PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
PREPARED AT THE DIRECTION OF COUNSEL IN ANTICIPATION OF LITIGATION — DO NOT DISTRIBUTE WITHOUT PRIOR AUTHORIZATION OF CALDERWOOD & HARKNESS LLP
July 20, 2023
MEMORANDUM
FROM: Alan Burke, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp.
CC: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
RE: Notification Trigger Analysis — Palomar Data Solutions Security Incident — State-by-State Assessment
MATTER NO.: 1025-00006
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to provide a definitive analysis of which state breach notification statutes are triggered as a result of the security incident involving Palomar Data Solutions, Inc. ("Palomar"), based on the specific data elements confirmed compromised in the final forensic report prepared by Graystone Forensics LLC ("Graystone") and delivered to Calderwood & Harkness LLP ("Calderwood & Harkness" or "the Firm") on July 14, 2023 (the "Final Forensic Report"). This memorandum assesses the applicability of each relevant state breach notification statute and provides a consolidated analysis of notification obligations, timing requirements, content requirements, and regulatory filing requirements across all affected jurisdictions.
Core Conclusion. Based on our analysis, notification obligations are triggered in all twenty-nine (29) states where affected individuals reside, plus the District of Columbia, encompassing a total of 318,247 affected individuals. No encryption safe harbor, risk-of-harm exemption, or other statutory exception is available to relieve Quorum Insurance Holdings Corp. ("Quorum" or the "Company") of its notification obligations in any of these jurisdictions.
The Final Forensic Report confirmed that the following categories of data elements were compromised as a result of the unauthorized access and exfiltration:
(a) Personally Identifiable Information ("PII") — including full names, dates of birth, Social Security numbers ("SSNs"), and driver's license numbers — was compromised for all 318,247 affected individuals.
(b) Financial Information — including bank account numbers and payment card numbers — was compromised for a subset of 84,619 individuals.
(c) Protected Health Information ("PHI") — including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims — was compromised for a subset of 41,203 individuals.
Because Social Security numbers were compromised for all 318,247 affected individuals, and because every affected jurisdiction defines "personal information" to include the combination of an individual's name and SSN, notification is triggered in every affected jurisdiction regardless of whether additional data elements (financial information or PHI) were also exposed for a given individual. The financial data and PHI subsets do, however, create additional content requirements in certain states, necessitate additional regulatory notification obligations, and will require the preparation of multiple notification letter versions.
This memorandum does not address the following topics, which are addressed in separate privileged memoranda:
• HIPAA Breach Notification Rule obligations arising from the PHI subset (addressed in the HIPAA Breach Notification Analysis Memo dated July 22, 2023);
• Connecticut Insurance Data Security Law obligations under Conn. Gen. Stat. § 38a-999b (addressed in a separate memorandum dated July 22, 2023); and
• Federal financial privacy law considerations, including the Gramm-Leach-Bliley Act.
This memorandum incorporates and builds upon the analytical framework established in the Firm's comprehensive 50-State Breach Notification Law Survey prepared on June 8, 2023, which serves as the foundational reference for the jurisdiction-specific analyses set forth herein. Additional jurisdiction-specific memoranda addressing New York SHIELD Act compliance (July 23, 2023) and California CCPA/CMIA notification obligations (July 24, 2023) will provide deeper treatment of those jurisdictions.
II. Background
A. The Incident
On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a known remote code execution vulnerability in Palomar Data Solutions, Inc.'s GoAnywhere MFT file transfer appliance, to gain unauthorized access to Palomar's network environment. CVE-2023-0669 was publicly disclosed in early February 2023 and was widely exploited by threat actors during the first quarter of 2023. Palomar, a third-party claims processing vendor retained by Quorum to process and administer certain categories of insurance claims, utilized the GoAnywhere MFT platform to receive, process, and transmit structured data files containing Quorum policyholder and claimant information.
Following initial access, the threat actor engaged in lateral movement within Palomar's network, ultimately gaining access to Palomar's claims processing environment where Quorum data was stored and processed. Data exfiltration occurred over an approximately thirty-five (35) day window, from March 14 through April 18, 2023. During this period, the threat actor systematically identified and exfiltrated structured data files containing policyholder and claimant records belonging to Quorum.
Palomar's Security Operations Center ("SOC") first discovered anomalous outbound data transfers on April 18, 2023, at which point Palomar initiated its own internal incident response procedures and engaged its external cybersecurity counsel. Palomar formally notified Quorum of the incident on April 21, 2023, via email communication from Derek Copeland, General Counsel of Palomar, to Thomas R. Whitfield, General Counsel of Quorum, and David Naranjo, Chief Information Security Officer of Quorum. The notification email confirmed that Palomar had identified unauthorized access to its network and that data belonging to Quorum may have been compromised, but did not at that time provide specific information regarding the scope or nature of the data involved.
Upon receipt of Palomar's notification, Quorum activated its internal incident response plan and promptly engaged external counsel. Calderwood & Harkness was formally engaged by Quorum on May 4, 2023, to provide legal advice and guidance regarding the incident, including analysis of Quorum's notification and regulatory obligations. On May 5, 2023, at the direction of Calderwood & Harkness, Quorum retained Graystone Forensics LLC to conduct a comprehensive forensic investigation of the incident under the protection of the attorney-client privilege and work product doctrine. Graystone was retained through Calderwood & Harkness to preserve the privileged nature of the forensic investigation and its findings.
B. Forensic Findings Summary
Graystone's forensic investigation proceeded in two phases. The preliminary findings report, delivered on June 2, 2023, confirmed that data exfiltration had occurred and that the exfiltrated data included structured data files from Palomar's claims processing environment containing Quorum policyholder and claimant records. The preliminary findings provided an initial estimate of the scope of the compromise but did not provide a definitive count of affected individuals or a complete enumeration of compromised data elements.
Graystone's Final Forensic Report, dated July 14, 2023, and prepared by Dr. Nolan Briggs, Principal Forensic Analyst, and Kendra Faulkner, Senior Forensic Investigator, confirmed the full scope of the compromise. The Final Forensic Report's principal findings are summarized as follows:
• Total Affected Individuals: 318,247 unique individuals across twenty-nine (29) states and the District of Columbia.
• PII Compromised (All Affected Individuals): Full names, dates of birth, Social Security numbers, and driver's license numbers were compromised for all 318,247 affected individuals. These data elements were contained in structured claims processing files that included policyholder and claimant identification records.
• Financial Information Compromised (Subset): Bank account numbers and payment card numbers were compromised for a subset of 84,619 individuals. These data elements were contained in claims payment files and policyholder payment records processed through Palomar's system.
• PHI Compromised (Subset): Health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims were compromised for a subset of 41,203 individuals. These data elements were contained in structured claims adjudication files that included medical and clinical information necessary for claims processing.
Many individuals appear in more than one of the above categories; for example, an individual whose workers' compensation claim was processed through Palomar may have had PII, financial information, and PHI compromised simultaneously. The total unique affected individual count, after deduplication, remains 318,247.
Data mining and affected individual identification — the process of linking specific compromised data elements to specific named individuals and their current mailing addresses — is currently underway and is expected to be completed by approximately August 4, 2023. Upon completion of data mining, Quorum will have the specific information necessary to determine which notification letter version each individual should receive, and the per-state affected individual counts currently estimated from Graystone's data sampling methodology will be confirmed with precision.
C. Scope of This Memo
This memorandum analyzes the notification trigger under each applicable state breach notification statute based on the specific data elements confirmed compromised in the Final Forensic Report. The analysis proceeds in three stages: (1) a general analytical framework applicable to all jurisdictions; (2) a detailed jurisdiction-by-jurisdiction analysis for the ten states with the largest affected populations; and (3) a summary analysis for the remaining nineteen states and the District of Columbia.
As noted above, this memorandum does not address HIPAA Breach Notification Rule obligations (which are addressed in the HIPAA Breach Notification Analysis Memo dated July 22, 2023), Connecticut Insurance Data Security Law obligations under Conn. Gen. Stat. § 38a-999b (addressed in a separate memorandum dated July 22, 2023), or federal financial privacy law considerations. This memorandum incorporates the analytical framework established in the 50-State Breach Notification Law Survey (June 8, 2023), the NY SHIELD Act Compliance Memo (July 23, 2023), and the California CCPA/CMIA Notification Analysis Memo (July 24, 2023), each of which provides deeper treatment of the respective jurisdictions.
III. Analytical Framework — State Breach Notification Trigger Elements
A. Common Statutory Elements
All fifty states, the District of Columbia, and U.S. territories have enacted breach notification statutes requiring entities that own, license, or maintain computerized personal information to provide notification to affected individuals when a "breach of security" or "unauthorized acquisition" of such information occurs. While these statutes vary in their specific language, definitions, and procedural requirements, they share a common analytical framework consisting of three principal elements that must be satisfied to trigger the notification obligation:
1. Breach of Security / Unauthorized Acquisition. The first element requires that a "breach of security," "security breach," or "unauthorized acquisition of" or "unauthorized access to" computerized data has occurred. States define this event variously — some focus on "unauthorized acquisition" (requiring actual acquisition of data by an unauthorized person), while others use broader formulations such as "unauthorized access to" or "unauthorized disclosure of" data. In this matter, the Final Forensic Report confirms that an external threat actor gained unauthorized access to Palomar's network and affirmatively exfiltrated structured data files containing Quorum policyholder and claimant data. This conduct satisfies the "breach of security" or "unauthorized acquisition" element under every applicable state statute, including those with narrower definitions requiring actual acquisition (as opposed to mere access).
2. Compromise of "Personal Information." The second element requires that the breach involved "personal information" as defined by the applicable state statute. The definition of "personal information" varies by jurisdiction, but virtually all states define it to include an individual's name in combination with one or more specified data elements (SSN, driver's license number, financial account number, and, in a growing number of states, medical or health information). The specific data elements compromised here — SSNs, driver's license numbers, financial account numbers, and medical information — satisfy the "personal information" definition in every affected jurisdiction, as discussed in detail in Section III.B below.
3. Absence of an Applicable Safe Harbor. The third element requires that no applicable safe harbor exempts the entity from the notification obligation. The most common safe harbor is the encryption safe harbor, under which notification is not required if the compromised data was encrypted and the encryption key was not also compromised. Other safe harbors include risk-of-harm exemptions and good-faith acquisition exceptions. As discussed in Sections III.C and III.D below, no safe harbor or exemption applies in this matter.
Because all three elements are satisfied in every affected jurisdiction, notification is required across all twenty-nine states with affected residents and the District of Columbia. The balance of this Section III addresses the specific application of each element to the facts of this incident.
B. "Personal Information" Definitions — Triggering Data Elements
Nearly all state breach notification statutes define "personal information" as an individual's first name or initial, and last name, in combination with one or more of the following data elements, when the name and data element are not encrypted or redacted:
(a) Social Security number. Included in the definition of "personal information" in all fifty states and D.C. Because SSNs were compromised for all 318,247 affected individuals, the "name + SSN" combination independently triggers notification in every affected jurisdiction, without regard to whether any other data element was also compromised.
(b) Driver's license number or state identification card number. Included in the definition of "personal information" in all fifty states and D.C. Because driver's license numbers were compromised for all 318,247 affected individuals, the "name + driver's license number" combination provides a secondary, independent trigger in every affected jurisdiction.
(c) Financial account number, credit card number, or debit card number (in some states, with required access codes, passwords, or security codes; in other states, without requiring access codes). Financial account numbers and payment card numbers were compromised for a subset of 84,619 individuals. This data element constitutes an independent trigger in all affected jurisdictions for the individuals in this subset. In certain states, the presence of financial data triggers enhanced content requirements in the notification letter, such as specific guidance regarding financial account monitoring, account closure, and fraud alerts.
(d) Medical information and/or health insurance information. A growing number of states have amended their breach notification statutes to include medical information, health insurance information, or both in the definition of "personal information." States that include medical or health information in their definitions include, among others, California, Connecticut, Illinois, Florida, Texas, Virginia, Maryland, Oregon, Colorado, and North Carolina. For the 41,203-individual PHI subset, the medical information component independently triggers notification in those states that include it in their definitions. In states that do not include medical information in their definitions, the SSN and driver's license number combinations already trigger the notification obligation for the same individuals, so the practical effect is that notification is triggered for the PHI subset in every affected jurisdiction.
In summary, because SSNs were compromised for all 318,247 affected individuals, the core notification trigger is satisfied in every affected jurisdiction. The additional data elements (financial information and PHI) create independent, overlapping triggers in many jurisdictions and generate additional compliance obligations — particularly with respect to notification content and regulatory filings — but they do not expand the universe of jurisdictions in which notification is required beyond those already triggered by the SSN compromise.
C. Encryption Safe Harbor
The encryption safe harbor is the most widely applicable exemption under state breach notification statutes. Under this safe harbor, notification is generally not required if the compromised data was encrypted using a method that renders the data unusable, unreadable, or indecipherable to unauthorized individuals, provided that the encryption key was not also compromised in the same breach.
Based on the findings in Graystone's Final Forensic Report, the exfiltrated data files were not encrypted at rest or in transit at the time of the exfiltration. Palomar stored Quorum claims processing data in structured data files (including flat files, CSV files, and database extracts) without encryption. The data was stored in plaintext on Palomar's claims processing servers, and the exfiltration by the threat actor transferred these files in their unencrypted state. Graystone's investigation confirmed that no file-level or field-level encryption was applied to the compromised data, and that the data was fully readable and usable in its exfiltrated form.
Accordingly, the encryption safe harbor is inapplicable in every affected jurisdiction. No state encryption exemption relieves Quorum of its notification obligations, and notification is required in all triggered jurisdictions. Calderwood & Harkness notes that the absence of encryption on sensitive data stored by a third-party vendor is a matter that may be relevant to Quorum's potential vendor management liability and is addressed in a separate memorandum regarding Quorum's vendor oversight obligations under applicable state data security laws.
D. Risk-of-Harm / Good-Faith Acquisition Exceptions
Several states incorporate additional exemptions or analytical steps into their breach notification statutes, the two most common of which are the "risk-of-harm" exemption and the "good-faith acquisition" exception.
Risk-of-Harm Exemption. Certain states — including, for example, Michigan, Wisconsin, and Ohio — permit an entity to forego notification if, after an appropriate investigation, the entity determines that the breach is "not reasonably likely to result in identity theft," "substantial harm," or other adverse consequences to the affected individuals. Calderwood & Harkness has carefully considered whether a risk-of-harm exemption could reasonably be claimed in any jurisdiction and concludes that it cannot. The breadth and sensitivity of the data compromised — including Social Security numbers, financial account numbers, and medical information — combined with the nature of the incident (deliberate exfiltration by an external threat actor employing a known vulnerability) makes it untenable to assert that the breach is not reasonably likely to result in harm. SSNs are the single most critical data element for identity theft, and their exposure in combination with names, dates of birth, and driver's license numbers creates a significant and well-documented risk of identity fraud. Moreover, several states that provide risk-of-harm exemptions require that the entity document its analysis and submit it to the state Attorney General, creating additional regulatory risk if the exemption is claimed and subsequently challenged.
Good-Faith Acquisition Exception. Some states provide an exception when personal information is acquired in good faith by an employee or agent of the entity and the information is used for a lawful purpose of the entity. This exception is categorically inapplicable here because the threat actor was an external, unauthorized individual who exploited a software vulnerability to gain access to Palomar's network. There is no basis for asserting that the acquisition of data was in "good faith" or by an employee or agent acting within the scope of employment.
In light of the foregoing, Calderwood & Harkness concludes that no risk-of-harm exemption, good-faith acquisition exception, or other statutory safe harbor is available in any affected jurisdiction. Notification is required across all twenty-nine states and the District of Columbia.
IV. State-by-State Affected Individual Breakdown
The following table presents the state-by-state breakdown of affected individuals based on Graystone's Final Forensic Report. The counts for the ten states with the largest affected populations are derived from Graystone's analysis of structured data fields within the exfiltrated files. The counts for the remaining nineteen states and the District of Columbia are based on Graystone's data sampling methodology and are subject to final confirmation upon completion of data mining, expected approximately August 4, 2023.
The remaining nineteen states and the District of Columbia, which account for a combined total of 56,216 affected individuals, are as follows: Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, New Hampshire, and the District of Columbia. Each of these jurisdictions has affected individuals whose name and SSN were compromised, triggering notification. Specific per-state counts for these jurisdictions will be confirmed upon completion of data mining (expected approximately August 4, 2023); the current estimates are derived from Graystone's data sampling methodology as described in the Final Forensic Report.
Connecticut, the domicile state of Quorum Insurance Holdings Corp., has the largest affected population at 52,114 individuals, reflecting the concentration of Quorum's policyholder and claimant base in its home state. New York and California follow as the second and third largest affected populations, respectively, and both impose significant regulatory and content requirements that are addressed in detail below and in the separate jurisdiction-specific memoranda referenced herein.
V. Notification Trigger Analysis — Top 10 States by Affected Population
This Section provides a detailed analysis of the notification trigger, timing requirements, regulatory notification obligations, and content requirements for each of the ten states with the largest affected populations. These ten states collectively account for 262,031 of the 318,247 affected individuals (approximately 82.3% of the total affected population).
A. Connecticut (52,114 Affected Individuals)
Statute: Conn. Gen. Stat. § 36a-701b.
Triggering Data Elements: The Connecticut statute defines "personal information" to include an individual's first name or first initial and last name in combination with any one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; (iii) financial account number, credit card number, or debit card number (in combination with any required security code, access code, or password); and (iv) medical information or health insurance information. All four categories of triggering data elements are present in this incident: SSNs and driver's license numbers were compromised for all 52,114 Connecticut residents, financial account numbers were compromised for a subset of those individuals, and medical information was compromised for an additional subset.
All Elements Present: Yes — SSN, driver's license number, financial account number (subset), and medical information (subset).
Notification Triggered: Yes.
Timing Requirement: Notice to affected individuals must be provided no later than sixty (60) days after the discovery of the breach. Notice to the Connecticut Attorney General must be provided no later than the time at which individual notices are distributed and must include certain additional information, including the number of Connecticut residents affected.
AG/Regulator Notification Required: Yes. Notification to the Connecticut Attorney General is required and must be submitted no later than the date individual notification letters are mailed. The AG notification must include a copy of the notice sent to affected individuals, a description of the breach, the number of Connecticut residents affected, and any steps taken in response to the breach.
Content Requirements: The notification to affected individuals must include: (i) a description of the incident in general terms; (ii) the type of personal information that was subject to the breach; (iii) a general description of the remedial measures taken by the entity in response to the breach; (iv) contact information for the entity, including a toll-free telephone number; (v) contact information for the Connecticut Attorney General; and (vi) toll-free numbers, addresses, and websites for the three major consumer credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises).
Additional Note: In addition to the notification obligations under Conn. Gen. Stat. § 36a-701b, Quorum is subject to separate notification obligations under the Connecticut Insurance Data Security Law, Conn. Gen. Stat. § 38a-999b, which requires notification to the Connecticut Insurance Department. Those obligations are analyzed in the separate memorandum dated July 22, 2023. Connecticut is the home state of Quorum and has the largest affected population, and Calderwood & Harkness recommends that Connecticut be the first jurisdiction in which regulatory filings are submitted.
B. New York (47,831 Affected Individuals)
Statute: N.Y. Gen. Bus. Law § 899-aa (as amended by the Stop Hacks and Improve Electronic Data Security Act (the "SHIELD Act"), effective March 21, 2020).
Triggering Data Elements: The SHIELD Act significantly expanded New York's definition of "private information" beyond the traditional "name + data element" formulation. Under the amended statute, "private information" includes: (i) an individual's name (or first initial and last name) in combination with any one or more of the following: Social Security number; driver's license number or state identification card number; financial account number, credit or debit card number (with or without a required security code, access code, personal identification number, or password, if the data element would be sufficient to permit access to an individual's financial account); or biometric information; or (ii) a username or email address in combination with a password or security question and answer that would permit access to an online account (this category is a "standalone trigger" that does not require a name element). The SHIELD Act also includes medical information and health insurance information as elements that may form part of the triggering combination.
All Elements Present: Yes. SSNs, driver's license numbers, and financial account numbers (for a subset) are confirmed compromised, each of which independently triggers notification in combination with names. Medical information (for a subset) is also confirmed compromised.
Notification Triggered: Yes.
Timing Requirement: "In the most expedient time possible and without unreasonable delay." The SHIELD Act does not impose a specific day count for notification, but entities are required to notify the New York Attorney General, the New York Department of State, and the New York Division of State Police simultaneously with, or prior to, providing notification to affected consumers.
AG/Regulator Notification Required: Yes. Quorum must notify the New York Attorney General, the Secretary of State, and the Division of State Police. These notifications must be made simultaneously with, or prior to, consumer notification. Because more than 5,000 New York residents are affected (47,831), Quorum must also provide notice to consumer reporting agencies detailing the timing, content, and distribution of the notices sent to affected individuals.
Content Requirements: The notification must describe the breach incident, the categories of personal information that were compromised, and provide contact information for the entity. A detailed analysis of the SHIELD Act's notification content requirements, as well as its "reasonable safeguards" requirement and implications for vendor oversight, is provided in the NY SHIELD Act Compliance Memo dated July 23, 2023.
Additional Note: New York has the second-largest affected population in this incident. The SHIELD Act's imposition of a "reasonable safeguards" requirement — separate from and in addition to the notification obligation — creates potential enforcement exposure regarding Quorum's vendor management practices and oversight of Palomar. This issue is addressed in the separate NY SHIELD Act Compliance Memo.
C. California (38,206 Affected Individuals)
Statute: Cal. Civ. Code § 1798.82 (California data breach notification statute). The California Confidentiality of Medical Information Act ("CMIA"), Cal. Civ. Code § 56 et seq., may also apply to the PHI subset.
Triggering Data Elements: The California statute defines "personal information" to include an individual's first name or first initial and last name in combination with any one or more of the following: (i) Social Security number; (ii) driver's license number or California identification card number; (iii) account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account; (iv) medical information; and (v) health insurance information. California has one of the broadest definitions of triggering data elements among the states.
All Elements Present: Yes. SSNs, driver's license numbers, financial account numbers (for a subset), and medical information (for a subset) are all confirmed compromised.
Notification Triggered: Yes.
Timing Requirement: "In the most expedient time possible and without unreasonable delay." California does not impose a specific day count for notification to affected individuals, though notification must be consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
AG/Regulator Notification Required: Yes. If the breach affects more than 500 California residents, the entity must submit a sample copy of the notification letter to the California Attorney General. Because the breach affects 38,206 California residents, AG notification is required. The sample notification letter must be submitted electronically through the California Attorney General's online portal.
Content Requirements: California imposes highly specific content requirements for breach notification letters. Under Cal. Civ. Code § 1798.82(d), the notification must be titled "Notice of Data Breach" and must include the following content sections: (1) "What Happened" — a description of the breach; (2) "What Information Was Involved" — the types of personal information compromised; (3) "What We Are Doing" — a description of the entity's response; (4) "What You Can Do" — recommended actions for the individual; and (5) "For More Information" — contact information for the entity. In addition, when SSNs are compromised, the notification must include an offer of appropriate identity theft prevention and mitigation services at no cost to the affected individual for not less than twelve months.
Additional Note: For the subset of California residents whose PHI was compromised, additional obligations may arise under the CMIA. The CMIA imposes specific requirements regarding the unauthorized release of medical information that are distinct from, and in some respects more stringent than, the general breach notification statute. A comprehensive analysis of the CMIA's application to this incident is provided in the California CCPA/CMIA Notification Analysis Memo dated July 24, 2023.
D. Texas (29,477 Affected Individuals)
Statute: Tex. Bus. & Com. Code § 521.053.
Triggering Data Elements: The Texas statute defines "sensitive personal information" to include an individual's first name or first initial and last name in combination with any one or more of the following: (i) Social Security number; (ii) driver's license number or government-issued identification number; (iii) account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual's financial account; and (iv) information regarding the individual's physical or mental health condition, provision of health care, or payment for health care (added via statutory amendment).
All Elements Present: Yes. SSNs, driver's license numbers, financial account numbers (for a subset), and medical/health information (for a subset) are all confirmed compromised.
Notification Triggered: Yes.
Timing Requirement: Notification must be made "as quickly as possible" and in no event later than sixty (60) days after the entity determines or is notified that the breach has occurred. Texas adopted the 60-day hard deadline in its 2019 amendment to the statute.
AG/Regulator Notification Required: Yes. If the breach affects 250 or more Texas residents, the entity must notify the Texas Attorney General. Because the breach affects 29,477 Texas residents, AG notification is required. The AG notification must be submitted through the Texas Attorney General's online data breach notification portal and must include specific information regarding the breach, the data elements compromised, and the number of Texas residents affected.
Content Requirements: The notification must include specific content elements as prescribed by the statute, including a description of the incident, the data elements compromised, and recommended actions for affected individuals.
Additional Note: Texas is the domicile state of Palomar Data Solutions, Inc. However, because Quorum is the entity that owns the data and maintains the direct relationship with the affected policyholders and claimants, Quorum — not Palomar — bears the primary notification obligation to affected individuals. Palomar's obligations as a "data processor" or service provider under Texas law are subject to separate analysis, and Quorum's contractual rights against Palomar with respect to notification costs and responsibilities are addressed in the separate Vendor Contract and Indemnification Analysis Memo.
E. Florida (22,913 Affected Individuals)
Statute: Fla. Stat. § 501.171 (Florida Information Protection Act of 2014, or "FIPA").
Triggering Data Elements: FIPA defines "personal information" broadly to include an individual's first name or first initial and last name in combination with any one or more of the following: (i) Social Security number; (ii) driver's license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity; (iii) financial account number or credit or debit card number, in combination with any required security code, access code, or password; (iv) any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional; and (v) an individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.
All Elements Present: Yes. SSNs, driver's license numbers, financial account numbers (for a subset), and medical history/health information (for a subset) are all confirmed compromised.
Notification Triggered: Yes.
Timing Requirement: Notice to affected individuals must be provided no later than thirty (30) days after the determination that a breach has occurred or reason to believe a breach has occurred. This is one of the most aggressive notification deadlines in the country and must be flagged for priority compliance. The 30-day clock begins upon "determination" that the breach occurred, which Calderwood & Harkness recommends treating as the completion of data mining (expected approximately August 4, 2023), the point at which Quorum will have sufficient information to identify specific affected individuals and the data elements compromised for each.
AG/Regulator Notification Required: Yes. If the breach affects 500 or more Florida residents, written notification to the Florida Department of Legal Affairs (i.e., the Attorney General) is required within 30 days. Because the breach affects 22,913 Florida residents, this requirement is triggered. The AG notification must be submitted in writing and must include specific information, including: a synopsis of the events surrounding the breach; the number of Florida residents affected; the services being offered to affected individuals; a copy of the notification letter; and the name, address, telephone number, and email address of the entity's contact person.
Content Requirements: The notification to affected individuals must include the dates of the breach (or an estimated date range), a description of the personal information that was compromised, and contact information for the entity.
Special Note: Florida's 30-day deadline is among the shortest in the country and requires that Quorum prioritize Florida notifications. Calderwood & Harkness strongly recommends that Quorum treat Florida — along with Colorado, which also has a 30-day deadline — as the highest-priority jurisdictions for notification compliance. Assuming a determination date of approximately August 4, 2023, the Florida deadline would fall on approximately September 3, 2023. The recommended notification timeline set forth in Section VII.C of this memorandum is designed to satisfy this deadline with a reasonable margin.
F. Pennsylvania (18,640 Affected Individuals)
Statute: 73 Pa. Stat. § 2303 (Breach of Personal Information Notification Act).
Triggering Data Elements: The Pennsylvania statute defines "personal information" to include an individual's first name or first initial and last name in combination with and linked to any one or more of the following: (i) Social Security number; (ii) driver's license number or a state identification card number issued in lieu of a driver's license; and (iii) financial account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.
All Elements Present: Yes. SSNs, driver's license numbers, and financial account numbers (for a subset) are confirmed compromised. Pennsylvania does not include medical information in its definition of "personal information" for breach notification purposes, but the SSN and driver's license number triggers are independently satisfied.
Notification Triggered: Yes.
Timing Requirement: Notice must be provided "without unreasonable delay." Pennsylvania does not impose a specific day count. However, notice may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation, and the entity must provide notice after the law enforcement agency determines that notification will not compromise the investigation.
AG/Regulator Notification Required: Yes. The Pennsylvania Attorney General must be notified. In addition, if the entity provides notice to more than 1,000 individuals, the entity must also notify consumer reporting agencies of the timing, distribution, and content of the notice. Because 18,640 Pennsylvania residents are affected, both the AG notification and CRA notification requirements are triggered.
Content Requirements: The statute prescribes standard content requirements for the notification letter. Pennsylvania does not impose the same level of prescriptive formatting as California or Massachusetts.
G. Illinois (16,502 Affected Individuals)
Statute: 815 ILCS 530/10 (Personal Information Protection Act, or "PIPA").
Triggering Data Elements: The Illinois statute defines "personal information" to include an individual's first name or first initial and last name in combination with any one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; (iii) financial account number or credit or debit card number, or an account number or credit card number in combination with any required security code, access code, or password; (iv) medical information; and (v) health insurance information. Illinois has an expanded definition that includes medical and health insurance information.
All Elements Present: Yes. SSNs, driver's license numbers, financial account numbers (for a subset), medical information (for a subset), and health insurance information (for a subset) are all confirmed compromised.
Notification Triggered: Yes.
Timing Requirement: "In the most expedient time possible and without unreasonable delay." Illinois does not impose a specific day count, but notification to the Attorney General must be made no later than the time individual notices are sent.
AG/Regulator Notification Required: Yes. If the breach affects more than 500 Illinois residents, notification to the Illinois Attorney General is required. Because 16,502 Illinois residents are affected, this threshold is met. The AG notification must include certain specified information regarding the breach.
Content Requirements: The notification must include toll-free numbers and addresses for consumer reporting agencies, the Federal Trade Commission, and the Illinois Attorney General. These elements must be incorporated into the Illinois-specific version of the notification letter or, at minimum, included as supplements to the general notification letter for Illinois recipients.
H. New Jersey (14,388 Affected Individuals)
Statute: N.J. Stat. § 56:8-163 (New Jersey Identity Theft Prevention Act).
Triggering Data Elements: The New Jersey statute defines "personal information" to include an individual's first name or first initial and last name linked with any one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; and (iii) account number or credit or debit card number, in combination with any required security code, access code, or password.
All Elements Present: Yes. SSNs, driver's license numbers, and financial account numbers (for a subset) are confirmed compromised. New Jersey does not currently include medical information in its standard definition of "personal information" for breach notification purposes, but the SSN and driver's license number triggers are independently satisfied for all 14,388 New Jersey residents.
Notification Triggered: Yes.
Timing Requirement: "In the most expedient time possible and without unreasonable delay." New Jersey does not impose a specific day count.
AG/Regulator Notification Required: Yes. Notification to the New Jersey Division of State Police and the New Jersey Attorney General is required prior to consumer notification. The entity must report the breach to the Division of State Police within the Division's Cyber Crimes Bureau and must provide information regarding the breach, including the type of personal information compromised and the number of New Jersey residents affected.
Content Requirements: The notification must include a description of the breach, contact information for the entity, and information regarding identity theft protection measures available to affected individuals. The statute requires that the entity offer credit monitoring services when SSNs are compromised, and the notification letter should include instructions for enrolling in such services.
I. Ohio (11,743 Affected Individuals)
Statute: Ohio Rev. Code § 1349.19.
Triggering Data Elements: The Ohio statute defines "personal information" to include an individual's name (consisting of the individual's first name or first initial and last name) in combination with and linked to any one or more of the following: (i) Social Security number; (ii) driver's license number or state identification card number; and (iii) account number or credit or debit card number, in combination with and linked to any required security code, access code, or password that would permit access to an individual's financial account.
All Elements Present: Yes. SSNs, driver's license numbers, and financial account numbers (for a subset) are confirmed compromised. Like Pennsylvania and New Jersey, Ohio does not include medical information in its standard definition of "personal information" for breach notification purposes, but the SSN and driver's license number triggers are independently satisfied.
Notification Triggered: Yes.
Timing Requirement: Notice must be provided "in the most expedient time possible, but not later than forty-five (45) days following its discovery or notification of the breach." Ohio's 45-day deadline is relatively short — shorter than Connecticut's 60-day deadline but longer than Florida's 30-day deadline. This deadline must be tracked alongside Florida and Colorado for priority compliance purposes.
AG/Regulator Notification Required: Yes. Notification to the Ohio Attorney General is required when breach notification is provided to Ohio residents. The AG notification must include information about the breach and the notification being provided to affected individuals.
Content Requirements: Standard content requirements apply. The notification must describe the breach, identify the personal information compromised, and provide contact information and recommended protective measures.
Special Note: Ohio enacted the Ohio Data Protection Act (Ohio Rev. Code § 1354.01 et seq.) in 2018, which provides an affirmative defense in tort actions arising from data breaches for entities that maintain a cybersecurity program that "reasonably conforms to" an industry-recognized cybersecurity framework. While this safe harbor may be relevant to potential civil litigation exposure, it does not affect the notification obligation and is addressed in a separate memorandum regarding Quorum's litigation risk.
J. Massachusetts (10,217 Affected Individuals)
Statute: Mass. Gen. Laws ch. 93H, § 3; implementing regulations at 201 CMR 17.00.
Triggering Data Elements: The Massachusetts statute defines "personal information" to include a resident's first name and last name, or first initial and last name, in combination with any one or more of the following: (i) Social Security number; (ii) driver's license number or state-issued identification card number; and (iii) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number, or password, that would permit access to a resident's financial account.
All Elements Present: Yes. SSNs, driver's license numbers, and financial account numbers (for a subset) are confirmed compromised. Massachusetts does not include medical information in its standard definition of "personal information" for breach notification purposes under ch. 93H, but the SSN and driver's license number triggers are independently satisfied.
Notification Triggered: Yes.
Timing Requirement: Notice must be provided "as soon as practicable and without unreasonable delay." Massachusetts does not impose a specific day count, but the Attorney General's office has historically taken the position that notification should be provided promptly following completion of the investigation.
AG/Regulator Notification Required: Yes. Notification to the Massachusetts Attorney General and the Director of Consumer Affairs and Business Regulation (within the Office of Consumer Affairs and Business Regulation) is required and must be provided simultaneously with individual notifications. The AG/Director notification must be submitted using the Commonwealth's standardized breach notification form, which requires specific information including the nature of the breach, the number of Massachusetts residents affected, the data elements compromised, and the steps taken in response.
Content Requirements: Massachusetts has among the most prescriptive content requirements in the country, as set forth in 201 CMR 17.00. The notification letter must include, at minimum: (i) the individual's right to obtain a police report regarding the breach; (ii) the individual's right to request a security freeze on their credit file and information on how to do so; (iii) specific statutory language regarding consumer rights under Massachusetts law; and (iv) a description of the incident. The notification letter must be in a specific prescribed format and must not include the total number of affected individuals in the consumer letter (this is a unique Massachusetts requirement designed to prevent the notification from being used as marketing material). The notification letter must also include specific contact information for the entity, the FTC, and the Massachusetts Attorney General.
Special Note: Due to the highly prescriptive nature of Massachusetts' content requirements, Calderwood & Harkness recommends preparing a Massachusetts-specific version of the notification letter. A detailed analysis of Massachusetts-specific content requirements and a draft Massachusetts notification letter will be provided in a separate Massachusetts-Specific Consumer Notification Letter Memo, targeted for preparation by approximately August 12, 2023.
VI. Notification Trigger Analysis — Remaining 19 States and the District of Columbia
A. Summary Table
The following table provides a summary of the notification trigger analysis for the remaining nineteen states and the District of Columbia, which collectively account for 56,216 affected individuals. Because SSNs were compromised for all affected individuals, the notification trigger is satisfied in every jurisdiction regardless of whether additional data elements were compromised for specific individuals within each state.
Note: Estimated affected individual counts are based on Graystone's data sampling methodology and are subject to final confirmation upon completion of data mining (expected approximately August 4, 2023). The District of Columbia affected individual count is included in the combined total of 56,216 and will be separately enumerated upon completion of data mining.
B. Key Observations for Remaining Jurisdictions
The following observations highlight noteworthy aspects of the notification analysis for the remaining nineteen states and the District of Columbia:
Universal Trigger Satisfied. All nineteen states and the District of Columbia define "personal information" to include an individual's name in combination with a Social Security number. Because SSNs were compromised for all 318,247 affected individuals, the fundamental notification trigger is satisfied in every jurisdiction within this group. Driver's license numbers provide a secondary, independent trigger in each jurisdiction.
Timing Requirements. Timing requirements across these jurisdictions range from open-ended standards ("as soon as possible" or "without unreasonable delay," with no fixed deadline) to specific numerical deadlines. The most notable timing requirements are:
• Colorado (30 days): Colorado's 30-day notification deadline, measured from the date the entity determines that a security breach occurred, is among the most aggressive in the country and on par with Florida's deadline. Calderwood & Harkness recommends treating Colorado as a highest-priority jurisdiction alongside Florida.
• Washington (30 days for AG notification; 45 days for individual notification): Washington requires notification to the Attorney General within 30 days of the breach discovery if the breach affects more than 500 Washington residents. Individual notification must be provided within 45 days.
• New Hampshire (prior AG notice): New Hampshire requires that notification to the Attorney General be provided prior to consumer notification. This sequencing requirement must be incorporated into the notification timeline.
• Maryland, Wisconsin, Arizona, Oregon, and Tennessee (45 days): Each of these states imposes a 45-day notification deadline, making them the next tier of priority after the 30-day jurisdictions.
• Virginia and Louisiana (60 days): These states impose 60-day deadlines.
AG/Regulator Notification. Attorney General or regulator notification is required in the substantial majority of these jurisdictions. Calderwood & Harkness will confirm specific thresholds (e.g., the number of affected residents triggering AG notice) upon finalization of per-state counts after data mining completion on approximately August 4, 2023. Based on current estimates, the AG notification thresholds are met in all jurisdictions that impose them, with the possible exception of jurisdictions where the affected population is near a threshold boundary.
Medical/Health Information. Several jurisdictions within this group include medical information or health insurance information (or both) in their statutory definition of "personal information." These jurisdictions include Virginia, Maryland, North Carolina, Colorado, Arizona, Oregon, Washington, Missouri, and the District of Columbia. In those states, the PHI subset independently triggers the notification obligation — though, as noted, the obligation is already independently triggered by the SSN compromise. The presence of medical information in the compromised data may, however, affect content requirements in certain of these jurisdictions and should be reflected in the notification letters for affected individuals in the PHI subset.
C. District of Columbia
Statute: D.C. Code § 28-3852.
The District of Columbia breach notification statute defines "personal information" to include an individual's first name or first initial and last name, or phone number, or address, and any one or more of the following: (i) Social Security number; (ii) driver's license number or District of Columbia identification card number; (iii) credit card number or debit card number; or (iv) any other number or code or combination of numbers or codes that allows access to or use of an individual's financial or credit account. The statute also includes biometric data, genetic information and testing results, passport number, taxpayer identification number, military identification number, and other elements within its expanded definition.
All triggering data elements are present: SSNs, driver's license numbers, and financial account numbers (for a subset) were compromised. Notification is triggered. Notification to the District of Columbia Attorney General is required and must be provided in "the most expedient time possible and without unreasonable delay."
VII. Timing Requirements — Consolidated Analysis and Recommended Notification Schedule
A. Summary of Timing Deadlines
The following is a consolidated summary of the notification timing deadlines across all thirty affected jurisdictions (twenty-nine states and the District of Columbia), organized by the stringency of the deadline:
30-Day Jurisdictions (Most Aggressive):
• Florida (Fla. Stat. § 501.171): No later than 30 days after determination that a breach occurred.
• Colorado (Colo. Rev. Stat. § 6-1-716): No later than 30 days after the date of determination that a security breach occurred.
• Washington (Wash. Rev. Code § 19.255.010): 30 days for AG notification (if >500 affected); 45 days for individual notification.
45-Day Jurisdictions:
• Ohio (Ohio Rev. Code § 1349.19): Not later than 45 days following discovery or notification of the breach.
• Maryland (Md. Code, Com. Law § 14-3504): 45 days.
• Wisconsin (Wis. Stat. § 134.98): 45 days.
• Arizona (Ariz. Rev. Stat. § 18-552): 45 days.
• Oregon (Or. Rev. Stat. § 646A.604): 45 days.
• Tennessee (Tenn. Code § 47-18-2107): 45 days.
60-Day Jurisdictions:
• Connecticut (Conn. Gen. Stat. § 36a-701b): No later than 60 days after discovery of the breach.
• Texas (Tex. Bus. & Com. Code § 521.053): No later than 60 days after determination.
• Virginia (Va. Code § 18.2-186.6): 60 days.
• Louisiana (La. Rev. Stat. § 51:3074): 60 days.
"Without Unreasonable Delay" / No Fixed Deadline:
• New York (N.Y. Gen. Bus. Law § 899-aa): "In the most expedient time possible and without unreasonable delay."
• California (Cal. Civ. Code § 1798.82): "In the most expedient time possible and without unreasonable delay."
• Pennsylvania (73 Pa. Stat. § 2303): "Without unreasonable delay."
• Massachusetts (Mass. Gen. Laws ch. 93H, § 3): "As soon as practicable and without unreasonable delay."