PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
July 24, 2023
MEMORANDUM
To: Alan Burke, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
From: Sara Hendricks, Working Associate, Privacy & Data Security, Calderwood & Harkness LLP
Re: California Notification Obligations — Cal. Civ. Code § 1798.82 and California Confidentiality of Medical Information Act — Quorum Insurance Holdings Corp. / Palomar Data Solutions, Inc. Security Incident
Matter No.: 1025-00006
Client: Quorum Insurance Holdings Corp.
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes the California-specific breach notification obligations arising from the Palomar Data Solutions, Inc. ("Palomar") vendor-originated data security incident affecting Quorum Insurance Holdings Corp. ("Quorum" or the "Company"). The incident, which is the subject of ongoing privileged legal analysis and incident response, resulted in the unauthorized access to and exfiltration of personal information belonging to a confirmed total of 318,247 individuals across 29 states and the District of Columbia. Of those affected individuals, 38,206 are residents of the State of California, making California the third-largest affected state by volume, behind Connecticut (52,114 affected individuals) and New York (47,831 affected individuals).
Because more than 500 California residents are affected by the breach, notification to the California Attorney General is required under Cal. Civ. Code § 1798.82(f), in addition to direct notification to all 38,206 affected California residents.
The data elements compromised for the 38,206 California residents include personally identifiable information ("PII"), specifically names, dates of birth, Social Security numbers, and driver's license numbers. A subset of those California residents also had financial information compromised, including bank account numbers and payment card numbers. A further subset had protected health information ("PHI") compromised, consisting of health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims processed by Palomar on Quorum's behalf.
This memorandum addresses Quorum's obligations under three California statutory frameworks: (1) the California data breach notification statute, Cal. Civ. Code § 1798.82 (the general breach notification law); (2) the California Confidentiality of Medical Information Act ("CMIA"), Cal. Civ. Code §§ 56–56.37, which governs the confidentiality and unauthorized disclosure of medical information; and (3) the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code §§ 1798.100–1798.199.100, with specific attention to the private right of action for data breaches under § 1798.150 and the interplay between CCPA obligations and breach notification duties.
Key conclusions of this analysis are as follows:
• Notification is triggered and required for all 38,206 affected California residents under Cal. Civ. Code § 1798.82. The unauthorized acquisition and exfiltration of unencrypted personal information (including Social Security numbers, driver's license numbers, names, and dates of birth) constitutes a "breach of the security of the system" within the meaning of § 1798.82(g), and no statutory exception or safe harbor applies.
• Attorney General notification is required because the breach affects more than 500 California residents. A sample copy of the California-specific notification letter must be electronically submitted to the California Attorney General via the AG's online breach reporting portal.
• The CMIA may impose additional obligations for the subset of California residents whose medical information (health conditions, diagnosis codes, treatment information) was compromised. While certain CMIA reporting obligations may apply primarily to health care providers and facilities rather than insurers, the notification provided to PHI-affected individuals should incorporate CMIA-appropriate language as a conservative and protective measure.
• California-specific content and formatting requirements must be followed. The notification letter must use prescribed headings ("What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," "For More Information"), be printed in no smaller than 10-point type, and be titled "Notice of Data Breach."
• The CCPA does not impose separate breach notification obligations, but creates a private right of action under § 1798.150 for consumers whose nonencrypted personal information was subject to unauthorized access due to a business's failure to maintain reasonable security. Quorum's exposure under this provision and recommended mitigation strategies are discussed in Section V below.
This analysis is based in part on the final forensic report issued by Graystone Forensics LLC ("Graystone") on July 14, 2023, which confirmed the scope and nature of the data compromised in the incident, as well as the data mining performed by Clearfield Notification Services LLC ("Clearfield") in coordination with Graystone, with identification of individual California residents targeted for completion by August 4, 2023.
II. Background
A. The Security Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in the Vireo Health IT (Managed File Transfer) appliance operated by Palomar Data Solutions, Inc., Quorum's third-party claims-processing vendor. The exploitation of this vulnerability allowed the threat actor to gain unauthorized access to Palomar's network environment, including systems and file repositories used to process and store Quorum's personal lines insurance claims data.
The threat actor maintained persistent access to the Palomar network for a period of approximately 35 days, from March 14, 2023, through April 18, 2023 (the "Exfiltration Window"). During this period, the threat actor accessed and exfiltrated structured data files containing personal information of Quorum policyholders, claimants, and other individuals whose data was maintained in Palomar's claims-processing environment. The Graystone forensic investigation confirmed that the exfiltration was accomplished through staged transfers to an external command-and-control server, and that the data left Palomar's network in unencrypted form.
Palomar's Security Operations Center ("SOC") first identified anomalous outbound data transfers on April 18, 2023, at which point the threat actor's access was terminated and containment measures were implemented. Palomar engaged its internal incident response team and external cybersecurity counsel on April 19, 2023. On April 21, 2023, Palomar notified Quorum of the incident via email from Derek Copeland, Palomar's General Counsel, addressed to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer.
Upon receipt of Palomar's notification, Quorum engaged Calderwood & Harkness LLP as breach response counsel. Calderwood & Harkness retained Graystone Forensics LLC under the attorney-client privilege and work product protections on May 5, 2023, to conduct an independent forensic investigation of the incident's scope and impact on Quorum's data. Graystone issued its preliminary findings on June 2, 2023, and its final forensic report on July 14, 2023. The final forensic report confirmed that the incident resulted in the unauthorized access to and exfiltration of personal information belonging to a total of 318,247 individuals across 29 states and the District of Columbia.
B. California-Specific Scope
Of the 318,247 total affected individuals, 38,206 are confirmed California residents. This determination is based on Graystone's analysis of the compromised data files cross-referenced with address information maintained in Quorum's policyholder and claimant databases.
For all 38,206 California residents, the compromised data includes the following PII elements:
• Full names (first and last)
• Dates of birth
• Social Security numbers
• Driver's license numbers
In addition to these baseline PII elements, certain subsets of California residents had additional categories of sensitive data compromised:
• Financial information subset: A subset of the 38,206 California residents had financial information compromised, including bank account numbers and payment card numbers. Nationwide, 84,619 individuals had financial data compromised; the precise California count within this subset is being determined through the data mining process currently underway by Clearfield and Graystone, with a target completion date of August 4, 2023.
• Protected health information (PHI) subset: A further subset of the 38,206 California residents had PHI compromised, consisting of health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims. Nationwide, 41,203 individuals had PHI compromised; again, the precise California count is being confirmed through data mining.
The compromised data originates from Quorum's personal lines claims data, which was processed by Palomar under a Master Services Agreement dated November 12, 2019, as subsequently amended (the "MSA"). The data was maintained in Palomar's claims processing environment in connection with Palomar's performance of claims administration, adjudication, and processing services on behalf of Quorum.
C. Quorum's California Presence
Quorum Insurance Holdings Corp. is a Delaware corporation headquartered at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103. Quorum is publicly traded on the Nasdaq Stock Market under the ticker symbol QIHC. For fiscal year 2022, Quorum reported total annual revenue of approximately $4.82 billion. The Company employs approximately 11,400 individuals across its operations. As of May 2023, Quorum's market capitalization was approximately $6.1 billion.
Quorum operates a family of insurance subsidiaries that are licensed to conduct insurance business in all 50 states, including California. Quorum's California-licensed subsidiaries offer personal and commercial insurance lines, specialty insurance products, and digital underwriting services through the Company's proprietary QuorumEdge platform. Quorum regularly conducts business with California residents across these insurance lines and maintains policyholder and claimant information — including personal information — for a significant number of California-resident insureds and claimants.
For purposes of California's breach notification statute, Quorum qualifies as a "person or business that conducts business in California" and that "owns or licenses computerized data that includes personal information" within the meaning of Cal. Civ. Code § 1798.82(a). Accordingly, Quorum is subject to California's breach notification obligations with respect to the compromised personal information of the 38,206 affected California residents.
III. Analysis Under Cal. Civ. Code § 1798.82 (California Data Breach Notification Law)
A. Covered Entity / Applicability
California's data breach notification statute, Cal. Civ. Code § 1798.82, applies to "a person or business that conducts business in California, and that owns or licenses computerized data that includes personal information." The statute imposes notification obligations on two categories of entities: (1) data owners, who own or license the data (§ 1798.82(a)), and (2) data maintainers, who maintain computerized data they do not own (§ 1798.82(b)).
Quorum is the owner of the personal information at issue. The data compromised in the incident consists of Quorum's policyholder and claimant records, which were provided to Palomar solely for purposes of claims processing services under the MSA. Quorum retains ownership of the data under Section 8.1 of the MSA, which provides that "[a]ll Client Data, including without limitation personal information of Client's policyholders and claimants, shall remain the property of Client at all times." Quorum therefore falls squarely within the scope of § 1798.82(a) as an entity that "owns or licenses computerized data that includes personal information."
Even though the breach occurred within Palomar's network environment rather than Quorum's own systems, Quorum's notification obligations are independent and direct. Under the statutory scheme, a data maintainer (such as Palomar) is required under § 1798.82(b) to notify the data owner of any breach of the security of the data "immediately following discovery" of the breach. Palomar fulfilled this obligation by notifying Quorum on April 21, 2023, three days after Palomar's SOC discovered the anomalous outbound data transfers. However, the obligation to notify affected individuals rests with the data owner — here, Quorum. Palomar's notification to Quorum triggered Quorum's obligation to assess the scope of the breach and provide notification to affected California residents.
Accordingly, Quorum is the party obligated to notify the 38,206 affected California residents directly under § 1798.82(a).
B. Definition of "Personal Information"
The notification obligation under § 1798.82 is triggered only where the compromised data constitutes "personal information" as defined by the statute. Cal. Civ. Code § 1798.81.5(d)(1) defines "personal information" as:
An individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:
(A) Social Security number.
(B) Driver's license number or California identification card number.
(C) Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.
(D) Medical information.
(E) Health insurance information.
(F) Unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual. Unique biometric data does not include a physical or digital photograph, unless used or stored for facial recognition purposes.
(G) Information or data collected through the use or operation of an automated license plate recognition system, as defined in Section 1798.90.5.
In this matter, the compromised data for all 38,206 California residents includes full names (first and last) in combination with the following data elements:
• Social Security numbers — compromised for all 38,206 individuals. This data element falls within § 1798.81.5(d)(1)(A).
• Driver's license numbers — compromised for all 38,206 individuals. This data element falls within § 1798.81.5(d)(1)(B).
Additionally, the data was maintained in unencrypted form in Palomar's claims processing environment. The Graystone forensic investigation confirmed that the compromised data files were stored as structured, unencrypted data, and that the data was exfiltrated in unencrypted form. No encryption was applied at the file, field, or database level that would have rendered the personal information unreadable or unusable.
For the financial data subset, the compromised data also includes bank account numbers and payment card numbers, potentially in combination with security codes or other access credentials. This data element falls within § 1798.81.5(d)(1)(C). The precise California count within this subset is pending completion of data mining.
For the PHI subset, the compromised data includes medical information — specifically, health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related claims. This data element falls within § 1798.81.5(d)(1)(D). Additionally, depending on the specific data fields compromised for particular individuals, health insurance information may also be implicated under § 1798.81.5(d)(1)(E). The precise California count within this subset is also pending completion of data mining.
The statute further defines "personal information" in § 1798.81.5(d)(1)(F) through (G) to include unique biometric data and automated license plate recognition data. Neither of these data elements is implicated in this incident, and no further analysis of those categories is required.
Conclusion: Notification is triggered for all 38,206 affected California residents because their names combined with Social Security numbers and driver's license numbers constitute "personal information" under § 1798.81.5(d)(1)(A)–(B). For individuals whose financial or medical data was also compromised, additional notification content identifying those data categories is required. The lack of encryption eliminates any argument that the data was rendered unreadable or unusable so as to fall outside the definition of "personal information."
C. Notification Trigger — "Breach of the Security of the System"
The notification obligation under § 1798.82(a) arises when there is a "breach of the security of the system." This term is defined in § 1798.82(g) as:
"[U]nauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business."
The statute further provides that "[g]ood faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security of the system, provided that the personal information is not used or subject to further unauthorized disclosure."
In this matter, the Graystone forensic investigation confirmed that the threat actor's exploitation of CVE-2023-0669 resulted in unauthorized access to Palomar's network and the unauthorized exfiltration of structured data files containing personal information of Quorum's policyholders and claimants. The access was not authorized by Palomar, Quorum, or any employee or agent of either entity. The data was acquired by the threat actor without authorization and transferred to an external command-and-control server outside of Palomar's controlled environment. This constitutes an "unauthorized acquisition of computerized data" that "compromises the security, confidentiality, or integrity of personal information."
The good-faith employee/agent exception under § 1798.82(g) is inapplicable. The threat actor is an external, unauthorized party with no relationship to Quorum or Palomar.
There is no "safe harbor" provision under California law that would exempt notification in situations where the compromised data was encrypted or otherwise rendered unreadable. In any event, as noted above, the data at issue was maintained and exfiltrated in unencrypted form, so even if such a safe harbor existed, it would not apply here.
Conclusion: The incident constitutes a "breach of the security of the system" under § 1798.82(g), and the notification obligation under § 1798.82(a) is triggered.
D. Notification Timing Requirements
Cal. Civ. Code § 1798.82(a) provides that notification to affected individuals must be made:
"[I]n the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement."
Unlike a number of other state breach notification statutes that prescribe specific day-count deadlines (for example, Connecticut requires notification within 60 days, Florida within 30 days, and Washington within 30 days), California does not impose a fixed numerical deadline. Instead, California employs the "most expedient time possible" standard, which the California Attorney General's office and California courts have historically interpreted strictly. The AG's office has publicly stated in data breach reports and enforcement actions that it expects entities to provide notification promptly once the scope of the breach is determined and affected individuals are identified, and has criticized delays that are not attributable to law enforcement investigation or the legitimate complexity of the forensic investigation and data review.
The statute also provides that notification may be delayed if a law enforcement agency determines that the notification would impede a criminal investigation, and the agency has made a request for delay. See § 1798.82(c). No law enforcement delay request has been received in this matter, and we are not aware of any pending law enforcement investigation that would necessitate a delay in notification.
In this matter, the relevant timeline is as follows:
• April 18, 2023: Palomar discovered the breach.
• April 21, 2023: Palomar notified Quorum.
• May 5, 2023: Calderwood & Harkness retained Graystone under privilege to conduct forensic investigation.
• June 2, 2023: Graystone issued preliminary forensic findings, confirming the scope and nature of the unauthorized access and exfiltration.
• July 14, 2023: Graystone issued its final forensic report, confirming the categories of compromised data and the total number of affected individuals (318,247).
• August 4, 2023 (target): Data mining to be completed, identifying specific California residents and the categories of data compromised for each individual.
• August 18 – September 15, 2023 (planned): Consumer notification mailing window.
The planned notification mailing window of August 18 through September 15, 2023, represents approximately 14 to 42 days following the completion of data mining (which will confirm the identity and data categories for each affected California resident) and approximately 35 to 63 days following the issuance of the final forensic report. This timeframe is consistent with the "most expedient time possible" standard, given the complexity of the forensic investigation, the multi-state nature of the incident, the need for data mining to identify specific individuals and the categories of data compromised for each, and the preparation of jurisdiction-specific notification letters.
We note that the California Attorney General has previously taken the position that a delay of more than 60 to 90 days from the date of discovery of a breach to the date of notification may be viewed as unreasonable, absent extenuating circumstances. Measured from Quorum's receipt of notification from Palomar on April 21, 2023, to the start of the planned mailing window on August 18, 2023, the elapsed time is approximately 119 days. However, a significant portion of that period was attributable to the legitimate and necessary forensic investigation, the multi-state complexity of the data review, and the data mining process. We recommend documenting the basis for this timeline in the AG submission to demonstrate the reasonableness of the notification timing.
Recommendation: Notification to California residents should commence no later than August 18, 2023, which is the planned start of the general mailing window, and be completed no later than September 15, 2023. The filing of the AG notification is planned for August 16, 2023, two days prior to the start of consumer mailings.
E. Content Requirements for Notification Letter
California imposes specific content and formatting requirements for data breach notification letters. Cal. Civ. Code § 1798.82(d)(1) provides that the notification must be written and must include, at a minimum, the following elements, organized under the following prescribed headings:
1. "What Happened" — A general description of the breach, including the date of the breach (or an estimated date or date range), and a general description of the incident.
2. "What Information Was Involved" — A description of the types of personal information that were or are reasonably believed to have been the subject of the breach.
3. "What We Are Doing" — A description of what the entity has done to protect individuals whose information has been breached, including contact information for credit reporting agencies (including toll-free telephone numbers and addresses).
4. "What You Can Do" — Advice on steps that the individual whose information has been breached may take to protect himself or herself.
5. "For More Information" — A toll-free telephone number and address, and, if applicable, a website address for the notifying entity or its agent, that the individual may use to obtain additional information.
Additionally, the notification letter must comply with the following formatting requirements:
• The notification must be titled "Notice of Data Breach."
• The notification must be written in plain language.
• The notification must be printed in no smaller than 10-point type.
These requirements are unique to California and distinguish the California-specific notification letter from the model or general notification letter that may be used for other jurisdictions. The California notification letter must be prepared as a separate version incorporating the prescribed headings and formatting, even if the substantive content is similar to notifications provided under other states' laws.
If the notification is provided to more than 500 California residents — which is the case here, with 38,206 affected California residents — a single sample copy of the notification must be submitted electronically to the California Attorney General pursuant to § 1798.82(f). This submission requirement is discussed further in Section III.F below.
Recommendation: The California-specific notification letter should be drafted using the prescribed heading format and plain-language requirements. Three versions of the letter should be prepared to address the different data categories compromised for different subsets of California residents (PII only, PII plus financial data, and PII plus medical/health information). All versions should use the prescribed headings and comply with the 10-point type minimum requirement.
F. Attorney General Notification Requirement
Cal. Civ. Code § 1798.82(f) provides:
"If a person or business that is required to issue a security breach notification to more than 500 California residents as a result of a single breach of the security system, the person or business shall electronically submit a single sample copy of that security breach notification, excluding any personally identifiable information, to the Attorney General."
In this matter, the breach requires notification to 38,206 California residents, which far exceeds the 500-resident threshold. Accordingly, Quorum is required to electronically submit a single sample copy of the California-specific notification letter to the California Attorney General. The submission must exclude any personally identifiable information (i.e., a sample/template version of the letter should be submitted, not a copy addressed to a specific individual).
The submission is made via the California Attorney General's online breach reporting portal, which is maintained by the AG's Privacy Enforcement and Protection Unit. The portal requires the submitting entity to provide certain cover information in addition to the sample notification letter, including:
• The name and contact information of the notifying entity (Quorum Insurance Holdings Corp.)
• The number of California residents affected (38,206)
• The date or date range of the breach (March 14 – April 18, 2023)
• The date of discovery of the breach (April 18, 2023, by Palomar; April 21, 2023, notification to Quorum)
• The types of personal information compromised
• A sample copy of the notification letter
The planned filing date for the California AG notification is August 16, 2023, which is two business days prior to the start of the consumer notification mailing window. This timing allows the AG to receive the notification before California residents begin receiving their notification letters, which is consistent with best practices and the AG's stated preferences.
Recommendation: The California AG electronic notification should be submitted on August 16, 2023, via the AG's online portal. The submission should include the cover transmittal information identified above and a sample copy of each version of the California-specific notification letter. Calderwood & Harkness will prepare and submit the AG notification on Quorum's behalf.
G. Substitute Notice Provisions
Cal. Civ. Code § 1798.82(d)(2)–(3) permits an entity to provide "substitute notice" in lieu of direct written notice under certain circumstances. Substitute notice is permitted if:
(i) the cost of providing notice would exceed $250,000;
(ii) the affected class of subject persons to be notified exceeds 500,000; or
(iii) the person or business does not have sufficient contact information to provide direct written notice.
If substitute notice is permitted, it must consist of all of the following: (a) email notice, when the entity has an email address for the affected individual; (b) conspicuous posting of the notification on the entity's website; and (c) notification to major statewide media.
In this matter:
• Cost threshold: The cost of direct written notification to 38,206 California residents is well within manageable limits under the Clearfield Notification Services LLC contract and does not approach the $250,000 threshold for the California mailing alone.
• Class size threshold: The 38,206 affected California residents are significantly below the 500,000-person threshold.
• Contact information: Quorum maintains current mailing addresses for its policyholders and claimants in its policyholder and claimant databases, and these addresses are sufficient to provide direct written notice to the affected California residents.
Conclusion: None of the conditions for substitute notice under § 1798.82(d)(2)–(3) are met. Direct written notice will be provided to all 38,206 affected California residents. As a supplementary precautionary measure, Quorum also plans to post a notice on its website describing the incident and the steps individuals can take, but this website posting is not a substitute for direct written notice and is being provided as an additional, voluntary communication channel.
H. Method of Notification
Cal. Civ. Code § 1798.82(j) specifies the permissible methods for providing written notification. Notification may be provided by:
(i) Written notice delivered to the postal address in the notifying person's or business's records for the individual to be notified;
(ii) Electronic notice, if the notice is consistent with the provisions regarding electronic records and signatures set forth in Section 7001 of Title 15 of the United States Code (the federal E-SIGN Act); or
(iii) Substitute notice, if the conditions described in § 1798.82(d)(2) are satisfied.
Quorum plans to provide notification via direct written notice delivered by first-class mail to the postal addresses maintained in Quorum's policyholder and claimant records. The mailing will be executed by Clearfield Notification Services LLC, Quorum's designated notification and call center vendor for this incident. Clearfield's account manager for this engagement is Jerome Tillman. Clearfield's offices are located at 4500 Rockside Road, Suite 210, Independence, Ohio 44131.
Additionally, as noted above, Quorum plans to post a notice on its website (www.quoruminsurance.com) as a supplementary notification measure. This website posting will be available no later than August 18, 2023, coinciding with the start of the consumer mailing window.
IV. Analysis Under the California Confidentiality of Medical Information Act (CMIA)
A. Applicability of the CMIA
The California Confidentiality of Medical Information Act, Cal. Civ. Code §§ 56–56.37 ("CMIA"), establishes comprehensive protections for the confidentiality of medical information in California. The CMIA governs the use, disclosure, and security of "medical information" by specific categories of entities, including "providers of health care," "health care service plans," and "contractors."
The CMIA defines key terms relevant to this analysis as follows:
• "Medical information" is defined in Cal. Civ. Code § 56.05(j) as "any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental or physical condition, or treatment." The definition is broad and encompasses a wide range of health-related data linked to identifiable individuals.
• "Contractor" is defined in Cal. Civ. Code § 56.05(d) as "any person or entity that is a medical group, independent practice association, pharmaceutical benefits manager, or a person or entity that maintains medical information as defined in this subdivision in order to provide services, including, but not limited to, the management of health care claims, to an insurer, employer, hospital, health care service plan, health care provider, or any of these entities' contractors or subcontractors."
• "Provider of health care" is defined in Cal. Civ. Code § 56.05(m) to include licensed health care practitioners and facilities, but does not extend to insurance companies in their general insurance operations.
• "Health care service plan" is defined by reference to the Knox-Keene Health Care Service Plan Act of 1975, Health & Safety Code § 1345(f), and encompasses managed care organizations, HMOs, and similar entities that contract to provide health care services.
The question presented is whether Quorum, as an insurance company maintaining medical information derived from workers' compensation and health-related insurance claims, falls within the scope of any of these CMIA-defined categories.
Analysis: Quorum does not appear to qualify as a "provider of health care" under § 56.05(m), as it is an insurance holding company, not a licensed health care practitioner or facility. Quorum's insurance subsidiaries also likely do not qualify as "health care service plans" under the Knox-Keene Act, as they are licensed as insurance companies under the California Insurance Code rather than as health care service plans under the Knox-Keene Act. The distinction between an insurance company regulated under the Insurance Code and a health care service plan regulated under the Knox-Keene Act is well established in California law.
However, Quorum may qualify as a "contractor" under § 56.05(d). The definition of "contractor" includes "a person or entity that maintains medical information . . . in order to provide services, including, but not limited to, the management of health care claims." Quorum's insurance subsidiaries process workers' compensation claims and health-related insurance claims, which involve the maintenance of medical information — specifically, health conditions, diagnosis codes, and treatment information — for purposes of claims management and adjudication. This activity may bring Quorum within the definition of "contractor," even though Quorum is primarily an insurance company rather than a traditional claims management entity.
The scope of the CMIA's application to insurers maintaining medical information for claims processing purposes is not entirely settled. However, several considerations support treating Quorum as subject to at least some CMIA obligations:
• The compromised data includes "individually identifiable information . . . regarding a patient's medical history, mental or physical condition, or treatment," which falls squarely within the statutory definition of "medical information" under § 56.05(j).
• The California Legislature has broadly construed the CMIA to protect the confidentiality of medical information, and courts have generally interpreted the statute's coverage provisions expansively.
• Even if Quorum is not directly subject to all CMIA provisions, a failure to address the medical information aspects of the breach in the notification letter could expose Quorum to reputational risk and potential enforcement scrutiny.
Number of affected individuals: The subset of California residents whose PHI/medical information was compromised is a portion of the 38,206 total affected California residents. Nationwide, 41,203 individuals had PHI compromised; the exact California count within this subset is being confirmed through the data mining process, with a target completion date of August 4, 2023.
B. CMIA Breach Notification Requirements
The CMIA includes specific breach notification and reporting provisions. Cal. Civ. Code § 56.36 addresses the consequences of unauthorized disclosure of medical information:
• § 56.36(a): Prohibits the negligent creation, maintenance, preservation, storage, abandonment, destruction, or disposal of medical information.
• § 56.36(b): Provides a private right of action for any individual whose medical information has been used or disclosed in violation of the CMIA. The individual may recover compensatory damages, punitive damages, attorneys' fees, costs of litigation, and nominal damages of not less than $1,000 and not more than $5,000 in the absence of proof of actual damages.
• § 56.36(e)–(g): Certain CMIA reporting obligations apply specifically to clinics, health facilities, home health agencies, and hospices. These provisions require such entities to report any unlawful or unauthorized access to, or use or disclosure of, medical information to the affected patient and to the California Department of Public Health ("CDPH") within specified timeframes.
The CDPH reporting obligations under § 56.36(e)–(g) appear to apply primarily to health care providers and facilities — clinics, health facilities, home health agencies, and hospices — rather than to insurers or other entities that maintain medical information in the course of claims processing. Quorum's insurance operations do not fall within these specifically enumerated entity types.
Separate analysis required: Whether Quorum is subject to the CDPH reporting obligation turns on whether Quorum is classified as one of the specifically enumerated entity types (clinic, health facility, home health agency, or hospice). Based on our analysis, Quorum does not fall within any of these categories, and the CDPH reporting obligation likely does not apply to Quorum directly. However, this conclusion warrants confirmation, and we recommend treating it as an open item pending further review.
Regardless of whether the specific CDPH reporting obligation applies, the CMIA creates meaningful obligations and litigation risk for entities that maintain medical information that is subject to unauthorized disclosure:
• The private right of action under § 56.36(b) provides for statutory damages of $1,000 to $5,000 per individual for unauthorized disclosure of medical information, even absent proof of actual damages. For the California PHI subset, this creates a separate damages exposure independent of the CCPA private right of action.
• The prohibition on negligent maintenance of medical information under § 56.36(a) could form the basis for a claim that Quorum (or Palomar) failed to adequately secure the medical information.
Recommendation: Even if the specific CDPH reporting obligation under § 56.36(e)–(g) may not apply to Quorum as an insurer, the notification provided to California residents under Cal. Civ. Code § 1798.82 should include reference to the medical information compromised for the PHI subset. The notification letter for PHI-affected California individuals should incorporate CMIA-appropriate language and remedies, as described further in Section IV.C below. This approach is consistent with a conservative and protective interpretation of Quorum's obligations and mitigates the risk of enforcement action or litigation based on an alleged failure to adequately disclose the medical information aspects of the breach.
C. CMIA Content and Notification Obligations — Practical Recommendations
For the subset of California residents whose medical or health information was compromised in the incident, we recommend that the notification letter include the following CMIA-specific elements:
1. Identification of medical information types: The letter should specifically identify the types of medical information involved, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims. The description should be sufficiently specific to allow the individual to understand the nature of the medical information that was accessed and exfiltrated, without disclosing unnecessary clinical detail in the letter itself.
2. Characterization of the incident under CMIA: The letter should describe the unauthorized access and exfiltration as an "unauthorized disclosure of medical information" within the meaning of the CMIA. This language aligns the notification with the CMIA's statutory framework and demonstrates Quorum's acknowledgment of the medical information dimension of the breach.
3. CMIA rights advisory: The letter should advise affected individuals of their rights under the CMIA, including the right to bring a civil action for nominal damages of $1,000 (and up to $5,000) and actual damages under Cal. Civ. Code § 56.36(b). While including this information in the notification letter is not expressly required by statute, it is consistent with transparent and good-faith notification practices and may reduce the risk that plaintiffs' counsel can argue that Quorum concealed or minimized the nature of the compromised data.
4. Cross-reference with HIPAA notification: For individuals who are also subject to HIPAA-compliant notification (which is being provided simultaneously pursuant to 45 C.F.R. § 164.404(c)), the California notification letter should be drafted to satisfy both the California § 1798.82 content requirements and the HIPAA notification content requirements. The letter should reference the HIPAA-compliant notification being provided and the individual's rights under HIPAA, including the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR").
This analysis should be read in conjunction with the separate HIPAA Breach Notification Analysis Memo dated July 22, 2023, which addresses Quorum's obligations under the HIPAA Breach Notification Rule, 45 C.F.R. §§ 164.400–164.414, including notification to affected individuals, HHS-OCR, and prominent media outlets.
V. Interplay with the California Consumer Privacy Act (CCPA)
A. CCPA Breach Context
The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 ("CPRA"), Cal. Civ. Code §§ 1798.100–1798.199.100, establishes comprehensive consumer privacy rights and obligations for businesses that collect and process the personal information of California residents. While the CCPA is principally a privacy regulation statute rather than a breach notification statute, it includes a significant provision that creates a private right of action in the context of data breaches.
Cal. Civ. Code § 1798.150(a)(1) provides:
"Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:
(A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty dollars ($750) per consumer per incident, or actual damages, whichever is greater.
(B) Injunctive or declaratory relief.
(C) Any other relief the court deems proper."
Several critical features of this provision are relevant to Quorum's exposure:
First, the private right of action under § 1798.150 is limited to "nonencrypted and nonredacted personal information" as defined in § 1798.81.5(d)(1)(A) — that is, the same definition of "personal information" that triggers the breach notification obligation under § 1798.82. As discussed in Section III.B above, the compromised data in this matter falls within this definition, and the data was maintained in unencrypted form.
Second, the private right of action requires that the unauthorized access and exfiltration occurred "as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information." This causation element is significant: the CCPA does not impose strict liability for all data breaches, but rather limits the private right of action to breaches that result from a failure to maintain "reasonable security."
Third, the CCPA private right of action attaches to the "business" — here, Quorum — rather than to a "service provider." Under the CCPA's framework, Palomar would be classified as a "service provider" processing personal information on Quorum's behalf, and the private right of action does not directly extend to service providers (though service provider conduct may be relevant to the causation analysis).
Importantly, the CCPA does not impose separate breach notification obligations. The notification obligation arises under Cal. Civ. Code § 1798.82, not under the CCPA. The CCPA's relevance to this incident is as a source of potential litigation liability rather than as a source of additional notification requirements.
B. CCPA "Business" and "Service Provider" Obligations
Under the CCPA, Quorum qualifies as a "business" that collects personal information of California residents. The CCPA defines a "business" as a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information (or on whose behalf personal information is collected), and that satisfies one or more of the specified thresholds (annual gross revenues exceeding $25 million, processing of personal information of 100,000 or more consumers, or deriving 50 percent or more of annual revenues from selling or sharing consumers' personal information). Quorum, with annual revenue of $4.82 billion and insurance operations involving personal information of California residents across personal and commercial lines, clearly meets the CCPA's "business" definition.
Palomar, as a data processor acting on Quorum's behalf under the MSA, would be classified as a "service provider" under the CCPA. Cal. Civ. Code § 1798.140(ag) defines a "service provider" as a person or entity that processes personal information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract. The MSA between Quorum and Palomar provides for Palomar's processing of Quorum's policyholder and claimant data for claims administration purposes, which constitutes a "business purpose" under the CCPA.
As a service provider, Palomar's obligations under the CCPA include:
• Processing personal information only for the business purposes specified in the written contract with Quorum;
• Not retaining, using, or disclosing the personal information for any purpose other than the specified business purposes or as otherwise permitted by the CCPA;
• Not selling or sharing the personal information;
• Implementing reasonable security measures to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
The MSA between Quorum and Palomar includes data security obligations that are consistent with CCPA service provider requirements. Specifically, the MSA's Data Security Exhibit (Exhibit D) requires Palomar to implement and maintain commercially reasonable safeguards, apply security patches within 30 days of release, conduct annual penetration testing, and undergo SOC 2 Type II audits. Amendment 2 to the MSA, executed on September 15, 2022, updated the Data Security Exhibit and added the SOC 2 Type II audit requirement, reflecting Quorum's proactive approach to vendor security management.
Conclusion: The CCPA does not impose a separate notification obligation beyond what is required under § 1798.82. The notification analysis under § 1798.82 is the primary statutory framework for breach notification in California. However, the CCPA's private right of action under § 1798.150 creates a significant litigation risk that must be addressed through proactive mitigation strategies, as discussed in Section V.C below.
C. Litigation Risk Assessment
The potential exposure under the CCPA private right of action is significant in dollar terms. Statutory damages under § 1798.150(a)(1)(A) range from $100 to $750 per consumer per incident. Applied to the 38,206 affected California residents, the theoretical statutory damages range is:
These figures represent the theoretical maximum exposure if all 38,206 California residents were to bring claims and if a court were to award statutory damages at the specified per-consumer rates. In practice, actual litigation exposure may differ based on a number of factors, including class certification dynamics, the court's exercise of discretion in setting per-consumer damages amounts, and the availability and strength of Quorum's defenses.
Defense posture: Quorum has strong defenses to a CCPA § 1798.150 claim based on the following considerations:
• Vendor-originated breach: The breach resulted from Palomar's failure to patch the GoAnywhere MFT vulnerability (CVE-2023-0669) within a reasonable timeframe, not from any security failure within Quorum's own network or systems. The CCPA private right of action requires a causal nexus between the business's failure to maintain reasonable security and the unauthorized access/exfiltration. If the breach is attributable to the service provider's security failures rather than the business's own conduct, this causation element may not be satisfied.
• Reasonable vendor oversight: Quorum maintained a robust vendor risk management program, overseen by Priya Deshmukh, Vice President of Vendor Risk Management. The MSA with Palomar included comprehensive data security requirements (Exhibit D), including commercially reasonable safeguards, 30-day patching obligations, annual penetration testing, and SOC 2 Type II audit requirements. Amendment 2 to the MSA, executed in September 2022, further strengthened these requirements. These contractual protections and vendor oversight activities support a defense that Quorum implemented and maintained reasonable security procedures and practices with respect to personal information processed by its service provider.
• No evidence of Quorum system compromise: The Graystone forensic investigation confirmed that the breach was confined to Palomar's network environment. Quorum's own systems were not compromised, and there is no evidence of any security deficiency in Quorum's internal data security practices.