SERVICES AGREEMENT AND STATEMENT OF WORK
Breach Notification, Call Center Operations, and Credit Monitoring / Identity Theft Protection Services
SOW Reference Number: SOW-2023-QIH-001
August 6, 2023
BETWEEN
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 ("Directing Counsel")
acting on behalf of and at the direction of
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 ("Client")
AND
Clearfield Notification Services LLC 4500 Rockside Road, Suite 210 Independence, OH 44131 ("Service Provider" or "Clearfield")
PRIVILEGED AND CONFIDENTIAL — Prepared at the Direction of Counsel in Anticipation of Litigation. Attorney-Client Privilege and Work Product Doctrine Apply. This document and the information contained herein are protected by the attorney-client privilege and the work product doctrine. Any unauthorized review, use, disclosure, or distribution is prohibited. If you have received this document in error, please notify Calderwood & Harkness LLP immediately and destroy all copies.
Right-click to update Table of Contents
ARTICLE 1 — RECITALS AND BACKGROUND
1.1 Recitals
WHEREAS, Calderwood & Harkness LLP ("Directing Counsel" or "C&H") has been retained by Quorum Insurance Holdings Corp. (Nasdaq: QIHC), a Delaware corporation headquartered in Hartford, Connecticut, in connection with a data security incident first identified in April 2023 (Calderwood & Harkness Matter No. 1025-00006); and
WHEREAS, the data security incident (the "Incident") involves the unauthorized access to and exfiltration of personally identifiable information ("PII"), protected health information ("PHI"), and financial data of policyholders and claimants of Quorum Insurance Holdings Corp. ("Quorum" or "Client") from the systems of Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"), which maintained and processed such information on behalf of Quorum pursuant to a services agreement between Quorum and Palomar; and
WHEREAS, forensic investigation conducted by retained forensic consultants has determined that the unauthorized access to Palomar's systems occurred between on or about March 14, 2023 and April 18, 2023, and that during that period, threat actors accessed and exfiltrated records containing PII, PHI, and financial data belonging to Quorum policyholders and claimants; and
WHEREAS, as a result of the Incident, Quorum is required to provide consumer breach notification to affected individuals pursuant to applicable federal and state data breach notification statutes, including but not limited to the Connecticut Data Breach Notification Act (Conn. Gen. Stat. § 36a-701b), the California Customer Records Act (Cal. Civ. Code § 1798.82), the Massachusetts Data Breach Notification Law (Mass. Gen. Laws ch. 93H § 3 and 201 CMR 17.00), and the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), and Quorum requires services for consumer breach notification, call center support, and credit monitoring and identity theft protection for affected individuals; and
WHEREAS, Clearfield Notification Services LLC ("Clearfield" or "Service Provider") is an established provider of breach notification mailing, call center operations, and credit monitoring and identity theft protection services, with demonstrated expertise in managing large-scale data breach response programs, and has been identified by Directing Counsel as a qualified service provider for the engagement described herein; and
WHEREAS, Calderwood & Harkness retains Clearfield under the attorney-client privilege umbrella, at the direction of counsel, for the purpose of assisting Directing Counsel in providing legal advice and services to Quorum in connection with the Incident, and all work product, communications, and deliverables generated in connection with this engagement shall be treated as privileged and confidential; and
WHEREAS, the parties desire to set forth the terms and conditions under which Clearfield shall provide the Services described in this Statement of Work;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows.
1.2 Engagement Structure
Clearfield Notification Services LLC is engaged by Calderwood & Harkness LLP, in its capacity as outside counsel to Quorum Insurance Holdings Corp., on behalf of and for the benefit of Quorum. This engagement is structured as a retention by Directing Counsel, at the direction of counsel, in furtherance of the provision of legal advice to Quorum regarding the Incident and Quorum's obligations under applicable data breach notification laws.
All directions, approvals, and substantive communications relating to the Services shall flow through Calderwood & Harkness LLP. The primary points of contact at Calderwood & Harkness for purposes of this engagement are as follows:
(a) Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice Group;
(b) Alan Burke, Lead Associate, Privacy & Data Security Practice Group; and
(c) Sara Hendricks, Working Associate, Privacy & Data Security Practice Group.
Clearfield acknowledges and agrees that it shall take direction from and report to Calderwood & Harkness in connection with all matters relating to the Services. Clearfield shall not communicate directly with Quorum personnel without the prior approval of Calderwood & Harkness. The following Quorum contacts are designated for operational coordination purposes, and may be contacted by Clearfield only with prior written or verbal authorization from C&H:
(a) Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.; and
(b) David Naranjo, Chief Information Security Officer, Quorum Insurance Holdings Corp.
The primary point of contact at Clearfield for purposes of this engagement shall be Jerome Tillman, Account Manager, who shall serve as the day-to-day liaison between Clearfield and Calderwood & Harkness and shall be responsible for coordinating the delivery of all Services described herein.
ARTICLE 2 — DEFINITIONS
For purposes of this Services Agreement and Statement of Work, the following terms shall have the meanings ascribed to them below. Capitalized terms used but not defined in this Article shall have the meanings ascribed to them elsewhere in this SOW.
"Affected Individuals" means the three hundred eighteen thousand two hundred forty-seven (318,247) individuals identified through forensic investigation, data mining, and document review as having had their personal information compromised as a result of the Incident, residing in twenty-nine (29) states and the District of Columbia, as reflected in the data files provided by Calderwood & Harkness to Clearfield pursuant to Article 7.2.
"Business Associate Agreement" or "BAA" means the Business Associate Agreement executed concurrently herewith between Quorum Insurance Holdings Corp. and Clearfield Notification Services LLC, attached hereto as Exhibit A.
"Client" or "Quorum" means Quorum Insurance Holdings Corp., a Delaware corporation, EIN 06-4832197, with its principal office located at 400 Constitution Plaza, Suite 2200, Hartford, CT 06103.
"Credit Monitoring Services" means the twenty-four (24) month credit monitoring and identity theft protection enrollment offered to Affected Individuals as described in Service Stream C (Article 3.3), including three-bureau credit monitoring, identity theft alerts, dark web monitoring, identity theft insurance, and identity restoration assistance.
"Directing Counsel" means Calderwood & Harkness LLP, a limited liability partnership organized under the laws of the District of Columbia, with offices at 1700 K Street NW, Suite 900, Washington, D.C. 20006.
"Financial Data Subset" means the eighty-four thousand six hundred nineteen (84,619) Affected Individuals whose compromised personal information includes financial data, including but not limited to bank account numbers, routing numbers, payment card numbers, and related financial account credentials.
"Incident" means the data security incident involving unauthorized access to the computer systems and networks of Palomar Data Solutions, Inc., occurring between on or about March 14, 2023 and April 18, 2023, resulting in the unauthorized access to and exfiltration of PII, PHI, and financial data of Quorum policyholders and claimants maintained by Palomar on behalf of Quorum.
"Notification Letters" means the consumer breach notification letters to be printed and mailed to Affected Individuals by Clearfield in accordance with the specifications set forth in Service Stream A (Article 3.1).
"PHI" means protected health information as defined in 45 C.F.R. § 160.103.
"PHI Subset" means the forty-one thousand two hundred three (41,203) Affected Individuals whose compromised personal information includes protected health information, including but not limited to health conditions, diagnosis codes (including ICD-10 codes), treatment information, and claims-related medical data derived from workers' compensation claims, disability claims, and health-related insurance claims processed by Palomar on behalf of Quorum.
"PII" means personally identifiable information, including but not limited to names, dates of birth, Social Security numbers, driver's license numbers, state identification numbers, mailing addresses, email addresses, and telephone numbers.
"PII-Only Subset" means those Affected Individuals whose compromised data consists solely of PII (including names, dates of birth, Social Security numbers, and driver's license numbers) but does not include financial data or PHI, and who are therefore not included in the Financial Data Subset or the PHI Subset.
"Services" means, collectively, the Notification Services (Service Stream A), Call Center Services (Service Stream B), and Credit Monitoring Services (Service Stream C) described in Article 3 of this SOW.
"SLA" means the service level agreements set forth in Exhibit C to this SOW.
"SOW" or "Statement of Work" means this Services Agreement and Statement of Work, including all exhibits and attachments hereto, as the same may be amended from time to time in accordance with Article 13.4.
"SOW Effective Date" means August 6, 2023.
"Total SOW Value" means three million two hundred fourteen thousand five hundred dollars ($3,214,500), as calculated in Article 4.1.4.
ARTICLE 3 — SCOPE OF SERVICES
Clearfield shall provide the following Services to Directing Counsel on behalf of Quorum, in each case in accordance with the specifications, timelines, and service levels set forth in this Article 3 and the corresponding SLAs attached as Exhibit C.
3.1 Service Stream A: Notification Printing and Mailing Services
3.1.1 Description. Clearfield shall perform the printing, assembly, and mailing of individualized consumer breach notification letters to all three hundred eighteen thousand two hundred forty-seven (318,247) Affected Individuals via first-class U.S. mail. Each Notification Letter shall be printed on Quorum Insurance Holdings Corp. letterhead, in formats and with content reviewed and approved by Calderwood & Harkness LLP prior to production printing. Clearfield shall be responsible for all aspects of letter production, including paper stock procurement, printing, personalization with individual recipient information (name, address, description of compromised data types, unique activation code for credit monitoring enrollment), folding, insertion into window envelopes bearing Quorum branding, postage application, and delivery to the United States Postal Service for first-class mailing.
Four (4) distinct notification letter versions shall be printed and mailed, based upon the type of data compromised for each individual recipient and applicable state-specific regulatory requirements, as follows:
(a) General PII Version — This letter version shall be used for Affected Individuals in the PII-Only Subset whose compromised personal information consists of PII (including name, date of birth, Social Security number, and/or driver's license number) but who are not members of the Financial Data Subset or the PHI Subset. This version shall describe the types of PII compromised, provide information regarding the availability of credit monitoring services, and include instructions for enrollment.
(b) SSN + Financial Data Version — This letter version shall be used for the eighty-four thousand six hundred nineteen (84,619) Affected Individuals in the Financial Data Subset whose compromised personal information includes financial data (bank account numbers, routing numbers, payment card numbers) in addition to PII. This version shall include additional guidance regarding financial account monitoring, fraud alerts, and security freezes, in addition to credit monitoring enrollment information.
(c) PHI Version (HIPAA-Compliant) — This letter version shall be used for the forty-one thousand two hundred three (41,203) Affected Individuals in the PHI Subset whose compromised personal information includes protected health information. This version shall comply with the notification requirements of the HIPAA Breach Notification Rule (45 C.F.R. §§ 164.404 and 164.406), shall describe the types of PHI compromised in a manner consistent with HIPAA guidance, and shall include required HIPAA-specific disclosures, including a description of the steps Quorum has taken and will take in response to the breach, contact information for the individual to ask questions or learn additional information, and contact information for the Secretary of the U.S. Department of Health and Human Services.
(d) State-Specific Variants (California and Massachusetts) — Adapted versions of the applicable notification letters shall be prepared for Affected Individuals residing in California (approximately 38,206 individuals) and Massachusetts (approximately 10,217 individuals), to comply with the specific content and formatting requirements of Cal. Civ. Code § 1798.82, the California Confidentiality of Medical Information Act ("CMIA"), Mass. Gen. Laws ch. 93H § 3, and 201 CMR 17.00. The California variant shall include the specific disclosures required by Section 1798.82(d), including the toll-free telephone numbers and addresses of the major credit reporting agencies. The Massachusetts variant shall include the right to obtain a police report, the right to request a security freeze, and any other disclosures required by Massachusetts law.
Clearfield acknowledges that certain Affected Individuals may fall into multiple categories (e.g., an individual in both the Financial Data Subset and the PHI Subset who resides in California). In such cases, Clearfield shall apply the "most protective" letter version logic as directed by Calderwood & Harkness, ensuring that each such individual receives a single consolidated notification letter that addresses all applicable data types and state-specific requirements. Calderwood & Harkness shall provide written guidance to Clearfield on the priority hierarchy and consolidation logic for multi-category individuals prior to production printing.
3.1.2 Address Verification and Processing
Prior to mailing, Clearfield shall perform comprehensive address verification and processing for all 318,247 mailing addresses provided in the affected individual data files, including the following:
(a) National Change of Address (NCOA) Processing. Clearfield shall run all mailing addresses through the United States Postal Service National Change of Address database to identify individuals who have filed a change of address within the preceding forty-eight (48) months and to update mailing addresses accordingly.
(b) Address Standardization and Validation. Clearfield shall validate and standardize all mailing addresses using USPS Coding Accuracy Support System ("CASS")-certified software to ensure compliance with USPS addressing standards, correct formatting errors, and improve deliverability.
(c) Undeliverable-As-Addressed (UAA) Returns Processing. Clearfield shall process all Notification Letters returned by the USPS as undeliverable-as-addressed. For returned letters that include a forwarding address provided by the USPS, Clearfield shall re-mail the Notification Letter to the updated address. For returned letters without a forwarding address, Clearfield shall perform a reasonable address search using commercially available databases and, where a new address is identified, shall re-mail the Notification Letter to the newly identified address. Clearfield shall maintain detailed records of all returned and re-mailed letters and shall include such information in the reporting deliverables described in Article 11.
3.1.3 Mailing Timeline
The following mailing timeline shall apply to Service Stream A:
(a) Target Mailing Commencement Date: August 18, 2023. Clearfield shall commence the mailing of Notification Letters no later than August 18, 2023, subject to timely receipt of final approved letter templates from Calderwood & Harkness and completion of the print proof approval process described in Section 3.1.4.
(b) Initial Mailing Completion: All initial Notification Letter mailings shall be completed no later than September 15, 2023, providing an approximately twenty-eight (28) day mailing window from the date of first mailing. Clearfield shall use commercially reasonable efforts to complete the initial mailing as expeditiously as possible, with the objective of mailing all letters within the first fourteen (14) business days of the mailing window.
(c) UAA Re-Mails: Re-mailing of Notification Letters to updated addresses for undeliverable returns shall be completed within ten (10) business days of Clearfield's receipt of each returned letter.
(d) Daily Mailing Status Reports: Clearfield shall provide daily mailing status reports to Calderwood & Harkness during the active mailing window, in accordance with the reporting requirements set forth in Article 11.1. Each daily report shall include the number of letters mailed that day, cumulative letters mailed to date, the number of letters remaining, and the number of returned letters received and processed.
3.1.4 Letter Template Approval Process
The following approval process shall govern the production of Notification Letters:
(a) Calderwood & Harkness shall provide final approved letter templates for all four (4) Notification Letter versions (and any state-specific variants) to Clearfield no later than August 12, 2023. Templates shall be provided in an editable electronic format (Microsoft Word or equivalent) and shall include all variable data field mappings.
(b) Within forty-eight (48) hours of receipt of final approved letter templates, Clearfield shall produce sample print proofs for each letter version and submit such proofs to Calderwood & Harkness for review and approval. Print proofs shall include sample personalized letters demonstrating the variable data merge, envelope samples, and assembly samples.
(c) Calderwood & Harkness sign-off on print proofs is required before Clearfield may commence production printing. Clearfield shall not begin production printing until it has received written confirmation of approval from Kevin Ostrowski, Alan Burke, or Sara Hendricks of Calderwood & Harkness.
(d) Any changes to Notification Letter content, formatting, or variable data field mappings after initial print proof approval shall require written authorization from Kevin Ostrowski or Alan Burke of Calderwood & Harkness. Clearfield shall promptly notify Calderwood & Harkness if any proposed post-approval changes may affect the mailing timeline.
3.2 Service Stream B: Call Center Operations
3.2.1 Description. Clearfield shall establish and operate a dedicated toll-free call center to handle inbound telephone inquiries from Affected Individuals who receive Notification Letters or otherwise become aware of the Incident and seek information regarding the breach notification, the credit monitoring enrollment program, or other related matters. The toll-free number assigned to this engagement shall be printed on all Notification Letters, included in any substitute notice or website posting, and otherwise made available to Affected Individuals as directed by Calderwood & Harkness. The call center shall be staffed by trained agents who are knowledgeable regarding the Incident (to the extent permitted by approved scripts), the types of data compromised, the credit monitoring enrollment process, and the resources available to Affected Individuals.
3.2.2 Operating Parameters
The following operating parameters shall apply to the call center:
(a) Operational Window. The call center shall be operational for a period of twelve (12) weeks from the date of the first Notification Letter mailing, commencing on or about August 18, 2023 and continuing through approximately November 10, 2023. Any extension of the operational window beyond twelve (12) weeks shall be subject to mutual agreement and the additional fees set forth in Article 4.1.2.
(b) Hours of Operation. The call center shall operate during the following hours:
(i) Monday through Friday: 8:00 AM to 8:00 PM Eastern Time; and
(ii) Saturday: 9:00 AM to 5:00 PM Eastern Time.
(c) Staffing. Clearfield shall maintain the following minimum staffing levels during the call center operational window:
(i) Weeks 1–4 (Peak Period): Minimum of twenty-five (25) trained agents available to handle calls during all hours of operation;
(ii) Weeks 5–8: Minimum of fifteen (15) trained agents available to handle calls during all hours of operation; and
(iii) Weeks 9–12: Minimum of eight (8) trained agents available to handle calls during all hours of operation.
Staffing levels may be adjusted by mutual agreement based on actual call volumes, provided that Clearfield shall maintain sufficient staffing to meet the ASA and abandonment rate targets set forth below at all times.
(d) Average Speed to Answer (ASA) Target. Clearfield shall maintain an average speed to answer of sixty (60) seconds or less across all operating hours.
(e) Abandonment Rate Target. Clearfield shall maintain a call abandonment rate of five percent (5%) or less across all operating hours. For purposes of this target, "abandonment rate" means the percentage of inbound calls in which the caller disconnects before being connected to an agent, excluding calls disconnected within the first fifteen (15) seconds.
3.2.3 Call Center Scripts and Training
(a) Approved Scripts and FAQs. Calderwood & Harkness shall provide approved call center scripts and frequently asked questions ("FAQ") documents to Clearfield for use by call center agents. The reference document for this engagement shall be the Call Center Script & FAQ document dated August 14, 2023, as may be updated from time to time by Calderwood & Harkness. Clearfield agents shall adhere to the approved scripts and FAQs at all times and shall not deviate from the approved language without prior authorization from Calderwood & Harkness.
(b) Agent Training. Clearfield shall be responsible for training all call center agents prior to the go-live date of August 18, 2023. Agent training shall cover the following topics, at a minimum:
(i) A summary of the Incident, limited to the information set forth in the approved scripts and FAQs;
(ii) The types of data compromised and the distinction between PII-Only, Financial Data, and PHI categories;
(iii) Instructions for assisting callers with credit monitoring enrollment, including the use of activation codes and the online enrollment portal;
(iv) Escalation procedures for legal inquiries, media inquiries, and complex or sensitive calls (as described in Section 3.2.4);
(v) The strict prohibition on discussing liability, fault, legal theories, litigation status, or any legal positions of Quorum, Calderwood & Harkness, or any other party; and
(vi) Sensitivity training for handling calls from distressed or upset individuals.
(c) Directing Counsel Participation. Calderwood & Harkness, or designated Quorum personnel authorized by Calderwood & Harkness, shall have the right to participate in the initial agent training session to ensure that agents are properly prepared to handle calls in a manner consistent with the privileged and confidential nature of this engagement.
(d) Quality Assurance. Clearfield shall implement a quality assurance program that includes routine monitoring of recorded calls, evaluation of agent performance against established metrics and script adherence, and regular feedback sessions with agents. Clearfield shall provide weekly quality assurance reports to Calderwood & Harkness summarizing call monitoring results, identified issues, and corrective actions taken.
3.2.4 Escalation Protocol
Clearfield shall implement the following tiered escalation protocol for the call center:
(a) Tier 1 — Standard Inquiries. Tier 1 agents shall handle standard inbound inquiries in accordance with the approved call center scripts and FAQs, including general questions about the Incident, the types of data compromised, the credit monitoring enrollment process, and the steps Quorum has taken in response to the Incident. Tier 1 agents shall resolve calls at the first point of contact whenever possible.
(b) Tier 2 — Supervisor Escalation. Complex inquiries that cannot be resolved by Tier 1 agents using the approved scripts and FAQs shall be escalated to a Tier 2 supervisor. Tier 2 supervisors shall have enhanced training and access to additional reference materials to address more detailed or nuanced questions from Affected Individuals. If a Tier 2 supervisor is unable to resolve an inquiry, it shall be escalated in accordance with subsection (c) below.
(c) Legal Escalation. Any inbound inquiry involving one or more of the following shall be immediately escalated to Calderwood & Harkness LLP for handling:
(i) Threats of litigation or references to retaining legal counsel;
(ii) Inquiries from members of the media, journalists, or press outlets;
(iii) Questions regarding legal liability, fault, or responsibility for the Incident;
(iv) Inquiries from government agencies, regulators, or law enforcement;
(v) Requests for information beyond the scope of the approved scripts and FAQs; and
(vi) Any other inquiry that the Tier 2 supervisor determines, in their reasonable judgment, may implicate legal, regulatory, or privilege concerns.
Legal escalations shall be directed to Alan Burke, Lead Associate, or Sara Hendricks, Working Associate, at Calderwood & Harkness. Call center agents and supervisors shall not provide any legal commentary, opinions, or analysis to callers under any circumstances. When escalating a call, the agent or supervisor shall obtain the caller's name, telephone number, and a brief description of the inquiry, and shall advise the caller that a representative from Calderwood & Harkness will contact them within one (1) business day.
3.2.5 Reporting. Clearfield shall provide the following call center reports to Calderwood & Harkness:
(a) Daily Reports (Weeks 1–4). During the first four (4) weeks of call center operations, Clearfield shall provide daily call volume and performance reports to Calderwood & Harkness by 10:00 AM Eastern Time on the following business day.
(b) Weekly Reports (Weeks 5–12). Beginning in week five (5) and continuing through the end of the call center operational window, Clearfield shall provide weekly call volume and performance reports, delivered no later than the close of business on the first business day following each reporting week.
(c) Report Contents. Each daily or weekly report shall include, at a minimum, the following information:
(i) Total calls received during the reporting period;
(ii) Total calls answered by agents;
(iii) Average hold time;
(iv) Average speed to answer (ASA);
(v) Call abandonment rate;
(vi) Call reason breakdown by category (e.g., general inquiry, credit monitoring enrollment assistance, data type inquiry, complaint, legal escalation);
(vii) Number and summary of escalations (Tier 2 and legal escalations);
(viii) Number of credit monitoring enrollment referrals and assistance calls; and
(ix) Any notable trends, issues, or agent performance concerns.
(d) Weekly Escalation Summaries. In addition to the standard daily and weekly reports, Clearfield shall provide a separate weekly escalation summary detailing all Tier 2 and legal escalations, including caller information, nature of inquiry, and disposition.
(e) Final Report. Upon closure of the call center, Clearfield shall prepare and deliver a final comprehensive call center activity report summarizing total call volume, performance metrics, escalation statistics, and credit monitoring enrollment referral data for the entire twelve (12) week operational window.
3.3 Service Stream C: Credit Monitoring and Identity Theft Protection Services
3.3.1 Description. Clearfield shall provide enrollment in and delivery of twenty-four (24) month credit monitoring and identity theft protection services to Affected Individuals who elect to enroll. The credit monitoring and identity theft protection program shall include the following components:
(a) Three-Bureau Credit Monitoring. Continuous monitoring of credit files maintained by all three major consumer credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises), with alerts provided to enrollees upon detection of key changes to their credit reports, including new account openings, credit inquiries, public record filings, and changes to personal information.
(b) Identity Theft Alerts. Real-time alerts to enrollees upon detection of suspicious activity potentially indicative of identity theft, including but not limited to changes of address, new account applications, and public record filings associated with the enrollee's identity.
(c) Dark Web Monitoring. Automated scanning of dark web forums, marketplaces, and data repositories for the appearance of enrollees' personal information, including Social Security numbers, email addresses, and financial account credentials, with notification to enrollees upon detection.
(d) Identity Theft Insurance. Each enrollee shall be covered by an identity theft insurance policy providing up to one million dollars ($1,000,000) in coverage for qualified expenses incurred as a result of identity theft, including but not limited to legal fees, lost wages, and costs associated with restoring the enrollee's identity and credit.
(e) Identity Restoration Assistance. Enrollees who experience identity theft during the coverage period shall have access to dedicated identity restoration specialists who will assist with the investigation and resolution of identity theft incidents, including liaising with creditors, credit reporting agencies, and government agencies on behalf of the affected enrollee.
3.3.2 Enrollment Mechanism
Clearfield shall establish and maintain the following enrollment mechanisms for Affected Individuals:
(a) Unique Activation Codes. A unique activation code shall be generated for each Affected Individual and included in the Notification Letter mailed to that individual. Activation codes shall be individualized per recipient and shall be traceable to the specific individual for enrollment tracking and reporting purposes. Each activation code shall be valid for the duration of the enrollment window described in subsection (d) below.
(b) Online Enrollment Portal. Clearfield shall develop, host, and maintain a dedicated online enrollment portal accessible via a custom URL branded for Quorum Insurance Holdings Corp. The portal shall be available twenty-four (24) hours per day, seven (7) days per week, and shall provide a user-friendly enrollment experience that allows Affected Individuals to enter their activation code, verify their identity, provide enrollment information, and activate their credit monitoring and identity theft protection coverage. The portal shall comply with all applicable accessibility standards and shall be secured with industry-standard encryption and authentication protocols.
(c) Toll-Free Enrollment Hotline. Clearfield shall maintain a toll-free telephone enrollment hotline to accommodate Affected Individuals who prefer to enroll by telephone. The enrollment hotline may be integrated with the call center described in Service Stream B during the call center operational window, or may be operated as a separate dedicated line. Following the closure of the call center, the toll-free enrollment hotline shall remain operational for the duration of the enrollment window.
(d) Enrollment Window. The enrollment window shall remain open for twelve (12) months from the date of the Notification Letter (i.e., through approximately September 2024). Affected Individuals who do not enroll within the twelve (12) month enrollment window shall forfeit their eligibility for credit monitoring services, unless otherwise directed by Calderwood & Harkness.
3.3.3 Estimated Take-Rate and Enrollment Projections
The parties acknowledge the following enrollment projections, which are based on Clearfield's industry benchmarks and experience with prior engagements of similar scope and scale:
(a) Total Affected Individuals Eligible for Enrollment: 318,247.
(b) Estimated Take-Rate: Approximately forty percent (40%) of eligible Affected Individuals are expected to enroll in credit monitoring services, based on Clearfield's historical experience with comparable breach notification programs involving similar data types and populations.
(c) Estimated Total Enrollees: Approximately 127,299 individuals.
(d) Service Period per Enrollee: Twenty-four (24) months from the date of each individual enrollee's activation.
The parties acknowledge that the estimated take-rate and enrollment projections set forth in this Section 3.3.3 are estimates only and that actual enrollment numbers may vary. As described in Article 4.1.3, the negotiated flat fee for Service Stream C is not subject to adjustment based on actual enrollment numbers.
3.3.4 Service Provider Obligations
In connection with the delivery of Credit Monitoring Services, Clearfield shall be responsible for the following:
(a) Management of all enrollment processing, including activation code generation, validation, and tracking;
(b) Hosting and maintenance of the online enrollment portal and toll-free enrollment hotline for the full twelve (12) month enrollment window;
(c) Delivery of continuous credit monitoring, identity theft alerts, dark web monitoring, identity theft insurance, and identity restoration assistance for the full twenty-four (24) month coverage period following each individual enrollee's activation date;
(d) Provision of monthly enrollment status reports to Calderwood & Harkness, in accordance with the reporting requirements set forth in Article 11.1;
(e) Handling of all enrollee inquiries related to credit monitoring service delivery, including technical support for the online portal and assistance with identity theft insurance claims, both during and after the call center operational window; and
(f) Compliance with all applicable laws and regulations in connection with the delivery of Credit Monitoring Services, including but not limited to the Fair Credit Reporting Act ("FCRA"), applicable state consumer protection laws, and data privacy requirements.
ARTICLE 4 — FEES AND PAYMENT
4.1 Fee Schedule
4.1.1 Service Stream A — Notification Printing and Mailing
The total fee for Service Stream A (Notification Printing and Mailing Services) shall be a fixed fee of six hundred thirty-six thousand dollars ($636,000), calculated based on three hundred eighteen thousand two hundred forty-seven (318,247) Affected Individuals at a rate of approximately two dollars ($2.00) per letter. This fixed fee is inclusive of all costs associated with printing, personalization, assembly, postage (first-class U.S. mail), NCOA processing, CASS address verification, address standardization, and initial mailing of all Notification Letters.
The fixed fee includes the cost of processing and re-mailing Notification Letters returned as undeliverable-as-addressed (UAA) for up to five percent (5%) of the total mailing volume (i.e., up to approximately fifteen thousand nine hundred twelve (15,912) re-mailed letters). Re-mails exceeding the five percent (5%) threshold shall be billed at an incremental rate of two dollars and fifty cents ($2.50) per re-mail, invoiced monthly in arrears based on actual re-mail volumes.
4.1.2 Service Stream B — Call Center Operations
The total fee for Service Stream B (Call Center Operations) shall be a fixed fee of four hundred seventy-eight thousand five hundred dollars ($478,500) for the twelve (12) week operational window. This fixed fee is inclusive of all costs associated with agent staffing, supervision, training, technology infrastructure (including telephony systems, call recording, and automated call distribution), quality assurance, and all reporting deliverables described in this SOW.
In the event that Calderwood & Harkness and Clearfield mutually agree to extend the call center operational window beyond twelve (12) weeks, the extension fee shall be thirty-five thousand dollars ($35,000) per additional week, prorated for partial weeks as applicable.
4.1.3 Service Stream C — Credit Monitoring and Identity Theft Protection
The total fee for Service Stream C (Credit Monitoring and Identity Theft Protection Services) shall be a negotiated flat fee of two million one hundred thousand dollars ($2,100,000). This flat fee was negotiated based on projected enrollment of approximately one hundred twenty-seven thousand two hundred ninety-nine (127,299) individuals (reflecting an estimated forty percent (40%) take-rate) at a per-enrollee rate of approximately eighteen dollars ($18.00) per month for a twenty-four (24) month coverage period, aggregated and negotiated to a flat fee for the convenience of both parties.
The flat fee is all-inclusive and covers the following components: activation code generation and tracking, online enrollment portal development and hosting, toll-free enrollment hotline operation, twenty-four (24) months of three-bureau credit monitoring for all enrollees, identity theft alerts, dark web monitoring, one million dollar ($1,000,000) identity theft insurance coverage per enrollee, identity restoration assistance, and all enrollee support services throughout the enrollment window and twenty-four (24) month coverage period.
The flat fee shall not be adjusted based on the actual number of enrollees, whether actual enrollment falls above or below the estimated forty percent (40%) take-rate. In the event that actual enrollment significantly exceeds one hundred fifty percent (150%) of the projected enrollment (i.e., exceeds approximately 190,949 enrollees), the parties agree to negotiate in good faith regarding an equitable adjustment to the flat fee, but Clearfield shall have no right to suspend or discontinue services to enrollees during such negotiation.
4.1.4 Total Contract Value
The total value of this Statement of Work is calculated as follows:
The Total SOW Value does not include any additional charges that may be incurred for UAA re-mails exceeding the five percent (5%) threshold (Article 4.1.1) or for call center extensions beyond the twelve (12) week operational window (Article 4.1.2).
4.2 Payment Terms
4.2.1 General Invoicing
All invoices shall be submitted monthly by Clearfield to Calderwood & Harkness LLP, Attention: Rachel Bernstein, Billing Partner. Payment terms shall be Net thirty (30) days from the date of Calderwood & Harkness's receipt of each invoice. All invoices shall clearly reference Calderwood & Harkness Matter No. 1025-00006 and SOW Reference Number SOW-2023-QIH-001.
4.2.2 Payment Schedule by Service Stream
The following payment schedules shall apply to each Service Stream:
Service Stream A — Notification Printing and Mailing ($636,000):
(a) Fifty percent (50%) of the Service Stream A fee ($318,000) due upon execution of this SOW; and
(b) Fifty percent (50%) of the Service Stream A fee ($318,000) due upon completion of the initial mailing (target date: September 15, 2023).
Service Stream B — Call Center Operations ($478,500):
(a) Three (3) equal monthly installments of one hundred fifty-nine thousand five hundred dollars ($159,500) each, invoiced at the commencement of each month of the twelve (12) week call center operational window (approximately monthly in August, September, and October 2023).
Service Stream C — Credit Monitoring and Identity Theft Protection ($2,100,000):
(a) Forty percent (40%) of the Service Stream C fee ($840,000) due upon execution of this SOW;
(b) Thirty percent (30%) of the Service Stream C fee ($630,000) due upon completion of the mailing window (target date: September 15, 2023); and
(c) Thirty percent (30%) of the Service Stream C fee ($630,000) due six (6) months after initial enrollment activation (approximately February 2024).
4.3 Insurance Coverage
The parties acknowledge that costs incurred by Quorum under this SOW may be submitted by Quorum Insurance Holdings Corp. for reimbursement under Quorum's cyber-liability insurance program. The applicable insurance coverage is maintained through Atlas Mutual Insurance Company, Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892. Clearfield shall cooperate in good faith with any reasonable documentation requests from Quorum's insurer, Atlas Mutual Insurance Company, or its designated representatives, related to invoicing, services rendered, and verification of deliverables under this SOW, provided that any such communications with the insurer shall be coordinated through Calderwood & Harkness to preserve applicable privileges.
Notwithstanding the foregoing, the payment obligations of Calderwood & Harkness (on behalf of Quorum) under this SOW are not contingent upon Quorum's receipt of insurance reimbursement from Atlas Mutual Insurance Company or any other insurer. Clearfield shall not be required to subordinate its right to payment to the status or outcome of Quorum's insurance claim.
ARTICLE 5 — TERM AND TERMINATION
5.1 SOW Effective Date and Term
This SOW shall be effective as of August 6, 2023 (the "SOW Effective Date"). The term of this SOW shall continue until all obligations under each Service Stream have been fully performed and completed, estimated as follows:
(a) Service Stream A (Notification Printing and Mailing): Clearfield's obligations under Service Stream A shall be deemed complete upon the conclusion of all initial mailings and all UAA re-mailings, estimated to occur by approximately October 2023, and delivery of the final completion report.
(b) Service Stream B (Call Center Operations): Clearfield's obligations under Service Stream B shall be deemed complete upon the expiration of the twelve (12) week call center operational window, estimated to be approximately August 18, 2023 through November 10, 2023, and delivery of the final call center activity report, unless the operational window is extended by mutual agreement.
(c) Service Stream C (Credit Monitoring and Identity Theft Protection): Clearfield's obligations under Service Stream C shall continue for twenty-four (24) months following the date of the last individual enrollment, and in no event later than approximately September 2026 (reflecting a twelve (12) month enrollment window through September 2024, plus twenty-four (24) months of coverage). Clearfield's obligations under Service Stream C shall be deemed complete upon the expiration of the last enrollee's twenty-four (24) month coverage period and delivery of the final enrollment and utilization summary report.
5.2 Early Termination
(a) Termination for Cause. Either party may terminate this SOW, in whole or with respect to any individual Service Stream, in the event of a material breach by the other party, provided that the terminating party has delivered written notice to the breaching party specifying the nature of the breach and the breaching party has failed to cure such breach within fifteen (15) days following receipt of such notice. If the breach is of a nature that cannot reasonably be cured within fifteen (15) days, the breaching party shall not be deemed in default if it commences curative action within such fifteen (15) day period and thereafter diligently pursues such cure to completion.
(b) Termination for Convenience. Calderwood & Harkness (on behalf of Quorum) may terminate any Service Stream for convenience upon thirty (30) days' prior written notice to Clearfield. In the event of termination for convenience, Quorum shall be obligated to pay Clearfield for all services rendered through the effective date of termination, plus any non-cancellable costs reasonably incurred by Clearfield prior to the effective date of termination in reliance on this SOW (including, without limitation, costs for materials ordered, postage prepaid, and staffing commitments that cannot reasonably be unwound).