1025-00006 · Graystone Forensics LLC · Consumer Notifications

consumer-notification-letter-phi.docx DOCUMENT Data Privacy

13 / 88 ← → ✕

QUORUM INSURANCE HOLDINGS CORP. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

August 10, 2023

[Recipient Full Name] [Recipient Address Line 1] [Recipient City, State, ZIP]

Dear [Recipient Name]:

Notice of Data Security Incident Involving Your Protected Health Information

Quorum Insurance Holdings Corp. ("Quorum," "we," "us," or "our") is writing to inform you about a data security incident that may have affected your personal information, including your protected health information ("PHI"). We take the privacy and security of personal information entrusted to us very seriously. We are providing you this notice to explain the circumstances of the incident, describe the types of information that may have been involved, and outline the steps we are taking in response—as well as the steps you can take to help protect yourself. This notice is being provided in accordance with the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations, including the Breach Notification Rule set forth at 45 C.F.R. § 164.404, as well as applicable state breach notification laws.

In addition to this notice, we want you to know that we are making available to you, at no cost, complimentary credit monitoring and identity theft protection services for a period of twenty-four (24) months, as described in further detail below and in the enclosed enrollment instructions. We encourage you to review this letter carefully and to take advantage of the resources we are offering.

What Happened

In the ordinary course of our insurance operations, Quorum utilizes a third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"), to process certain claims-related data on Quorum's behalf. Palomar serves as a business associate of Quorum under HIPAA and is subject to contractual obligations regarding the security and confidentiality of the information it processes.

On or about March 14, 2023, an unauthorized third party exploited a previously identified vulnerability in a file transfer application used by Palomar to transmit and receive data files. Specifically, the unauthorized actor exploited a remote code execution vulnerability known as CVE-2023-0669, which affected Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. By leveraging this vulnerability, the unauthorized actor was able to gain unauthorized access to certain systems within Palomar's network environment.

The unauthorized access continued over a period of approximately thirty-five (35) days, from approximately March 14, 2023, through April 18, 2023. During this window, the forensic evidence indicates that certain data files were exfiltrated—that is, copied and transferred outside of Palomar's systems—by the unauthorized actor.

On April 18, 2023, Palomar's security operations team detected anomalous outbound data transfers from its network. Palomar immediately initiated its incident response protocols to contain and investigate the activity. Palomar subsequently notified Quorum of the security incident on April 21, 2023.

Upon learning of the incident, Quorum acted promptly to understand the nature and scope of the compromise. We immediately engaged outside legal counsel at Calderwood & Harkness LLP, a nationally recognized privacy and data security law firm, to coordinate our incident response efforts. Under the direction of counsel, we retained Graystone Forensics LLC, a leading cybersecurity forensic investigation firm, to conduct a comprehensive forensic investigation of the incident.

The forensic investigation, which involved an exhaustive review of network logs, file access records, and data transfer activity, confirmed on July 14, 2023, the scope of data that was accessed and exfiltrated during the period of unauthorized access. Following that determination, Quorum undertook a comprehensive, manual data review process to identify the specific individuals whose information was contained in the affected files. That data review was completed on August 4, 2023, at which time we were able to confirm your information was among the data involved.

What Information Was Involved

Based on our investigation and the comprehensive data review, we have determined that the following categories of your information may have been accessed or acquired by the unauthorized party during the incident:

Personal Identifying Information: Your full name, date of birth, Social Security number, and/or driver's license or state identification number.

Protected Health Information: Health-related information associated with workers' compensation claims and/or health-related insurance claims that were processed by Palomar on Quorum's behalf, which may include health conditions, medical diagnosis codes (such as ICD-10 codes), and/or treatment information.

Financial Information (if applicable): For some individuals, the affected data may also have included bank account numbers and/or payment card numbers associated with claim payments or premium transactions. If your financial information was determined to be among the data involved, this category applies to you.

The information described above was contained in structured data files maintained within Palomar's claims processing environment. We want to assure you that, to date, we have no evidence that your information has been misused as a result of this incident. However, out of an abundance of caution, we are notifying you and providing the resources described in this letter so that you can take appropriate steps to monitor and protect your information.

What We Are Doing

Upon learning of this incident, Quorum immediately took a number of steps to investigate the breach, to mitigate potential harm to affected individuals, and to protect against further breaches. These steps include the following:

• Engaged expert legal counsel. We retained Calderwood & Harkness LLP to coordinate all aspects of our incident response, including the forensic investigation, regulatory notifications, and individual notifications.

• Retained a leading forensic investigation firm. Under the direction of counsel, we engaged Graystone Forensics LLC to conduct a thorough forensic investigation to determine the nature, scope, and impact of the unauthorized access and data exfiltration.

• Worked with Palomar to remediate the vulnerability and terminate unauthorized access. We worked closely with Palomar to ensure that the CVE-2023-0669 vulnerability in the GoAnywhere MFT appliance was fully remediated, that the unauthorized actor's access to Palomar's network was terminated, and that all indicators of compromise were identified and addressed.

• Notified applicable federal and state regulators. We filed notification with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") on August 15, 2023, and with applicable state attorneys general and state regulatory agencies across all affected jurisdictions beginning August 14, 2023, in compliance with federal and state breach notification requirements.

• Required Palomar to implement enhanced security measures. We have required Palomar to implement a range of enhanced security measures to strengthen its defenses against future incidents. These measures include, among other things, enhanced patch management protocols to ensure that critical security updates are applied promptly; deployment of advanced endpoint detection and response ("EDR") capabilities across its network; and engagement of an independent third-party security assessor to conduct ongoing security audits and assessments of Palomar's systems and practices.

• Providing complimentary credit monitoring and identity theft protection services. We are offering all affected individuals, including you, twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, at no cost to you. Details on how to enroll are provided below and in the enclosed enrollment instructions.

We are committed to being transparent about this incident and to taking all reasonable steps to mitigate its impact. We will continue to evaluate our vendor oversight practices and data security measures to help prevent similar incidents from occurring in the future.

What You Can Do

While we have no evidence at this time that your information has been misused, we encourage you to remain vigilant and to take the following steps to help protect yourself from potential harm:

Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services

Quorum is offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, at no cost to you. These services include credit monitoring, identity restoration assistance, and identity theft insurance coverage. To enroll, you may either:

• Visit our dedicated enrollment website at [dedicated enrollment website URL] and follow the on-screen instructions, using the unique reference number and activation code provided in the enclosed enrollment instructions; or

• Call our dedicated toll-free telephone number at 1-8XX-XXX-XXXX to enroll by phone with the assistance of a trained representative.

Please note that you must enroll by [enrollment deadline date — 90 days from mailing date] in order to take advantage of these complimentary services. We strongly encourage you to enroll as soon as possible.

Monitor Your Health Insurance Statements and Explanation of Benefits (EOBs)

Because your protected health information may have been involved in this incident, we encourage you to carefully review all Explanation of Benefits ("EOB") statements and health insurance statements you receive from your health insurance providers. Look for any services, procedures, prescriptions, or claims that you did not receive or did not authorize. If you identify any unfamiliar charges, claims, or entries, contact your health insurance provider immediately to report the discrepancy and request a review. Medical identity theft can result in inaccurate entries in your medical records, which could affect the care you receive in the future, so it is important to review your records carefully.

Review Your Account Statements and Credit Reports

We recommend that you regularly monitor your bank statements, financial account statements, and credit card statements for any unauthorized or suspicious transactions. If you identify any transactions that you did not make or authorize, contact your financial institution immediately to report the activity.

You are entitled to receive a free copy of your credit report from each of the three nationwide credit reporting agencies once every twelve months. To request your free credit reports, you may visit www.annualcreditreport.com or call 1-877-322-8228. Reviewing your credit reports can help you identify any accounts or inquiries that you did not authorize, which may be a sign of identity theft.

In addition, you may wish to consider placing a free fraud alert or a credit freeze (also known as a security freeze) on your credit files with each of the three nationwide credit reporting agencies. A fraud alert notifies creditors to take additional steps to verify your identity before extending credit in your name. A credit freeze restricts access to your credit report, making it more difficult for someone to open new accounts in your name. You may contact the three credit reporting agencies as follows:

Harborview Enterprises P.O. Box 740256 Atlanta, GA 30374 1-800-525-6285 www.Harborview Enterprises.com

Penrose Group P.O. Box 9554 Allen, TX 75013 1-888-397-3742 www.Penrose Group.com

Penmark Enterprises P.O. Box 2000 Chester, PA 19016 1-800-680-7289 www.Penmark Enterprises.com

Please be aware that placing a fraud alert or credit freeze is free under federal law and will not affect your credit score.

Report Suspicious Activity

If you believe you are a victim of identity theft or if you detect any suspicious activity involving your personal information, we recommend that you take the following steps:

• File a report with the Federal Trade Commission ("FTC"). You may file an identity theft report with the FTC online at www.identitytheft.gov or by calling 1-877-438-4338 (TTY: 1-866-653-4261). The FTC can provide you with a personalized recovery plan and assist you in resolving identity theft issues.

• File a police report with your local law enforcement agency. You may wish to file a report with your local police department and obtain a copy of the police report for your records. A police report may be helpful in disputing fraudulent accounts or charges with creditors and credit reporting agencies.

• Contact your state attorney general's office. Your state attorney general's office may have additional resources and information available to assist victims of identity theft and data breaches. You may find contact information for your state attorney general at www.naag.org.

Request Copies of Your Medical Records

Under HIPAA, you have the right to request copies of your medical records from your health care providers and health insurers. We encourage you to review your medical records carefully for any evidence of medical identity theft, such as unfamiliar entries, diagnoses, procedures, or treatments that you did not receive. If you identify any inaccuracies, contact your health care provider or health insurer to request a correction.

You also have the right under HIPAA to request an accounting of disclosures of your protected health information from your health care providers and health insurers. An accounting of disclosures is a record of certain instances in which your PHI was shared with or disclosed to third parties. Reviewing this accounting can help you identify any unauthorized disclosures of your information. To request an accounting of disclosures, contact your health care provider's or health insurer's privacy office.

Contact Information

If you have any questions about this incident, need assistance enrolling in the complimentary credit monitoring and identity theft protection services, or would like additional information, please do not hesitate to contact us using any of the following methods:

Quorum Dedicated Incident Response Line (Operated by Clearfield Notification Services LLC)

Toll-Free Telephone: 1-8XX-XXX-XXXX Hours of Operation: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time Dedicated Website: [URL]

Mailing Address: Quorum Insurance Holdings Corp., Attn: Privacy Office, 400 Constitution Plaza, Suite 2200, Hartford, CT 06103

Trained representatives are available to answer your questions and assist you during the call center's hours of operation. We anticipate that the dedicated call center will remain available for a period of twelve (12) weeks from the date of this letter.

Additionally, if you believe that your health information privacy rights have been violated, you have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You may contact the Office for Civil Rights as follows:

U.S. Department of Health and Human Services Office for Civil Rights

Website: www.hhs.gov/ocr/privacy/hipaa/complaints/ Toll-Free Telephone: 1-800-368-1019 TDD: 1-800-537-7697

Mailing Address: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Room 509F, HHH Building, Washington, D.C. 20201

Please note that you will not be retaliated against for filing a complaint with HHS-OCR.

Closing

Quorum sincerely regrets any concern or inconvenience this incident may cause you. We understand the importance of protecting the personal information and protected health information of the individuals we serve, and we take that responsibility seriously. We are committed to taking the steps necessary to help prevent a similar incident from occurring in the future, and we will continue to evaluate and enhance our data security practices and vendor oversight measures.

We strongly encourage you to take advantage of the complimentary twenty-four (24) months of credit monitoring and identity theft protection services being offered to you at no cost. Enrolling in these services can provide you with an important layer of protection and peace of mind.

If you have any questions or need further assistance, please call our dedicated toll-free number at 1-8XX-XXX-XXXX or visit our dedicated website at [URL]. Our trained representatives are ready to help.

Thank you for your patience and understanding.

Sincerely,

Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Enclosure: Instructions for Enrolling in Complimentary 24-Month Credit Monitoring and Identity Theft Protection Services through Clearfield Notification Services LLC

Your Unique Reference Number / Activation Code: [Unique Reference Number]

This notification is being provided in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Breach Notification Rule, 45 C.F.R. § 164.404, and applicable state breach notification statutes. This notice is being sent to you as an individual whose protected health information may have been involved in the data security incident described above. Nothing in this letter is intended as, nor should it be construed as, an admission of liability, fault, or wrongdoing by Quorum Insurance Holdings Corp. or any of its affiliates, subsidiaries, officers, directors, employees, or agents.

Quorum Insurance Holdings Corp., Nasdaq: QIHC

QUORUM INSURANCE HOLDINGS CORP. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
August 10, 2023
[Recipient Full Name] [Recipient Address Line 1] [Recipient City, State, ZIP]
Dear [Recipient Name]:
Notice of Data Security Incident Involving Your Protected Health Information
Quorum Insurance Holdings Corp. ("Quorum," "we," "us," or "our") is writing to inform you about a data security incident that may have affected your personal information, including your protected health information ("PHI"). We take the privacy and security of personal information entrusted to us very seriously. We are providing you this notice to explain the circumstances of the incident, describe the types of information that may have been involved, and outline the steps we are taking in response—as well as the steps you can take to help protect yourself. This notice is being provided in accordance with the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations, including the Breach Notification Rule set forth at 45 C.F.R. § 164.404, as well as applicable state breach notification laws.
In addition to this notice, we want you to know that we are making available to you, at no cost, complimentary credit monitoring and identity theft protection services for a period of twenty-four (24) months, as described in further detail below and in the enclosed enrollment instructions. We encourage you to review this letter carefully and to take advantage of the resources we are offering.
What Happened
In the ordinary course of our insurance operations, Quorum utilizes a third-party claims data processing vendor, Palomar Data Solutions, Inc. ("Palomar"), to process certain claims-related data on Quorum's behalf. Palomar serves as a business associate of Quorum under HIPAA and is subject to contractual obligations regarding the security and confidentiality of the information it processes.
On or about March 14, 2023, an unauthorized third party exploited a previously identified vulnerability in a file transfer application used by Palomar to transmit and receive data files. Specifically, the unauthorized actor exploited a remote code execution vulnerability known as CVE-2023-0669, which affected Palomar's GoAnywhere MFT (Managed File Transfer) file transfer appliance. By leveraging this vulnerability, the unauthorized actor was able to gain unauthorized access to certain systems within Palomar's network environment.
The unauthorized access continued over a period of approximately thirty-five (35) days, from approximately March 14, 2023, through April 18, 2023. During this window, the forensic evidence indicates that certain data files were exfiltrated—that is, copied and transferred outside of Palomar's systems—by the unauthorized actor.
On April 18, 2023, Palomar's security operations team detected anomalous outbound data transfers from its network. Palomar immediately initiated its incident response protocols to contain and investigate the activity. Palomar subsequently notified Quorum of the security incident on April 21, 2023.
Upon learning of the incident, Quorum acted promptly to understand the nature and scope of the compromise. We immediately engaged outside legal counsel at Calderwood & Harkness LLP, a nationally recognized privacy and data security law firm, to coordinate our incident response efforts. Under the direction of counsel, we retained Graystone Forensics LLC, a leading cybersecurity forensic investigation firm, to conduct a comprehensive forensic investigation of the incident.
The forensic investigation, which involved an exhaustive review of network logs, file access records, and data transfer activity, confirmed on July 14, 2023, the scope of data that was accessed and exfiltrated during the period of unauthorized access. Following that determination, Quorum undertook a comprehensive, manual data review process to identify the specific individuals whose information was contained in the affected files. That data review was completed on August 4, 2023, at which time we were able to confirm your information was among the data involved.
What Information Was Involved
Based on our investigation and the comprehensive data review, we have determined that the following categories of your information may have been accessed or acquired by the unauthorized party during the incident:
Personal Identifying Information: Your full name, date of birth, Social Security number, and/or driver's license or state identification number.
Protected Health Information: Health-related information associated with workers' compensation claims and/or health-related insurance claims that were processed by Palomar on Quorum's behalf, which may include health conditions, medical diagnosis codes (such as ICD-10 codes), and/or treatment information.
Financial Information (if applicable): For some individuals, the affected data may also have included bank account numbers and/or payment card numbers associated with claim payments or premium transactions. If your financial information was determined to be among the data involved, this category applies to you.
The information described above was contained in structured data files maintained within Palomar's claims processing environment. We want to assure you that, to date, we have no evidence that your information has been misused as a result of this incident. However, out of an abundance of caution, we are notifying you and providing the resources described in this letter so that you can take appropriate steps to monitor and protect your information.
What We Are Doing
Upon learning of this incident, Quorum immediately took a number of steps to investigate the breach, to mitigate potential harm to affected individuals, and to protect against further breaches. These steps include the following:
• Engaged expert legal counsel. We retained Calderwood & Harkness LLP to coordinate all aspects of our incident response, including the forensic investigation, regulatory notifications, and individual notifications.
• Retained a leading forensic investigation firm. Under the direction of counsel, we engaged Graystone Forensics LLC to conduct a thorough forensic investigation to determine the nature, scope, and impact of the unauthorized access and data exfiltration.
• Worked with Palomar to remediate the vulnerability and terminate unauthorized access. We worked closely with Palomar to ensure that the CVE-2023-0669 vulnerability in the GoAnywhere MFT appliance was fully remediated, that the unauthorized actor's access to Palomar's network was terminated, and that all indicators of compromise were identified and addressed.
• Notified applicable federal and state regulators. We filed notification with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR") on August 15, 2023, and with applicable state attorneys general and state regulatory agencies across all affected jurisdictions beginning August 14, 2023, in compliance with federal and state breach notification requirements.
• Required Palomar to implement enhanced security measures. We have required Palomar to implement a range of enhanced security measures to strengthen its defenses against future incidents. These measures include, among other things, enhanced patch management protocols to ensure that critical security updates are applied promptly; deployment of advanced endpoint detection and response ("EDR") capabilities across its network; and engagement of an independent third-party security assessor to conduct ongoing security audits and assessments of Palomar's systems and practices.
• Providing complimentary credit monitoring and identity theft protection services. We are offering all affected individuals, including you, twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, at no cost to you. Details on how to enroll are provided below and in the enclosed enrollment instructions.
We are committed to being transparent about this incident and to taking all reasonable steps to mitigate its impact. We will continue to evaluate our vendor oversight practices and data security measures to help prevent similar incidents from occurring in the future.
What You Can Do
While we have no evidence at this time that your information has been misused, we encourage you to remain vigilant and to take the following steps to help protect yourself from potential harm:
Enroll in Complimentary Credit Monitoring and Identity Theft Protection Services
Quorum is offering you twenty-four (24) months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC, at no cost to you. These services include credit monitoring, identity restoration assistance, and identity theft insurance coverage. To enroll, you may either:
• Visit our dedicated enrollment website at [dedicated enrollment website URL] and follow the on-screen instructions, using the unique reference number and activation code provided in the enclosed enrollment instructions; or
• Call our dedicated toll-free telephone number at 1-8XX-XXX-XXXX to enroll by phone with the assistance of a trained representative.
Please note that you must enroll by [enrollment deadline date — 90 days from mailing date] in order to take advantage of these complimentary services. We strongly encourage you to enroll as soon as possible.
Monitor Your Health Insurance Statements and Explanation of Benefits (EOBs)
Because your protected health information may have been involved in this incident, we encourage you to carefully review all Explanation of Benefits ("EOB") statements and health insurance statements you receive from your health insurance providers. Look for any services, procedures, prescriptions, or claims that you did not receive or did not authorize. If you identify any unfamiliar charges, claims, or entries, contact your health insurance provider immediately to report the discrepancy and request a review. Medical identity theft can result in inaccurate entries in your medical records, which could affect the care you receive in the future, so it is important to review your records carefully.
Review Your Account Statements and Credit Reports
We recommend that you regularly monitor your bank statements, financial account statements, and credit card statements for any unauthorized or suspicious transactions. If you identify any transactions that you did not make or authorize, contact your financial institution immediately to report the activity.
You are entitled to receive a free copy of your credit report from each of the three nationwide credit reporting agencies once every twelve months. To request your free credit reports, you may visit www.annualcreditreport.com or call 1-877-322-8228. Reviewing your credit reports can help you identify any accounts or inquiries that you did not authorize, which may be a sign of identity theft.
In addition, you may wish to consider placing a free fraud alert or a credit freeze (also known as a security freeze) on your credit files with each of the three nationwide credit reporting agencies. A fraud alert notifies creditors to take additional steps to verify your identity before extending credit in your name. A credit freeze restricts access to your credit report, making it more difficult for someone to open new accounts in your name. You may contact the three credit reporting agencies as follows:
Harborview Enterprises P.O. Box 740256 Atlanta, GA 30374 1-800-525-6285 www.Harborview Enterprises.com
Penrose Group P.O. Box 9554 Allen, TX 75013 1-888-397-3742 www.Penrose Group.com
Penmark Enterprises P.O. Box 2000 Chester, PA 19016 1-800-680-7289 www.Penmark Enterprises.com
Please be aware that placing a fraud alert or credit freeze is free under federal law and will not affect your credit score.
Report Suspicious Activity
If you believe you are a victim of identity theft or if you detect any suspicious activity involving your personal information, we recommend that you take the following steps:
• File a report with the Federal Trade Commission ("FTC"). You may file an identity theft report with the FTC online at www.identitytheft.gov or by calling 1-877-438-4338 (TTY: 1-866-653-4261). The FTC can provide you with a personalized recovery plan and assist you in resolving identity theft issues.
• File a police report with your local law enforcement agency. You may wish to file a report with your local police department and obtain a copy of the police report for your records. A police report may be helpful in disputing fraudulent accounts or charges with creditors and credit reporting agencies.
• Contact your state attorney general's office. Your state attorney general's office may have additional resources and information available to assist victims of identity theft and data breaches. You may find contact information for your state attorney general at www.naag.org.
Request Copies of Your Medical Records
Under HIPAA, you have the right to request copies of your medical records from your health care providers and health insurers. We encourage you to review your medical records carefully for any evidence of medical identity theft, such as unfamiliar entries, diagnoses, procedures, or treatments that you did not receive. If you identify any inaccuracies, contact your health care provider or health insurer to request a correction.
You also have the right under HIPAA to request an accounting of disclosures of your protected health information from your health care providers and health insurers. An accounting of disclosures is a record of certain instances in which your PHI was shared with or disclosed to third parties. Reviewing this accounting can help you identify any unauthorized disclosures of your information. To request an accounting of disclosures, contact your health care provider's or health insurer's privacy office.
Contact Information
If you have any questions about this incident, need assistance enrolling in the complimentary credit monitoring and identity theft protection services, or would like additional information, please do not hesitate to contact us using any of the following methods:
Quorum Dedicated Incident Response Line (Operated by Clearfield Notification Services LLC)
Toll-Free Telephone: 1-8XX-XXX-XXXX Hours of Operation: Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time Dedicated Website: [URL]
Mailing Address: Quorum Insurance Holdings Corp., Attn: Privacy Office, 400 Constitution Plaza, Suite 2200, Hartford, CT 06103
Trained representatives are available to answer your questions and assist you during the call center's hours of operation. We anticipate that the dedicated call center will remain available for a period of twelve (12) weeks from the date of this letter.
Additionally, if you believe that your health information privacy rights have been violated, you have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You may contact the Office for Civil Rights as follows:
U.S. Department of Health and Human Services Office for Civil Rights
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/ Toll-Free Telephone: 1-800-368-1019 TDD: 1-800-537-7697
Mailing Address: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Room 509F, HHH Building, Washington, D.C. 20201
Please note that you will not be retaliated against for filing a complaint with HHS-OCR.
Closing
Quorum sincerely regrets any concern or inconvenience this incident may cause you. We understand the importance of protecting the personal information and protected health information of the individuals we serve, and we take that responsibility seriously. We are committed to taking the steps necessary to help prevent a similar incident from occurring in the future, and we will continue to evaluate and enhance our data security practices and vendor oversight measures.
We strongly encourage you to take advantage of the complimentary twenty-four (24) months of credit monitoring and identity theft protection services being offered to you at no cost. Enrolling in these services can provide you with an important layer of protection and peace of mind.
If you have any questions or need further assistance, please call our dedicated toll-free number at 1-8XX-XXX-XXXX or visit our dedicated website at [URL]. Our trained representatives are ready to help.
Thank you for your patience and understanding.
Sincerely,
Jennifer Liang Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Enclosure: Instructions for Enrolling in Complimentary 24-Month Credit Monitoring and Identity Theft Protection Services through Clearfield Notification Services LLC
Your Unique Reference Number / Activation Code: [Unique Reference Number]
This notification is being provided in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") Breach Notification Rule, 45 C.F.R. § 164.404, and applicable state breach notification statutes. This notice is being sent to you as an individual whose protected health information may have been involved in the data security incident described above. Nothing in this letter is intended as, nor should it be construed as, an admission of liability, fault, or wrongdoing by Quorum Insurance Holdings Corp. or any of its affiliates, subsidiaries, officers, directors, employees, or agents.
Quorum Insurance Holdings Corp., Nasdaq: QIHC

QUORUM INSURANCE HOLDINGS CORP. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103

Record

Parties

Dates

Amounts