum across multiple workstreams, including incident assessment, forensic investigation oversight, regulatory notification compliance, regulatory defense, vendor indemnification and settlement negotiation, insurance claim coordination, and board-level reporting.
By way of background, the underlying incident involved a threat actor's exploitation of CVE-2023-0669, a remote code execution vulnerability in Severin Corporation's GoAnywhere Managed File Transfer ("MFT") platform, within Palomar's file transfer appliance infrastructure. The exploitation resulted in unauthorized access to Quorum data maintained by Palomar during a window of approximately March 14, 2023 through April 18, 2023—a period of approximately 35 days. The forensic investigation, conducted by Graystone Forensics LLC under the direction of C&H counsel, confirmed that the compromised data included personally identifiable information ("PII"), protected health information ("PHI"), and financial data belonging to approximately 318,247 individuals across 29 states and the District of Columbia.
As of the date of this memorandum, all regulatory tracks arising from the incident have been resolved favorably. The multistate attorney general coalition comprising attorneys general from 29 states issued a closure letter dated November 22, 2023, declining to pursue enforcement action. The Connecticut Insurance Department closed its inquiry without enforcement action on November 28, 2023. The U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") issued its closure notification on November 30, 2023. Additionally, the indemnification settlement between Quorum and Palomar was fully executed on October 27, 2023, providing meaningful financial recovery for the Company.
Notwithstanding these favorable resolutions, Quorum must maintain the integrity of its documentary record and the protections afforded by applicable privileges against the possibility of future adverse developments. Such developments could include, without limitation: (a) class action or individual lawsuits brought by affected consumers or plan participants; (b) regulatory re-examination or reopening of any closed investigation; (c) insurance audits or coverage disputes with Atlas Mutual Insurance Company ("Atlas Mutual") or Pinnacle Surplus Lines Insurance Corp. ("Pinnacle"); or (d) future contractual disputes with Palomar arising from the settlement agreement or the amended Master Services Agreement. The foreseeable risk of such matters warrants continued vigilance regarding document preservation and privilege maintenance.
This memorandum should be read in conjunction with the Privilege Protocol Memo dated May 5, 2023, issued by Kevin Ostrowski at the outset of the engagement, which established initial guidelines for privilege-protected communications during the active phases of the representation. To the extent there is any inconsistency between this memorandum and the May 5, 2023 Privilege Protocol Memo, this memorandum controls as the more current and comprehensive statement of protocol.
II. Document Categories and Classification Framework
All documents generated, received, or collected during the C&H engagement have been organized into ten (10) discrete categories for purposes of retention, privilege classification, and future retrieval. Each category is described in detail below, together with the applicable privilege or confidentiality designation. The classification framework is intended to facilitate efficient privilege review and log preparation in the event that any future proceeding requires document production.
A. Category 1: Attorney-Client Privileged Communications
Category 1 encompasses all communications between C&H attorneys and Quorum personnel made for the purpose of seeking or rendering legal advice in connection with the Palomar data security incident. These communications constitute the core of the attorney-client privileged materials in this matter and must be maintained with the highest degree of protection.
The C&H attorneys who participated in substantive communications with Quorum during this engagement include Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner, with substantive involvement in insurance coverage analysis), Alan Burke (Lead Associate), and Sara Hendricks (Working Associate). The Quorum personnel who communicated with C&H for purposes of seeking or receiving legal advice include Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), David Naranjo (Chief Information Security Officer), Margaret D. Calloway (Chief Compliance Officer), Priya Deshmukh (Vice President, Vendor Risk Management), Robert Wentworth (Chief Financial Officer), and Franklin Reeves (Chair, Board Audit Committee).
In addition to direct attorney-client communications, Category 1 includes internal Quorum communications in which C&H's legal advice was forwarded, discussed, summarized, or acted upon by members of the Quorum team. Such communications are protected by the attorney-client privilege to the extent that they reflect, reference, or incorporate the substance of legal advice rendered by C&H.
Category 1 also specifically includes the four Board Audit Committee Briefing Memoranda prepared by C&H for delivery to Franklin Reeves in his capacity as Chair of the Audit Committee of Quorum's Board of Directors. These memoranda were dated May 11, 2023 (Initial Incident Briefing), July 21, 2023 (Forensic Findings and Notification Analysis Briefing), October 16, 2023 (Regulatory Status and Settlement Update Briefing), and November 29, 2023 (Matter Closure and Post-Incident Recommendations Briefing). Each memorandum was prepared by C&H attorneys for the purpose of providing legal advice to the Board Audit Committee regarding the incident and the Company's legal exposure, and each is marked as attorney-client privileged.
Finally, Category 1 includes communications with Quorum's cyber insurance broker, Sandra Whitmore-Kim at Whitmore Risk Advisors Inc., to the extent such communications were made at the direction of counsel for the purpose of rendering or facilitating legal advice. Not all communications with Ms. Whitmore-Kim may be privileged; those that relate purely to insurance brokerage functions without a legal advice component should be classified as non-privileged business communications and logged accordingly.
B. Category 2: Attorney Work Product
Category 2 encompasses all legal analyses, strategy memoranda, legal research, and other materials prepared by C&H attorneys in anticipation of litigation or regulatory proceedings arising from the Palomar data security incident. These materials are protected by the work product doctrine, and many also reflect the mental impressions, conclusions, opinions, and legal theories of C&H counsel, thereby qualifying as opinion work product entitled to the highest degree of protection.
The specific documents comprising Category 2 include, but are not limited to, the following:
1. Initial Incident Assessment Memo (May 8, 2023) — C&H's preliminary legal assessment of the incident and Quorum's potential exposure across regulatory, litigation, and contractual dimensions.
2. Cyber-Insurance Coverage Analysis Memo (May 9, 2023) — Analysis of Quorum's available coverage under the Atlas Mutual primary policy and Pinnacle excess layer, including assessment of policy exclusions, notice requirements, and anticipated coverage positions.
3. Contractual Analysis Memo on Palomar MSA (May 12, 2023) — Detailed analysis of Palomar's obligations under the Master Services Agreement (including Sections 9.4, 12.2, and 14.2), breach of contract theories, and the contractual indemnification framework.
4. 50-State Breach Notification Law Survey (June 8, 2023) — Comprehensive survey of breach notification requirements across all 50 states and the District of Columbia, with specific identification of obligations triggered by the compromised data categories and the 29 affected jurisdictions.
5. SEC Disclosure Analysis Memo (July 19, 2023) — Assessment of Quorum's disclosure obligations under applicable SEC rules and guidance, including analysis of materiality and recommended disclosure language.
6. Notification Trigger Analysis Memo (July 20, 2023) — Multi-jurisdictional analysis determining which state notification statutes were triggered by the categories of data compromised, the number of affected individuals per state, and the applicable notification deadlines.
7. HIPAA Breach Notification Analysis Memo (July 22, 2023) — Analysis of Quorum's notification obligations under the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–414, with respect to the 41,203 individuals whose PHI was compromised.
8. CT Insurance Data Security Law Analysis Memo (July 22, 2023) — Analysis of Quorum's obligations under Connecticut's Insurance Data Security Law (Conn. Gen. Stat. § 38a-38 et seq.) and the Connecticut Insurance Department's regulatory expectations.
9. NY SHIELD Act Compliance Memo (July 23, 2023) — Assessment of compliance obligations under the New York Stop Hacks and Improve Electronic Data Security Act (N.Y. Gen. Bus. Law § 899-aa) and the reasonable safeguards requirements thereunder.
10. California CCPA/CMIA Analysis Memo (July 24, 2023) — Analysis of Quorum's obligations and potential private right of action exposure under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) and the Confidentiality of Medical Information Act (Cal. Civ. Code § 56 et seq.).
11. Negotiation Strategy Memo (August 28, 2023) — C&H's recommended negotiation strategy for the Palomar indemnification settlement, including analysis of Quorum's leverage, target settlement range, and proposed deal structure.
12. Summary of Settlement Terms Memo (October 28, 2023) — Post-execution summary and legal analysis of the Palomar settlement agreement and MSA Amendment 3, with assessment of the recovery achieved relative to total incident costs.
Category 2 also includes C&H's annotations, comments, marginal notes, and internal analyses on documents received from third parties. Specific examples include C&H's annotations on the multistate attorney general joint demand letter dated September 8, 2023; C&H's annotations on Palomar's response letter dated July 7, 2023; and C&H's annotations on the closure letters received from the multistate attorney general coalition, the Connecticut Insurance Department, and HHS-OCR. While the underlying third-party documents are generally non-privileged, C&H's annotations on those documents constitute work product reflecting counsel's mental impressions, legal analysis, and strategic thinking, and should be treated as opinion work product.
Additionally, Category 2 encompasses all draft term sheets and negotiation positions prepared by C&H in connection with the Palomar settlement negotiations, to the extent such documents contain or reflect C&H's strategic recommendations, legal analysis, or mental impressions.
C. Category 3: Privileged Forensic Investigation Materials
Category 3 encompasses all reports, communications, data, and analyses generated by Graystone Forensics LLC ("Graystone"), the digital forensics firm retained to conduct the technical investigation of the Palomar data security incident. The Graystone engagement was conducted by Dr. Nolan Briggs (Lead Forensic Investigator) and Kendra Faulkner (Senior Forensic Analyst) and their supporting team. Graystone was retained under the C&H attorney-client privilege umbrella pursuant to the Outside Counsel Retention Letter dated May 5, 2023, which expressly provided that Graystone was being engaged at the direction of counsel, at counsel's request, and for the purpose of assisting C&H in providing legal advice to Quorum regarding the incident.
The specific Graystone deliverables comprising Category 3 include:
1. Graystone Scope of Work & Investigation Plan (May 7, 2023) — The initial scope document and investigation plan approved by C&H and Quorum, defining the parameters of Graystone's forensic analysis.
2. Graystone Preliminary Forensic Findings Memo (June 2, 2023) — Graystone's interim findings memo identifying initial indicators of compromise, the attack vector (CVE-2023-0669 exploitation), the approximate intrusion timeline, and preliminary data exposure assessment.
3. Graystone Final Forensic Report (July 14, 2023) — Graystone's comprehensive final report documenting the complete forensic investigation, including confirmed attack methodology, intrusion timeline, data exfiltration analysis, affected data categories, affected individual counts by state, and remediation recommendations.
4. C&H Analysis of Preliminary Findings (June 5, 2023) — C&H's legal analysis of Graystone's preliminary findings, including assessment of notification trigger implications and initial litigation exposure.
5. C&H Summary & Legal Analysis of Final Forensic Findings (July 18, 2023) — C&H's comprehensive legal analysis of Graystone's final report, including assessment of regulatory notification obligations, litigation exposure, and settlement leverage vis-à-vis Palomar.
In addition to the foregoing deliverables, Category 3 includes all underlying forensic data, disk images, log files, network traffic captures, malware samples, analyst working notes, chain-of-custody documentation, and other technical materials transmitted by Graystone to C&H during the course of the investigation. These materials constitute the raw evidentiary foundation for Graystone's expert analysis and findings.
It is important to note that the Category 3 materials carry dual protection under both the attorney-client privilege and the work product doctrine. The dual protection arises because Graystone was retained at the direction of counsel, at counsel's request, and for the express purpose of providing information necessary for C&H to render legal advice to Quorum regarding the incident. The forensic investigation was not conducted for ordinary business purposes, nor was it a routine IT audit or compliance review. Rather, it was commissioned specifically to support C&H's legal analysis and to prepare for anticipated litigation and regulatory proceedings. Accordingly, the Graystone materials should be afforded the strongest available protection, and any future challenge to the privilege designation of these materials should be resisted vigorously.
D. Category 4: Common Interest Materials
Category 4 encompasses materials shared between Quorum (and its counsel, C&H) and Atlas Mutual Insurance Company (and its claims adjuster, Paul Enriquez) under the Common Interest Agreement dated May 10, 2023. The common interest privilege protects communications and shared materials between parties who share a common legal interest from waiver of the attorney-client privilege or work product protection that might otherwise result from disclosure to a third party.
The Common Interest Agreement covers materials shared in connection with Atlas Mutual Cyber Liability Insurance Policy No. CYB-2023-041587 and the related Claim No. CYB-CLM-2023-05892. The Atlas Mutual policy provides a per-occurrence limit of $15,000,000, subject to a self-insured retention ("SIR") of $2,500,000. Materials shared between Quorum and Atlas Mutual's claims personnel for the purpose of analyzing coverage, assessing liability, and coordinating a joint defense or response to potential claims by third parties fall within the scope of the Common Interest Agreement and retain their privileged status as to all other third parties.
Category 4 also potentially encompasses communications involving Pinnacle Surplus Lines Insurance Corp. ("Pinnacle") and its claims contact, Lisa Garner, to the extent covered by the Common Interest Agreement or by a separate common interest arrangement. Pinnacle provides the excess cyber liability layer under Policy No. XS-CYB-2023-7812, with a $25,000,000 excess limit attaching above the Atlas Mutual primary layer. Given that Pinnacle's coverage exposure may be implicated depending on the ultimate cost of the incident and any future litigation, the common interest in coordinating a unified response to third-party claims extends logically to the excess carrier.
It must be emphasized that sharing of privileged materials under the common interest doctrine does not waive the privilege as to third parties. The privilege remains fully intact against all parties outside the common interest group. However, care should be taken to ensure that all materials shared with Atlas Mutual or Pinnacle are transmitted pursuant to and with reference to the Common Interest Agreement, and that the sharing is documented to facilitate future privilege log entries.
E. Category 5: Regulatory Submissions and Correspondence (Non-Privileged)
Category 5 encompasses all regulatory notification filings, responses, and correspondence submitted to or received from governmental regulators in connection with the Palomar data security incident. The final, submitted versions of these documents are generally non-privileged, as they were voluntarily disclosed to regulatory bodies in the course of compliance with legal obligations or in response to regulatory inquiries.
The regulatory filings comprising Category 5 include the following:
• Connecticut Attorney General notification (August 14, 2023), filed pursuant to Conn. Gen. Stat. § 36a-701b.
• Connecticut Insurance Department notification (August 14, 2023), filed pursuant to Conn. Gen. Stat. § 38a-999b.
• HHS-OCR notification (August 15, 2023), filed pursuant to 45 C.F.R. § 164.408, covering the 41,203 individuals whose PHI was compromised.
• New York Attorney General notification (August 16, 2023), filed pursuant to N.Y. Gen. Bus. Law § 899-aa.
• California Attorney General notification (August 16, 2023), filed pursuant to Cal. Civ. Code § 1798.82.
• Massachusetts Attorney General notification (August 17, 2023), filed pursuant to Mass. Gen. Laws ch. 93H, § 3.
• Remaining 24 state notifications (filed between August 17 and August 25, 2023), each filed pursuant to the applicable state breach notification statute.
In addition to the initial notification filings, Category 5 includes the following regulatory response and correspondence materials:
• Multistate AG Response Brief and Exhibits A–D (October 13, 2023), submitted in response to the multistate attorney general joint demand letter dated September 8, 2023.
• Supplemental Information Submission to Multistate AG (November 3, 2023), providing additional information requested by the coalition.
• CT Insurance Department Inquiry Response (September 22, 2023), responding to the Department's initial inquiry regarding Quorum's compliance with the Connecticut Insurance Data Security Law.
• CT Insurance Department Supplemental Submission (October 20, 2023), providing additional information and documentation requested by the Department.
• HHS-OCR Inquiry Response (October 5, 2023), responding to OCR's request for additional information regarding the HIPAA-related aspects of the incident.
• Closure/no-action letter from multistate AG (received November 22, 2023).
• Closure/no-action letter from CT Insurance Department (received November 28, 2023).
• Closure/no-action letter from HHS-OCR (received November 30, 2023).
An important distinction must be maintained between the final, submitted versions of these regulatory documents and the internal draft versions. While the final submitted versions are generally non-privileged (having been voluntarily disclosed to the regulators), internal draft versions of regulatory submissions bearing C&H attorney edits, comments, markup, and strategic annotations retain their privilege and work product protections. Strategy memoranda prepared by C&H in connection with the drafting and filing of these submissions likewise retain their privilege and work product protections. Accordingly, the privilege log should carefully distinguish between final submitted versions (non-privileged) and internal drafts with counsel's input (privileged/work product).
F. Category 6: Consumer Notification Materials (Non-Privileged)
Category 6 encompasses the final versions of all consumer-facing notification materials and related vendor engagement documentation. As with Category 5, the final versions of these materials are generally non-privileged because they were disseminated to affected individuals and the public.
The consumer notification letters were prepared in multiple versions to address different data categories and state-specific requirements:
• General PII version — for individuals whose non-SSN, non-financial PII was compromised.
• SSN + Financial Data version — for the approximately 84,619 individuals whose Social Security numbers and/or financial account data were compromised.
• PHI/HIPAA version — for the 41,203 individuals whose protected health information was compromised, incorporating HIPAA-required content elements.
• California-specific version — incorporating California-specific requirements under Cal. Civ. Code § 1798.82 and the California Attorney General's recommended notification format.
• Massachusetts-specific version — incorporating Massachusetts-specific content requirements under Mass. Gen. Laws ch. 93H, § 3 and 201 CMR 17.00.
Category 6 further includes the substitute notice and website posting language published on August 15, 2023, as well as the call center script and frequently asked questions ("FAQ") document prepared for use by Clearfield Notification Services LLC ("Clearfield") in operating the consumer response call center, delivered to Clearfield on August 14, 2023.
The Clearfield Services Agreement and Statement of Work, executed on August 6, 2023, is also classified within Category 6. Under this agreement, Clearfield was engaged to provide the following services in connection with the consumer notification process:
• Notification letter printing and mailing services: $636,000
• Call center operations (12-week operational window): $478,500
• 24-month credit monitoring and identity theft protection enrollment and administration: $2,100,000 (flat fee)
• Total Clearfield engagement cost: $3,214,500
The Regulatory Notification Tracker and Confirmation Log, finalized on August 25, 2023, is also classified within Category 6. This document provides a comprehensive record of all consumer notification mailings, including mailing dates, affected individual counts by state, notification version used, and delivery confirmation data.
As with Category 5, internal draft versions of consumer notification materials bearing C&H attorney edits, comments, markup, or strategic annotations retain their work product protections. The final, distributed versions are non-privileged; the drafts reflecting counsel's legal judgment are protected.
G. Category 7: Vendor Indemnification / Settlement Materials
Category 7 encompasses all documents related to Quorum's indemnification demand, negotiation, and settlement with Palomar. This category includes both privileged and non-privileged materials, and the privilege classification of each document must be carefully assessed based on its nature and the circumstances of its creation and dissemination.
The following documents are classified as non-privileged, as they were communicated to or exchanged with adverse parties:
• Breach of Contract Demand Letter to Palomar (June 20, 2023), addressed to Derek Copeland (Palomar General Counsel) and Palomar's outside counsel at Mercer, Haight & Dunlop LLP (Catherine Langford) — the sent version is a non-privileged external communication.
• Palomar's Initial Response (July 7, 2023), received from Catherine Langford at Mercer, Haight & Dunlop LLP — the received document is non-privileged. However, C&H's annotations on Palomar's response are privileged work product.
• C&H Rebuttal Letter (July 25, 2023), transmitted to Palomar's counsel — the sent version is non-privileged.
• Exchanged Settlement Term Sheets (September 18, 2023 and October 15, 2023) — the versions exchanged with Palomar's counsel are non-privileged to the extent they reflect negotiated positions. However, internal draft versions containing C&H strategy notes, redlined alternatives, and counsel's mental impressions are work product.
• Executed Settlement Agreement and Mutual Release (October 27, 2023) — a non-privileged contractual document reflecting the final settlement terms. The key terms of the settlement include: (i) Palomar's payment of $4,200,000 in cash to Quorum within 30 days of execution; (ii) an 18-month fee reduction of 8% on Palomar's services, representing an estimated value of $1,956,000; (iii) engagement by Palomar of an independent third-party security assessor within 60 days; and (iv) implementation by Palomar of enhanced patch management protocols and endpoint detection and response capabilities within 90 days. The total effective recovery to Quorum under the settlement is approximately $6,156,000.
• MSA Amendment 3 — Enhanced Data Security and Audit Provisions (October 27, 2023) — a non-privileged contractual document executed concurrently with the settlement agreement, incorporating enhanced security obligations including 14-day critical patch deployment, 24-hour incident notification, and quarterly vulnerability scanning.
The following documents within Category 7 are classified as privileged / work product:
• Negotiation Strategy Memo (August 28, 2023) — C&H's internal strategy memorandum reflecting counsel's assessment of negotiation leverage, recommended settlement range, and tactical approach. This document constitutes opinion work product.
• Summary of Settlement Terms Memo (October 28, 2023) — C&H's post-execution analysis and legal assessment of the settlement outcome, including comparison to initial demand positions and evaluation of the recovery achieved relative to total incident costs. This document constitutes opinion work product.
• Internal draft term sheets with C&H strategy annotations — All internal working drafts reflecting counsel's negotiation strategy, proposed alternatives, and assessment of Palomar's likely positions.
H. Category 8: Insurance Claim and Coverage Materials
Category 8 encompasses all documents related to Quorum's claims under its cyber liability insurance program, including the primary policy with Atlas Mutual and the excess policy with Pinnacle.
The following documents are classified as non-privileged to the extent they were transmitted to the insurance carriers:
• Notice of Claim to Atlas Mutual Insurance Company (May 8, 2023), providing initial notification of the incident under Policy No. CYB-2023-041587.
• Notice of Claim to Pinnacle Surplus Lines Insurance Corp. (May 8, 2023), providing initial notification of the incident under Policy No. XS-CYB-2023-7812.
• Proof of Loss / Final Cost Summary to Atlas Mutual (November 15, 2023), submitted in support of Quorum's claim. The total incurred costs documented in the Proof of Loss are $8,230,250. After application of the $2,500,000 SIR, the amount claimed against the Atlas Mutual policy is $5,730,250.
The following document is classified as privileged:
• Insurance Coverage Status Update Memo (August 30, 2023) — an internal C&H memorandum analyzing the status of Quorum's insurance claims, coverage positions, and potential coverage disputes. This document contains C&H's legal analysis and strategic recommendations regarding the insurance recovery and constitutes both attorney-client privileged communication and opinion work product.
Correspondence with Paul Enriquez (Atlas Mutual, Claims Adjuster) and Lisa Garner (Pinnacle, Claims Contact) may be partially privileged under the Common Interest Agreement described in Section II.D above. Each such communication should be evaluated on a case-by-case basis to determine whether it was made pursuant to and within the scope of the common interest arrangement, and whether the substance of the communication involved the exchange of legal analysis or strategy as opposed to purely factual or administrative information.
I. Category 9: Engagement and Administrative Materials
Category 9 encompasses the administrative and engagement-related documents that establish the framework for C&H's representation and the various third-party engagements undertaken in connection with the incident response. While many of these documents are not themselves privileged in the traditional sense, they provide the foundational documentation that supports the privilege designations applied to other categories and should be retained accordingly.
The documents comprising Category 9 include:
• Engagement Letter (May 4, 2023) — the executed engagement letter between C&H and Quorum, defining the scope of representation, fee arrangements, and applicable terms.
• Outside Counsel Retention Letter for Graystone Forensics (May 5, 2023) — the letter by which Graystone was retained at the direction of C&H counsel, establishing the privilege umbrella for Graystone's work.
• Privilege Protocol Memo (May 5, 2023) — the initial privilege protocol memorandum issued by Kevin Ostrowski, establishing guidelines for privilege-protected communications at the outset of the engagement.
• Legal Hold Notice (May 6, 2023) — the legal hold notice issued to Quorum's internal custodians, directing the preservation of all documents and data related to the Palomar incident.
• Common Interest Agreement with Atlas Mutual (May 10, 2023) — the executed agreement establishing the common interest privilege framework for sharing of privileged materials between Quorum and Atlas Mutual.
• Engagement Scope Expansion Letter (September 10, 2023) — the letter expanding the scope of C&H's engagement to encompass the multistate AG regulatory defense workstream, following receipt of the joint demand letter.
• BrightPath Consulting Group Inc. Engagement Documentation — the engagement letter and related documentation for BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director), which was retained to provide crisis communications advisory services in connection with the incident.
• Billing Records and Fee Statements — C&H's billing records and monthly fee statements for the engagement. Total C&H legal fees for the engagement are $2,163,750, reflecting the work of the following attorneys at the following hourly rates:
The billing records and fee statements reflect approximately 2,400 total attorney hours across all workstreams. Billing records may be subject to claims of privilege to the extent they reveal the nature and substance of legal services rendered; however, purely financial and time-entry information is generally treated as non-privileged.
J. Category 10: Palomar Data Solutions Source Materials
Category 10 encompasses all documents originating from Palomar or exchanged between Quorum and Palomar personnel in connection with the incident, as well as the underlying contractual documentation governing the Quorum-Palomar relationship. These materials are generally non-privileged, although certain communications involving Quorum's legal department may carry privilege protections depending on their content and purpose.
The key documents comprising Category 10 include:
• Initial Breach Notification Email from Palomar (April 21, 2023) — an email from Derek Copeland (Palomar General Counsel) to Thomas R. Whitfield and David Naranjo, providing initial notification of the data security incident. This notification was received approximately 24 hours late relative to the 48-hour breach notification requirement set forth in Section 9.4 of the Palomar MSA, as Palomar discovered anomalous activity on April 18, 2023. The delayed notification was a significant factor in Quorum's breach of contract demand.
• Operational Communications — All communications between Quorum personnel and Palomar personnel regarding incident details, remediation steps, data identification and categorization, and affected individual enumeration.
• Palomar's Technical Incident Reports — All technical reports and supplemental information provided by Palomar to Quorum regarding the nature, scope, and remediation of the security incident, including Palomar's own internal investigation materials shared with Quorum.
• Master Services Agreement and Amendments — The governing contractual relationship between Quorum and Palomar, consisting of:
• Master Services Agreement dated November 12, 2019
• Amendment 1 (March 3, 2021)
• Amendment 2 (September 15, 2022)
• Amendment 3 (October 27, 2023) — the enhanced data security and audit provisions amendment executed as part of the settlement
• Key exhibits and provisions include Exhibit D (Data Security Requirements), Exhibit E (Insurance Requirements), Section 9.4 (Breach Notification, requiring notification within 48 hours of discovery), Section 12.2 (Indemnification, capped at 2× trailing twelve-month fees, representing a maximum of $32,600,000), and Section 14.2 (Termination for Cause).
• SOC 2 Type II Audit Reports — Annual SOC 2 Type II examination reports for Palomar's data processing controls, issued by Kessler, Park & Associates CPA, PLLC (Vivian Park, Engagement Partner). These reports document Palomar's control environment and are relevant to assessing the adequacy of Palomar's security posture before and during the incident.
III. Privilege Log Requirements
A. Obligation to Maintain a Privilege Log
Quorum must maintain a comprehensive privilege log identifying all documents withheld from production on the basis of attorney-client privilege, work product doctrine, common interest privilege, or any combination thereof. The maintenance of an accurate and complete privilege log is essential to the preservation of Quorum's privilege rights. A party that asserts privilege but fails to substantiate the assertion through a proper privilege log risks waiver of the privilege through what courts have described as a "blanket" or "unjustified" privilege claim.
The privilege log must be maintained in a format capable of efficient review and production if required by a court, arbitrator, or regulatory body in any future proceeding. The log should be prepared and maintained in an electronic spreadsheet or database format that permits sorting, filtering, and searching by relevant fields, and that can be readily exported into a format suitable for production (e.g., PDF, Excel, or load file for use in e-discovery platforms).
The privilege log should be updated on an ongoing basis if any new privileged documents are identified, if privilege designations are revised or corrected, or if any documents previously withheld on privilege grounds are determined to be non-privileged or to have been the subject of a waiver. Any updates to the privilege log should be documented with the date of the update and the identity of the individual who made the change.
B. Required Log Fields
For each document or communication entered on the privilege log, the following fields must be completed:
1. Document Date — The date the document was created, transmitted, or received.
2. Author(s) — The name(s) and title(s) of all individuals who authored or drafted the document.
3. Recipient(s) — The name(s) and title(s) of all individuals to whom the document was addressed or transmitted.
4. CC/BCC Parties — The name(s) and title(s) of all individuals who were copied (whether by carbon copy or blind carbon copy) on the communication.
5. Document Type — The format of the document (e.g., email, memorandum, letter, report, presentation, spreadsheet, annotation, draft, etc.).
6. Subject / Description — A brief, non-privileged description of the document's subject matter, sufficient to permit a reviewing court or opposing party to assess the privilege claim without revealing the substance of the privileged communication. Care should be taken to describe the document in terms that do not disclose the legal advice, mental impressions, conclusions, or legal theories reflected therein.
7. Privilege Basis Asserted — The specific privilege or protection asserted as the basis for withholding the document. Available designations include: (a) Attorney-Client Privilege ("AC"); (b) Attorney Work Product — Fact Work Product ("WP-F"); (c) Attorney Work Product — Opinion Work Product ("WP-O"); (d) Common Interest Privilege ("CI"); or (e) any combination thereof (e.g., "AC / WP-O" for a document that is both an attorney-client privileged communication and opinion work product).
8. Redaction Notes — Where a document is produced in redacted form rather than withheld in full, a description of the basis for each redaction and the privilege or protection asserted.
The distinction between opinion work product and fact work product is important and should be carefully maintained in the privilege log. Opinion work product—reflecting the mental impressions, conclusions, opinions, and legal theories of counsel—receives virtually absolute protection and is discoverable only in the rarest of circumstances. Fact work product—consisting of factual information gathered or compiled by counsel in anticipation of litigation—is subject to a qualified protection that may be overcome upon a showing of substantial need and inability to obtain the substantial equivalent without undue hardship. Because many of the C&H memoranda and analyses in this matter contain both factual information and counsel's legal opinions and strategic assessments, it is recommended that they be logged as opinion work product where appropriate to maximize the level of protection asserted.
C. Treatment of Dual-Purpose Documents
Certain documents in this matter serve both business and legal purposes, and the treatment of such dual-purpose documents requires careful analysis. Under the prevailing standard in most federal circuits and many state courts, the attorney-client privilege attaches to a dual-purpose communication only if the primary purpose of the communication was to seek or render legal advice. Where a communication serves both a business purpose and a legal advice purpose, and neither purpose clearly predominates, the privilege determination may be contested and should be analyzed with particular care.
This issue is of particular relevance with respect to communications involving David Naranjo (CISO) and Priya Deshmukh (VP, Vendor Risk Management), both of whom performed dual roles during the incident response. Mr. Naranjo was responsible for both operational IT remediation (a business function) and providing technical information to C&H counsel for purposes of legal analysis (a legal function). Ms. Deshmukh was responsible for both ongoing vendor relationship management with Palomar (a business function) and supporting C&H's contractual analysis and indemnification strategy (a legal function). Communications involving these individuals may contain both operational and legal content, and the privilege designation of each such communication should be assessed individually.
Where possible during the active engagement, C&H recommended that legal advice be segregated into separate communications from operational or business content to avoid dual-purpose privilege challenges. Where segregation was not achieved, the relevant documents should be logged with a clear explanation of the dual-purpose analysis, including identification of the primary purpose of the communication and the basis for concluding that the legal advice purpose predominated.
D. Treatment of Forwarded Communications
Where privileged communications were forwarded to recipients outside the scope of the privilege—that is, to individuals other than the client team (Thomas R. Whitfield, Jennifer Liang, David Naranjo, Margaret D. Calloway, Priya Deshmukh, Robert Wentworth, Franklin Reeves), C&H counsel, and parties within the common interest group—the act of forwarding may constitute a waiver of the privilege with respect to the forwarded communication.
All instances of forwarding of privileged communications to non-privileged recipients must be identified and flagged for review by Kevin Ostrowski. For each such instance, the analysis should address: (a) the identity of the recipient(s) to whom the communication was forwarded; (b) whether the recipient(s) were within or outside the scope of the privilege; (c) the circumstances of the forwarding (e.g., whether it was intentional or inadvertent); (d) the extent of the privileged content disclosed; and (e) whether the forwarding constitutes a subject-matter waiver or a limited waiver of the specific communication only.
To the extent that any forwarding is determined to have resulted in a waiver, the affected communication should be removed from the privilege log or re-classified accordingly, and the waiver should be documented for the file.
IV. Document Retention Periods
A. Minimum Retention Periods
All documents in Categories 1 through 10 as described in Section II above shall be retained for a minimum period of seven (7) years from December 1, 2023 (the date of matter closure), meaning that no documents may be destroyed or deleted prior to December 1, 2030, at the earliest.
The seven-year minimum retention period is established to accommodate the longest applicable statutes of limitations for potential claims—whether based in contract, tort, or statutory privacy law—that could arise from the Palomar data security incident across the 29 affected states and the District of Columbia. The analysis supporting this determination takes into account the following considerations:
• The longest general statute of limitations for breach of contract claims among the affected jurisdictions is six years (applicable in several states, including New York and Connecticut). Adding an additional year as a cushion to account for potential tolling, discovery rules, and delayed accrual yields the seven-year period.
• Statutes of limitations for negligence and other tort claims vary by state but generally range from two to six years.
• Statutory privacy claims under various state consumer protection and data breach statutes generally carry statutes of limitations ranging from one to five years.
• The statute of limitations for claims under HIPAA (to the extent enforceable by HHS-OCR) is six years from the date of the violation under 28 U.S.C. § 2462.
• Potential class action claims may involve equitable tolling doctrines, delayed discovery rules, or other doctrines that could extend the effective limitations period.
With respect to HIPAA-related records specifically—including the Category 5 regulatory submissions related to the 41,203 PHI-affected individuals and the Category 3 forensic materials documenting the PHI exposure—the HIPAA regulations at 45 C.F.R. § 164.530(j) require that covered entities retain documentation of their policies, procedures, and compliance activities for a period of six (6) years from the date of creation or the last effective date, whichever is later. While this six-year requirement is technically shorter than the seven-year overall retention period established herein, C&H recommends aligning the retention of HIPAA-related records with the broader seven-year retention period for purposes of consistency and administrative simplicity. Accordingly, all HIPAA-related records should be retained through at least December 1, 2030, along with all other documents in the matter file.
B. Extended Retention Triggers
The seven-year minimum retention period is subject to automatic extension in the event of any of the following triggering events:
1. Litigation: If any litigation (including class action complaints, individual lawsuits, or third-party claims) is commenced against Quorum or any related party in connection with the Palomar data security incident before the expiration of the seven-year retention period, all documents in all categories must be retained until the litigation is fully resolved, all appeals are exhausted or the time for appeal has expired, and C&H or successor counsel advises in writing that the legal hold may be lifted.
2. Regulatory Proceedings: If any regulatory proceeding, governmental investigation, or administrative enforcement action is commenced or re-opened in connection with the incident before the expiration of the retention period, the same extended retention obligations apply.
3. Arbitration: If any arbitration proceeding is commenced (e.g., under the MSA's dispute resolution provisions) before the expiration of the retention period, the same extended retention obligations apply.
4. Reasonable Anticipation: If, at any time before the expiration of the retention period, Quorum has a reasonable basis to anticipate that litigation, regulatory action, or arbitration may be commenced—even if no formal proceeding has yet been initiated—all documents must be preserved and the legal hold maintained. The determination of whether litigation or regulatory action is reasonably anticipated should be made in consultation with C&H or successor counsel.
Additionally, if Quorum receives a subpoena, civil investigative demand, or discovery request related to the Palomar data security incident at any time, all documents in all categories must be immediately preserved regardless of where the document stands in relation to the scheduled retention period. Receipt of any such demand or request should be communicated immediately to Thomas R. Whitfield and to C&H (Kevin Ostrowski) for review and response.
C. Destruction Protocol
Upon expiration of the applicable retention period (whether the standard seven-year period or any extended period triggered under Section IV.B), the following destruction protocol shall apply:
1. No documents may be destroyed without prior written approval from Quorum's General Counsel (currently Thomas R. Whitfield, or his successor in that role). This requirement is absolute and applies to all document categories, whether privileged or non-privileged, and whether maintained in physical or electronic form.
2. Pre-destruction legal review: Before any documents are approved for destruction, Quorum should engage C&H or successor counsel to confirm that no pending or reasonably anticipated matters require continued preservation of any portion of the document set. Counsel should review the current litigation, regulatory, and contractual landscape and provide a written opinion that destruction may proceed.
3. Complete and irreversible destruction: All destruction must be conducted in a manner that ensures the complete and irreversible elimination of the documents and data. For physical documents, this means secure cross-cut shredding by a certified document destruction vendor, with a certificate of destruction retained in the legal department's files. For electronic records, this means certified data wiping using methods compliant with NIST SP 800-88 (Guidelines for Media Sanitization) or physical destruction of storage media, with a certificate of destruction or data sanitization retained in the legal department's files.
4. Destruction log: A log should be maintained documenting the date of destruction, the categories and volume of documents destroyed, the method of destruction, the identity of the individual who approved the destruction, and the identity of the vendor or personnel who performed the destruction.
V. Segregation and Storage of Privileged Materials
A. Physical Documents
All physical documents bearing privilege markings or classified as privileged under the framework established in Section II above should be stored in a secure, access-restricted location within Quorum's legal department at the Company's headquarters:
Quorum Insurance Holdings Corp. Legal Department 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Access to the physical privileged document storage area shall be limited to Thomas R. Whitfield (General Counsel), Jennifer Liang (Chief Privacy Officer), and such additional legal department staff as may be designated by Mr. Whitfield on a need-to-know basis. No individual outside of the legal department should have unsupervised access to the privileged document storage area, and access should be logged.
Physical documents should be organized and filed by the ten document categories outlined in Section II above, with clear category labels and privilege markings on each file folder or storage container. Within each category, documents should be organized chronologically.
B. Electronic Documents
All electronic privileged documents should be maintained in a segregated, access-controlled repository within Quorum's document management system. This repository should be configured with the following characteristics:
• Access controls: Access permissions should be restricted to authorized legal department personnel designated by Thomas R. Whitfield. Role-based access controls should be implemented to ensure that only individuals with a demonstrated need-to-know can view, download, or modify the privileged materials.
• Segregation from general business storage: The privileged document repository should be maintained as a separate and distinct storage environment from Quorum's general business document storage systems. The repository should not be accessible through general network shares, intranet portals, or other common access points used by non-legal department personnel.
• Encryption: All privileged documents should be encrypted at rest (using AES-256 or equivalent encryption) and in transit (using TLS 1.2 or higher). Encryption keys should be managed by the legal department or IT security personnel under the direction of the legal department.
• Audit logging: The repository should maintain an audit log of all access events, including the date, time, user identity, and action taken (view, download, modify, delete). Audit logs should be reviewed periodically by Jennifer Liang or her designee.
• Backup and disaster recovery: The privileged document repository should be included in Quorum's backup and disaster recovery procedures, with backups maintained in an equally secure and access-restricted environment.
Calderwood & Harkness will maintain its own complete copy of the matter file in its document management system under Matter No. 1025-00006. C&H's physical file will be maintained at:
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006