PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION AND ATTORNEY WORK PRODUCT PREPARED AT THE DIRECTION OF COUNSEL
This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared at the direction of counsel. It is intended solely for the use of the addressees and authorized recipients identified herein. This memorandum contains legal analysis, mental impressions, conclusions, and recommendations of counsel. It is not intended for disclosure to any third party and should not be disclosed without the express written authorization of a partner of Calderwood & Harkness LLP. Any unauthorized disclosure may result in a waiver of applicable privileges.
MEMORANDUM
July 22, 2023
FROM: Sara Hendricks, Associate, Privacy & Data Security Practice Group, Calderwood & Harkness LLP
TO: Kevin Ostrowski, Partner, Privacy & Data Security Practice Group Alan Burke, Associate, Privacy & Data Security Practice Group
RE: HIPAA Breach Notification Analysis — Quorum Insurance Holdings Corp. Data Security Incident
MATTER NO.: 1025-00006
CLIENT: Quorum Insurance Holdings Corp.
I. Executive Summary
The purpose of this memorandum is to analyze the applicability of the HIPAA Breach Notification Rule, codified at 45 C.F.R. Part 164, Subpart D (§§ 164.400–164.414), to the subset of individuals whose protected health information ("PHI") was compromised in the vendor-originated data security incident at Palomar Data Solutions, Inc. ("Palomar"). This analysis is limited to the HIPAA-specific notification obligations arising from the incident and should be read in conjunction with the broader state breach notification analysis being prepared concurrently by this team.
Based on the factual record now available — including the final forensic report issued by Graystone Forensics LLC on July 14, 2023 — it is our conclusion that HIPAA breach notification obligations are triggered with respect to 41,203 individuals whose PHI was among the data exfiltrated by the threat actor during the compromise of Palomar's network environment. This conclusion rests on the following key determinations:
First, Quorum Insurance Holdings Corp. ("Quorum" or the "Company"), through its operating insurance subsidiaries offering workers' compensation insurance and certain health-related specialty lines, functions as a "covered entity" under HIPAA — specifically, as a "health plan" as that term is defined under 45 C.F.R. § 160.103. Quorum is therefore subject to the HIPAA Privacy, Security, and Breach Notification Rules with respect to the PHI it creates, receives, maintains, or transmits in connection with those regulated activities.
Second, Palomar Data Solutions functions as a "business associate" under HIPAA by virtue of its processing of PHI on behalf of Quorum pursuant to the Master Services Agreement dated November 12, 2019 (the "MSA"), as amended, which includes a Business Associate Agreement ("BAA") component incorporated within the data security exhibit (Exhibit D) of the MSA, as added by Amendment 2, dated September 15, 2022.
Third, the four-factor risk assessment required under 45 C.F.R. § 164.402(2) does not support a finding of low probability that the PHI has been compromised. All four factors weigh in favor of a determination that the impermissible disclosure constitutes a reportable breach of unsecured PHI.
As a result of these determinations, the following notification obligations are triggered:
• Notification to the Secretary of the U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights ("OCR"): Because the breach affects more than 500 individuals, notification to HHS-OCR is required contemporaneously with individual notifications and without unreasonable delay, no later than 60 calendar days from the date of discovery of the breach, pursuant to 45 C.F.R. § 164.408.
• Notification to Prominent Media Outlets: Because the breach affects more than 500 residents of at least several individual states or jurisdictions, media notice is required under 45 C.F.R. § 164.406 for each such state or jurisdiction.
• Notification to Affected Individuals: Written notification to each of the 41,203 affected individuals is required under 45 C.F.R. § 164.404, without unreasonable delay and no later than 60 calendar days from the date of discovery.
We recommend that Quorum file the HHS-OCR breach notification no later than August 15, 2023, via the HHS Breach Notification Portal, and that individual PHI-specific notification letters be coordinated with the broader consumer notification mailing managed by Clearfield Notification Services LLC, with initial mailings beginning August 18, 2023. Media notice should be distributed concurrently with the HHS-OCR filing, in coordination with BrightPath Consulting Group Inc.
The analysis supporting these conclusions, together with our recommendations regarding notification timing, content, and method, is set forth in detail below.
II. Background and Factual Summary
A. The Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability affecting the GoAnywhere MFT (Managed File Transfer) appliance operated by Palomar Data Solutions, Inc. The GoAnywhere MFT appliance is a widely used enterprise file transfer platform, and CVE-2023-0669 was publicly disclosed as a zero-day vulnerability in early February 2023. Palomar utilized this appliance to facilitate the transfer and processing of large-volume data files, including files containing data processed on behalf of Quorum and other Palomar clients.
By exploiting the vulnerability, the threat actor gained unauthorized access to Palomar's network environment. Forensic analysis indicates that the threat actor maintained persistent access to Palomar's systems and engaged in lateral movement across the network during an exfiltration window spanning approximately 35 days, from March 14, 2023 through April 18, 2023. During this period, the threat actor identified, staged, and exfiltrated significant volumes of structured data files, including database exports and CSV/flat files, from Palomar's file transfer staging environment.
Palomar's Security Operations Center ("SOC") first detected anomalous outbound data transfers on April 18, 2023. Upon detection, Palomar initiated incident response procedures, including containment measures to terminate the threat actor's access to the network and engagement of its own third-party forensic consultants.
Palomar notified Quorum of the incident on April 21, 2023, by email from Derek Copeland, Palomar's General Counsel, to Thomas R. Whitfield, Quorum's General Counsel, and David Naranjo, Quorum's Chief Information Security Officer. The notification email provided a preliminary summary of the incident but did not include a definitive assessment of the scope of data compromised or the specific categories of information affected. Subsequent communications between Palomar and Quorum, facilitated through outside counsel, provided incremental updates on the investigation.
Upon receiving Palomar's notification, Quorum's legal department and information security team initiated internal incident response procedures. Thomas R. Whitfield engaged Calderwood & Harkness LLP to serve as outside breach counsel. On May 5, 2023, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone"), under the attorney-client privilege umbrella, to conduct an independent forensic investigation into the incident and to identify the full scope of data compromised. Graystone's engagement was structured as a privileged investigation directed by counsel, with Graystone reporting directly to Calderwood & Harkness to preserve applicable privileges.
B. Graystone Forensic Findings Relevant to PHI
The forensic investigation conducted by Graystone Forensics LLC culminated in the issuance of a Final Forensic Report dated July 14, 2023, prepared by Dr. Nolan Briggs, Principal Forensic Analyst, and Kendra Faulkner, Senior Forensic Analyst (the "Graystone Report"). The Graystone Report is a privileged document prepared under the direction of counsel and should be treated as attorney work product.
The Graystone Report's key findings relevant to this HIPAA analysis are as follows:
The total number of affected individuals across all data categories is 318,247, spanning 29 states and the District of Columbia. This figure encompasses all categories of personal information compromised in the exfiltration, including but not limited to personally identifiable information ("PII"), financial information, and protected health information.
Of particular relevance to this analysis, Graystone identified a subset of 41,203 individuals whose protected health information was among the exfiltrated structured data files. This PHI subset was identified through Graystone's analysis of the specific files and data tables confirmed to have been staged and exfiltrated by the threat actor during the 35-day exfiltration window.
The types of PHI compromised for these 41,203 individuals include:
• Health conditions and medical diagnoses
• Diagnosis codes, including International Classification of Diseases ("ICD") codes
• Treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum
• Claims-related information, including dates of service, provider information, and claims adjudication data
Critically, the PHI was intermingled with PII elements for the same individuals within the same data files and data tables. The PII elements included full names, dates of birth, Social Security numbers, and driver's license numbers. The co-location of health information and directly identifying PII within the same structured data records means that the health information is readily linkable to specific, identifiable individuals. There is no reasonable basis to conclude that the health information could not be associated with particular individuals.
The data mining and affected individual identification process — the process of parsing the exfiltrated data files, cross-referencing records to eliminate duplicates, and compiling a final list of affected individuals by data category — was completed on August 4, 2023. The identification of the 41,203-individual PHI subset was finalized as of that date.
C. Quorum's HIPAA-Regulated Activities
Quorum Insurance Holdings Corp. is a diversified insurance holding company headquartered in Hartford, Connecticut. Quorum's operating subsidiaries offer a range of insurance products, including, among other lines, workers' compensation insurance and certain health-related specialty lines of insurance.
To the extent that Quorum's operating subsidiaries provide or administer health benefits, workers' compensation medical benefits, or other health-related coverage that constitutes a "health plan" as defined under HIPAA, 45 C.F.R. § 160.103, those subsidiaries are covered entities subject to the HIPAA Privacy, Security, and Breach Notification Rules. The definition of "health plan" under HIPAA is broad and includes, among other things, health insurance issuers, group health plans, and certain other individual or group plans that provide or pay the cost of medical care. Workers' compensation insurers, to the extent they process health-related claims data, may be treated as covered entities for HIPAA purposes with respect to the health information they create or receive in connection with claims processing.
We have reviewed Quorum's HIPAA compliance program documentation and have conferred with Jennifer Liang, Quorum's Chief Privacy Officer, regarding Quorum's status as a covered entity. Based on our review, we proceed on the assumption that Quorum functions as a covered entity (health plan) with respect to the PHI at issue in this incident — namely, the health conditions, diagnosis codes, and treatment information associated with workers' compensation and health-related insurance claims.
Palomar Data Solutions processes claims data — including PHI — on behalf of Quorum pursuant to the MSA dated November 12, 2019, as amended. Palomar's services under the MSA include the receipt, processing, and storage of claims-related data files containing PHI and PII of Quorum's insureds and claimants. By virtue of these activities, Palomar is a "business associate" as defined by 45 C.F.R. § 160.103, which defines a business associate as a person or entity that, on behalf of a covered entity, creates, receives, maintains, or transmits PHI for a function or activity regulated by HIPAA.
The MSA, as amended by Amendment 2 (September 15, 2022), includes a BAA component within the data security exhibit (Exhibit D). The BAA sets forth the parties' respective obligations with respect to the privacy and security of PHI, including breach notification requirements. Specifically, MSA Section 9.4 imposes a contractual obligation on Palomar to notify Quorum of any suspected or confirmed security incident within 48 hours of discovery. As discussed in Section IV.D below, Palomar's notification on April 21, 2023 — three days after its SOC detected anomalous activity on April 18, 2023 — was approximately 24 hours late under this contractual requirement, although it was well within the 60-day HIPAA notification window.
III. Legal Framework — HIPAA Breach Notification Rule
A. Statutory and Regulatory Authority
The HIPAA Breach Notification Rule derives its statutory authority from the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act"), enacted as part of the American Recovery and Reinvestment Act of 2009. Section 13402 of the HITECH Act, codified at 42 U.S.C. § 17932, establishes the requirement that covered entities and business associates provide notification to affected individuals, the Secretary of HHS, and, in certain circumstances, prominent media outlets, following the discovery of a breach of unsecured PHI.
The implementing regulations are set forth at 45 C.F.R. Part 164, Subpart D (§§ 164.400–164.414). The final rule implementing the breach notification provisions was published by HHS on August 24, 2009, and was subsequently modified by the Omnibus Rule published on January 25, 2013 (effective March 26, 2013), which, among other things, established the current presumption-of-breach standard and the four-factor risk assessment framework.
The key regulatory sections relevant to this analysis are as follows:
• 45 C.F.R. § 164.402 — Definitions, including the definitions of "breach" and "unsecured protected health information," and the four-factor risk assessment for determining whether an impermissible use or disclosure of PHI constitutes a reportable breach.
• 45 C.F.R. § 164.404 — Notification to Individuals, setting forth the timing, content, and method requirements for individual breach notification.
• 45 C.F.R. § 164.406 — Notification to Media, requiring notification to prominent media outlets where a breach affects more than 500 residents of a single state or jurisdiction.
• 45 C.F.R. § 164.408 — Notification to the Secretary of HHS, requiring notification to the HHS Secretary via the Breach Notification Portal, with timing dependent on the number of individuals affected.
• 45 C.F.R. § 164.410 — Notification by a Business Associate, establishing the business associate's obligation to notify the covered entity of a breach of unsecured PHI.
• 45 C.F.R. § 164.412 — Law Enforcement Delay, permitting a delay in breach notification if a law enforcement official determines that notification would impede a criminal investigation or cause damage to national security.
• 45 C.F.R. § 164.414 — Administrative Requirements and Burden of Proof, establishing the covered entity's or business associate's burden to demonstrate that all required notifications have been provided or that an impermissible use or disclosure did not constitute a breach.
B. Definition of "Breach" Under HIPAA
Under 45 C.F.R. § 164.402, a "breach" is defined as the acquisition, access, use, or disclosure of PHI in a manner not permitted under Subpart E (the HIPAA Privacy Rule) of 45 C.F.R. Part 164, which compromises the security or privacy of the PHI. The 2013 Omnibus Rule modified the standard for determining whether an impermissible use or disclosure constitutes a breach by establishing a presumption of breach: any impermissible acquisition, access, use, or disclosure of PHI is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been compromised based on a risk assessment considering at least the four factors enumerated in § 164.402(2).
The burden of proof rests on the covered entity or business associate to demonstrate, through the four-factor risk assessment, that a particular impermissible use or disclosure does not rise to the level of a reportable breach. If the covered entity cannot demonstrate a low probability of compromise, the impermissible use or disclosure must be treated as a reportable breach and notification obligations are triggered. This framework is codified at 45 C.F.R. § 164.414(b), which provides that the covered entity or business associate bears the burden of demonstrating that all notifications were provided as required or that an impermissible use or disclosure did not constitute a breach.
In this case, there is no dispute that an impermissible acquisition, access, use, or disclosure of PHI occurred. The threat actor's unauthorized access to Palomar's network and exfiltration of structured data files containing PHI constitutes an impermissible acquisition and disclosure of PHI under the Privacy Rule. The relevant question is whether the presumption of breach can be rebutted through the four-factor risk assessment — an analysis we undertake in Section III.C below.
C. Four-Factor Risk Assessment
The four factors that must be considered in determining whether an impermissible use or disclosure of PHI results in a low probability of compromise, and therefore may be excluded from breach notification requirements, are set forth at 45 C.F.R. § 164.402(2)(i)–(iv). We analyze each factor below as applied to the facts of this incident.
Factor 1: The Nature and Extent of the PHI Involved, Including the Types of Identifiers and the Likelihood of Re-identification
The first factor requires consideration of the nature and extent of the PHI involved in the impermissible use or disclosure, including the types of identifiers and the likelihood of re-identification. This factor considers whether the PHI involved is of a nature that presents a significant risk of harm if used or disclosed improperly.
In this case, the PHI at issue includes highly sensitive health information: diagnosis codes (ICD codes), health conditions, treatment information, and claims-related data derived from workers' compensation claims and health-related insurance claims. This type of clinical and diagnostic health information is among the most sensitive categories of PHI, as it reveals specific medical conditions and treatments associated with identifiable individuals.
Moreover, the PHI was not isolated from identifying information. Rather, the health information was intermingled with — and directly linked to — PII elements including full names, dates of birth, Social Security numbers, and driver's license numbers. The combination of detailed health information with direct identifiers such as Social Security numbers eliminates any possibility that the data could be considered de-identified or that re-identification would be difficult. The data is, by its nature, fully identified and readily attributable to specific individuals.
Assessment: This factor weighs strongly in favor of a finding that the PHI has been compromised. The sensitive nature of the health information, combined with its direct linkage to unique personal identifiers, presents a significant risk of harm to affected individuals.
Factor 2: The Unauthorized Person Who Used the PHI or to Whom the Disclosure Was Made
The second factor requires consideration of the identity and nature of the unauthorized recipient or user of the PHI. HHS guidance indicates that this factor may weigh against a finding of breach where, for example, the unauthorized recipient is another covered entity or a person with independent obligations to safeguard the information, or where the unauthorized disclosure was made to a person who would have no reason to use or retain the data.
In this case, the unauthorized party is an unidentified criminal threat actor who exploited a known software vulnerability to gain unauthorized access to Palomar's network for the apparent purpose of data exfiltration. The threat actor's identity remains unknown. There is no indication that this was an inadvertent disclosure to a person unlikely to retain or use the data; to the contrary, the deliberate nature of the exploitation, the sustained 35-day period of access, and the methodical staging and exfiltration of data files all indicate that the threat actor obtained the data intentionally and with the presumed purpose of using, selling, or otherwise exploiting the information.
Assessment: This factor weighs strongly in favor of a finding that the PHI has been compromised. The disclosure was made to a criminal actor with no obligation or incentive to safeguard the data, and whose apparent purpose was data theft.
Factor 3: Whether the PHI Was Actually Acquired or Viewed
The third factor considers whether the PHI was actually acquired or viewed by the unauthorized person, as opposed to the mere opportunity to access the information without evidence that the data was in fact accessed or obtained.
The Graystone forensic analysis confirms that the structured data files containing PHI were actually staged and exfiltrated from Palomar's network by the threat actor during the 35-day exfiltration window. Graystone's analysis of network traffic logs, file access records, and data transfer artifacts provides a high degree of confidence that the data was not merely accessible but was affirmatively acquired — that is, copied and transferred out of Palomar's network to external systems controlled by the threat actor.
Assessment: This factor weighs strongly in favor of a finding that the PHI has been compromised. The data was not merely exposed; it was actually acquired by the threat actor.
Factor 4: The Extent to Which the Risk to the PHI Has Been Mitigated
The fourth factor considers whether the risk to the PHI has been mitigated — for example, through retrieval of the data, assurances from the unauthorized recipient that the data has been destroyed, or other measures that reduce the probability that the PHI will be used or disclosed in a harmful manner.
In this case, Palomar has taken steps to contain the intrusion, including patching the GoAnywhere MFT vulnerability, terminating the threat actor's access, and engaging forensic consultants to assess the scope of the compromise. Quorum, through Calderwood & Harkness, has engaged Graystone Forensics to conduct an independent investigation. Quorum intends to offer 24 months of complimentary credit monitoring and identity theft protection services to all affected individuals, including the 41,203 PHI-affected individuals, through Clearfield Notification Services LLC.
However, the exfiltrated data has not been recovered, and there is no assurance or evidence that the threat actor has destroyed, refrained from disseminating, or refrained from using the data. The threat actor's identity is unknown, and no communication or demand has been received from the threat actor that would provide any basis for concluding that the data is no longer in the threat actor's possession or has not been further disseminated. Under these circumstances, the risk to the PHI cannot be considered meaningfully mitigated.
Assessment: This factor weighs in favor of a finding that the PHI has been compromised. The exfiltrated data remains in the possession of an unknown criminal actor, and the risk of misuse has not been effectively mitigated.
Conclusion of Four-Factor Risk Assessment
The four-factor risk assessment required under 45 C.F.R. § 164.402(2) does not support a finding of low probability that the PHI has been compromised. All four factors weigh in favor of notification. The presumption of breach has not been rebutted. Accordingly, the impermissible acquisition and disclosure of PHI in connection with the Palomar data security incident constitutes a reportable breach of unsecured PHI under HIPAA, and breach notification obligations under 45 C.F.R. Part 164, Subpart D are triggered.
D. "Unsecured PHI" Analysis
The breach notification obligations under HIPAA apply only to breaches of "unsecured PHI" — that is, PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary of HHS. See 45 C.F.R. § 164.402 (definition of "unsecured protected health information"); see also HHS, Guidance Specifying the Technologies and Methodologies that Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, 74 Fed. Reg. 19,006 (Apr. 27, 2009). The two methods identified in the HHS guidance are (1) encryption consistent with NIST standards, and (2) destruction (e.g., shredding of paper records or clearing, purging, or destroying electronic media consistent with NIST Special Publication 800-88).
The exfiltrated data was stored in structured data files — including database exports, CSV files, and flat files — on Palomar's systems, specifically within Palomar's file transfer staging environment. Graystone's forensic findings confirm that the data in the file transfer staging environment was not encrypted at rest. While certain data in other portions of Palomar's infrastructure may have been subject to encryption, the specific files that were staged and exfiltrated from the file transfer environment were stored in plaintext, unencrypted format.
Accordingly, the PHI at issue qualifies as "unsecured PHI" within the meaning of 45 C.F.R. § 164.402, and is fully subject to the breach notification requirements of Subpart D.
IV. Notification Obligations
A. Notification to Individuals (45 C.F.R. § 164.404)
1. Timing. Under 45 C.F.R. § 164.404(b), a covered entity must provide written notification to each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of a breach. The notification must be provided without unreasonable delay and in no case later than 60 calendar days from the date of discovery of the breach.
The "date of discovery" of a breach is defined under 45 C.F.R. § 164.404(a)(2) as the first day on which the breach is known or, by exercising reasonable diligence, would have been known to the covered entity or, in the case of a breach at a business associate, to the business associate. Under 45 C.F.R. § 164.410(b), a business associate's discovery of a breach is imputed to the covered entity for purposes of triggering the covered entity's notification obligations. In other words, the 60-day clock begins running from the date the business associate knew or should have known of the breach, not from the date the covered entity received notification from the business associate.
Applying these principles to the facts of this incident:
• Palomar's SOC detected anomalous outbound data transfers on April 18, 2023. This date constitutes the earliest point at which the breach was or should have been known to the business associate.
• Palomar notified Quorum on April 21, 2023 — three days after Palomar's initial detection.
• Under the imputation rule of § 164.410(b), the date of April 18, 2023 (Palomar's discovery date) is imputed to Quorum as the date of discovery for purposes of the 60-day notification clock.
• Applying the strict 60-day calculation from April 18, 2023, the outer deadline for individual notifications would be June 17, 2023.
This presents a timing challenge. The data mining process necessary to identify all 41,203 affected individuals whose PHI was compromised was not completed until August 4, 2023 — approximately seven weeks after the June 17 deadline calculated from Palomar's discovery date. The individual notification letters are planned for mailing beginning August 18, 2023. Under a strict reading of the 60-day-from-discovery rule, the notifications would be past due.
However, the 60-day period established by § 164.404(b) is a maximum outer limit; the operative standard is that notification must be provided "without unreasonable delay." HHS has acknowledged in regulatory preamble and guidance that the obligation to notify without unreasonable delay must be understood in context: a covered entity must exercise reasonable diligence in investigating the breach and identifying affected individuals, and the time required for a good-faith forensic investigation does not necessarily constitute "unreasonable delay," even if the investigation extends beyond the 60-day period measured from the business associate's initial detection of anomalous activity.
In this case, the following facts support the reasonableness of the notification timeline:
• Calderwood & Harkness was retained promptly upon Quorum's receipt of Palomar's notification. Graystone Forensics was engaged on May 5, 2023 — approximately two weeks after Quorum first learned of the incident. This timeline reflects prompt action by Quorum and its counsel.
• Graystone's forensic investigation was conducted with reasonable diligence and proceeded through the issuance of the Final Forensic Report on July 14, 2023. The investigation required analysis of network traffic logs, file access records, data transfer artifacts, and the parsing and analysis of the exfiltrated data to determine the specific individuals and data elements affected.
• The data mining process — necessary to identify the 41,203 individuals within the PHI subset — was completed on August 4, 2023. This process involved cross-referencing structured data files against Quorum's records, deduplicating individual records, and classifying data by category (PII, PHI, financial information) to ensure accurate identification and appropriate notification content.
• Throughout this period, Quorum and its counsel acted with diligence, maintained ongoing communications with Palomar regarding the investigation, and coordinated with Clearfield Notification Services LLC regarding notification logistics.
We recommend that Quorum thoroughly document the timeline of diligent investigation efforts to support the reasonableness of the notification timeline should HHS-OCR inquire regarding the timing of notifications. A chronological log of key investigation milestones, decisions, and communications should be maintained in the privileged investigation file.
Alternative Date-of-discovery Analysis. There is a reasonable basis for an alternative interpretation of the "date of discovery" that yields a more favorable timeline. Under § 164.404(a)(2), the date of discovery is the first day on which the breach "is known" to the covered entity. HHS has indicated that a covered entity is deemed to have knowledge of a breach when it knows, or by exercising reasonable diligence would have known, that a breach has occurred. Before the completion of Graystone's forensic investigation, Quorum knew that a security incident had occurred at Palomar, but did not yet have confirmation that the incident constituted a reportable breach of PHI. The four-factor risk assessment required under § 164.402(2) could not be meaningfully completed — and the determination that a reportable breach had occurred could not be made — until the Graystone Final Forensic Report was issued on July 14, 2023, which provided the factual basis necessary to assess the nature and extent of the PHI compromised, confirm that data was actually acquired, and evaluate the factors bearing on the probability of compromise.
If the date of discovery is measured from the date the breach was identified as a reportable breach — i.e., when the four-factor risk assessment was completed and the scope of PHI compromise was confirmed — then the relevant discovery date is July 14, 2023, and the 60-day deadline would be September 12, 2023. Under this analysis, the planned mailing window of August 18 through September 15, 2023 falls largely within the 60-day period, with the bulk of notifications issued well before the September 12 deadline.
Recommendation: We recommend that Quorum adopt the position that the date of discovery for individual notification purposes is July 14, 2023 — the date of the Graystone Final Forensic Report that confirmed the scope and nature of the PHI compromise and provided the factual predicate for the four-factor risk assessment and breach determination. This yields a 60-day deadline of September 12, 2023. The planned notification mailing window of August 18 through September 15, 2023 falls largely within this period, and the initial mailings will be completed well in advance of the September 12 deadline. To the extent that any notifications are mailed after September 12 (i.e., during the tail end of the September 15 mailing window), we recommend documenting the operational justification for any marginal delay and the continuous diligence exercised throughout the process.
In the event HHS-OCR adopts the position that the date of discovery was April 18, 2023 (Palomar's detection date), we would argue that the delay was not "unreasonable" in light of the complexity of the forensic investigation, the diligence exercised by Quorum and its counsel, and the need to accurately identify affected individuals before notification could be provided. HHS has recognized in enforcement guidance that the 60-day period may be extended where a covered entity is acting in good faith and with reasonable diligence to investigate a potential breach.
2. Content Requirements (45 C.F.R. § 164.404(c))
The individual breach notification must include, to the extent possible, the following elements as set forth in 45 C.F.R. § 164.404(c)(1):
(A) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known.
(B) A description of the types of unsecured PHI that were involved in the breach, such as whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved. In this case, the description should reference: health conditions, diagnosis codes (ICD codes), treatment information from workers' compensation and health-related insurance claims, names, dates of birth, Social Security numbers, and driver's license numbers.
(C) Any steps individuals should take to protect themselves from potential harm resulting from the breach. This should include guidance regarding monitoring of Explanation of Benefits ("EOB") statements for unauthorized medical claims, monitoring of credit reports and financial account statements, and reporting of any suspicious activity to applicable authorities.
(D) A brief description of what the covered entity is doing to investigate the breach, to mitigate losses, and to protect against any further breaches. This should reference the forensic investigation, containment measures, vendor remediation, and the offer of complimentary credit monitoring and identity theft protection services.
(E) Contact procedures, including a toll-free telephone number, an email address, a website, or a postal address that the individual may use to ask questions or learn additional information.
The PHI-specific consumer notification letter is being prepared under a separate work stream (referenced as consumer-notification-letter-phi.docx) and must incorporate all of the above content elements. We recommend that the notification letter include the following additional information:
• A reference to the 24-month complimentary credit monitoring and identity theft protection services being offered to all affected individuals through Clearfield Notification Services LLC, including enrollment instructions and an activation code.
• The toll-free call center number operated by Clearfield Notification Services LLC, staffed with agents trained to respond to inquiries from affected individuals regarding the incident and the remediation services being offered.
• Appropriate language regarding medical identity theft risks, given that the compromised data includes health-related information. Affected individuals should be advised to review their medical records and EOB statements for signs of unauthorized use of their health insurance benefits and to report any discrepancies to their health plan and to law enforcement.
The notification letter will be reviewed and approved by Calderwood & Harkness prior to finalization and submission to Clearfield for printing and mailing.
3. Method of Notification
Under 45 C.F.R. § 164.404(d)(1), the primary method of individual notification is written notification by first-class mail to the last known address of the affected individual. The notification may alternatively be provided by email if the individual has agreed to receive electronic notice.
For the 41,203 PHI-affected individuals, notification will be sent by first-class mail through Clearfield Notification Services LLC, which is managing the printing, mailing, and tracking of all consumer notification letters across the broader 318,247-individual notification program.
For individuals whose contact information is insufficient or out of date — for example, where notification letters are returned as undeliverable — substitute notice is required under 45 C.F.R. § 164.404(d)(2). The form of substitute notice depends on the number of individuals for whom contact information is insufficient:
• If fewer than 10 individuals have insufficient contact information, substitute notice may be provided by an alternative form of written notice, telephone, or other means.
• If 10 or more individuals have insufficient contact information, substitute notice must consist of either: (i) a conspicuous posting on the home page of the covered entity's website for a period of 90 consecutive days, or (ii) a conspicuous notice in major print or broadcast media in the geographic areas where the affected individuals likely reside. In either case, the notice must include a toll-free telephone number that remains active for at least 90 days.
We are coordinating with Clearfield regarding address verification and undeliverable mail procedures. Substitute notice language and website posting content are being prepared separately and will be provided for review.
B. Notification to the Secretary of HHS (45 C.F.R. § 164.408)
1. Timing — Breaches Affecting 500 or More Individuals
Under 45 C.F.R. § 164.408(b), for breaches of unsecured PHI affecting 500 or more individuals, the covered entity must provide notification to the Secretary of HHS contemporaneously with the individual notifications required under § 164.404, and without unreasonable delay and in no case later than 60 days from the date of discovery of the breach.
The PHI subset in this incident includes 41,203 individuals — well in excess of the 500-person threshold. Accordingly, this is a "large breach" subject to the contemporaneous reporting requirement, and notification to the Secretary cannot be deferred to an annual log submission (which is the alternative procedure applicable to breaches affecting fewer than 500 individuals under § 164.408(c)).
Recommendation: We recommend that Quorum file the HHS-OCR breach notification on or before August 15, 2023, in advance of the consumer notification mailing beginning August 18, 2023. Filing prior to the commencement of individual notifications ensures compliance with the "contemporaneous" requirement and demonstrates proactive engagement with HHS-OCR.
2. Method of Notification
Notification to the Secretary of HHS is filed electronically via the HHS Breach Notification Portal, accessible at https://ocrportal.hhs.gov/ocr/breach/wizard_breach.jsf. The portal provides a structured online submission form that collects the required information about the breach.
The portal submission requires the following information:
• Name and contact information of the covered entity
• Name and contact information of any business associate involved in the breach
• Approximate number of individuals affected
• Date of the breach
• Date of discovery of the breach
• Type of breach (e.g., unauthorized access/disclosure, theft, loss, improper disposal, hacking/IT incident)
• Location of breached information (e.g., network server, email, paper, laptop, desktop computer, electronic medical record, portable electronic device)
• Description of the types of PHI involved in the breach
• Description of safeguards in place prior to the breach
• Actions taken in response to the breach
Upon submission, the breach will be recorded in the HHS Breach Portal. For breaches affecting 500 or more individuals, the breach is publicly posted on the HHS Breach Portal public listing — commonly referred to as the "Wall of Shame" — which is searchable by the public. The public listing includes the name of the covered entity, the state, the number of individuals affected, the type of breach, and the date of the report.
Based on Quorum's headquarters location in Hartford, Connecticut, the assigned investigative office within HHS-OCR is Region I (Boston), which covers Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, and Vermont. Any follow-up inquiries or compliance reviews initiated by OCR in connection with this breach would likely be managed by Region I.
3. Content of HHS-OCR Notification
We recommend that the HHS-OCR portal submission include the following information:
• Covered Entity: Quorum Insurance Holdings Corp., 400 Constitution Plaza, Suite 2200, Hartford, CT 06103; EIN 06-4832197
• Contact Person: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp.; with outside counsel contact: Kevin Ostrowski, Partner, Calderwood & Harkness LLP
• Business Associate Involved: Palomar Data Solutions, Inc., 7100 Greenville Avenue, Suite 450, Dallas, TX 75231
• Date of Breach: March 14, 2023 (date of initial unauthorized access by the threat actor)
• Date of discovery: April 18, 2023 (date Palomar's SOC first detected anomalous outbound data transfers); alternatively, July 14, 2023 (date of Graystone Final Forensic Report confirming PHI scope and completing the factual predicate for the four-factor risk assessment — consistent with the recommended position outlined in Section IV.A.1 above)
• Approximate Number of Individuals Affected: 41,203
• Type of Breach: Unauthorized access/disclosure — Hacking/IT Incident — Network Server
• Types of PHI Involved: Health conditions, diagnosis codes (ICD codes), treatment information derived from workers' compensation and health-related insurance claims, combined with identifying information including full names, dates of birth, Social Security numbers, and driver's license numbers
• Safeguards in Place Prior to the Breach: Reference to Quorum's enterprise information security program, vendor risk management program (overseen by Priya Deshmukh, VP, Vendor Risk Management), BAA with Palomar (Exhibit D of MSA, as amended), and vendor oversight measures including the SOC 2 Type II audit requirement added by MSA Amendment 2 (September 15, 2022). The PHI at issue was held by the business associate (Palomar) and was subject to the security controls and obligations set forth in the MSA and BAA.
• Actions Taken in Response to the Breach: Engagement of Calderwood & Harkness LLP as outside breach counsel; retention of Graystone Forensics LLC to conduct independent forensic investigation under attorney-client privilege; coordination with Palomar on containment and remediation; notification to affected individuals; offer of 24-month complimentary credit monitoring and identity theft protection services through Clearfield Notification Services LLC; pursuit of vendor accountability measures including indemnification and enhanced security requirements; notification to applicable state regulators and attorneys general; media notice as required by HIPAA and applicable state law.
The portal submission will be prepared by Calderwood & Harkness and reviewed by Kevin Ostrowski prior to filing. We will coordinate with Quorum's legal department to obtain any necessary authorizations before submission.
C. Notification to Prominent Media Outlets (45 C.F.R. § 164.406)
1. Trigger. Under 45 C.F.R. § 164.406(a), a covered entity must provide notice to prominent media outlets serving a state or jurisdiction if a breach of unsecured PHI affects more than 500 residents of that state or jurisdiction.
In this case, the PHI subset includes 41,203 individuals across 29 states and the District of Columbia. The total affected population (across all data categories, not limited to PHI) includes significant concentrations in Connecticut (52,114), New York (47,831), California (38,206), Texas (29,477), Florida (22,913), Pennsylvania (18,640), Illinois (16,502), New Jersey (14,388), Ohio (11,743), and Massachusetts (10,217). While the state-by-state breakdown of the 41,203-individual PHI subset has not yet been finalized, given the overall geographic distribution of the affected population and the substantial total PHI count, it is highly probable that the PHI-affected population exceeds 500 residents in multiple states.
Conclusion: The media notice obligation under § 164.406 is triggered for at least those states where the PHI-affected population exceeds 500 residents. We will finalize the state-by-state PHI count upon completion of the data mining analysis and identify the specific states for which media notice is required.
2. Timing and Method
Media notice must be provided without unreasonable delay and no later than 60 days from the date of discovery of the breach. The notice must be provided to "prominent media outlets" serving the affected state or jurisdiction. HHS has not defined "prominent media outlets" with specificity, but the term is generally understood to encompass major newspapers, television stations, wire services, and other media organizations with broad reach in the applicable geographic area.
Recommendation: We recommend preparing and distributing the media notice concurrently with the HHS-OCR notification, targeting August 15, 2023. Distribution should be coordinated with BrightPath Consulting Group Inc. (Meredith Ashford, Managing Director), which is managing the overall crisis communications strategy for this incident. BrightPath can identify the appropriate media outlets for each affected state and manage the distribution of the media notice consistent with the broader communications plan.
3. Content. The media notice must include the same content elements required for individual notifications under 45 C.F.R. § 164.404(c), as described in Section IV.A.2 above. The notice should be drafted in a brief, factual format consistent with press release or public notice conventions. The media notice should include:
• A description of the incident, including the approximate dates of the breach and discovery
• A description of the types of PHI involved
• Steps individuals should take to protect themselves
• A description of the actions Quorum is taking in response to the breach
• Contact information, including the toll-free call center number operated by Clearfield Notification Services LLC
The media notice will be prepared by Calderwood & Harkness in coordination with BrightPath and reviewed by Kevin Ostrowski prior to distribution.
D. Business Associate Notification Obligations (45 C.F.R. § 164.410)
Under 45 C.F.R. § 164.410(a), a business associate is required to notify the covered entity of a breach of unsecured PHI without unreasonable delay and in no case later than 60 days from the date of discovery of the breach. The business associate must identify each individual whose unsecured PHI has been, or is reasonably believed to have been, breached, and provide such identification to the covered entity.
In this case, Palomar's SOC discovered the anomalous outbound data transfers on April 18, 2023, and Palomar notified Quorum on April 21, 2023 — three days after discovery. This notification was well within the HIPAA 60-day window.
However, the contractual notification requirement under MSA Section 9.4 — which requires Palomar to notify Quorum of any suspected or confirmed security incident within 48 hours of discovery — was not met. Palomar's notification on April 21, 2023, was provided approximately 72 hours after the April 18 SOC detection, which is approximately 24 hours beyond the 48-hour contractual window. While this contractual breach does not affect the HIPAA analysis (HIPAA requires only 60-day notice from the business associate), it is relevant to Quorum's contractual remedies and indemnification claims against Palomar, which are being analyzed separately.
The HIPAA notification obligation runs from the business associate to the covered entity; Quorum's downstream notification obligations — to individuals, HHS-OCR, and media — are not dependent on receipt of notification from Palomar but are triggered by the date of discovery, which is imputed from the business associate. As discussed in Section IV.A.1 above, the imputation of Palomar's April 18 discovery date to Quorum creates the 60-day clock for Quorum's notification obligations, regardless of any delay in Palomar's notification to Quorum. Palomar's compliance or non-compliance with its HIPAA or contractual notification obligations does not constitute a defense to Quorum's own notification obligations.
V. Interaction with State Breach Notification Obligations
The HIPAA breach notification requirements operate in parallel with, and do not preempt, state breach notification laws. Under HIPAA's general preemption framework (45 C.F.R. § 160.203), HIPAA preempts contrary state laws, but state laws that are "more stringent" than the HIPAA requirements are not preempted. State breach notification laws, to the extent they impose requirements that are more protective of individuals' privacy or that impose additional obligations not addressed by HIPAA, remain fully applicable.
The 41,203 PHI-affected individuals are a subset of the broader 318,247-individual affected population for whom state breach notifications are being prepared under the applicable breach notification laws of the 29 affected states and the District of Columbia. The state notification analysis is being conducted under a separate workstream and is addressed in the following companion memoranda:
• 50-State Breach Notification Law Survey (dated June 8, 2023) — comprehensive survey of applicable state breach notification statutes, including triggering data elements, notification timing, content requirements, and regulatory filing obligations.
• Notification Trigger Analysis Memo (dated July 20, 2023) — analysis of which state breach notification laws are triggered by the specific categories of data compromised in this incident.
• State-by-State Notification Timeline & Content Requirements Matrix (dated August 1, 2023) — detailed matrix setting forth the notification deadlines, content requirements, regulatory filing requirements, and substitute notice provisions for each affected state.
For the 41,203 PHI-affected individuals, the individual notification letter must satisfy both HIPAA's content requirements under 45 C.F.R. § 164.404(c) and the applicable state-specific content requirements for each individual's state of residence. Where state requirements impose content elements beyond those required by HIPAA (e.g., specific statutory references, identity theft prevention information, credit freeze instructions, state attorney general contact information), the notification letter must incorporate those additional elements.
We recommend preparing the PHI-specific notification letter as a combined notice that satisfies both the HIPAA requirements and the applicable state requirements. This approach minimizes the risk of non-compliance with either regime and avoids the need for separate HIPAA and state notification mailings to the same individual. The combined letter is being prepared by Calderwood & Harkness in coordination with Clearfield Notification Services LLC and will be produced in state-specific versions as necessary to accommodate state-by-state content variations.
VI. Applicable Exceptions and Defenses
A. Encryption Exception
Under 45 C.F.R. § 164.402, the HIPAA breach notification requirements apply only to "unsecured PHI" — PHI that has not been rendered unusable, unreadable, or indecipherable to unauthorized persons through encryption or destruction consistent with HHS guidance. If the PHI at issue had been encrypted in accordance with NIST standards at the time of the exfiltration, the encryption safe harbor would apply, and the incident would not trigger HIPAA breach notification obligations regardless of the four-factor risk assessment.
This exception is not applicable. As confirmed by the Graystone forensic analysis, the exfiltrated data was stored in structured data files (database exports, CSV/flat files) in the file transfer staging environment on Palomar's systems and was not encrypted at rest in that environment. There is no basis for invoking the encryption safe harbor.
B. Unintentional Acquisition Exception (45 C.F.R. § 164.402(1)(i))
Section 164.402(1)(i) provides that certain unintentional acquisitions, accesses, or uses of PHI by employees or persons acting under the authority of a covered entity or business associate are excluded from the definition of "breach," provided the acquisition, access, or use was made in good faith and within the scope of authority, and the PHI is not further used or disclosed in an impermissible manner.
This exception is not applicable. The incident at issue was a deliberate, criminal hacking incident involving the exploitation of a known software vulnerability by an external threat actor. The unauthorized acquisition was not an inadvertent access by an employee or authorized person acting in good faith within the scope of authority. There is no basis for invoking this exception.
C. Law Enforcement Delay (45 C.F.R. § 164.412)
Under 45 C.F.R. § 164.412, a covered entity or business associate may delay breach notification if a law enforcement official determines that notification, notice, or posting would impede a criminal investigation or cause damage to national security. The covered entity must delay notification for the time period specified by the law enforcement official, provided such request is made in writing or, if made orally, is documented in writing by the covered entity within 30 days.
No law enforcement request to delay notification has been received as of the date of this memorandum. Neither the Federal Bureau of Investigation, the U.S. Secret Service, nor any other law enforcement agency has contacted Quorum, Palomar, or Calderwood & Harkness to request a delay in notification. If any law enforcement engagement arises and a delay request is made, we will advise the team immediately and assess the applicable requirements under § 164.412.
VII. Recommended Actions and Timeline
Based on the analysis set forth in this memorandum, we recommend that Quorum proceed with the following actions on the timeline specified below: