50-STATE BREACH NOTIFICATION LAW SURVEY
Privileged & Confidential — Attorney-Client Privileged / Attorney Work Product
Prepared by:
Sara Hendricks, Associate Alan Burke, Lead Associate Privacy & Data Security Practice Group Calderwood & Harkness LLP 1200 Avenue of the Americas, 38th Floor New York, New York 10036
Prepared for:
Thomas R. Whitfield, General Counsel Jennifer Liang, Chief Privacy Officer Quorum Insurance Holdings Corp. 280 Trumbull Street, Suite 1400 Hartford, Connecticut 06103
June 8, 2023
Matter No.: 1025-00006
Client: Quorum Insurance Holdings Corp.
Re: Data Security Incident Involving Palomar Data Solutions, Inc. — Survey of State Breach Notification Laws
This memorandum is a privileged and confidential attorney-client communication and attorney work product. It was prepared at the direction of counsel for Quorum Insurance Holdings Corp. in connection with legal advice relating to a data security incident. This document and its contents are protected by the attorney-client privilege and the work product doctrine. This document should not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Quorum Insurance Holdings Corp. Disclosure to any third party may constitute a waiver of applicable privileges.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY AND PURPOSE
1.1 Purpose of Survey
Calderwood & Harkness LLP has prepared this 50-State Breach Notification Law Survey at the direction of Thomas R. Whitfield, General Counsel, and Jennifer Liang, Chief Privacy Officer, of Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), in connection with a data security incident originating from Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). This survey is intended to provide Quorum's in-house legal and privacy teams with a comprehensive analysis of the breach notification obligations that may arise under the laws of all fifty states and the District of Columbia as a result of the incident described below.
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, thereby gaining unauthorized access to Palomar's network and systems environment. Based on available forensic evidence, the threat actor maintained persistent access to Palomar's network over an approximately thirty-five-day window spanning from March 14, 2023 through April 18, 2023. During that period, the threat actor exfiltrated structured data files containing personal information pertaining to Quorum policyholders, claimants, and beneficiaries. Palomar's security operations center ("SOC") discovered anomalous outbound data transfers on April 18, 2023, at which time Palomar initiated its internal incident response protocol. Palomar formally notified Quorum of the incident on April 21, 2023, pursuant to the notification provisions set forth in Section 9.4 of the Master Services Agreement dated November 12, 2019 between Quorum and Palomar (the "MSA").
Upon receiving Palomar's notification, Quorum engaged Calderwood & Harkness LLP to provide legal counsel regarding the incident and retained Graystone Forensics LLC ("Graystone") under the attorney-client privilege umbrella to conduct the forensic investigation. Graystone has been operating under the direction of Calderwood & Harkness LLP since April 24, 2023. As of the date of this survey, Graystone's preliminary findings, issued in a Preliminary Forensic Investigation Report dated June 2, 2023, confirm the exfiltration of structured data files containing personal information. The final scope determination of affected individuals is pending and is currently expected to be completed in mid-July 2023, with data mining to identify specific affected individuals by state of residence expected to conclude in early August 2023.
This survey identifies and analyzes the breach notification statutes of all fifty states and the District of Columbia in order to determine which jurisdictions' notification requirements may be triggered based on the categories of compromised data identified to date. The survey is organized to facilitate Quorum's notification planning process and to enable the preparation of state-specific consumer notification letters, attorney general and regulator filings, and related compliance documentation once the final forensic report and affected-individual identification are completed.
1.2 Data Elements Potentially Compromised
Based on Graystone's Preliminary Forensic Investigation Report dated June 2, 2023, the following categories of data have been confirmed as potentially compromised in the incident:
Personally Identifiable Information (PII):
• Full names (first name and last name)
• Dates of birth
• Social Security numbers ("SSNs")
• Driver's license numbers and state identification card numbers
Financial Information:
• Bank account numbers (including routing numbers for a subset of affected individuals who had elected direct-deposit payment of claims)
• Payment card numbers (credit and debit card numbers for a subset of affected individuals who had made premium payments via card)
Protected Health Information (PHI):
• Health conditions and diagnosis codes
• Treatment information derived from workers' compensation claims and health-related insurance claims
• Health insurance policy numbers and subscriber identification numbers
It should be noted that not all affected individuals have had all categories of data compromised. Graystone's data mining analysis, once completed, will identify the specific data elements compromised for each affected individual. As of the preliminary analysis, the total estimated number of affected individuals is approximately 318,247, distributed across multiple states. A subset of approximately 41,203 individuals is estimated to have had protected health information compromised.
Important Scope Limitation: The HIPAA Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D (§§ 164.400–414), applies to the subset of compromised data that constitutes protected health information. Analysis of Quorum's HIPAA notification obligations is addressed in a separate memorandum being prepared by this firm, which is targeted for completion on or about July 22, 2023. Similarly, federal requirements under the Gramm-Leach-Bliley Act ("GLBA"), Securities and Exchange Commission disclosure obligations, and other federal regulatory frameworks are not within the scope of this survey. This survey focuses exclusively on state-law breach notification obligations.
1.3 Key Findings Summary
The following key findings emerge from this survey:
Universal Statutory Coverage. All fifty states and the District of Columbia have enacted data breach notification statutes. There is no state in which Quorum would be exempt from notification obligations by virtue of the absence of a governing statute.
Notification Obligations Will Be Triggered in All Affected States. Based on the categories of compromised data elements — including SSNs, driver's license numbers, financial account numbers, and health/medical information — notification obligations will be triggered in every state in which affected residents are identified. The compromised data elements fall squarely within the definition of "personal information" under every state statute surveyed, and the confirmed exfiltration of data satisfies even the narrowest "unauthorized acquisition" triggers.
Pending Final Scope Determination. As of the date of this survey, Graystone's data mining work is ongoing. Once the final forensic report and affected-individual identification are completed, Calderwood & Harkness will prepare a separate Notification Trigger Analysis Memorandum identifying the specific states that have affected residents, the precise numbers of affected individuals per state, the applicable notification deadlines for each state, and the recommended sequencing for notification mailings and regulatory filings.
Key Variables Across States. While the fundamental obligation to notify affected individuals is universal, the specific requirements vary significantly across jurisdictions. The key variables that Quorum must account for in its notification planning include:
(a) Definition of "personal information" triggering notification obligations, including whether health/medical information is an enumerated trigger element;
(b) Timing requirements, ranging from thirty days to ninety days, with some states imposing no fixed outer deadline;
(c) Required content of consumer notices, with some states prescribing detailed formatting and content elements and others imposing minimal or no specific content requirements;
(d) Attorney General and regulator notification obligations, including threshold numbers of affected residents that trigger the filing obligation;
(e) Substitute notice provisions, which permit alternative notification methods under specified conditions;
(f) Private right of action availability, which affects Quorum's litigation exposure in particular jurisdictions; and
(g) Applicability to third-party vendor-originated breaches, where the data controller (Quorum) bears the primary notification obligation even though the breach originated at the data processor (Palomar).
1.4 Organization of This Survey
This survey is organized as follows:
Section II: Analytical Framework. This section discusses the key definitional and structural issues common across state breach notification statutes, including the distinction between "risk-of-harm" and "strict trigger" states, timing requirements, content requirements, the applicability of notification obligations to vendor-originated breaches, encryption safe harbors, and the interaction between state notification statutes and federal law.
Section III: State-by-State Analysis. This section provides an individualized analysis of the breach notification statutes of all fifty states and the District of Columbia, organized alphabetically. Each state entry follows a standardized format addressing twelve analytical categories, as described in the introduction to Section III.
Section IV: Comparative Summary Tables. This section presents comparative tables summarizing key statutory requirements across all jurisdictions, organized by topic area, including timing requirements, attorney general notification obligations, content requirements, credit monitoring mandates, substitute notice provisions, and private right of action availability.
Section V: States of Particular Concern for This Incident. This section identifies and discusses the states that present the greatest compliance challenges or litigation exposure for Quorum based on the size of the affected population, the stringency of the applicable requirements, and the likely regulatory attention.
Section VI: Recommendations and Next Steps. This section sets forth Calderwood & Harkness's recommendations regarding notification planning, credit monitoring, substitute notice, and ongoing compliance monitoring.
Appendix A: Comparative Matrix. This appendix cross-references a separate spreadsheet document (to be finalized upon completion of affected-individual identification) providing a detailed comparative matrix of all state requirements.
Appendix B: Glossary of Key Terms. This appendix defines the key terms used throughout this survey and in the underlying state statutes.
II. ANALYTICAL FRAMEWORK
2.1 Common Statutory Elements
Despite significant variation in detail and scope, the fifty state breach notification statutes and the District of Columbia's statute share a common structural framework built around several core statutory elements. Understanding these common elements is essential to navigating the state-by-state analysis that follows in Section III.
Definition of "Breach" or "Security Breach"
The foundational triggering concept in all breach notification statutes is the definition of "breach" or "security breach." While the precise language varies, the core concept across statutes is the unauthorized acquisition of, access to, or disclosure of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity.
Significant variations exist within this common framework. Some states define the trigger event narrowly as the "unauthorized acquisition" of personal information, requiring that data actually be obtained by an unauthorized person. Other states define the trigger more broadly to include "unauthorized access to" personal information, which can encompass situations where an unauthorized person merely views or accesses data without affirmatively acquiring or removing it. The distinction is analytically significant, though for purposes of this incident — where Graystone has confirmed actual exfiltration (i.e., acquisition) of data — the broader "access" trigger and the narrower "acquisition" trigger are both satisfied.
A further critical variation is whether the statute includes a risk-of-harm qualifier. Approximately seventeen states impose a risk-of-harm trigger, under which notification is required only if the breach is "reasonably likely to cause" harm, identity theft, fraud, or similar adverse consequences to affected individuals. The remaining states and the District of Columbia apply a strict trigger, under which any unauthorized acquisition of covered personal information triggers the notification obligation, regardless of whether harm is likely. The risk-of-harm distinction is discussed in greater detail in Section 2.2 below.
Definition of "Personal Information"
Virtually all state breach notification statutes define "personal information" as an individual's first name or first initial and last name in combination with one or more specified data elements, when the data is not encrypted or redacted. The most commonly enumerated data elements include:
• Social Security numbers
• Driver's license numbers or state identification card numbers
• Financial account numbers (bank account, credit card, or debit card numbers), typically in combination with any required security code, access code, password, or personal identification number that would permit access to the account
• Payment card numbers (credit or debit card numbers)
In recent years, many states have expanded their statutory definitions of personal information to include additional data elements, reflecting the evolving landscape of identity theft and data misuse. These expanded definitions may include, depending on the jurisdiction:
• Health or medical information
• Health insurance policy numbers or subscriber identification numbers
• Biometric data (fingerprints, retinal scans, voiceprints, DNA profiles)
• Email addresses in combination with passwords or security questions and answers
• Taxpayer identification numbers
• Passport numbers
• Military identification numbers
• Digital or electronic signatures
• Username or account credentials in combination with passwords or security questions
For this incident, the compromised data includes SSNs, driver's license numbers, financial account numbers, and health/medical information. Each of these categories is an enumerated trigger element in the vast majority of state statutes. As a result, notification obligations will be triggered in every state in which affected residents are identified, regardless of whether the particular state's definition of personal information includes all four categories or only a subset.
Covered Entities. Most state breach notification statutes apply broadly to any "person" or "business" that "owns or licenses" computerized data containing personal information of state residents. The term "person" is typically defined to include individuals, partnerships, corporations, limited liability companies, associations, and other business entities, as well as governmental entities in many states. Some states have enacted separate statutes or imposed additional obligations for specific regulated industries, including insurance companies, healthcare providers, financial institutions, and educational institutions.
Quorum Insurance Holdings Corp. is a Delaware corporation headquartered in Hartford, Connecticut, engaged in the business of providing property and casualty insurance, workers' compensation insurance, and related products to policyholders in all fifty states and the District of Columbia. Quorum holds insurance licenses in forty-seven states and operates through subsidiary and affiliated entities in additional jurisdictions. As an entity that owns and maintains computerized data containing personal information of residents of multiple states, Quorum is a "covered entity" under all applicable breach notification statutes.
Palomar Data Solutions, Inc. is a Texas corporation that provides claims-processing and data management services to Quorum under the MSA. In many states, Palomar qualifies as a "data processor" or "third-party service provider" that maintains data on behalf of Quorum. As discussed in Section 2.5, the notification obligations as between data owners and data processors are allocated differently across states, but Quorum, as the entity that collected and maintains the customer relationship, is the primary obligor for consumer notification in all jurisdictions.
Notification to Individuals
All fifty states and the District of Columbia require notification to affected individuals when the triggering conditions are met. Written notice delivered by first-class mail is universally accepted as a permissible notification method and is the method that Calderwood & Harkness recommends as the primary notification channel for this incident. Some states also permit electronic notice under specified conditions, typically requiring compliance with the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act, 15 U.S.C. § 7001 et seq.) or state analogues. Telephonic notice is permitted in some states as an alternative or supplement to written notice.
The timing of individual notification varies significantly across jurisdictions and is discussed in detail in Section 2.3 below. Content requirements for notification letters also vary and are discussed in Section 2.4.
Notification to Regulators and Attorneys General
A substantial majority of states require that covered entities notify the state attorney general or another designated state regulator (such as a consumer protection division, department of financial regulation, or insurance department) when a breach affects residents of the state. The obligation to notify state regulators is in addition to — not in lieu of — the obligation to notify affected individuals.
The threshold triggers for regulator notification vary across states. Some states require notification to the attorney general for any breach affecting state residents, regardless of the number of individuals affected. Other states require notification only when a minimum number of residents are affected, with common thresholds including 250, 500, and 1,000 affected individuals. The timing of regulator notification also varies; some states require that regulator notification be provided before or simultaneously with individual notice, while others permit regulator notification within a specified period after individual notice is sent.
Given the scale of this incident — with an estimated 318,247 total affected individuals distributed across multiple states — it is virtually certain that the regulator notification thresholds will be exceeded in every state that imposes such a threshold. Accordingly, Quorum should proceed on the assumption that regulator notification will be required in every state that mandates it, without reliance on threshold-based exemptions.
Substitute Notice. Most state breach notification statutes provide for "substitute notice" as an alternative notification method that may be used when the cost of providing direct notice (i.e., individual written notice by mail) exceeds a specified threshold, the affected class exceeds a specified size threshold, or the entity lacks sufficient contact information to provide direct notice to all affected individuals. The most common statutory thresholds are:
• Cost of direct notice exceeds $250,000;
• Affected class exceeds 500,000 individuals; or
• Entity lacks sufficient contact information for direct notice.
Substitute notice typically requires the entity to undertake a combination of: (i) email notification to affected individuals for whom the entity has email addresses; (ii) conspicuous posting of a notice on the entity's website; and (iii) notification to major statewide media outlets serving the state in which the affected individuals reside.
For this incident, Quorum intends to provide direct mail notification to all 318,247 affected individuals as the primary notification method. Substitute notice will be deployed as a supplemental measure — including website posting and, as required, media notification — but will not replace direct mail notification for any affected individual for whom Quorum has a valid mailing address.
2.2 Risk-of-Harm vs. Strict Trigger Analysis
As noted in Section 2.1, a significant analytical distinction among state breach notification statutes is whether the statute applies a "risk-of-harm" qualifier or a "strict trigger" to the notification obligation.
Risk-of-Harm States. Approximately seventeen states include a risk-of-harm qualifier in their breach notification statutes. In these states, notification is required only if the unauthorized acquisition or access to personal information is "reasonably likely to cause" harm, identity theft, fraud, or other adverse consequences to the affected individuals. The risk-of-harm qualifier typically permits the breached entity to conduct an internal assessment — sometimes referred to as a "good-faith risk assessment" — to determine whether notification is warranted. Factors considered in such assessments may include the nature and sensitivity of the compromised data, the likelihood that the data has been or will be misused, the existence of safeguards (such as encryption or tokenization) that would render the data unusable, and any evidence of actual misuse.
Strict Trigger States. The remaining states and the District of Columbia apply a strict trigger standard under which any unauthorized acquisition of unencrypted personal information triggers the notification obligation, without regard to whether the breach is likely to result in harm. In these jurisdictions, the entity's subjective assessment of the risk of harm is irrelevant; the mere fact of unauthorized acquisition is sufficient to require notification.
Application to This Incident. For purposes of this incident, the distinction between risk-of-harm and strict trigger states is of limited practical significance. The data elements that have been confirmed as exfiltrated — SSNs, driver's license numbers, financial account numbers, and health/medical information — are among the most sensitive categories of personal information. The exfiltration of SSNs alone is universally recognized as creating a significant risk of identity theft and financial fraud. Graystone's preliminary findings confirm actual exfiltration (not merely unauthorized access), which further strengthens the conclusion that the data has been obtained by an unauthorized party and is available for potential misuse. Under these circumstances, even in states that apply a risk-of-harm qualifier, notification will almost certainly be required because the nature of the compromised data and the confirmed exfiltration make it objectively unreasonable to conclude that the breach is not "reasonably likely to cause" harm.
Recommendation. Calderwood & Harkness recommends that Quorum proceed on the assumption that notification obligations are triggered in all states in which affected residents are identified, including risk-of-harm states, without relying on risk-of-harm exceptions to avoid or defer notification. Reliance on a risk-of-harm exception in the face of confirmed exfiltration of SSNs and financial data would expose Quorum to significant regulatory enforcement risk and reputational harm, and would be difficult to defend in any subsequent attorney general inquiry or private litigation.
2.3 Timing Requirements — Overview
The timing requirements for individual notification vary considerably across jurisdictions. The following general categories describe the landscape:
"Most Expedient Time Possible" Standard. The most common formulation, adopted by a plurality of states, requires notification "in the most expedient time possible and without unreasonable delay," often subject to the legitimate needs of law enforcement investigation and the time necessary to complete the entity's own investigation to determine the scope of the breach and identify affected individuals. This standard does not impose a fixed outer deadline but creates an obligation of reasonable promptness. States applying this standard include California, New York, New Jersey, Illinois, and many others.
Fixed Deadlines. A growing number of states have supplemented or replaced the "most expedient time" standard with fixed outer deadlines, measured from the date of "Discovery" or "determination" that a breach has occurred. These fixed deadlines range from as short as thirty days to as long as ninety days, with the most common fixed deadlines being forty-five and sixty days. The states with the most aggressive (shortest) fixed deadlines include:
• 30 days: Colorado, Florida, Washington
• 45 days: Alabama, Arizona, Maryland, New Mexico, Ohio, Oregon, Rhode Island, Vermont, Wisconsin
• 60 days: Connecticut, Delaware, Iowa, Louisiana, Mississippi, South Dakota, Tennessee, Texas
Starting the Clock: "Discovery" vs. "Determination." The point at which the notification clock begins to run is a critical issue for notification planning. Most states measure the deadline from the date of "Discovery" of the breach or the date on which the entity "determines" (or "should have determined through the exercise of reasonable diligence") that a breach has occurred and notification is required. The distinction between "Discovery" (which may be construed as the date the entity first learns of the incident) and "determination" (which may be construed as the date the entity completes its investigation and determines that notification is required) can affect the calculation of the applicable deadline by days or weeks.
For this incident, the relevant dates are as follows:
• April 18, 2023: Palomar's SOC discovers anomalous data transfers.
• April 21, 2023: Palomar notifies Quorum.
• June 2, 2023: Graystone issues Preliminary Forensic Investigation Report confirming exfiltration.
• Mid-July 2023 (estimated): Graystone issues Final Forensic Report.
• Early August 2023 (estimated): Completion of data mining to identify specific affected individuals by state.
In Calderwood & Harkness's assessment, the "determination date" for purposes of most state notification statutes will most likely be the date on which Quorum has sufficient information to identify specific affected individuals and the data elements compromised for each — i.e., the completion of data mining, currently estimated for early August 2023. However, some states may construe the determination date as an earlier point, such as the date of Graystone's preliminary findings (June 2, 2023) or even the date of Palomar's initial notification (April 21, 2023). Quorum should therefore adopt a conservative approach and assume that some states may measure the notification deadline from the earlier of these dates. This makes the thirty-day and forty-five-day deadline states particularly time-sensitive.
Recommendation. Upon completion of data mining and affected-individual identification, Quorum should immediately calendar the applicable deadlines for each state, prioritizing the thirty-day deadline states (Colorado, Florida, Washington) and the states with the shortest attorney general notification windows (Vermont: fourteen business days). Notification letters and regulatory filings should be substantially prepared in advance of the determination date so that they can be finalized and transmitted promptly once the final data is available.
2.4 Content Requirements — Overview
The content requirements for consumer notification letters vary significantly across states. Some states prescribe specific formatting requirements and mandate the inclusion of detailed content elements; others impose minimal or no content requirements, leaving the substance of the notification to the discretion of the notifying entity. The following categories describe the range of prescriptiveness:
Highly Prescriptive States. A number of states prescribe specific content elements that must be included in consumer notification letters. The most commonly required elements include:
• A description of the incident in general terms
• The types of personal information involved in the breach
• The date, estimated date, or date range of the breach
• Steps the entity has taken or intends to take in response to the breach
• Steps the individual can take to protect himself or herself, including information about fraud alerts, credit freezes, and security freezes
• Contact information for the entity providing the notification, including a toll-free telephone number, mailing address, and email address
• Contact information for the three major consumer reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises)
• Contact information for the Federal Trade Commission
• Contact information for the state attorney general
States with particularly detailed and prescriptive content requirements include California, Connecticut, Illinois, Maryland, Massachusetts, New Hampshire, New Jersey, New York, Oregon, and Washington.
Credit Monitoring and Identity Theft Protection. Several states require that consumer notification letters include an offer of complimentary credit monitoring or identity theft protection services when the breach involves SSNs or other particularly sensitive data elements. The duration of the required monitoring varies:
• 24 months: Connecticut (for SSN breaches, effective October 1, 2021)
• 18 months: Massachusetts (AG guidance for SSN breaches)
• 12 months: California, Delaware, Florida, Illinois, Maine, Maryland, Oregon, Rhode Island, Washington
• Statutory encouragement but no mandate: Alabama, Colorado, and several other states
Quorum plans to offer twenty-four months of complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC to all affected individuals, regardless of state of residence. This approach will satisfy or exceed all state-specific credit monitoring mandates and eliminates the need to create state-specific variations of the credit monitoring offering.
2.5 Applicability to Third-Party / Vendor-Originated Breaches
A central analytical issue for this incident is the allocation of notification obligations between Quorum, as the entity that collected and controls the personal information, and Palomar, as the third-party vendor that processed and stored the data on Quorum's behalf and whose systems were compromised.
In the vast majority of states, the breach notification statutes distinguish between the entity that "owns or licenses" the data (the data controller or data owner) and the entity that "maintains" or "stores" the data on behalf of another (the data processor or service provider). When a data processor experiences a breach of data that it maintains on behalf of a data owner, the statutes generally impose two separate but related obligations:
(a) Data Processor's Obligation: The data processor must notify the data owner "in the most expedient time possible" or "without unreasonable delay" of the breach, so that the data owner can fulfill its notification obligations. This obligation is typically owed to the data owner, not directly to the affected individuals.
(b) Data Owner's Obligation: The data owner (here, Quorum) bears the primary obligation to notify affected individuals and applicable regulators. The data owner is the entity with the direct customer relationship and is in the best position to provide meaningful notification.
In some states, however, the data processor may also have direct notification obligations to affected individuals, particularly if the data processor independently qualifies as an entity that "owns or licenses" the data or if the statute does not clearly distinguish between data owners and data processors.
For this incident, Quorum is the primary obligor for notification in all jurisdictions. Quorum collected the personal information from its policyholders, claimants, and beneficiaries in the course of its insurance business, and Palomar maintained the data on Quorum's behalf under the MSA. Palomar's contractual obligation under MSA Section 9.4 to notify Quorum within forty-eight hours of discovering a security incident is a separate contractual matter and may be relevant to contractual claims against Palomar, but it does not alter the statutory allocation of notification obligations.
Palomar may have independent statutory obligations to notify affected individuals in certain states, particularly Texas (where Palomar is headquartered) and states whose statutes impose notification obligations on entities that "maintain" personal information regardless of ownership. However, those obligations are Palomar's to discharge, and Quorum's notification obligations are independent of whether Palomar separately complies.
2.6 Encryption/Redaction Safe Harbor
Nearly all state breach notification statutes include a safe harbor provision exempting entities from the obligation to provide notification if the compromised data was encrypted (or, in some states, redacted or otherwise rendered unusable) at the time of the breach, provided that the encryption key or other means of decryption was not also compromised in the same incident.
Application to This Incident. The encryption safe harbor does not apply to this incident. Based on Graystone's preliminary findings, the compromised data was maintained in structured, unencrypted data files within Palomar's claims processing environment. Specifically, the GoAnywhere MFT file transfer appliance was used to transmit data files between Quorum's systems and Palomar's claims processing platform, and the data files at rest within Palomar's environment were stored in unencrypted form. Although data was encrypted in transit using TLS 1.2, the data at rest was not encrypted, and the threat actor accessed and exfiltrated the data in its unencrypted form.
Quorum therefore cannot avail itself of the encryption safe harbor in any state. This conclusion applies regardless of whether Quorum's own systems employed encryption for data at rest, because the breach occurred within Palomar's environment where the data was unencrypted.
The absence of encryption at rest within Palomar's environment is a significant issue that may bear on Quorum's contractual claims against Palomar under the MSA (specifically, whether Palomar's failure to encrypt data at rest constituted a breach of its information security obligations under MSA Section 9.2) and on any regulatory inquiry into the adequacy of security measures. These issues are addressed in separate memoranda.
2.7 Interaction with Federal Law
While this survey focuses exclusively on state-law breach notification obligations, it is important to note the parallel federal regulatory frameworks that apply to this incident and that are being addressed in separate work streams:
HIPAA Breach Notification Rule. The Health Insurance Portability and Accountability Act of 1996, as amended by the Health Information Technology for Economic and Clinical Act ("HITECH Act"), imposes breach notification obligations on covered entities and their business associates when unsecured protected health information is compromised. Quorum, as a health plan and/or healthcare clearinghouse with respect to certain of its insurance products, is a covered entity under HIPAA. Palomar is a business associate. The HIPAA breach notification requirements — including notification to affected individuals, the Secretary of the U.S. Department of Health and Human Services ("HHS"), and, for breaches affecting 500 or more individuals, prominent media outlets — apply to the subset of approximately 41,203 individuals whose protected health information was compromised. A separate memorandum analyzing Quorum's HIPAA notification obligations is being prepared and is targeted for completion on July 22, 2023.
Gramm-Leach-Bliley Act. As an insurance company, Quorum is a "financial institution" subject to the GLBA and the regulations promulgated thereunder, including the FTC's Safeguards Rule and applicable state insurance department regulations. The GLBA imposes requirements regarding the security and confidentiality of customer financial information but does not itself contain a breach notification provision for consumers. Certain states exempt GLBA-regulated entities from their general breach notification statutes, but most do not. Quorum should not rely on any GLBA exemption without confirming its applicability on a state-by-state basis.
Insurance-Specific Data Security Laws. Several states have adopted the National Association of Insurance Commissioners ("NAIC") Insurance Data Security Model Law, which imposes cybersecurity program requirements and incident notification obligations specific to entities licensed as insurers in those states. Connecticut's Insurance Data Security Law (Conn. Gen. Stat. § 38a-999b) is the most immediately relevant, given Quorum's domicile in Connecticut, and imposes a seventy-two-hour reporting obligation to the Connecticut Insurance Department for cybersecurity events. Additional states that have adopted versions of the NAIC Model Law are identified in Section V of this survey. Compliance with these insurance-specific requirements is being addressed in coordination with Quorum's insurance regulatory counsel.
SEC Disclosure Obligations. To the extent Quorum or any of its parent or affiliated entities is a public reporting company subject to SEC reporting obligations, the SEC's recently proposed (and, as of this date, pending) cybersecurity disclosure rules may impose additional obligations. These are outside the scope of this survey.
III. STATE-BY-STATE ANALYSIS
This section provides an individualized analysis of the breach notification statutes of all fifty states and the District of Columbia. Each state entry follows a standardized format addressing twelve analytical categories:
1. Statute Citation
2. Trigger Definition (acquisition vs. access; risk-of-harm qualifier, if any)
3. Definition of "Personal Information" (data elements covered)
4. Applicability to This Incident (based on compromised data types)
5. Timing Requirement (fixed deadline and/or "most expedient time" standard)
6. Content Requirements (prescribed elements for consumer notice)
7. AG / Regulator Notification (required? threshold? timing?)
8. Substitute Notice (conditions and method)
9. Credit Monitoring / Identity Theft Protection (mandatory offer? duration?)
10. Private Right of Action (availability and scope)
11. Penalties for Noncompliance
12. Special Notes / Particularities
The survey provides full detail for the ten states most likely to have the largest affected populations based on Quorum's policyholder geographic footprint, as well as the District of Columbia. Abbreviated entries are provided for the remaining states, covering all twelve analytical categories in summary form. All entries contain sufficient detail to support notification planning and compliance.
3.1 Alabama
Statute Citation: Ala. Code § 8-38-1 et seq. (Alabama Data Breach Notification Act of 2018).
Trigger Definition: Alabama employs an acquisition trigger with a good-faith risk assessment permitted. A covered entity must provide notification if it determines, after a good-faith and prompt investigation, that sensitive personally identifying information of an Alabama resident has been, or is reasonably believed to have been, acquired by an unauthorized person as a result of a breach of security. The statute permits the entity to consider the nature of the information, the likelihood of harm, and the existence of identity theft or fraud in making its determination.
Definition of "Personal Information": "Sensitive personally identifying information" is defined as an individual's first name or first initial and last name in combination with one or more of the following data elements: SSN; driver's license number or state identification card number; financial account number, credit card number, or debit card number in combination with any security code, access code, password, or expiration date necessary to access the account or conduct a transaction; medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; health insurance policy number or subscriber identification number and any unique identifier used by a health insurer; or username or email address in combination with a password or security question and answer.
Applicability to This Incident: SSN, driver's license number, financial account numbers, and health/medical information are all enumerated trigger elements. All four categories of compromised data fall within Alabama's definition of sensitive personally identifying information. Notification will be required for all affected Alabama residents.
Timing Requirement: Notification must be provided within forty-five (45) days of the entity's determination that a breach has occurred, or within forty-five days of the conclusion of the entity's investigation, whichever is earlier. The notification period may be extended by law enforcement request.
Content Requirements: The notification must include: (a) the date, estimated date, or date range of the breach; (b) a description of the sensitive personally identifying information that was acquired as part of the breach; (c) a general description of the actions taken by the covered entity to restore the security and confidentiality of the personal information involved; (d) a general description of steps the individual can take to protect against identity theft; and (e) contact information for the covered entity providing the notice. It is also advisable, though not expressly required by statute, to include contact information for the three major consumer reporting agencies and the Federal Trade Commission.
AG / Regulator Notification: Required if more than 1,000 Alabama residents are affected. The Attorney General must be notified as expeditiously as possible and no later than forty-five (45) days after the determination that a breach has occurred. The notification to the AG must include: the date or estimated date range of the breach; a description of the information acquired; an estimated number of affected individuals; the actions taken to restore security; and a copy of the notice to be sent to affected individuals. If fewer than 1,000 individuals are affected, AG notification is not required but is recommended as best practice.
Substitute Notice: Available if the cost of direct notice exceeds $500,000, the affected class exceeds 100,000 individuals, or the entity lacks sufficient contact information. Substitute notice must include: (i) email notice to affected individuals for whom the entity has email addresses; (ii) conspicuous posting on the entity's website; and (iii) notification to statewide media.
Credit Monitoring / Identity Theft Protection: The statute encourages but does not mandate the offer of free credit monitoring or identity theft protection services. However, given the nature of the compromised data (SSNs), offering credit monitoring is strongly recommended as best practice and consistent with Quorum's planned offering of twenty-four months of complimentary monitoring.
Private Right of Action: Alabama's statute does not provide an explicit private right of action for individuals. Enforcement is through the Attorney General, who may bring an action on behalf of affected individuals. However, individuals may pursue claims under Alabama's common law tort theories or the Alabama Deceptive Trade Practices Act in appropriate circumstances.
Penalties for Noncompliance: The Attorney General may impose civil penalties of up to $500,000 per breach for knowing violations of the statute. The AG may also seek injunctive relief and restitution.
Special Notes / Particularities: Alabama was one of the last states to enact a breach notification statute (effective June 1, 2018). The statute's forty-five-day deadline and 1,000-resident AG notification threshold are relatively common among states that have enacted legislation in recent years. Alabama has also adopted the NAIC Insurance Data Security Model Law; Quorum should confirm compliance with insurance-specific reporting obligations through its insurance regulatory counsel.
3.2 Alaska
Statute Citation: Alaska Stat. § 45.48.010 et seq.
Trigger Definition: Notification is required when a covered person becomes aware of a breach of security involving personal information. The trigger encompasses the unauthorized acquisition, or reasonable belief that there has been an unauthorized acquisition, of personal information that compromises the security, confidentiality, or integrity of the information.
Definition of "Personal Information": An individual's first name or first initial and last name, in combination with one or more of the following: SSN; driver's license number or state identification card number; or financial account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.
Applicability to This Incident: SSN, driver's license number, and financial account numbers are enumerated trigger elements. PHI is not expressly listed as a standalone trigger element, but the combination of name plus SSN is independently sufficient to trigger notification. Notification will be required for all affected Alaska residents.
Timing Requirement: "In the most expedient time possible and without unreasonable delay," consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. No fixed outer deadline.
Content Requirements: The statute does not prescribe specific content elements for the notification. However, best practice dictates inclusion of the standard elements described in Section 2.4 of this survey.
AG / Regulator Notification: Not specifically required by statute. Voluntary notification to the Alaska Attorney General is recommended for breaches affecting a significant number of Alaska residents.
Substitute Notice: Available if the cost of direct notice exceeds $150,000, the affected class exceeds 300,000 individuals, or the entity lacks sufficient contact information. Substitute notice requires: (i) email notice; (ii) conspicuous website posting; and (iii) notification to major statewide media. Note that Alaska's cost threshold ($150,000) and class size threshold (300,000) are lower than the most common thresholds of $250,000 and 500,000, respectively.
Credit Monitoring / Identity Theft Protection: Not mandated by statute.
Private Right of Action: Not explicitly provided by the breach notification statute. However, affected individuals may pursue claims under Alaska's Unfair Trade Practices and Consumer Protection Act (Alaska Stat. § 45.50.471 et seq.) or common law theories.
Penalties for Noncompliance: Violations are subject to enforcement under Alaska's consumer protection statutes.
Special Notes / Particularities: Alaska's statute is relatively basic compared to more recently enacted or amended statutes. The lower substitute notice thresholds are notable but are unlikely to be relevant for this incident, as Quorum plans to provide direct mail notification.
3.3 Arizona
Statute Citation: Ariz. Rev. Stat. § 18-552.
Trigger Definition: Notification is required upon the unauthorized acquisition of and access to unencrypted or unredacted computerized personal information maintained by or on behalf of an entity, where the unauthorized acquisition and access is reasonably likely to cause substantial economic loss to an affected individual. Arizona applies a risk-of-harm qualifier, requiring that the breach be reasonably likely to cause substantial economic loss.