PRIVILEGED AND CONFIDENTIAL
ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
INTERNAL MEMORANDUM
This memorandum is protected by the attorney-client privilege and attorney work product doctrine. It is intended solely for the use of the Calderwood & Harkness engagement team members identified below. Do not distribute, copy, or forward without the express authorization of Kevin Ostrowski.
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Date: May 5, 2023
TO: Alan Burke, Lead Associate, Privacy & Data Security Practice Group Sara Hendricks, Working Associate, Privacy & Data Security Practice Group
FROM: Kevin Ostrowski, Responsible Partner, Privacy & Data Security Practice Group
RE: Privilege Protocols — Forensic Investigation of Palomar Data Solutions, Inc. Security Incident; Quorum Insurance Holdings Corp.
Matter No.: 1025-00006
Client: Quorum Insurance Holdings Corp.
Right-click to update Table of Contents
I. PURPOSE AND BACKGROUND
1.1 Purpose of This Memorandum
The purpose of this memorandum is to establish binding internal protocols for the Calderwood & Harkness LLP ("C&H" or the "firm") engagement team governing the preservation of attorney-client privilege and attorney work product protection over all aspects of the forensic investigation being conducted at counsel's direction in connection with the data security incident involving Palomar Data Solutions, Inc. ("Palomar") and our client, Quorum Insurance Holdings Corp. ("Quorum" or the "Client").
This memorandum is intended to ensure that all members of the C&H engagement team understand their individual and collective responsibilities in maintaining privilege throughout all phases of this engagement, including the forensic investigation phase, the regulatory notification phase, any subsequent regulatory defense proceedings, potential litigation, and vendor accountability workstreams. The protocols outlined herein apply to all communications, documents, reports, analyses, memoranda, and other materials created or received in connection with Matter No. 1025-00006.
Strict adherence to these protocols is essential. The value of the forensic investigation to the Client depends in large part on our ability to protect the resulting work product from disclosure to adverse parties, regulators, and litigants. A single careless communication or improperly marked document can undermine the entire privilege framework, potentially exposing the Client to significant legal and financial risk. Each team member must internalize these protocols and apply them consistently in every interaction—written, verbal, and electronic—related to this matter.
This memorandum supplements but does not replace the firm's general privilege and confidentiality policies as set forth in the Calderwood & Harkness Attorney Handbook (revised January 2023) and the firm's Information Security and Data Handling Policy (revised March 2023). Where any conflict exists between this memorandum and those general policies, the more restrictive standard shall govern. Team members are encouraged to consult the firm's general policies for background guidance but must treat this memorandum as the controlling authority for all privilege-related decisions specific to Matter No. 1025-00006.
1.2 Engagement Background
Calderwood & Harkness was engaged by Quorum Insurance Holdings Corp. through its General Counsel, Thomas R. Whitfield, effective May 4, 2023, to coordinate the legal response to a data security incident originating at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. The engagement encompasses the full spectrum of incident response activities, including oversight of the forensic investigation, compliance with state and federal notification obligations, defense against potential regulatory inquiries and enforcement actions, and assessment of vendor accountability and potential indemnification claims.
The underlying incident involves the compromise of Palomar's network infrastructure through the exploitation of CVE-2023-0669, a critical remote code execution vulnerability affecting Severin Corporation's GoAnywhere Managed File Transfer ("GoAnywhere MFT") platform. This vulnerability, which was publicly disclosed in early February 2023, permits an authenticated attacker to achieve remote code execution on a vulnerable GoAnywhere MFT instance. Based on the preliminary information provided by Palomar, the threat actor exploited this vulnerability to gain unauthorized access to Palomar's file-transfer environment, which processes claims data on behalf of Quorum and other insurance carrier clients.
According to the information communicated by Palomar to Quorum, the unauthorized access window extended from approximately March 14, 2023, through April 18, 2023—a period of approximately thirty-five (35) days. During this window, the threat actor is believed to have accessed, and potentially exfiltrated, data files transiting through the GoAnywhere MFT platform, including files containing Quorum policyholder and claimant data.
Palomar's Security Operations Center ("SOC") discovered anomalous outbound data transfers on April 18, 2023, which triggered an internal investigation and containment response. Palomar formally notified Quorum of the incident on April 21, 2023, via email from Derek Copeland, Palomar's General Counsel, addressed to Thomas R. Whitfield (Quorum General Counsel) and David Naranjo (Quorum Chief Information Security Officer). The notification email described the incident in general terms and indicated that Palomar had engaged its own forensic investigator to assess the scope and impact of the compromise. Palomar's notification did not identify the specific data elements potentially affected, nor did it provide an estimate of the number of individuals whose data may have been compromised.
Based on the nature of the data processed by Palomar on behalf of Quorum, the incident potentially affects multiple categories of sensitive personal information, including but not limited to:
• Personally Identifiable Information ("PII"): names, addresses, dates of birth, Social Security numbers, driver's license numbers, and other government-issued identification numbers of Quorum policyholders and insurance claimants;
• Protected Health Information ("PHI"): medical records, diagnosis codes, treatment information, health plan beneficiary numbers, and other health-related data submitted in connection with health insurance claims processed through Palomar's platform;
• Financial Data: bank account numbers, payment card information, claims payment records, and other financial information associated with policyholder accounts and claims payments.
The potential involvement of PHI implicates the notification and breach reporting requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), in addition to the breach notification statutes of numerous states. The combination of PII, PHI, and financial data significantly increases both the regulatory exposure and the potential for private litigation, including class action claims.
The scope of Calderwood & Harkness's engagement, as set forth in the engagement letter dated May 4, 2023, encompasses the following principal workstreams:
1. Forensic Investigation Oversight: Direction and management of a third-party forensic investigation to determine the nature, scope, and impact of the compromise, including identification of the specific data elements and individuals affected;
2. Notification Compliance: Assessment and execution of notification obligations under applicable federal and state laws, including HIPAA/HITECH, state breach notification statutes, and any contractual notification provisions;
3. Regulatory Defense: Preparation for and response to any regulatory inquiries, investigations, or enforcement actions initiated by state attorneys general, the U.S. Department of Health and Human Services Office for Civil Rights ("HHS-OCR"), state insurance departments, or other regulatory bodies;
4. Vendor Accountability: Analysis of Palomar's contractual obligations to Quorum, including representations and warranties, indemnification provisions, and insurance requirements under the Master Services Agreement between Quorum and Palomar dated September 12, 2020, as amended.
1.3 Retention of Graystone Forensics LLC
On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone"), a digital forensics and incident response firm based in Tysons Corner, Virginia, to conduct the technical forensic investigation of the Palomar security incident. The decision to retain Graystone was made by Calderwood & Harkness in its capacity as legal counsel to Quorum, and Graystone's retention is structured to preserve the attorney-client privilege and work product protection over all aspects of the forensic investigation.
The Graystone engagement is led by Dr. Nolan Briggs, Managing Director, Incident Response, who serves as the engagement lead and primary point of contact for Calderwood & Harkness. The day-to-day analytical work will be conducted under the supervision of Kendra Faulkner, Senior Forensic Analyst, who will manage the technical examination of forensic evidence, including log analysis, network traffic analysis, file system examination, and data exfiltration assessment.
The structural arrangement of Graystone's retention is critical to the privilege framework and must be understood by every member of the engagement team. Graystone is retained by Calderwood & Harkness—not directly by Quorum—specifically to preserve the privilege umbrella over the forensic investigation. Graystone's work is performed at the direction of counsel to assist Calderwood & Harkness in providing legal advice to Quorum regarding the security incident. This structure invokes the well-established principle that communications with and work product of a non-attorney consultant retained by counsel to assist in the provision of legal services are protected by the attorney-client privilege and work product doctrine. See, e.g., United States v. Kovel, 296 F.2d 918 (2d Cir. 1961); In re Grand Jury Subpoena, 341 F.3d 331 (4th Cir. 2003).
The retention letter between Calderwood & Harkness and Graystone, executed on May 5, 2023, expressly states the following:
(a) Graystone is retained by Calderwood & Harkness LLP to act under counsel's direction and at counsel's request;
(b) The purpose of Graystone's engagement is to assist Calderwood & Harkness in rendering legal advice to Quorum Insurance Holdings Corp. in connection with a data security incident;
(c) All work product, reports, memoranda, communications, analyses, data, and findings produced by Graystone in connection with the engagement are privileged and confidential;
(d) Graystone shall not disclose any information, findings, or work product to any party other than Calderwood & Harkness attorneys without the express prior written authorization of the responsible partner;
(e) Graystone's work product shall bear appropriate privilege markings as directed by Calderwood & Harkness.
This structure must be consistently maintained throughout the engagement. Any deviation from this framework—including direct retention of Graystone by Quorum, direct communication of privileged findings by Graystone to Quorum personnel, or treatment of Graystone as a business consultant rather than a legal consultant—could undermine the privilege framework and potentially result in waiver. All team members must be mindful of this structural requirement in their day-to-day interactions with both Graystone and the Client.
II. GOVERNING LEGAL PRINCIPLES
2.1 Attorney-Client Privilege
The attorney-client privilege protects confidential communications between an attorney and a client made for the purpose of obtaining or providing legal advice. In the context of this engagement, the privilege covers communications between Calderwood & Harkness attorneys and authorized Quorum personnel made in connection with the legal response to the Palomar security incident.
The following Quorum personnel are authorized client representatives for purposes of the attorney-client privilege as of the date of this memorandum:
• Thomas R. Whitfield, General Counsel
• Jennifer Liang, Chief Privacy Officer
• David Naranjo, Chief Information Security Officer
• Priya Deshmukh, Vice President, Vendor Risk Management
• Robert Wentworth, Senior Vice President, Claims Operations
• Margaret D. Calloway, Chief Executive Officer (through Thomas R. Whitfield only)
• Franklin Reeves, Board Chair, Audit Committee (through Thomas R. Whitfield only)
Additional individuals may be added to this list as the engagement evolves, but only with the express authorization of Kevin Ostrowski, who will confirm any additions in writing to the engagement team.
The privilege extends to communications with Graystone Forensics to the extent that Graystone is functioning as an agent of counsel assisting in the rendition of legal advice. This extension of the privilege is grounded in the Kovel doctrine, which recognizes that an attorney may, in certain circumstances, need to rely on the expertise of non-lawyer consultants to understand complex factual or technical matters in order to provide competent legal advice to the client. Under this framework, the consultant functions as a "translator" of complex information, enabling the attorney to understand the client's situation and render informed legal counsel. The privilege over communications with and work product of the consultant is derivative of the attorney-client relationship and depends on the consultant's role as an agent of the attorney.
The privilege can be waived—intentionally or inadvertently—by disclosure of privileged communications or materials to third parties who are outside the privilege umbrella. Waiver need not be complete to be damaging; selective or partial disclosure of privileged materials can result in subject-matter waiver, potentially opening the door to discovery of all related privileged communications on the same subject. Accordingly, the engagement team must exercise constant vigilance against inadvertent disclosure, including disclosure through improperly addressed emails, inadequately marked documents, or careless discussions in the presence of unauthorized individuals.
2.2 Attorney Work Product Doctrine
The attorney work product doctrine, codified in Federal Rule of Civil Procedure 26(b)(3) and recognized in analogous state rules, protects documents and tangible things prepared in anticipation of litigation or for trial by or for a party or by or for that party's representative (including the party's attorney, consultant, surety, indemnitor, insurer, or agent). The doctrine provides two tiers of protection:
(a) Ordinary (Fact) Work Product: Documents and tangible things prepared in anticipation of litigation are discoverable only upon a showing of substantial need and inability to obtain the substantial equivalent by other means without undue hardship. Even when such a showing is made, the court must protect against disclosure of the mental impressions, conclusions, opinions, or legal theories of the attorney.
(b) Opinion Work Product: Materials reflecting the attorney's mental impressions, conclusions, opinions, and legal theories enjoy near-absolute protection and are virtually never discoverable.
In the context of this engagement, all documents, analyses, memoranda, reports, and communications prepared in anticipation of litigation or in connection with rendering legal advice to Quorum constitute protected work product. This includes, without limitation:
• Calderwood & Harkness memoranda analyzing the legal implications of the forensic findings;
• Calderwood & Harkness assessments of notification obligations, regulatory exposure, and litigation risk;
• Calderwood & Harkness strategy documents regarding vendor accountability and indemnification claims;
• Graystone Forensics' forensic reports, interim findings, working papers, and technical analyses, when prepared at counsel's direction for the purpose of enabling legal advice.
Graystone's forensic reports occupy a particularly important position within the work product framework. To the extent that Graystone's reports are prepared at the direction of counsel for the purpose of assisting counsel in providing legal advice—as opposed to being prepared for a business purpose such as network remediation or vendor management—they constitute attorney work product. Moreover, to the extent that Graystone's reports reflect or incorporate counsel's mental impressions, legal strategies, or analytical framework (for example, where counsel directs Graystone to investigate specific issues relevant to anticipated litigation theories), the reports may qualify as opinion work product entitled to heightened protection.
The engagement team must be aware of the risk posed by dual-purpose documents—that is, documents that serve both legal and business purposes. Courts in various jurisdictions have adopted differing approaches to the work product protection of dual-purpose documents. Some courts apply a "primary purpose" test, holding that work product protection applies only if the primary motivating purpose for the document's creation was to assist in providing legal advice or preparing for litigation. Other courts apply a "because of" test, which is somewhat more protective, holding that work product protection applies if the document would not have been created in substantially similar form "but for" the prospect of litigation or the need for legal advice.
To minimize the risk that dual-purpose issues will undermine work product protection, all documents created in connection with this engagement should be prepared with the primary purpose of facilitating legal advice clearly stated. Where a document is created at counsel's direction, it should expressly note that it was prepared at the direction of counsel and for the purpose of enabling counsel to provide legal advice to the Client. This is particularly important for Graystone deliverables, which opposing parties or regulators may attempt to characterize as ordinary business documents prepared for IT remediation or vendor management purposes rather than as legal work product.
2.3 Common Interest Agreement
A Common Interest Agreement (sometimes referred to as a "joint defense agreement" or "common interest privilege agreement") is being negotiated between Quorum and Atlas Mutual Insurance Company ("Atlas Mutual"), Quorum's primary cyber-liability insurer under Policy No. CYB-2023-041587, Claim No. CYB-CLM-2023-05892. The Common Interest Agreement, once executed, will permit the sharing of certain privileged materials between Quorum (through C&H) and Atlas Mutual (through Atlas Mutual's coverage counsel) without waiver of the attorney-client privilege or work product protection, based on the recognized principle that disclosure to a party sharing a common legal interest does not constitute waiver when the disclosure is made in furtherance of the common interest.
The Common Interest Agreement is expected to cover the sharing of privileged forensic findings, legal analyses, and strategy materials to the extent necessary for Atlas Mutual to evaluate and administer Quorum's cyber-liability claim. The scope of materials to be shared, and the terms governing their use, will be defined by the agreement's terms.
Until the Common Interest Agreement is fully executed and confirmed by Kevin Ostrowski, the following prohibition applies without exception:
No privileged or work product materials of any kind—including but not limited to Graystone reports, C&H legal memoranda, draft regulatory filings, privilege logs, or internal communications—are to be shared with Atlas Mutual Insurance Company, Paul Enriquez (Atlas Mutual Claims Adjuster), or any other Atlas Mutual representative. This prohibition extends equally to Pinnacle Surplus Lines Insurance Corp. and Lisa Garner or any other representative of Pinnacle Surplus Lines, which provides excess cyber-liability coverage to Quorum.
Once the Common Interest Agreement has been fully executed and Kevin Ostrowski has confirmed its terms to the engagement team, sharing of materials under the agreement must be conducted strictly in accordance with its provisions. Only Kevin Ostrowski or Rachel Bernstein (of counsel, Privacy & Data Security Practice Group) are authorized to share materials under the Common Interest Agreement. No other member of the engagement team may transmit privileged materials to any insurance carrier representative, even after the agreement is in place, without the express direction of Kevin Ostrowski or Rachel Bernstein.
III. DOCUMENT MARKING AND LABELING REQUIREMENTS
3.1 Mandatory Privilege Markings
Proper and consistent privilege marking is one of the most important safeguards against inadvertent waiver. While privilege markings are not, by themselves, legally sufficient to establish privilege, they serve several critical functions: they put recipients on notice that the document is claimed as privileged; they demonstrate the sender's intent to maintain confidentiality; they support arguments against waiver in the event of inadvertent disclosure; and they facilitate the identification and segregation of privileged materials for privilege log and document production purposes.
Accordingly, every document created in connection with Matter No. 1025-00006 must bear the following legend on the first page and, where practicable, on every subsequent page:
"PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT — PREPARED AT THE DIRECTION OF COUNSEL — CALDERWOOD & HARKNESS LLP — MATTER NO. 1025-00006"
This legend must appear in a prominent location, such as the header, footer, or a conspicuous block at the top of the first page. Where the document format does not readily permit placement on every page (e.g., certain spreadsheet formats), the legend must appear at minimum on the first page or tab and in the document's metadata or properties fields.
Email communications related to this matter must include the privilege legend in one of the following locations:
(a) As a prefix in the email subject line (e.g., "PRIVILEGED & CONFIDENTIAL — [Subject]");
(b) As a header notation at the top of the email body, before the substantive text of the message; or
(c) Both (a) and (b), which is the preferred approach.
This marking requirement applies to every message in an email chain, including replies and forwards. When replying to or forwarding an email, the team member must verify that the privilege legend appears in the subject line and at the top of the new message. Do not rely on a legend appearing only in an earlier message in the chain, as the chain may be severed or the earlier message may not be visible to all recipients.
Draft documents circulated internally within C&H or to the Client must carry the additional marking "DRAFT — PRIVILEGED" together with a version number and date (e.g., "DRAFT — PRIVILEGED — v.2 — May 10, 2023"). This additional marking serves two purposes: it reinforces the privileged nature of the document, and it helps ensure that draft versions are not mistaken for final versions and inadvertently disclosed or filed.
3.2 Graystone Forensics Deliverables
Maintaining proper privilege markings on Graystone deliverables is critical because these materials are the most likely targets of discovery requests, regulatory demands, and litigation challenges to the privilege framework. The following requirements apply to all Graystone deliverables without exception:
Addressee Requirements: All Graystone reports, memoranda, data analyses, interim findings, status updates, and communications must be addressed to:
"Kevin Ostrowski, Esq., Calderwood & Harkness LLP"
or, in the alternative, to:
"Alan Burke, Esq., Calderwood & Harkness LLP"
Graystone deliverables must not be addressed to any other individual, including any Quorum personnel, under any circumstances. This addressing protocol is essential to maintaining the consultant-as-agent-of-attorney framework. If a deliverable is addressed to a Quorum employee—even if it is simultaneously copied to C&H—it may be argued that Graystone was functioning as the Client's consultant rather than as counsel's agent, potentially destroying the privilege.
Privilege Marking Requirements: All Graystone deliverables must bear the following marking, prominently displayed on the first page and, where practicable, on every subsequent page:
"PRIVILEGED AND CONFIDENTIAL — PREPARED AT THE DIRECTION OF COUNSEL — FOR USE BY CALDERWOOD & HARKNESS LLP IN PROVIDING LEGAL ADVICE TO QUORUM INSURANCE HOLDINGS CORP."
Flow of Deliverables: Under no circumstances should Graystone deliverables be transmitted directly to Quorum personnel, even when those deliverables are ultimately intended for the Client's review. All Graystone deliverables must flow through Calderwood & Harkness. The deliverable is first received by C&H, reviewed by C&H for proper marking and content, accompanied by C&H's legal analysis, and then transmitted to the Client by C&H. This flow-through protocol reinforces the structural relationship between Graystone and C&H, and between C&H and the Client, that underpins the privilege framework.
Alan Burke's Review Responsibility: Alan Burke is responsible for confirming proper privilege markings on every Graystone deliverable before it is forwarded to the Client or any other authorized recipient. This review must include verification that:
(a) The deliverable is properly addressed to Kevin Ostrowski, Esq. or Alan Burke, Esq. at Calderwood & Harkness LLP;
(b) The required privilege marking appears on the first page and on each subsequent page where practicable;
(c) The deliverable does not contain any language suggesting that Graystone was acting at the direction of, or reporting to, anyone other than Calderwood & Harkness;
(d) The deliverable does not reference any direct communications between Graystone and Quorum personnel that were not overseen by C&H attorneys.
If any deficiency is identified, Alan Burke must request correction from Graystone before the deliverable is forwarded. In urgent circumstances where time does not permit correction, Alan Burke must note the deficiency in a cover communication and arrange for the corrected version to be substituted as promptly as possible.
3.3 File Organization
Proper file organization is essential to maintaining the integrity of the privilege framework and to enabling efficient preparation of privilege logs and document productions. All documents related to Matter No. 1025-00006 must be stored in the firm's document management system ("DMS") under the designated matter number. The following subfolder structure must be maintained:
(a) Privileged / Work Product: This subfolder contains all attorney-client communications, attorney work product, Graystone deliverables, C&H legal memoranda, draft regulatory filings annotated with legal analysis, and all other materials claimed as privileged or work product.
(b) Non-Privileged / Business Records: This subfolder contains non-privileged factual materials, including the Palomar notification email of April 21, 2023, publicly available technical advisories (e.g., CISA and Severin Corporation advisories regarding CVE-2023-0669), finalized (non-privileged) versions of regulatory notification filings, correspondence with notification vendors, and other non-privileged business records.
(c) Common Interest — Shared Materials: This subfolder contains copies of any materials shared under the Common Interest Agreement with Atlas Mutual, together with records of the date, recipient, and scope of each disclosure. This subfolder will be activated only after the Common Interest Agreement is fully executed.
Sara Hendricks is responsible for maintaining the file organization structure and for ensuring that newly created or received documents are promptly and accurately categorized into the appropriate subfolder. In cases of uncertainty regarding the proper categorization of a document, Sara Hendricks should consult with Alan Burke or Kevin Ostrowski before filing.
Privilege Log: Sara Hendricks is responsible for maintaining a running privilege log documenting every privileged communication and document in the matter. The privilege log must include, at minimum, the following fields for each entry:
• Date of communication or document
• Author(s) / Sender(s)
• Recipient(s) (including all individuals copied)
• Subject matter description (sufficiently detailed to support the privilege claim without disclosing privileged substance)
• Document type (e.g., email, memorandum, report, draft filing)
• Privilege basis asserted (attorney-client privilege, work product, or both)
• Any special notations (e.g., "opinion work product," "Common Interest sharing authorized on [date]")
The privilege log must be maintained on an ongoing basis and updated promptly as new privileged communications and documents are created or received. It must be kept in a state of readiness for production at all times, as any regulatory inquiry or litigation may require the prompt submission of a privilege log.
IV. COMMUNICATION PROTOCOLS
4.1 Authorized Communication Channels
The security of communication channels is a fundamental component of privilege preservation. A privileged communication transmitted through an insecure channel may be intercepted by unauthorized third parties, potentially resulting in waiver. Moreover, the use of informal or personal communication channels makes it difficult to ensure proper marking, archiving, and inclusion in the privilege log.
Accordingly, all communications regarding the forensic investigation, legal analysis, regulatory strategy, and any other privileged aspects of Matter No. 1025-00006 must occur exclusively through the following approved channels:
(a) Calderwood & Harkness Internal Email: Communications among C&H team members must use firm email addresses (i.e., addresses ending in @calderwoodharkness.com). The firm's email system provides encryption in transit, archiving, and integration with the document management system.
(b) Encrypted Email to/from Quorum: Communications with authorized Quorum personnel must use the firm's encrypted email system and must be directed only to the following approved email addresses:
• Thomas R. Whitfield: twhitfield@quoruminsurance.com
• Jennifer Liang: jliang@quoruminsurance.com
• David Naranjo: dnaranjo@quoruminsurance.com
Communications with other Quorum personnel (e.g., Priya Deshmukh, Robert Wentworth) require specific authorization from Kevin Ostrowski for each communication or series of communications.
(c) Encrypted Email to/from Graystone Forensics: Communications with Graystone must be directed only to the following approved email addresses:
• Dr. Nolan Briggs: nbriggs@graystoneforensics.com
• Kendra Faulkner: kfaulkner@graystoneforensics.com
Prohibited Communication Channels: The following channels must not be used for any communication containing privileged forensic findings, legal analysis, or other confidential information related to this matter:
• Unencrypted email (including personal email accounts such as Northgate Software, Cascade Health IT, or Ridgeline Technologies)
• Text messages (SMS or Westmark Software) or other messaging applications (e.g., Meridian Services Inc., Signal, Meridian Solutions, Northgate Data Systems chat)
• Social media platforms of any kind
• Any communication platform not listed among the approved channels above
Telephone and Video Conferences: Discussions of privileged matters via telephone or video conference (e.g., Northgate Data Systems meetings, Calderon Software) are permitted on secure lines. However, the following protocols apply to all such calls:
(a) At the outset of each call, the C&H attorney leading the call must confirm the identities of all participants and verify that no unauthorized individuals are present or within earshot;
(b) If the call includes Quorum personnel, the C&H attorney must confirm that the call is not being recorded by any participant unless specifically agreed and that no unauthorized individuals are listening;
(c) If the call includes Graystone personnel, the C&H attorney must confirm that no Graystone personnel beyond those identified in the engagement letter are participating;
(d) Detailed notes of privileged telephone or video discussions should be prepared by an C&H attorney (typically Sara Hendricks), marked as privileged, and stored in the Privileged / Work Product subfolder. These notes should be entered in the privilege log.
4.2 Quorum Client Contacts — Authorized Recipients
Privilege is maintained only when communications are limited to individuals within the scope of the attorney-client relationship. In a corporate representation, the privilege extends to communications with corporate employees who are authorized to communicate with counsel on behalf of the corporation regarding the subject matter of the representation. However, communications with corporate employees who are not within this authorized group—or with former employees, contractors, or other non-authorized individuals—may not be privileged and could result in waiver.
Accordingly, privileged communications and work product materials related to this matter may be shared only with the following authorized Quorum personnel, subject to the scope limitations noted below:
(a) Thomas R. Whitfield, General Counsel — Primary client contact. Full access to all privileged communications and work product. All communications regarding board-level briefings and communications with the CEO must flow through Mr. Whitfield.
(b) Jennifer Liang, Chief Privacy Officer — Full access to privileged communications and work product related to the forensic investigation findings, notification obligations, and regulatory compliance workstreams.
(c) David Naranjo, Chief Information Security Officer — Full access to privileged communications and work product related to the forensic investigation findings and technical remediation matters.
(d) Priya Deshmukh, Vice President, Vendor Risk Management — Access limited to vendor accountability workstream materials (e.g., analysis of Palomar's contractual obligations, indemnification provisions, and vendor management issues). Access to materials outside the vendor accountability workstream requires specific approval from Kevin Ostrowski on a case-by-case basis.
(e) Margaret D. Calloway, Chief Executive Officer — Access limited to board-level briefing materials only, and only through Thomas R. Whitfield. Direct communications between C&H and Ms. Calloway must be pre-approved by Kevin Ostrowski.
(f) Franklin Reeves, Board Chair, Audit Committee — Access limited to board briefing memoranda only, and only through Thomas R. Whitfield. Direct communications between C&H and Mr. Reeves must be pre-approved by Kevin Ostrowski.
Robert Wentworth, SVP, Claims Operations occupies a limited and carefully circumscribed role with respect to privileged materials. Mr. Wentworth may receive limited factual information necessary for the operational remediation of claims-processing functions affected by the incident. However, Mr. Wentworth should not receive legal analysis, C&H legal memoranda, or Graystone privileged reports without specific prior approval from Kevin Ostrowski. Any factual information provided to Mr. Wentworth should be limited to what is necessary for remediation purposes and should be transmitted with appropriate privilege markings.
Reminder to the Client: The Client must be reminded—and Alan Burke should include this reminder in each substantive communication with the Client—not to forward privileged materials to any Quorum personnel not on the authorized list set forth above. The Client must be specifically cautioned against forwarding privileged materials to:
• Any personnel of Palomar Data Solutions, Inc.;
• Any personnel of insurance carriers (Atlas Mutual Insurance Company, Pinnacle Surplus Lines Insurance Corp.) or insurance brokers (Whitmore Risk Advisors Inc.);
• Any external auditors, including personnel of Halstead & Monroe LLP (Quorum's external auditor) and Gregory Chin, engagement partner;
• Any other third parties not expressly authorized by Kevin Ostrowski.
4.3 Graystone Forensics Communication Protocols
The communication protocols governing interactions between Graystone Forensics and other parties are among the most important safeguards in this engagement. Improper communications by Graystone could directly undermine the Kovel framework by creating the impression that Graystone is acting as the Client's consultant rather than as counsel's agent.
General Rule: All Graystone communications must be directed to or through Calderwood & Harkness attorneys. Specifically, all substantive communications—meaning any communication that involves the discussion, transmission, or exchange of forensic findings, analytical work product, conclusions, opinions, or recommendations—must be addressed to or conducted through Kevin Ostrowski, Alan Burke, or Sara Hendricks.
Limited Exception for Technical Data Exchanges: Graystone may communicate directly with Quorum IT personnel (specifically, members of David Naranjo's information security team) for the limited purpose of obtaining technical access and data necessary for the forensic investigation. Examples of such technical data exchanges include:
• Requests for access credentials to Quorum's network environments, servers, or applications;
• Requests for system logs, firewall logs, network traffic captures, or other raw technical data;
• Coordination of data transfer logistics (e.g., secure file transfer, hard drive imaging, evidence collection);
• Technical troubleshooting related to forensic tool deployment or data acquisition.
This exception is narrowly construed and subject to the following mandatory conditions:
(a) Such communications must be strictly limited to factual and technical data exchanges necessary for the conduct of the forensic analysis. No forensic conclusions, findings, preliminary assessments, analytical work product, or recommendations shall be communicated directly to Quorum IT personnel, even informally or verbally.
(b) Alan Burke or Sara Hendricks must be copied on, or actively participate in, all substantive interactions between Graystone and Quorum IT staff. Where a communication is purely logistical or ministerial in nature (e.g., scheduling a data transfer window), copying C&H attorneys is strongly preferred but not strictly required, provided that a record of the communication is maintained by Graystone and promptly shared with C&H.
(c) Before any meeting, call, or substantive exchange between Graystone and Quorum IT personnel, Alan Burke or Sara Hendricks should conduct a pre-call or pre-meeting briefing with the Graystone team to reinforce the boundaries of the communication exception and to identify any topics or questions that are off-limits for direct discussion with Quorum staff.
(d) If, during a direct interaction with Quorum IT personnel, a Graystone analyst is asked a question that calls for the disclosure of forensic conclusions or analytical findings, the analyst must decline to answer and redirect the question to Calderwood & Harkness.
Prohibition on Communications with Third Parties: Graystone must not communicate with any of the following parties regarding the investigation, or regarding any aspect of the forensic findings or engagement, without the express written authorization of Kevin Ostrowski:
• Palomar Data Solutions, Inc. or any of its personnel;
• Mercer, Haight & Dunlop LLP (Palomar's outside counsel), including Catherine Langford and Brian Soto;
• Atlas Mutual Insurance Company or any insurance carrier;
• Whitmore Risk Advisors Inc. or any insurance broker;
• Any regulatory agency, law enforcement agency, or governmental body;
• Any other third party of any kind.
This prohibition is absolute and applies regardless of whether the third party initiates the communication. If Graystone receives any unsolicited communication from any third party regarding the investigation, Graystone must immediately notify Alan Burke and must not respond to the communication without C&H's authorization.
4.4 Restrictions on Communications with Opposing Counsel and Third Parties
Beyond the Graystone-specific protocols set forth in Section 4.3 above, the following restrictions apply to all C&H team members with respect to communications with third parties:
Palomar Data Solutions and Mercer, Haight & Dunlop LLP: No privileged materials, forensic findings (whether preliminary or final), or legal analysis shall be shared with Palomar Data Solutions, Inc. or its outside counsel, Mercer, Haight & Dunlop LLP (Catherine Langford, Brian Soto), without the express authorization of Kevin Ostrowski. Palomar is a potential adverse party in a vendor indemnification or breach-of-contract claim, and any disclosure of privileged materials to Palomar or its counsel could result in waiver and provide Palomar with insight into our legal strategy and assessment of Quorum's position. Communications with Palomar's counsel regarding the incident should be handled exclusively by Kevin Ostrowski or, at his direction, by Alan Burke, and should be limited to non-privileged factual matters unless Kevin Ostrowski determines that a broader disclosure is strategically appropriate.
Insurance Carriers: Communications with Atlas Mutual Insurance Company (Paul Enriquez, Claims Adjuster, and Atlas Mutual's coverage counsel) and Pinnacle Surplus Lines Insurance Corp. (Lisa Garner) must be handled exclusively by Kevin Ostrowski or Rachel Bernstein. As discussed in Section 2.3, no privileged or work product materials may be shared with any insurance carrier representative until the Common Interest Agreement is fully executed and confirmed. Once the Common Interest Agreement is in place, sharing must occur in strict accordance with its terms. Until the Common Interest Agreement is executed, communications with insurance carriers should be limited to non-privileged factual information, such as the date of the incident, the general nature of the compromise, and the categories of data potentially affected. Sharing of Graystone reports, C&H legal analysis, or other privileged materials with insurance carriers prior to execution of the Common Interest Agreement is prohibited.
Insurance Broker — Whitmore Risk Advisors Inc.: Communications with Sandra Whitmore-Kim of Whitmore Risk Advisors Inc., Quorum's cyber-insurance broker, should be limited to non-privileged information regarding coverage and claims-processing matters. The broker does not fall within the privilege umbrella and is not expected to be a party to the Common Interest Agreement. Graystone reports, C&H legal analysis, and other privileged materials must not be shared with the broker under any circumstances. If the broker requests information that touches on privileged matters, the request should be referred to Kevin Ostrowski.
Crisis Communications Firm — BrightPath Consulting Group Inc.: Communications with Meredith Ashford and BrightPath Consulting Group Inc. ("BrightPath"), which has been or may be retained by Quorum to assist with crisis communications, require special care. BrightPath is not retained under the privilege umbrella and does not function as an agent of counsel. Accordingly, privileged forensic findings, legal analysis, and Graystone reports must not be shared with BrightPath. BrightPath should receive only approved factual summaries for use in drafting public statements, media responses, and customer communications. These factual summaries must be prepared or reviewed by Calderwood & Harkness attorneys before distribution to BrightPath to ensure that they do not incorporate or reference privileged materials. Alan Burke is responsible for coordinating with the Client regarding the preparation and approval of factual summaries for BrightPath.
Notification Vendor — Clearfield Notification Services LLC: Clearfield Notification Services LLC ("Clearfield"), through Jerome Tillman, may be engaged by Quorum to handle the operational aspects of individual notification (e.g., printing, mailing, call center services, credit monitoring enrollment). Clearfield is a notification vendor, not a legal consultant, and does not fall within the privilege umbrella. No privileged materials shall be shared with Clearfield under any circumstances. Clearfield is to receive only the finalized, approved notification content (i.e., the final notification letter text approved by C&H and the Client) and operational instructions necessary for execution of the notification mailing and related services.
V. FORENSIC WORK PRODUCT — HANDLING AND DISTRIBUTION
5.1 Preliminary and Final Forensic Reports
The forensic reports produced by Graystone constitute the core privileged work product of this engagement. These reports will contain Graystone's technical findings regarding the nature, scope, and impact of the compromise, including the identification of affected data elements, the number of individuals whose data was potentially compromised, and the forensic evidence regarding the threat actor's methods, access pathways, and exfiltration activities. The reports will form the factual foundation upon which Calderwood & Harkness will base its legal advice to Quorum regarding notification obligations, regulatory exposure, litigation risk, and vendor accountability.
Based on the current engagement timeline, Graystone anticipates delivering the following reports:
(a) Preliminary Findings Report: Expected delivery approximately early June 2023. This report will set forth Graystone's initial findings regarding the scope of the compromise, including preliminary identification of affected data repositories, data elements, and estimated record counts. The preliminary report will inform C&H's initial assessment of notification obligations and regulatory exposure.
(b) Final Forensic Report: Expected delivery approximately mid-July 2023. This report will present Graystone's comprehensive findings, including definitive conclusions regarding the scope and nature of the compromise, the data elements and individuals affected, the forensic evidence of exfiltration (including volume and destination of exfiltrated data, if determinable), and the timeline and methodology of the attack. The final report will support C&H's definitive legal advice regarding notification obligations, regulatory filings, and litigation strategy.
Both the preliminary and final reports are core privileged work product and must be handled with the utmost care. The following protocols govern the delivery, review, and distribution of these reports:
(a) Delivery: Reports must be delivered in encrypted format (password-protected PDF or equivalent) to Alan Burke and Kevin Ostrowski only. Reports must be transmitted via the approved encrypted email channel. The encryption password must be communicated separately (e.g., by telephone).
(b) C&H Review: Before any distribution of a Graystone report to the Client, Alan Burke must:
(i) Verify that the report bears proper privilege markings in accordance with Section 3.2 of this memorandum;
(ii) Review the report for any content that could undermine the privilege framework (e.g., references to direct communications with Quorum personnel, language suggesting Graystone is acting at the Client's direction rather than at counsel's direction);
(iii) Prepare a cover memorandum analyzing the legal implications of Graystone's findings, including an assessment of notification obligations, regulatory exposure, litigation risk, and recommended next steps;
(iv) Obtain Kevin Ostrowski's approval for distribution of the report and cover memorandum to the Client.
(c) Distribution to the Client: The Client receives the Graystone report together with, or shortly after, the C&H analysis memorandum. The purpose of this protocol is to ensure that the forensic report is transmitted within the context of the attorney-client relationship—i.e., as a tool used by counsel to provide legal advice—rather than as a standalone factual document that could be characterized as a non-privileged business record. The cover memorandum should be transmitted as a unified communication package with the Graystone report, reinforcing the connection between the forensic findings and the legal advice being rendered.
5.2 Interim Findings and Working Papers