PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT PRIVILEGED / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP Attorneys at Law 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800
Fax: (202) 555-4801
www.calderwoodharkness.com
October 5, 2023
Via Electronic Submission and Sundial Data Systems
U.S. Department of Health and Human Services Office for Civil Rights, Region I Government Center, Room 1875 J.F.K. Federal Building 15 New Sudbury Street Boston, MA 02203
Re: Follow-Up Inquiry Regarding Breach Report Quorum Insurance Holdings Corp. — Breach of Unsecured Protected Health Information Breach Report Filed August 15, 2023 41,203 Affected Individuals
Dear Director and Staff of the Office for Civil Rights, Region I:
Calderwood & Harkness LLP represents Quorum Insurance Holdings Corp. ("Quorum" or "QIH"), a Delaware corporation publicly traded on the Nasdaq Global Select Market under the ticker symbol QIHC, with its principal executive offices located at 400 Constitution Plaza, Suite 2200, Hartford, Connecticut 06103, Employer Identification Number 06-4832197. We write in response to the Office for Civil Rights' ("OCR") follow-up inquiry dated September 18, 2023, regarding the breach notification filed by Quorum on August 15, 2023, pursuant to the breach notification requirements set forth at 45 C.F.R. § 164.408, in connection with a breach of unsecured protected health information ("PHI") affecting 41,203 individuals.
Quorum deeply appreciates OCR's diligence in reviewing the circumstances surrounding this breach and the adequacy of Quorum's response. Quorum is committed to full and transparent cooperation with OCR in connection with this inquiry and is pleased to provide the comprehensive information set forth below. This letter is intended to address each area of inquiry raised by OCR and to demonstrate the thoroughness of Quorum's incident response, breach notification compliance, and post-incident remediation efforts.
The engagement team at Calderwood & Harkness responsible for this matter is led by Kevin Ostrowski, Partner, with support from Alan Burke, Lead Associate, and Sara Hendricks, Working Associate. This matter is maintained under Calderwood & Harkness Matter Number 1025-00006. On behalf of Quorum, the principal client contacts for this matter are Thomas R. Whitfield, General Counsel; Jennifer Liang, Chief Privacy Officer; and David Naranjo, Chief Information Security Officer.
The remainder of this letter is organized as follows: Section I provides background on Quorum's business and a summary of the security incident; Section II describes the forensic investigation and scope of the PHI compromise; Section III details Quorum's compliance with HIPAA breach notification requirements; Section IV outlines Quorum's existing HIPAA compliance program; Section V addresses post-incident remediation measures; Section VI describes consumer protection measures; Section VII provides a cost summary and insurance coverage overview; and Section VIII addresses Quorum's ongoing commitment to cooperation with OCR.
I. BACKGROUND AND SUMMARY OF THE INCIDENT
A. Quorum's Business and Relationship with Palomar Data Solutions
Quorum Insurance Holdings Corp. is a top-25 United States insurance holding company, as measured by direct premiums written. Through its network of operating subsidiaries, Quorum is licensed to conduct insurance business in all fifty states, the District of Columbia, and Puerto Rico. Quorum offers a diversified portfolio of insurance products spanning personal lines (including homeowners, auto, and umbrella), commercial lines (including commercial property, general liability, commercial auto, and workers' compensation), specialty insurance (including professional liability, directors and officers liability, and cyber liability), and life and annuity products. As of December 31, 2022, Quorum employed approximately 11,400 individuals across its domestic operations and reported annual consolidated revenue for fiscal year 2022 of approximately $4.82 billion.
Central to Quorum's business operations is its proprietary digital underwriting platform, known internally and commercially as QuorumEdge. QuorumEdge integrates advanced data analytics, predictive modeling, and automated workflow capabilities to support Quorum's underwriting, policy administration, and claims management functions. QuorumEdge is developed, hosted, and maintained entirely within Quorum's own technology infrastructure and is subject to Quorum's comprehensive information security program.
In connection with its personal lines insurance operations, Quorum outsources certain claims data processing functions to Palomar Data Solutions, Inc. ("Palomar"), a Texas corporation headquartered at 7100 Greenville Avenue, Suite 450, Dallas, Texas 75231, Employer Identification Number 75-3291048. Palomar is a specialized data services firm that provides claims data intake, data normalization, structured data extraction, and related processing services for insurance industry clients. Palomar processes claims data submitted by or on behalf of Quorum policyholders and claimants in connection with workers' compensation, health-related, and other personal lines claims.
The relationship between Quorum and Palomar is governed by a Master Services Agreement ("MSA") executed on November 12, 2019, with an initial term of five years, set to expire on November 11, 2024. The MSA has been amended twice prior to the security incident: Amendment 1, executed on March 3, 2021, expanded the scope of claims data processing services provided by Palomar and adjusted pricing to reflect the expanded scope; and Amendment 2, executed on September 15, 2022, updated the data security requirements applicable to Palomar and added additional audit and compliance obligations, including a requirement that Palomar obtain and provide to Quorum an annual SOC 2 Type II audit report. Following the execution of Amendment 1, the annual contract value of the Quorum–Palomar engagement was approximately $16.3 million.
Critically, Palomar processes claims data containing protected health information as a business associate of Quorum within the meaning of the HIPAA Privacy Rule and Security Rule. A Business Associate Agreement ("BAA") is incorporated into the MSA framework as an integral component. The BAA requires Palomar to, among other things, use and disclose PHI only as permitted under the agreement and consistent with HIPAA requirements; implement appropriate administrative, technical, and physical safeguards to protect PHI; report security incidents and breaches of unsecured PHI to Quorum; and make its practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining compliance. Additionally, the MSA includes a detailed Data Security Exhibit, designated as Exhibit D, which sets forth specific technical and operational security requirements applicable to Palomar's handling of Quorum data, including PHI. Exhibit D was substantially revised and enhanced by Amendment 2, as described in greater detail in Section IV.E below.
B. The Security Incident
On or about March 14, 2023, an unauthorized threat actor exploited a known remote code execution vulnerability, tracked as CVE-2023-0669, in a GoAnywhere MFT (Managed File Transfer) file transfer appliance operated by Palomar within Palomar's network environment. GoAnywhere MFT is a widely used enterprise-grade managed file transfer solution developed by Severin Corporation (formerly Strathmore Industries). CVE-2023-0669 was a critical-severity pre-authentication remote code execution vulnerability that was publicly disclosed and for which a vendor patch was made available prior to the date of the threat actor's initial exploitation. The vulnerability was actively exploited by multiple threat actor groups during the relevant time period and was the subject of significant industry attention and advisories.
By exploiting CVE-2023-0669, the threat actor gained initial unauthorized access to Palomar's GoAnywhere MFT appliance and, from that foothold, conducted lateral movement within Palomar's network environment. Over an approximately thirty-five (35) day period, spanning from March 14, 2023, through April 18, 2023, the threat actor accessed and exfiltrated structured data files residing within Palomar's claims processing environment. These structured data files contained claims data belonging to multiple Palomar clients, including Quorum. The exfiltration was conducted using techniques designed to evade detection, including the use of encrypted tunneling and the staging of data in temporary directories within Palomar's infrastructure prior to transmission to external infrastructure controlled by the threat actor.
On April 18, 2023, Palomar's Security Operations Center ("SOC") detected anomalous outbound data transfer activity originating from the compromised GoAnywhere MFT appliance. Upon identification of the anomalous activity, Palomar's SOC initiated its internal incident response procedures, including isolation of the affected systems, revocation of compromised credentials, and engagement of Palomar's own third-party incident response firm. The detection of the anomalous activity on April 18, 2023, effectively ended the exfiltration window.
Palomar notified Quorum of the security incident on April 21, 2023, three days after detection. The notification was communicated via telephone and contemporaneous email from Palomar's General Counsel, Derek Copeland, to Quorum's General Counsel, Thomas R. Whitfield, and Quorum's Chief Information Security Officer, David Naranjo. In the initial notification, Palomar informed Quorum that a security incident had been detected involving unauthorized access to Palomar's file transfer infrastructure, that the incident was under active investigation, and that Palomar believed data belonging to certain Palomar clients, including Quorum, may have been accessed or exfiltrated. Palomar committed to providing ongoing updates as its investigation progressed.
C. Quorum's Immediate Response
Upon receiving notification from Palomar on April 21, 2023, Quorum immediately activated its internal incident response plan. Quorum's incident response team, led by CISO David Naranjo and General Counsel Thomas R. Whitfield, convened an initial assessment meeting on April 22, 2023, to evaluate the scope of the potential exposure, identify immediate containment steps within Quorum's control, and determine the need for external legal counsel and forensic support.
On May 4, 2023, Quorum formally engaged Calderwood & Harkness LLP to serve as outside legal counsel to coordinate Quorum's incident response, manage the forensic investigation under the direction and protection of attorney-client privilege, advise on regulatory notification obligations, and oversee vendor accountability and remediation efforts. Calderwood & Harkness's engagement was authorized by Quorum's Board of Directors through its Audit Committee, chaired by Franklin Reeves.
On May 5, 2023, the day following Calderwood & Harkness's engagement, Calderwood & Harkness retained Graystone Forensics LLC ("Graystone"), a specialized cybersecurity incident response and digital forensics firm headquartered in Tysons Corner, Virginia, to conduct the forensic investigation into the nature, scope, and impact of the security incident as it related to Quorum data. Graystone was retained under the direction and at the instruction of Calderwood & Harkness, and the forensic investigation was conducted under the protection of attorney-client privilege and the work product doctrine. The Graystone engagement was led by Dr. Nolan Briggs, Managing Director, Incident Response, and Kendra Faulkner, Senior Forensic Analyst.
Concurrently, on May 8, 2023, Quorum filed a claim under its primary cyber-liability insurance policy with Atlas Mutual Insurance Company (Policy Number CYB-2023-041587, Claim Number CYB-CLM-2023-05892). The claim was filed in accordance with the notice provisions of the policy and was acknowledged by Atlas Mutual's claims department within the policy's required acknowledgment period.
Throughout the incident response process, Quorum maintained regular and ongoing communication with Palomar regarding the status of Palomar's own investigation, remediation efforts, and the identification of potentially affected data. Quorum also coordinated with Palomar to ensure that both entities' forensic investigations were aligned and that relevant evidence was preserved in accordance with legal hold obligations.
II. FORENSIC INVESTIGATION AND SCOPE OF PHI COMPROMISE
A. Forensic Investigation Timeline
The forensic investigation conducted by Graystone Forensics, under the direction of Calderwood & Harkness, proceeded on an expedited timeline given the significance of the incident and the potential involvement of PHI and other sensitive personal information.
Graystone commenced its forensic analysis immediately upon engagement on May 5, 2023. Graystone's investigation involved, among other activities, examination of forensic images of Palomar's compromised systems (obtained through a cooperation framework negotiated between Calderwood & Harkness and Palomar's outside counsel); analysis of network traffic logs, authentication logs, and system event logs from Palomar's environment; identification and reconstruction of the threat actor's tactics, techniques, and procedures ("TTPs"); and determination of the specific data files accessed and exfiltrated during the intrusion window.
On June 2, 2023, Graystone issued its preliminary findings to Calderwood & Harkness and Quorum's incident response team. The preliminary findings confirmed that structured data files had been exfiltrated from Palomar's claims processing environment, that the exfiltration included files containing Quorum policyholder and claimant data, and that the compromised data likely included personal identifying information and, for certain subsets of individuals, PHI. The preliminary findings also confirmed the initial attack vector (CVE-2023-0669) and the approximate exfiltration window (March 14 through April 18, 2023).
Graystone continued its investigation through June and into July 2023, conducting additional analysis to definitively identify all data files that were exfiltrated and to determine with precision the types of data elements contained within each compromised file. On July 14, 2023, Graystone issued its final forensic report to Calderwood & Harkness. The final report confirmed the full scope of the data compromise, including the total number of individuals affected and the specific data elements involved.
Following the issuance of Graystone's final forensic report, Calderwood & Harkness coordinated a data mining and affected individual identification process to prepare for individual notification. This process involved the programmatic review and analysis of the compromised data files to identify each unique affected individual, determine the specific data elements compromised for each individual, and compile the mailing information necessary for individual notification. The data mining and affected individual identification process was completed on August 4, 2023.
B. Total Scope of Compromised Data
Graystone's final forensic report, together with the subsequent data mining and individual identification analysis, confirmed that a total of 318,247 unique individuals across twenty-nine (29) states and the District of Columbia were affected by the data exfiltration from Palomar's environment.
For all 318,247 affected individuals, the compromised data included personally identifiable information ("PII"), specifically: full names, dates of birth, Social Security numbers, and driver's license numbers (where such information was contained in the applicable claims records).
For a subset of 84,619 individuals, the compromised data also included financial information, specifically bank account numbers associated with direct deposit payment instructions for claims payments, and payment card numbers associated with premium or other payment transactions.
For a further subset of 41,203 individuals, the compromised data included protected health information within the meaning of the HIPAA Privacy Rule, 45 C.F.R. § 160.103. These 41,203 individuals are the subject of Quorum's HIPAA breach notification filed with OCR on August 15, 2023, and are the primary focus of this response letter.
C. Nature of Compromised PHI
The 41,203 individuals whose PHI was compromised were policyholders and claimants associated with workers' compensation and health-related insurance claims that had been submitted to and processed by Palomar on behalf of Quorum as part of Palomar's claims data processing services under the MSA. These individuals' claims files, which were maintained in structured data formats within Palomar's claims processing environment, contained health-related information in addition to the personal identifying information described above.
The specific types of PHI compromised for these 41,203 individuals included the following categories:
•  Health conditions: Descriptions and references to the health conditions, injuries, illnesses, or diagnoses underlying the insurance claims, as documented in the claims files.
•  Diagnosis codes: International Classification of Diseases ("ICD") codes, including ICD-10-CM codes, associated with the health conditions or injuries documented in the workers' compensation and health-related claims files. These codes provide standardized, granular identification of specific medical diagnoses.
•  Treatment information: Information derived from workers' compensation and health-related claims files regarding medical treatments, procedures, or services rendered in connection with the claimed conditions, to the extent such information was documented within the structured claims data processed by Palomar.
The PHI was contained in structured data files — specifically, delimited flat files and database export files — within Palomar's claims processing environment. These files were organized by claims category and processing date range, and they contained data fields mapping to policyholder and claimant identity, claims details, and health-related information.
Critically, the PHI was unsecured at the time of exfiltration, within the meaning of 45 C.F.R. § 164.402. While the data files were encrypted at rest within Palomar's storage environment using AES-256 encryption, the threat actor's lateral movement within Palomar's network provided access to the data in an unencrypted state during processing and prior to exfiltration. The data was not encrypted in transit during the exfiltration event itself, as the threat actor used the compromised GoAnywhere MFT appliance's own file transfer capabilities to stage and transmit the data to external infrastructure. Accordingly, the exception to the definition of "breach" for secured PHI set forth at 45 C.F.R. § 164.402(2) does not apply, and the incident constitutes a breach of unsecured PHI requiring notification under 45 C.F.R. Part 164, Subpart D.
D. Root Cause
The root cause of the breach was the exploitation of CVE-2023-0669, a critical-severity remote code execution vulnerability in the GoAnywhere MFT file transfer appliance operated by Palomar. This vulnerability was publicly disclosed, and a vendor-issued patch was made available by Severin Corporation prior to the date of the threat actor's initial exploitation of the vulnerability on March 14, 2023. The Cybersecurity and Infrastructure Security Agency ("CISA") added CVE-2023-0669 to its Known Exploited Vulnerabilities catalog, and multiple industry advisories were issued warning of active exploitation.
Under the terms of the MSA between Quorum and Palomar, as amended by Amendment 2 executed on September 15, 2022, Palomar was contractually required to apply patches for critical-severity vulnerabilities within thirty (30) days of the date a vendor patch was made available. This requirement was set forth in Section 4.2(d) of Exhibit D (Data Security Exhibit), as revised by Amendment 2. The vendor patch for CVE-2023-0669 was available well in advance of the thirty-day patching deadline applicable under the MSA.
Graystone's forensic analysis confirmed that, as of March 14, 2023, the date of the threat actor's initial access, Palomar had not applied the vendor patch for CVE-2023-0669 to its GoAnywhere MFT appliance. Palomar's failure to timely patch this known critical vulnerability was the direct and proximate cause of the threat actor's ability to gain initial access to Palomar's network environment and, subsequently, to access and exfiltrate the structured data files containing Quorum's policyholder and claimant data, including PHI.
Quorum wishes to emphasize that the breach originated entirely within Palomar's network environment. At no point during the incident did the threat actor access, compromise, or interact with Quorum's own network infrastructure, systems, or applications, including the QuorumEdge platform. Quorum's own systems remained secure throughout the incident. The compromise was limited to data that Quorum had entrusted to Palomar in the ordinary course of the business associate relationship for claims data processing purposes.
III. HIPAA BREACH NOTIFICATION COMPLIANCE
A. Notification to HHS-OCR
Quorum filed its breach notification with the U.S. Department of Health and Human Services, Office for Civil Rights, Region I (Boston), on August 15, 2023, pursuant to 45 C.F.R. § 164.408, which requires covered entities to notify the Secretary of HHS following the discovery of a breach of unsecured PHI. For breaches affecting 500 or more individuals, the covered entity must provide notification to the Secretary without unreasonable delay and in no case later than sixty (60) calendar days from the date of discovery of the breach.
For purposes of determining the timeliness of Quorum's notification, Quorum considers the "date of discovery" of the breach, as that term is used in 45 C.F.R. § 164.404(a)(2), to be July 14, 2023, the date on which Graystone Forensics issued its final forensic report confirming the full scope of compromised data, including the definitive identification of the 41,203 individuals whose PHI was involved. While Quorum was aware of the potential for a PHI compromise prior to that date — indeed, from the time of Palomar's initial notification on April 21, 2023 — the specific scope and nature of the PHI compromise was not ascertainable until the forensic investigation was completed. Quorum exercised reasonable diligence in conducting the investigation and determining the facts necessary to file a complete and accurate breach notification.
The notification was filed on August 15, 2023, which is thirty-two (32) calendar days from July 14, 2023. This is well within the sixty (60) calendar day maximum prescribed by 45 C.F.R. § 164.408. Quorum's notification was timely filed.
The notification accurately reported that 41,203 individuals were affected by the breach of unsecured PHI. The notification identified the breach as a hacking/IT incident and described the location of the breached information as a network server operated by Quorum's business associate, Palomar Data Solutions, Inc. The notification identified Palomar as the business associate involved in the breach and provided the information required by the HHS breach notification portal.
A copy of the HHS-OCR breach notification filed August 15, 2023, is attached hereto as Enclosure 2.
B. Individual Notifications
Quorum provided individual breach notification to each of the 41,203 affected individuals whose PHI was compromised, in compliance with 45 C.F.R. § 164.404.
HIPAA-compliant individual notification letters were prepared by Calderwood & Harkness in consultation with Quorum's Chief Privacy Officer, Jennifer Liang, and were reviewed for compliance with all applicable federal and state notification requirements. The notification letters were customized to reflect the specific types of data compromised for each individual and were printed and mailed by Clearfield Notification Services LLC ("Clearfield"), a professional notification services provider headquartered in Independence, Ohio, which was engaged to manage the notification logistics, call center operations, and credit monitoring enrollment. The Clearfield engagement was managed by Account Manager Jerome Tillman.
Mailing of the individual PHI-specific notification letters commenced on August 18, 2023, three days after the filing of the HHS-OCR breach notification. All mailings were completed by September 15, 2023, representing an approximately twenty-eight (28) day mailing window. All notification letters were sent via first-class United States mail to the last known mailing address for each affected individual. For individuals whose notification letters were returned as undeliverable, Quorum undertook reasonable efforts to obtain updated mailing addresses, including through the use of address-updating services, and re-sent notifications to updated addresses where available.
The PHI-specific individual notification letter contained all elements required by 45 C.F.R. § 164.404(c), including the following:
1.  A brief description of what happened, including the date of the breach and the date of discovery of the breach. The letter described the unauthorized access to Palomar's systems beginning on or about March 14, 2023, the exfiltration of data files over the period through April 18, 2023, the discovery of the incident by Palomar on April 18, 2023, and Palomar's notification to Quorum on April 21, 2023.
2.  A description of the types of unsecured PHI that were involved in the breach, including, as applicable, health conditions, diagnosis codes (ICD codes), and treatment information derived from workers' compensation and health-related claims files, along with the individual's name, date of birth, Social Security number, and (where applicable) driver's license number and financial account information.
3.  Any steps the individual should take to protect himself or herself from potential harm resulting from the breach, including recommendations to monitor financial accounts and explanation of benefits statements for unauthorized activity, to consider placing fraud alerts or security freezes on credit files with the three major credit reporting agencies, and to remain vigilant for signs of identity theft or medical identity theft.
4.  A brief description of what Quorum is doing to investigate the breach, mitigate harm to individuals, and protect against further breaches, including Quorum's engagement of forensic investigators, the offering of complimentary credit monitoring and identity theft protection services, and the implementation of enhanced data security measures with its business associate.
5.  Contact procedures for individuals to ask questions or learn additional information, including a dedicated toll-free telephone number for a call center operated by Clearfield Notification Services LLC specifically to handle inquiries related to this incident. The call center was staffed with trained representatives prepared to answer questions about the incident, assist individuals with enrollment in credit monitoring services, and provide guidance on protective measures. The call center was operational for a twelve (12) week window.
6.  Contact information for the U.S. Department of Health and Human Services, Office for Civil Rights, including the HHS-OCR complaint hotline telephone number and website address, as required by 45 C.F.R. § 164.404(c)(1)(vi).
A copy of the consumer notification letter (PHI version) is attached hereto as Enclosure 1.
In addition to the notification letters, all 41,203 PHI-affected individuals (as well as the broader population of 318,247 individuals affected by the compromise of PII and/or financial information) were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services. These services are administered by Clearfield Notification Services LLC and include daily credit monitoring alerts, identity theft insurance, and access to identity restoration specialists. As of the date of this letter, the estimated take-rate for credit monitoring enrollment is approximately 40%, representing approximately 127,299 enrollees across all affected populations.
C. Media Notice
As required by 45 C.F.R. § 164.406 for breaches of unsecured PHI affecting more than 500 residents of a state or jurisdiction, Quorum issued a media notice on August 15, 2023. The media notice was distributed in the form of a press release to prominent media outlets serving the affected states and jurisdictions. The media notice described the nature of the breach, the types of PHI involved, the steps individuals could take to protect themselves, and contact information for questions and enrollment in credit monitoring services. The media notice was also posted on Quorum's corporate website and on the QuorumEdge platform.
A copy of the media notice dated August 15, 2023, is attached hereto as Enclosure 3.
D. Notification to State Regulators
In addition to the HHS-OCR breach notification, Quorum filed breach notification reports with the attorneys general and/or relevant state regulatory authorities in all twenty-nine (29) affected states, as well as the District of Columbia. These notifications were filed between August 14 and August 25, 2023, and all were filed within the applicable statutory deadlines for breach notification in each respective jurisdiction.
The key initial filings included the following:
The remaining notifications for the other twenty-four affected states and the District of Columbia were filed between August 17 and August 25, 2023. Each state-specific notification was tailored to comply with the particular requirements of the applicable state breach notification statute, including, where required, the submission of copies of the consumer notification letter, descriptions of the specific data elements compromised, and the identification of the number of affected residents within the filing jurisdiction.
Quorum also made filings with the Connecticut Insurance Department pursuant to Conn. Gen. Stat. § 38a-999b, reflecting Quorum's status as a Connecticut-domiciled insurance holding company, and complied with all applicable insurance-specific notification requirements.
IV. QUORUM'S HIPAA COMPLIANCE PROGRAM
Quorum recognizes that a comprehensive and well-maintained HIPAA compliance program is essential to the protection of PHI and to meeting its obligations as a covered entity under the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. Quorum maintains a robust compliance program that addresses all required elements of the HIPAA regulatory framework. The following is an overview of the key components of Quorum's HIPAA compliance program.
A. Privacy and Security Governance
Quorum's HIPAA compliance program is overseen at the executive level by two designated officers: Jennifer Liang, Chief Privacy Officer ("CPO"), who serves as Quorum's designated HIPAA Privacy Officer; and David Naranjo, Chief Information Security Officer ("CISO"), who serves as Quorum's designated HIPAA Security Officer. Ms. Liang and Mr. Naranjo report directly to Quorum's General Counsel, Thomas R. Whitfield, and have dotted-line reporting to the Chief Executive Officer on matters related to privacy and information security, respectively.
Quorum's privacy and security governance framework includes Board-level oversight through the Audit Committee of the Board of Directors, chaired by Franklin Reeves. The Audit Committee receives quarterly reports from the CPO and CISO regarding the status of Quorum's HIPAA compliance program, privacy and security risk assessments, incident response activities, and material developments in the regulatory landscape. The Audit Committee also reviews and approves the annual privacy and security budget and evaluates the adequacy of resources allocated to HIPAA compliance.
All privacy and security policies, procedures, and standards are reviewed and updated at least annually, or more frequently as warranted by changes in the regulatory environment, changes in Quorum's business operations, or the identification of new risks or vulnerabilities. The annual policy review process is coordinated by the CPO and CISO and involves input from cross-functional stakeholders, including legal, compliance, information technology, human resources, and business operations.
B. Administrative Safeguards
Quorum maintains a comprehensive suite of written policies and procedures that address the requirements of the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. These policies are maintained in Quorum's centralized policy management system and are accessible to all workforce members.
Quorum conducts regular risk assessments to identify and evaluate risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI in accordance with 45 C.F.R. § 164.308(a)(1)(ii)(A). Risk assessments are conducted at least annually, with supplemental assessments conducted in connection with significant changes to Quorum's information systems, business operations, or the threat environment. The most recent enterprise-wide risk assessment was completed in February 2023 and was led by Quorum's internal audit function in coordination with the CISO's office.
Workforce training on HIPAA compliance is mandatory for all Quorum employees and contingent workers who have access to PHI or who perform functions related to the handling of PHI. HIPAA training is conducted at the time of onboarding for new workforce members and is repeated annually thereafter. Training content is updated at least annually to reflect regulatory developments, emerging threats, and lessons learned from incidents. Training completion is tracked through Quorum's learning management system, and workforce members who fail to complete required training within the designated timeframe are subject to progressive disciplinary measures.
Quorum maintains a sanctions policy, as required by 45 C.F.R. § 164.308(a)(1)(ii)(C), that provides for appropriate disciplinary action against workforce members who violate Quorum's HIPAA policies and procedures. The sanctions policy is documented in Quorum's HIPAA Policy Manual and is administered in coordination with the human resources department.
C. Technical Safeguards
Quorum's technical safeguards are designed to protect the confidentiality, integrity, and availability of ePHI within Quorum's own information systems and infrastructure. Key technical safeguards include:
•  Access Controls: Quorum implements role-based access controls ("RBAC") to ensure that workforce members have access only to the minimum necessary ePHI required to perform their job functions. Each workforce member is assigned a unique user identifier for authentication and access tracking purposes. Multi-factor authentication is required for remote access and for access to systems containing ePHI. Encryption of PHI at rest is implemented using AES-256 encryption for all databases and file storage systems within Quorum's environment that contain ePHI. Encryption of PHI in transit is implemented using TLS 1.2 or higher for all electronic transmissions of ePHI from Quorum's systems.
•  Audit Controls: Quorum maintains comprehensive logging and monitoring capabilities for all systems containing ePHI. System access logs, authentication events, and data access events are captured, retained, and reviewed in accordance with Quorum's log management and monitoring policies. Quorum's Security Operations Center conducts continuous monitoring and automated alerting for anomalous access patterns and potential security incidents.
•  Integrity Controls: Quorum implements mechanisms to authenticate ePHI and prevent unauthorized alteration, including data integrity checks, hash verification for data transfers, and database integrity monitoring.
•  Transmission Security: All electronic transmissions of ePHI from Quorum's own systems are encrypted using industry-standard encryption protocols (TLS 1.2 or higher). Quorum prohibits the transmission of unencrypted ePHI via email or other electronic communication channels.
D. Physical Safeguards
Quorum maintains physical safeguards for its facilities and electronic media in compliance with 45 C.F.R. §§ 164.310(a)–(d):
•  Facility Access Controls: Quorum's Hartford headquarters and data center facilities are protected by access control systems that include badge-based entry, visitor management procedures, surveillance monitoring, and security personnel. Access to areas containing ePHI is restricted to authorized personnel.
•  Workstation and Device Security: Quorum maintains policies governing the physical security of workstations and mobile devices, including requirements for screen locking, physical cable locks for laptops in office environments, and remote wipe capabilities for mobile devices.
•  Media Controls: Quorum maintains policies and procedures for the disposal and re-use of electronic media containing PHI. Electronic media containing ePHI are sanitized or destroyed in accordance with NIST SP 800-88, Guidelines for Media Sanitization, prior to disposal or re-use. Certificates of destruction are obtained and retained for audit purposes.
E. Business Associate Management
Quorum maintains a vendor risk management program overseen by Priya Deshmukh, Vice President, Vendor Risk Management. The vendor risk management program is responsible for evaluating the security and privacy practices of third-party vendors, ensuring that appropriate contractual protections are in place, and conducting ongoing monitoring of vendor compliance with data security obligations.
Business associate agreements are executed with all vendors that access, process, or store PHI on Quorum's behalf, in compliance with 45 C.F.R. § 164.502(e) and 45 C.F.R. § 164.308(b). Quorum's standard BAA template incorporates all required elements of 45 C.F.R. § 164.504(e) and is reviewed and updated by Quorum's legal department at least annually.
As described in Section I.A above, Palomar's MSA with Quorum included comprehensive business associate provisions and a detailed Data Security Exhibit (Exhibit D). Exhibit D, as amended by Amendment 2, required Palomar to, among other things:
•  Maintain commercially reasonable administrative, technical, and physical safeguards consistent with industry standards and applicable law, including HIPAA;
•  Patch critical-severity vulnerabilities within thirty (30) days of the date a vendor patch is made available;
•  Conduct annual penetration testing of its systems that process, store, or transmit Quorum data, with results and remediation plans shared with Quorum;
•  Provide to Quorum an annual SOC 2 Type II report covering the Trust Services Criteria relevant to security, availability, and confidentiality; and
•  Maintain and regularly test an incident response plan and business continuity/disaster recovery plan.
The SOC 2 Type II audit requirement was added by Amendment 2, executed September 15, 2022. Palomar's SOC 2 Type II reports were reviewed by Quorum's vendor risk management team upon receipt. Palomar's SOC 2 auditor was Kessler, Park & Associates CPA, PLLC, an accounting and advisory firm headquartered in Dallas, Texas, with the SOC 2 engagement led by Engagement Partner Vivian Park. Quorum notes that the SOC 2 Type II report received from Palomar did not identify specific control exceptions related to patch management, although the scope and timing of the audit period relative to the exploitation of CVE-2023-0669 is a matter that Quorum is evaluating further.
An overview of Quorum's HIPAA compliance program is attached hereto as Enclosure 6.
V. POST-INCIDENT REMEDIATION MEASURES
Quorum has undertaken significant remediation measures in the wake of this incident, directed both at holding Palomar accountable for its failures and at strengthening Quorum's own vendor risk management and incident response capabilities. These measures are designed to mitigate the risk of similar incidents in the future and to enhance the overall security posture of Quorum's business associate relationships.
A. Vendor Accountability — Palomar Data Solutions
Upon confirmation that the breach was caused by Palomar's failure to timely patch a known critical vulnerability in violation of Palomar's contractual obligations under the MSA, Quorum took prompt action to assert its contractual rights and hold Palomar accountable.
Quorum asserted contractual indemnification claims against Palomar under Section 12.2 of the MSA, which provides for Palomar's indemnification of Quorum against losses arising from Palomar's breach of its data security obligations, subject to a liability cap of two times (2×) the trailing twelve-month fees paid or payable by Quorum to Palomar. Based on the trailing twelve-month fees at the time of the incident, the applicable liability cap was $32,600,000.
On June 20, 2023, Calderwood & Harkness, on behalf of Quorum, issued a formal breach of contract demand letter to Palomar's outside counsel, Catherine Langford, a partner at Mercer, Haight & Dunlop LLP in Dallas, Texas. The demand letter detailed Palomar's failure to comply with the critical vulnerability patching requirements of Exhibit D, as amended, and asserted that Palomar's breach of its contractual obligations was the direct cause of the security incident and the resulting harm to Quorum and the affected individuals. The demand letter sought full indemnification for all costs, expenses, and liabilities incurred by Quorum as a result of the breach, as well as prospective damages.
Following extensive negotiations between Calderwood & Harkness and Mercer, Haight & Dunlop over the ensuing months, the parties reached a comprehensive settlement agreement, which was executed on October 27, 2023. The principal terms of the settlement agreement are as follows:
1.  Cash Payment: Palomar agreed to make a lump-sum cash payment of $4,200,000 to Quorum, payable within forty-five (45) days of execution of the settlement agreement, in partial satisfaction of Quorum's indemnification claims.
2.  Fee Reduction: Palomar agreed to an eighteen (18) month fee reduction of eight percent (8%), applied to all fees payable by Quorum to Palomar under the MSA during the eighteen-month period commencing on November 1, 2023. Based on the current annual contract value, this fee reduction represents effective savings to Quorum of approximately $1,956,000 over the eighteen-month period.
3.  Independent Security Assessment: Palomar agreed to engage, at Palomar's sole expense, an independent third-party security assessor to conduct enhanced annual security audits of Palomar's systems and security practices. The selection of the independent assessor is subject to Quorum's prior written approval. The results of each annual assessment are to be shared with Quorum, and Palomar is required to develop and implement a remediation plan addressing any findings rated as high or critical severity within defined timelines.
4.  Enhanced Security Measures: Palomar agreed to implement enhanced patch management capabilities and to deploy endpoint detection and response ("EDR") technology across all systems that process, store, or transmit Quorum data, with implementation to be completed within ninety (90) days of the execution of the settlement agreement.
The total effective recovery from Palomar under the settlement agreement is $6,156,000 ($4,200,000 cash payment plus $1,956,000 in fee reductions). Quorum reserves its right to pursue additional claims against Palomar to the extent future liabilities are incurred in connection with the breach that exceed the current settlement.
A summary of the settlement agreement terms (redacted as to commercially sensitive provisions) is attached hereto as Enclosure 4.
B. MSA Amendment 3 — Enhanced Data Security Provisions
Concurrently with the execution of the settlement agreement on October 27, 2023, Quorum and Palomar executed Amendment 3 to the MSA, which imposes substantially enhanced data security requirements on Palomar for the remainder of the MSA term. The key enhanced requirements under Amendment 3 include:
1.  Accelerated Patch Management: The timeline for patching critical-severity vulnerabilities has been reduced from thirty (30) days to fourteen (14) days from the date a vendor patch is made available. For vulnerabilities that are under active exploitation (as determined by CISA, vendor advisories, or industry threat intelligence sources), patching must be completed within seventy-two (72) hours, or compensating controls must be deployed within twenty-four (24) hours pending full remediation.
2.  Endpoint Detection and Response: Palomar is required to deploy and maintain endpoint detection and response ("EDR") technology on all systems within its environment that process, store, or transmit Quorum data. EDR solutions must be managed and monitored on a 24/7 basis.
3.  Quarterly Vulnerability Scanning: Palomar is required to conduct quarterly vulnerability scans of all systems within its environment that process, store, or transmit Quorum data, using industry-standard vulnerability scanning tools. Scan results, together with Palomar's remediation plans and timelines, must be provided to Quorum within fifteen (15) business days of each quarterly scan.
4.  Annual Independent Security Assessment: As described above, Palomar is required to undergo an annual independent security assessment at Palomar's sole expense, with results shared with Quorum and remediation plans implemented within defined timelines.
5.  Expedited Incident Notification: The timeline for Palomar to notify Quorum of a security incident has been reduced from forty-eight (48) hours to twenty-four (24) hours from the time Palomar becomes aware of an incident that may involve Quorum data.
A summary of the enhanced data security provisions set forth in MSA Amendment 3 is attached hereto as Enclosure 5.
C. Quorum Internal Remediation
In addition to the vendor-focused measures described above, Quorum has implemented a number of internal remediation measures designed to strengthen its own vendor risk management, incident response, and data protection capabilities:
•  Enhanced Vendor Risk Monitoring: Quorum has increased the frequency and depth of security reviews for critical vendors — defined as vendors that access, process, or store significant volumes of PHI, PII, or other sensitive data. Critical vendors are now subject to quarterly security reviews, in addition to the annual assessments previously conducted. The enhanced monitoring program is overseen by Priya Deshmukh, VP, Vendor Risk Management.
•  Updated Incident Response Plan: Quorum has revised and updated its enterprise incident response plan to incorporate lessons learned from this incident, including enhancements to the escalation and communication protocols for incidents originating at business associates, refined timelines for forensic investigation and data mining, and updated templates for regulatory and individual notifications.
•  Data Minimization Review: Quorum has initiated a comprehensive data minimization review, led by the CPO and CISO in coordination with business operations, to evaluate whether the volume and types of data shared with third-party processors, including business associates, can be reduced consistent with business requirements. The goal of this initiative is to minimize the amount of sensitive data, including PHI, that resides outside of Quorum's direct control at any given time.
•  Additional Employee Training: Quorum has implemented additional training for workforce members involved in vendor management, information technology, and privacy and security functions, with a particular focus on vendor security risk identification, escalation procedures, and the timely reporting of potential security concerns related to business associate relationships.
•  Tabletop Exercise Program: Quorum has established a recurring tabletop exercise program for breach response scenarios, with exercises conducted at least semi-annually. The tabletop exercises involve cross-functional participation from legal, compliance, information technology, privacy, communications, and executive leadership, and are designed to test the effectiveness of Quorum's incident response plan in realistic scenarios, including scenarios involving business associate breaches.
VI. CONSUMER PROTECTION MEASURES
Quorum has taken substantial steps to protect the interests of the individuals affected by this breach and to mitigate the potential for harm. As described in Section III.B above, all 41,203 individuals whose PHI was compromised received HIPAA-compliant individual notification letters containing all required elements under 45 C.F.R. § 164.404(c).
In recognition of the broader scope of the data compromise, all 318,247 affected individuals — including the 41,203 individuals whose PHI was involved, as well as the individuals whose PII and/or financial information was compromised without PHI involvement — were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services. These services are administered by Clearfield Notification Services LLC and include daily credit monitoring alerts from all three major credit reporting agencies, identity theft insurance coverage, and access to identity restoration specialists who can assist affected individuals in the event that their personal information is misused.
A dedicated toll-free call center was established and operated by Clearfield specifically to support affected individuals in connection with this incident. The call center was staffed by trained representatives prepared to answer questions about the incident, explain the credit monitoring services, assist with enrollment, and provide general guidance on protective measures. The call center was available during regular business hours (Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time) for a twelve (12) week window commencing on the date the first notification letters were mailed.
In addition to the mailed notification letters, substitute notice was posted on Quorum's corporate website consistent with applicable statutory requirements for substitute notice in jurisdictions where substitute notice is authorized. The website notice included a description of the incident, the types of information involved, steps individuals could take to protect themselves, and contact information for the toll-free call center.
To ensure transparent and timely public messaging regarding the incident, Quorum retained BrightPath Consulting Group Inc. ("BrightPath"), a communications and crisis management consulting firm headquartered in New York, New York, led by Managing Director Meredith Ashford. BrightPath assisted Quorum in developing and executing an external communications strategy that included the media notice described in Section III.C, coordination with Quorum's investor relations team for securities disclosure purposes, and preparation of talking points and frequently asked questions for Quorum's customer-facing personnel. BrightPath's engagement was designed to ensure that Quorum's communications were accurate, consistent, and appropriately balanced between transparency and the protection of sensitive investigative details.
VII. COST SUMMARY AND INSURANCE COVERAGE
Quorum has incurred significant costs in connection with its response to this incident. The following is a summary of the total incident response costs incurred as of the date of this letter:
Quorum maintains a comprehensive cyber-liability insurance program that responded to this incident. The structure of Quorum's cyber-liability insurance tower is as follows:
Primary Policy: Atlas Mutual Insurance Company, Policy Number CYB-2023-041587, providing a per-occurrence limit of $15,000,000, subject to a self-insured retention ("SIR") of $2,500,000. The primary policy covers first-party incident response costs, including forensic investigation, notification, credit monitoring, crisis management, and legal fees, as well as third-party liability arising from data breaches, subject to the policy's terms, conditions, and exclusions.
Excess Policy: Pinnacle Surplus Lines Insurance Corp., Policy Number XS-CYB-2023-7812, providing $25,000,000 in excess of the $15,000,000 primary limit, for a total cyber-liability insurance tower of $40,000,000.
The allocation of the total incident response costs between the SIR and the primary policy is as follows:
In addition to the insurance coverage described above, Quorum's recovery from Palomar under the settlement agreement — totaling $6,156,000 in cash payments and fee reductions — further offsets Quorum's net financial exposure. The interplay between the insurance recovery and the Palomar settlement recovery, including any subrogation rights of the insurer, is being addressed between Quorum and Atlas Mutual in the ordinary course.
VIII. COOPERATION AND ONGOING COMMITMENT
Quorum Insurance Holdings Corp. remains firmly committed to full and transparent cooperation with the U.S. Department of Health and Human Services, Office for Civil Rights, in connection with this inquiry and any further review OCR may deem appropriate. Quorum takes its obligations as a covered entity under HIPAA with the utmost seriousness and is dedicated to the protection of the PHI entrusted to it by its policyholders and claimants.
Quorum will promptly provide any additional information, documentation, or clarification that OCR may request in connection with this matter. Quorum's engagement team at Calderwood & Harkness LLP remains available for direct communication with OCR at any time and welcomes the opportunity to discuss any aspect of this response in further detail.
All correspondence, inquiries, and communications from OCR relating to this matter should be directed to:
Kevin Ostrowski, Partner Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800
Email: kostrowski@calderwoodharkness.com
Alan Burke, Senior Associate Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800
Email: aburke@calderwoodharkness.com
Additionally, OCR may contact Quorum's Chief Privacy Officer directly:
Jennifer Liang, Chief Privacy Officer Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Tel: (860) 555-3400
Email: jliang@quoruminsurance.com
IX. CONCLUSION
In summary, the breach of unsecured PHI that is the subject of this inquiry originated entirely within the network environment of Quorum's third-party business associate, Palomar Data Solutions, Inc., due to Palomar's failure to timely apply a vendor-issued patch for a known critical vulnerability (CVE-2023-0669) in its GoAnywhere MFT file transfer appliance. The threat actor exploited this vulnerability to gain unauthorized access to Palomar's systems and to exfiltrate structured data files containing, among other data, the PHI of 41,203 Quorum policyholders and claimants associated with workers' compensation and health-related insurance claims. Quorum's own systems were not compromised.
Upon receiving notification of the incident from Palomar, Quorum responded promptly and diligently. Quorum engaged experienced outside legal counsel and a specialized forensic investigation firm, conducted a thorough investigation under attorney-client privilege, and worked expeditiously to determine the full scope of the data compromise and to identify all affected individuals. Quorum filed its HIPAA breach notification with HHS-OCR well within the statutory sixty-day deadline, provided timely individual notifications to all 41,203 affected individuals whose PHI was compromised, issued the required media notice, and filed breach notifications with all applicable state regulators within their respective statutory deadlines.
Quorum has taken extensive post-incident remediation measures, including holding Palomar financially accountable through a settlement agreement providing for $6,156,000 in total recovery; imposing substantially enhanced data security requirements on Palomar through a new amendment to the MSA; and implementing internal improvements to Quorum's vendor risk management, incident response, data minimization, and workforce training programs. Quorum has also taken comprehensive steps to protect affected individuals, including offering twenty-four months of complimentary credit monitoring and identity theft protection services and operating a dedicated toll-free call center to assist affected individuals.
Quorum respectfully requests that OCR conclude its inquiry without further action or the imposition of any corrective measures or civil money penalties, based on the comprehensive response, timely compliance with all HIPAA breach notification requirements, and the significant remediation measures that Quorum has voluntarily undertaken as described herein. Quorum believes that its actions demonstrate a good-faith commitment to HIPAA compliance and to the protection of the individuals whose PHI was entrusted to its care.
Quorum appreciates OCR's diligent review of this matter and is grateful for the opportunity to provide this detailed response. We remain available to provide any further information or assistance that OCR may require.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski, Partner 1700 K Street NW, Suite 900 Washington, D.C. 20006 Tel: (202) 555-4800
Email: kostrowski@calderwoodharkness.com
Counsel for Quorum Insurance Holdings Corp.
Date: October 5, 2023
ENCLOSURES:
Enclosure 1: Copy of Consumer Notification Letter — PHI Version (HIPAA-Compliant)
Enclosure 2: Copy of HHS-OCR Breach Notification Filed August 15, 2023
Enclosure 3: Copy of Media Notice Dated August 15, 2023
Enclosure 4: Summary of Palomar Settlement Agreement Terms (Redacted as to Commercially Sensitive Terms)
Enclosure 5: Summary of MSA Amendment 3 Enhanced Data Security Provisions
Enclosure 6: Overview of Quorum's HIPAA Compliance Program
cc:
Thomas R. Whitfield, General Counsel, Quorum Insurance Holdings Corp. Jennifer Liang, Chief Privacy Officer, Quorum Insurance Holdings Corp. Alan Burke, Senior Associate, Calderwood & Harkness LLP Sara Hendricks, Associate, Calderwood & Harkness LLP
Jurisdiction | Regulatory Authority | Filing Date | Statutory Authority
Connecticut | Attorney General | August 14, 2023 | Conn. Gen. Stat. § 36a-701b
Connecticut | Insurance Department | August 14, 2023 | Conn. Gen. Stat. § 38a-999b
New York | Attorney General | August 16, 2023 | N.Y. Gen. Bus. Law § 899-aa
California | Attorney General | August 16, 2023 | Cal. Civ. Code § 1798.82
Massachusetts | Attorney General | August 17, 2023 | Mass. Gen. Laws ch. 93H, § 3
Cost Category | Amount
Graystone Forensics LLC — Forensic investigation fees | $1,847,000
Clearfield Notification Services LLC — Total | $3,214,500
— Notification printing and mailing | $636,000
— Call center operations | $478,500
— Credit monitoring services (24-month, negotiated flat fee) | $2,100,000
BrightPath Consulting Group Inc. — Communications consulting fees | $385,000
Calderwood & Harkness LLP — Legal fees | $2,163,750
Quorum internal costs (IT remediation, employee overtime) (estimated) | $620,000
Total incident response costs | $8,230,250
Allocation | Amount
Amount within SIR (Quorum's responsibility) | $2,500,000
Amount covered by Atlas Mutual primary policy | $5,730,250