1025-00006 · Graystone Forensics LLC · Regulatory Defense/CT Insurance Dept & HHS-OCR

hhs-ocr-no-further-action-letter-annotated.docx DOCUMENT Data Privacy

59 / 88 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

HHS-OCR No Further Action Letter — Calderwood & Harkness Internal Annotated Copy

C&H Matter Number: 1025-00006

Client: Quorum Insurance Holdings Corp.

Annotated by: Alan Burke, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP

Date of Annotations: December 1, 2023

NOTICE: This is an internal annotated copy of the official HHS-OCR letter dated November 30, 2023. Bracketed annotations in bold italics reflect Calderwood & Harkness analysis and are protected attorney work product under Federal Rule of Civil Procedure 26(b)(3) and applicable state equivalents. This document contains the mental impressions, conclusions, opinions, and legal theories of counsel. Do not distribute outside privilege holders. Any inadvertent disclosure of this document to any person not within the scope of the attorney-client privilege or work product protection does not constitute a waiver of any applicable privilege or protection.

PART ONE

FULL TEXT OF THE HHS-OCR LETTER

(with Embedded Calderwood & Harkness Annotations)

U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office for Civil Rights

Region I — Boston Regional Office

Government Center, J.F.K. Federal Building, Room 1875

Boston, MA 02203

Telephone: (800) 368-1019

November 30, 2023

VIA ELECTRONIC MAIL AND U.S. MAIL

Reference: Breach Report No. OCR-BI-23-014837

Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006

Re: Breach Report Filed by Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Breach Report No. OCR-BI-23-014837

Dear Mr. Ostrowski:

The U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights ("OCR"), is writing in connection with the breach notification submitted by Quorum Insurance Holdings Corp. ("Quorum" or the "Entity") on August 15, 2023, pursuant to Section 13402 of the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), 42 U.S.C. § 17932, and the Breach Notification Rule at 45 C.F.R. § 164.408. According to the breach notification, the reported breach involved the unsecured protected health information ("PHI") of approximately 41,203 individuals. This letter also references and acknowledges Quorum's response to OCR's follow-up inquiry, which was transmitted to this office via electronic mail on October 5, 2023, together with supplemental documentation provided in connection with that response.

[C&H Annotation — Alan Burke: "OCR correctly identifies the breach as reported under the HITECH Act / Breach Notification Rule rather than as a compliance review or complaint investigation. This is procedurally significant — it means the file was opened as a breach report review, not a formal investigation under 45 C.F.R. Part 160, Subpart D. The standard of review is less adversarial. Under a breach report review, OCR typically examines the notification for completeness and timeliness, reviews the entity's response to any follow-up inquiries, and determines whether the entity's own account of the breach and its response suggests potential HIPAA violations warranting further investigation. This is materially different from a complaint-driven or compliance-review-driven investigation, where OCR has broader investigative authority and where the entity bears a heavier burden. The fact that this remained a breach report review throughout the process — and was never escalated to a formal investigation — is a favorable procedural outcome for Quorum." ]

Summary of the Reported Breach

Based on the information provided by the Entity in its breach notification filing and in its October 5, 2023, response to this office's inquiry, OCR understands the relevant facts as follows:

The Entity reported that a threat actor gained unauthorized access to the network and systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party business associate that processes claims data on behalf of Quorum. The unauthorized access was achieved through the exploitation of a remote code execution vulnerability in a file transfer appliance utilized by Palomar in the course of its data processing operations. The initial unauthorized access occurred on or about March 14, 2023. The threat actor maintained unauthorized access to the Palomar network environment over a period of approximately thirty-five (35) days, during which time data exfiltration from Palomar's systems occurred. The period of unauthorized access and exfiltration extended from approximately March 14, 2023, through April 18, 2023.

The protected health information compromised as a result of the incident included health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. The Entity reported that the breach affected a total of 41,203 individuals whose PHI was maintained by Palomar in its capacity as a business associate of Quorum.

The Entity further reported that the breach was discovered by Palomar on April 18, 2023, and that Palomar notified Quorum of the breach on April 21, 2023.

[C&H Annotation — Alan Burke: "OCR's recitation of the facts is accurate and consistent with the Graystone Digital Forensics & Incident Response final forensic report dated July 14, 2023 (Graystone Report, Matter File 1025-00006-FR-001), and the breach notification submission we prepared and filed on August 15, 2023. No material discrepancies between OCR's characterization and the record. Importantly, OCR characterizes Palomar as a 'business associate' — this confirms OCR's acceptance of the BA relationship as the governing HIPAA framework for the breach. This is favorable for Quorum's compliance posture in several respects. First, it confirms that the breach originated at the BA level, not at the covered entity level, which means the primary HIPAA Security Rule obligations with respect to the compromised systems (access controls, audit controls, integrity controls, transmission security) fell on Palomar, not Quorum, under 45 C.F.R. § 164.314(a)(2)(i). Second, there is no mention of any HIPAA Security Rule deficiencies on Quorum's part — no suggestion that Quorum failed to conduct adequate risk analyses under § 164.308(a)(1)(ii)(A) with respect to its own systems, or that Quorum's vendor management practices were deficient under the Security Rule's administrative safeguard requirements. Third, the 35-day dwell time and the three-day notification lag (April 18 discovery to April 21 notification to Quorum) are characterized neutrally, without any suggestion of unreasonable delay on Palomar's part." ]

OCR's Review and Findings

OCR has reviewed the breach notification filed by the Entity, the Entity's October 5, 2023, response to this office's follow-up inquiry, and the supplemental materials provided in connection with that response. Based on its review, OCR acknowledges the following:

1. The reported breach originated at a third-party vendor, Palomar Data Solutions, Inc., which was acting as a business associate of the Entity. The breach did not originate within the Entity's own information systems or network environment.

2. The Entity had a Business Associate Agreement in place with Palomar Data Solutions, Inc., which was incorporated within the parties' Master Services Agreement framework, and which contained provisions addressing the safeguarding of protected health information, breach notification obligations, and the use and disclosure of PHI consistent with the requirements of 45 C.F.R. § 164.314(a)(2).

3. The Entity timely filed its breach notification with the Secretary of HHS within sixty (60) days of the date on which Quorum discovered (or reasonably should have known of) the breach, as required by 45 C.F.R. § 164.408. The breach notification was filed on August 15, 2023.

4. Individual notifications to affected individuals were mailed in compliance with 45 C.F.R. § 164.404 during the period of August 18, 2023, through September 15, 2023, which was within the sixty (60) day notification window prescribed by the Breach Notification Rule.

5. The Entity provided the required media notice pursuant to 45 C.F.R. § 164.406, applicable to breaches of unsecured PHI affecting more than five hundred (500) individuals in a single state or jurisdiction. The media notice was issued on August 15, 2023.

6. The notification letters to affected individuals contained all elements required by 45 C.F.R. § 164.404(c), including: (a) a brief description of the breach, including the date of the breach and the date of discovery; (b) a description of the types of unsecured PHI involved in the breach; (c) steps individuals should take to protect themselves from potential harm resulting from the breach; (d) a brief description of the Entity's investigation of the breach and the mitigation steps taken by the Entity in response; and (e) contact procedures for individuals to ask questions or learn additional information, including a toll-free telephone number, an e-mail address, a postal address, and a website, as well as contact information for the Secretary of HHS.

7. The Entity offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all individuals affected by the breach.

8. The Entity took accountability measures with respect to its business associate, including the initiation of contractual indemnification demands and the imposition of enhanced security requirements upon the business associate.

9. The Entity represented that it is reviewing and strengthening its vendor risk management and information security programs in response to the incident, including its processes for evaluating and monitoring the security practices of its business associates.

[C&H Annotation — Alan Burke: "This is the critical passage of the letter. OCR expressly credits nine distinct factors that collectively reflect Quorum's overall compliance posture. These are exactly the factors we emphasized in our October 5, 2023, response to OCR's inquiry (prepared by K. Ostrowski and A. Burke; reviewed by M. Featherstone). Breaking this down:

(a) The vendor-originated nature of the breach — OCR credits this as the first factor, which underscores that the primary compliance failure (the exploitation of the file transfer vulnerability, the 35-day dwell time) was Palomar's, not Quorum's. This is the most favorable single finding in the letter.

(b) The existence of the BAA — OCR notes the BAA was 'incorporated within the Master Services Agreement framework.' This is consistent with the structure of the Quorum-Palomar MSA (executed January 12, 2021; BAA provisions at Exhibit F). We should note that OCR does not evaluate the adequacy of the BAA's terms in any detail — it simply notes that a BAA existed and contained relevant provisions. This is sufficient for closure purposes but should not be read as OCR's endorsement of the specific BAA terms.

(c) Timely notifications across all three channels — OCR expressly credits the August 15 filing with the Secretary, the August 18 – September 15 individual notification mailing window, and the August 15 media notice. This validates the notification strategy and timeline developed by C&H and implemented by Quorum. The fact that all three notification deadlines were met is significant because late notification is one of the most common grounds for OCR enforcement action in breach cases.

(d) Notification content compliance — OCR confirms the individual notification letters met all content requirements of § 164.404(c). This validates the C&H drafting approach, including the inclusion of the toll-free number, the website, and the HHS contact information.

(e) Credit monitoring — The 24-month credit monitoring offer exceeds the minimum that OCR has historically credited (typically 12 months), and OCR explicitly notes it as a favorable factor.

(f) Vendor accountability measures — OCR credits the contractual indemnification demands and enhanced security requirements. This is consistent with the demand letter sent to Palomar on June 2, 2023, and the subsequent settlement and amended MSA terms.

(g) Ongoing remediation — OCR credits Quorum's representation regarding the review and strengthening of vendor risk management programs. This aligns with the remediation workstream we have been advising on.

This language strongly supports that Quorum's HIPAA compliance posture was sound and that OCR found no basis for enforcement action." ]

Based on its review of the information and materials submitted by the Entity, OCR is not making any determination as to whether Quorum Insurance Holdings Corp. violated the Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule"), 45 C.F.R. Part 160 and Subparts A and E of Part 164; the Security Standards for the Protection of Electronic Protected Health Information ("Security Rule"), 45 C.F.R. Part 160 and Subparts A and C of Part 164; or the Breach Notification Rule, 45 C.F.R. Part 160 and Subparts A and D of Part 164.

Based on its review, OCR has determined that no further action is warranted at this time regarding the breach reported by the Entity in Breach Report No. OCR-BI-23-014837.

[C&H Annotation — Alan Burke: "This is standard OCR closing language — 'no further action warranted at this time.' Two important points require emphasis. First, note the 'at this time' qualifier. This language is boilerplate and is included in virtually all OCR no-further-action letters; it is not unique to this matter and should not be read as signaling any particular residual concern about Quorum's compliance. The qualifier preserves OCR's discretion to reopen the matter if new information comes to light — for example, if affected individuals file HIPAA complaints with OCR alleging that the breach resulted from Quorum's own Security Rule deficiencies, or if a subsequent breach at Quorum or Palomar suggests systemic compliance failures.

Second, and critically, this is NOT an affirmative finding of compliance. OCR expressly states it is 'not making any determination as to whether [Quorum] violated' the HIPAA Rules. This means the letter cannot be cited as a regulatory finding that Quorum complied with HIPAA. In any subsequent litigation by affected individuals — for example, in the class action context or in individual state-law negligence claims — plaintiffs may argue that the absence of an affirmative compliance finding means the letter has no defensive value. We should advise the client that the letter is a favorable closure disposition (no fine, no penalty, no consent order, no corrective action plan) but is not a safe harbor against future regulatory scrutiny or private litigation. The distinction matters for any subsequent use of this letter in litigation or settlement discussions.

Recommend we advise Thomas Whitfield and Jennifer Liang accordingly during the final matter debrief." ]

Reservations

OCR advises the Entity that the closure of this matter does not constitute a determination by OCR that the Entity is or has been in compliance with the HIPAA Privacy Rule, the HIPAA Security Rule, or the Breach Notification Rule. The closure of this matter similarly does not constitute a determination by OCR that the Entity is or has been in non-compliance with any of the foregoing Rules.

OCR further advises the Entity that individuals may file complaints with OCR alleging violations of the HIPAA Rules at any time, and OCR retains full discretion to investigate any such complaints that may be filed in connection with the Entity's practices or the breach that is the subject of this letter.

OCR reserves the right to reopen this matter at any time if additional information comes to OCR's attention that, in OCR's judgment, warrants further review.

OCR encourages the Entity to continue its efforts to comply with the HIPAA Privacy, Security, and Breach Notification Rules, including the ongoing assessment of business associate agreements and the security practices of vendors and business associates to whom the Entity entrusts protected health information.

[C&H Annotation — Alan Burke: "These are standard reservations included in virtually all OCR closure letters. They are not unique to this matter, and comparable language appears in the OCR closure letters reviewed in our research for the October 5 response. However, one aspect of the concluding paragraph merits attention: the specific encouragement to 'continue its efforts to comply' with HIPAA, 'including the ongoing assessment of business associate agreements and the security practices of vendors and business associates.' While this is consistent with OCR's general emphasis on vendor risk management — an area OCR has highlighted in multiple enforcement actions and resolution agreements over the past several years — the specific mention of BAA assessment and vendor security practices in this letter may signal that OCR views vendor risk management as a continuing area of focus for Quorum.

This language aligns directly with our post-incident recommendations to Quorum, as set forth in the Post-Incident Lessons Learned & Remediation Recommendations Memo dated November 30, 2023 (C&H Memo 1025-00006-MEM-019). Specifically, Recommendation Nos. 3 (enhanced BAA terms incorporating security audit rights, incident response SLAs, and vulnerability management obligations), 4 (annual vendor security assessments using standardized questionnaires and penetration testing requirements), and 5 (tiered vendor risk classification program) are directly responsive to the concerns implied by this passage.

We should flag this language to Jennifer Liang (CPO) and Priya Deshmukh (Associate General Counsel — Privacy & Regulatory) as reinforcing the need for prompt implementation of the enhanced vendor oversight measures we recommended. David Naranjo (CISO) should also be notified, as the vendor security assessment program falls within his operational remit." ]

Closing

Accordingly, this office is closing its file on Breach Report No. OCR-BI-23-014837. No further response from the Entity or its counsel is required at this time. Should you have any questions regarding this letter or the closure of this matter, please contact this office at the address and telephone number listed above, referencing the breach report number in all communications.

Sincerely,

Margaret A. Callahan Regional Manager (Acting) Office for Civil Rights, Region I U.S. Department of Health and Human Services J.F.K. Federal Building, Room 1875 Boston, MA 02203

PART TWO

CALDERWOOD & HARKNESS SUMMARY ANNOTATIONS

(Attorney Work Product — Do Not Distribute)

Annotation Block 1: Significance of Closure

[C&H Annotation — Alan Burke, December 1, 2023:]

This OCR no-further-action letter, dated November 30, 2023, represents the third and final regulatory closure in the Palomar Data Solutions data breach matter. The three regulatory tracks that were opened in connection with the breach have now all concluded:

1. Multistate Attorneys General Inquiry. The multistate inquiry, led by the Connecticut Attorney General's Office and joined by the attorneys general of Massachusetts, New York, and New Jersey, closed without enforcement action on November 22, 2023. The closure letter from the Connecticut AG's office confirmed that the participating states would take no further action in connection with the breach. (See C&H Matter File 1025-00006-REG-AG, Closure Letter dated November 22, 2023.)

2. Connecticut Insurance Department Inquiry. The Connecticut Insurance Department ("CID") inquiry, initiated following the breach notification submitted to CID on August 15, 2023, closed without enforcement action on November 28, 2023. The CID closure letter confirmed that the Department would take no further regulatory action in connection with the breach. (See C&H Matter File 1025-00006-REG-CID, Closure Letter dated November 28, 2023.)

3. HHS-OCR Breach Report Review. This OCR no-further-action letter, dated November 30, 2023, closes the third and final regulatory track.

All three regulatory tracks have now closed without enforcement action, fines, penalties, consent orders, corrective action plans, or resolution agreements. This is a highly favorable outcome for Quorum.

Combined with the Palomar Data Solutions settlement agreement executed on October 27, 2023 (C&H Matter File 1025-00006-SET-001; total recovery of $6,156,000, consisting of a $4,200,000 cash payment and an 18-month fee reduction valued at $1,956,000), and the cyber insurance claim submitted to Atlas Mutual Insurance Company on November 15, 2023 (Claim No. CYB-CLM-2023-05892; $5,730,250 payable by Atlas under Policy No. CYB-2023-041587 in excess of the $2,500,000 self-insured retention), this closure effectively resolves all active workstreams in the Palomar data breach matter.

I recommend that the C&H team proceed with formal matter closure procedures effective December 1, 2023, subject to the ongoing monitoring obligations described in Annotation Block 3 below and the document retention requirements outlined in the Document Retention & Privilege Log Protocol Memo dated December 1, 2023 (C&H Memo 1025-00006-MEM-020).

Annotation Block 2: Key Takeaways for Client

[C&H Annotation — Alan Burke, December 1, 2023:]

The following key takeaways should be communicated to the client in the final matter debrief (to be scheduled by Kevin Ostrowski):

1. Business Associate Characterization. OCR's characterization of Palomar as a business associate and the breach as BA-originated is favorable and shifts primary responsibility for the underlying security failure to Palomar under the HIPAA framework. Under 45 C.F.R. § 164.314(a)(2)(i), business associates are independently required to comply with the Security Rule with respect to the electronic PHI they create, receive, maintain, or transmit on behalf of a covered entity. The fact that the breach originated in Palomar's systems — specifically, through a vulnerability in Palomar's file transfer appliance — means the Security Rule compliance failure was Palomar's, not Quorum's. OCR's express acknowledgment of this point is significant and may have defensive value in any future litigation.

2. Business Associate Agreement. The existence and terms of the BAA (incorporated as Exhibit F to the Quorum-Palomar Master Services Agreement, executed January 12, 2021) were cited as a positive factor by OCR. This reinforces the critical importance of maintaining robust, current BAA terms in all vendor agreements involving PHI. The BAA's inclusion of breach notification obligations (requiring Palomar to notify Quorum within 72 hours of discovering a breach), indemnification provisions, and security safeguard requirements contributed to OCR's favorable assessment. Going forward, Quorum should ensure that all BAAs are reviewed and updated in accordance with the enhanced BAA template provisions recommended in the Remediation Recommendations Memo.

3. Timely Notification. OCR expressly credited Quorum's timely notification across all three required channels: (a) the breach report to the Secretary of HHS, filed August 15, 2023; (b) individual notification letters mailed between August 18, 2023, and September 15, 2023; and (c) media notice issued on August 15, 2023. All three notifications were completed within the sixty (60) day window required by 45 C.F.R. §§ 164.404, 164.406, and 164.408. This validates the notification strategy and timeline developed by C&H in coordination with Quorum's legal and compliance teams during the period following the breach determination.

4. Notification Content. OCR confirmed that the individual notification letters met all content requirements of 45 C.F.R. § 164.404(c). This validates the C&H drafting approach, which was based on a comprehensive review of OCR guidance, prior OCR enforcement actions involving deficient notifications, and best practices in breach notification communications.

5. Credit Monitoring and Remediation. OCR expressly credited Quorum's offer of 24 months of complimentary credit monitoring and identity theft protection services to all affected individuals, as well as the vendor accountability measures (contractual indemnification demands and enhanced security requirements) taken against Palomar. The 24-month credit monitoring period exceeds the 12-month period that is more commonly offered in comparable breach responses and was a deliberate choice to demonstrate good faith and mitigate potential harm to affected individuals.

6. "At This Time" Qualifier. The "at this time" qualifier in OCR's closure language is standard boilerplate and should not be a cause for concern. However, it does mean that OCR retains the theoretical ability to reopen this matter if new information warrants. Accordingly, Quorum should maintain all breach-related documentation and continue its HIPAA compliance efforts. The closure letter is a favorable disposition but is not an affirmative finding of compliance and does not constitute a safe harbor against future regulatory scrutiny or private litigation.

Annotation Block 3: Recommended Follow-Up Actions

[C&H Annotation — Alan Burke, December 1, 2023:]

The following follow-up actions are recommended:

1. Client Distribution. Forward a clean (unannotated) copy of the OCR letter to Thomas R. Whitfield (General Counsel, Quorum Insurance Holdings Corp.), Jennifer Liang (Chief Privacy Officer), and David Naranjo (Chief Information Security Officer) under cover email from Kevin Ostrowski. The cover email should summarize the significance of the closure and note the key takeaways outlined in Annotation Block 2 above. Sara Hendricks to prepare draft cover email for Kevin's review.

2. Board Audit Committee Briefing. Include the OCR closure in the final Board Audit Committee briefing memo. The memorandum to Franklin Reeves (Chair, Audit Committee of the Board of Directors) dated November 29, 2023 (C&H Memo 1025-00006-MEM-018) should be supplemented with a brief addendum reflecting the November 30, 2023, OCR closure. Alan Burke to prepare the addendum for Kevin Ostrowski's review and transmittal.

3. Matter File Documentation. File the original OCR letter in the matter documentation under the regulatory correspondence section (C&H Matter File 1025-00006-REG-OCR). The annotated copy should be maintained in a separate subfolder designated for attorney work product. Both documents should be reflected on the privilege log.

4. No Further Response to OCR. No further response to OCR is required. The letter expressly states that no further response is necessary.

5. Implementation of Remediation Recommendations. Recommend that Quorum implement the enhanced vendor risk management and BAA provisions outlined in the Post-Incident Lessons Learned & Remediation Recommendations Memo dated November 30, 2023 (C&H Memo 1025-00006-MEM-019). The OCR letter's concluding language encouraging ongoing assessment of BAAs and vendor security practices reinforces the importance of these recommendations. Jennifer Liang and Priya Deshmukh should be specifically advised that OCR's language supports prioritizing the following recommendations from the Memo: (a) Recommendation No. 3 — enhanced BAA template with security audit rights, incident response SLAs, and vulnerability management obligations; (b) Recommendation No. 4 — annual vendor security assessments; and (c) Recommendation No. 5 — tiered vendor risk classification program.

6. Document Retention. All breach-related documentation — including forensic reports (Graystone Digital Forensics & Incident Response report dated July 14, 2023), notification records (copies of all individual notification letters, media notice, and OCR breach report), regulatory correspondence (AG inquiry correspondence, CID inquiry correspondence, and OCR correspondence), settlement agreements (Palomar settlement agreement dated October 27, 2023), and insurance claim documentation (Atlas Mutual claim submission dated November 15, 2023) — should be retained for a minimum of six (6) years from the date of this closure letter (i.e., through at least November 30, 2029). This retention period is consistent with HIPAA record retention requirements under 45 C.F.R. § 164.530(j) and with the retention schedule set forth in the Document Retention & Privilege Log Protocol Memo dated December 1, 2023 (C&H Memo 1025-00006-MEM-020). Quorum's records management team should be notified of the retention hold.

7. Ongoing Monitoring. Monitor for any individual HIPAA complaints filed with OCR related to this breach. OCR expressly reserved the right to investigate complaints from affected individuals. While we have no reason to expect such complaints, the possibility cannot be excluded, particularly given the size of the affected population (41,203 individuals). If Quorum receives any correspondence from OCR indicating that a complaint has been filed, Quorum should immediately notify Kevin Ostrowski at C&H.

Annotation Block 4: Impact on Pending Matters

[C&H Annotation — Alan Burke, December 1, 2023:]

The OCR closure has the following implications for the remaining pending matters and workstreams:

Insurance Claim — Atlas Mutual Insurance Company

Claim No. CYB-CLM-2023-05892, filed November 15, 2023. The OCR closure without any fine, penalty, corrective action plan, or resolution agreement means there is no regulatory fine or penalty amount to include in the insurance claim. The total breach response costs remain at $8,230,250, as detailed in the cost summary prepared by C&H and submitted to Atlas Mutual in connection with the claim. Of this amount, $5,730,250 is payable by Atlas Mutual under the primary cyber insurance policy (Policy No. CYB-2023-041587) in excess of the $2,500,000 self-insured retention ("SIR"). The absence of any regulatory penalty reduces the complexity of the claim and should facilitate timely processing by Atlas. No amendment to the claim submission is required as a result of the OCR closure.

Palomar Data Solutions Settlement

The settlement agreement with Palomar Data Solutions, Inc., was fully executed on October 27, 2023. The OCR closure does not affect the terms of the settlement. The total recovery under the settlement — $4,200,000 in cash (payable in two installments: $2,100,000 on November 15, 2023, and $2,100,000 on February 15, 2024) and an 18-month fee reduction of 8% across all service lines, valued at approximately $1,956,000 — remains intact. Total recovery: $6,156,000. The settlement agreement contains no provision conditioning performance on the outcome of any regulatory review, and Palomar's obligations are unconditional.

SEC Disclosure Considerations

The OCR closure without enforcement action is favorable for the materiality analysis discussed in the SEC Disclosure Analysis Memo dated July 19, 2023 (C&H Memo 1025-00006-MEM-009, prepared by the Capital Markets group in consultation with the Privacy & Data Security group). The absence of any regulatory enforcement action across all three tracks (multistate AG, CID, and OCR) supports the position that the incident's financial impact does not rise to a level requiring a Current Report on Form 8-K under Item 1.05 (Material Cybersecurity Incidents), as adopted by the SEC in July 2023.

The total breach response costs of $8,230,250, measured against Quorum's annual revenue of approximately $4.82 billion and market capitalization of approximately $6.1 billion, represent less than 0.2% of annual revenue and approximately 0.13% of market cap. When offset by the Palomar settlement recovery ($6,156,000) and the expected Atlas Mutual insurance recovery ($5,730,250), the net financial impact to Quorum is expected to be de minimis or favorable. These figures, combined with the absence of any regulatory fine, penalty, or consent order, support the conclusion that the incident does not meet the quantitative or qualitative materiality thresholds for 8-K disclosure.

Notwithstanding the foregoing, ongoing disclosure in the risk factors section of Quorum's quarterly reports on Form 10-Q should be maintained for at least the next two reporting periods, consistent with the disclosure approach outlined in the SEC Disclosure Analysis Memo. The risk factor disclosure should reflect the occurrence of the breach, the completion of the breach response and notification process, the closure of all regulatory inquiries without enforcement action, and the ongoing risk of data security incidents. Kevin Ostrowski to coordinate with Quorum's securities counsel (outside counsel at Foley & Palmer LLP, or in-house as appropriate) regarding the specific language for the upcoming 10-Q filing.

PART THREE

DISTRIBUTION AND FILING INSTRUCTIONS

[Instructions — Alan Burke to Sara Hendricks, December 1, 2023:]

Sara — please take the following actions regarding this document and the underlying OCR letter:

1. Matter File. Save this annotated copy to Matter No. 1025-00006, Regulatory Correspondence subfolder, under the HHS-OCR designation (C&H Matter File 1025-00006-REG-OCR). File as document number OCR-003 (following the initial breach report filing as OCR-001 and the October 5 inquiry response as OCR-002).

2. Privilege Log. Add this annotated copy to the privilege log under the attorney work product category. The entry should reflect: (a) document title: "HHS-OCR No Further Action Letter — Calderwood & Harkness Internal Annotated Copy"; (b) date: December 1, 2023; (c) author: Alan Burke; (d) privilege basis: attorney work product (mental impressions, conclusions, opinions, and legal theories of counsel); (e) description: internal annotated copy of OCR closure letter with C&H analysis of regulatory, litigation, and compliance implications.

3. Client Distribution — Clean Copy Only. Send a clean (unannotated) copy of the OCR letter — i.e., the letter as received from OCR, without any C&H annotations — to Thomas R. Whitfield (General Counsel, Quorum), Jennifer Liang (CPO, Quorum), and David Naranjo (CISO, Quorum). The clean copy should be transmitted under a cover email from Kevin Ostrowski. Please prepare a draft cover email for Kevin's review by 10:00 a.m. ET on December 4, 2023.

4. Do Not Transmit Annotated Version to Client. The annotated version of this letter — i.e., this document — must not be transmitted to the client or to any person outside of Calderwood & Harkness LLP. The annotations constitute internal attorney work product reflecting the mental impressions and legal analysis of C&H attorneys and are maintained solely within the firm's files.

5. Regulatory Notification Tracker. Update the Regulatory Notification Tracker (the master tracking spreadsheet finalized on August 25, 2023, maintained on the C&H shared drive at Matter 1025-00006/Trackers/) to reflect the OCR closure date of November 30, 2023. All three regulatory tracks should now show a status of "Closed — No Action" with the respective closure dates (AG: November 22, 2023; CID: November 28, 2023; OCR: November 30, 2023).

Thank you. Please confirm completion of these actions by email to me and Kevin Ostrowski.

— Alan Burke

— END OF DOCUMENT —

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

Calderwood & Harkness LLP

This document and all annotations contained herein constitute attorney work product prepared in anticipation of litigation and in the course of providing legal advice to the client. This document is protected from disclosure under Federal Rule of Civil Procedure 26(b)(3), the work product doctrine, and applicable state law equivalents. Any inadvertent disclosure does not constitute a waiver of privilege or protection.

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
HHS-OCR No Further Action Letter — Calderwood & Harkness Internal Annotated Copy
C&H Matter Number: 1025-00006
Client: Quorum Insurance Holdings Corp.
Annotated by: Alan Burke, Lead Associate, Privacy & Data Security, Calderwood & Harkness LLP
Date of Annotations: December 1, 2023
NOTICE: This is an internal annotated copy of the official HHS-OCR letter dated November 30, 2023. Bracketed annotations in bold italics reflect Calderwood & Harkness analysis and are protected attorney work product under Federal Rule of Civil Procedure 26(b)(3) and applicable state equivalents. This document contains the mental impressions, conclusions, opinions, and legal theories of counsel. Do not distribute outside privilege holders. Any inadvertent disclosure of this document to any person not within the scope of the attorney-client privilege or work product protection does not constitute a waiver of any applicable privilege or protection.
PART ONE
FULL TEXT OF THE HHS-OCR LETTER
(with Embedded Calderwood & Harkness Annotations)
U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES
Office for Civil Rights
Region I — Boston Regional Office
Government Center, J.F.K. Federal Building, Room 1875
Boston, MA 02203
Telephone: (800) 368-1019 | TDD: (800) 537-7697
November 30, 2023
VIA ELECTRONIC MAIL AND U.S. MAIL
Reference: Breach Report No. OCR-BI-23-014837
Kevin Ostrowski, Esq. Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
Re: Breach Report Filed by Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103 Breach Report No. OCR-BI-23-014837
Dear Mr. Ostrowski:
The U.S. Department of Health and Human Services ("HHS"), Office for Civil Rights ("OCR"), is writing in connection with the breach notification submitted by Quorum Insurance Holdings Corp. ("Quorum" or the "Entity") on August 15, 2023, pursuant to Section 13402 of the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"), 42 U.S.C. § 17932, and the Breach Notification Rule at 45 C.F.R. § 164.408. According to the breach notification, the reported breach involved the unsecured protected health information ("PHI") of approximately 41,203 individuals. This letter also references and acknowledges Quorum's response to OCR's follow-up inquiry, which was transmitted to this office via electronic mail on October 5, 2023, together with supplemental documentation provided in connection with that response.
[C&H Annotation — Alan Burke: "OCR correctly identifies the breach as reported under the HITECH Act / Breach Notification Rule rather than as a compliance review or complaint investigation. This is procedurally significant — it means the file was opened as a breach report review, not a formal investigation under 45 C.F.R. Part 160, Subpart D. The standard of review is less adversarial. Under a breach report review, OCR typically examines the notification for completeness and timeliness, reviews the entity's response to any follow-up inquiries, and determines whether the entity's own account of the breach and its response suggests potential HIPAA violations warranting further investigation. This is materially different from a complaint-driven or compliance-review-driven investigation, where OCR has broader investigative authority and where the entity bears a heavier burden. The fact that this remained a breach report review throughout the process — and was never escalated to a formal investigation — is a favorable procedural outcome for Quorum." ]
Summary of the Reported Breach
Based on the information provided by the Entity in its breach notification filing and in its October 5, 2023, response to this office's inquiry, OCR understands the relevant facts as follows:
The Entity reported that a threat actor gained unauthorized access to the network and systems of Palomar Data Solutions, Inc. ("Palomar"), a third-party business associate that processes claims data on behalf of Quorum. The unauthorized access was achieved through the exploitation of a remote code execution vulnerability in a file transfer appliance utilized by Palomar in the course of its data processing operations. The initial unauthorized access occurred on or about March 14, 2023. The threat actor maintained unauthorized access to the Palomar network environment over a period of approximately thirty-five (35) days, during which time data exfiltration from Palomar's systems occurred. The period of unauthorized access and exfiltration extended from approximately March 14, 2023, through April 18, 2023.
The protected health information compromised as a result of the incident included health conditions, diagnosis codes, and treatment information derived from workers' compensation claims and health-related insurance claims processed by Palomar on behalf of Quorum. The Entity reported that the breach affected a total of 41,203 individuals whose PHI was maintained by Palomar in its capacity as a business associate of Quorum.
The Entity further reported that the breach was discovered by Palomar on April 18, 2023, and that Palomar notified Quorum of the breach on April 21, 2023.
[C&H Annotation — Alan Burke: "OCR's recitation of the facts is accurate and consistent with the Graystone Digital Forensics & Incident Response final forensic report dated July 14, 2023 (Graystone Report, Matter File 1025-00006-FR-001), and the breach notification submission we prepared and filed on August 15, 2023. No material discrepancies between OCR's characterization and the record. Importantly, OCR characterizes Palomar as a 'business associate' — this confirms OCR's acceptance of the BA relationship as the governing HIPAA framework for the breach. This is favorable for Quorum's compliance posture in several respects. First, it confirms that the breach originated at the BA level, not at the covered entity level, which means the primary HIPAA Security Rule obligations with respect to the compromised systems (access controls, audit controls, integrity controls, transmission security) fell on Palomar, not Quorum, under 45 C.F.R. § 164.314(a)(2)(i). Second, there is no mention of any HIPAA Security Rule deficiencies on Quorum's part — no suggestion that Quorum failed to conduct adequate risk analyses under § 164.308(a)(1)(ii)(A) with respect to its own systems, or that Quorum's vendor management practices were deficient under the Security Rule's administrative safeguard requirements. Third, the 35-day dwell time and the three-day notification lag (April 18 discovery to April 21 notification to Quorum) are characterized neutrally, without any suggestion of unreasonable delay on Palomar's part." ]
OCR's Review and Findings
OCR has reviewed the breach notification filed by the Entity, the Entity's October 5, 2023, response to this office's follow-up inquiry, and the supplemental materials provided in connection with that response. Based on its review, OCR acknowledges the following:
1. The reported breach originated at a third-party vendor, Palomar Data Solutions, Inc., which was acting as a business associate of the Entity. The breach did not originate within the Entity's own information systems or network environment.
2. The Entity had a Business Associate Agreement in place with Palomar Data Solutions, Inc., which was incorporated within the parties' Master Services Agreement framework, and which contained provisions addressing the safeguarding of protected health information, breach notification obligations, and the use and disclosure of PHI consistent with the requirements of 45 C.F.R. § 164.314(a)(2).
3. The Entity timely filed its breach notification with the Secretary of HHS within sixty (60) days of the date on which Quorum discovered (or reasonably should have known of) the breach, as required by 45 C.F.R. § 164.408. The breach notification was filed on August 15, 2023.
4. Individual notifications to affected individuals were mailed in compliance with 45 C.F.R. § 164.404 during the period of August 18, 2023, through September 15, 2023, which was within the sixty (60) day notification window prescribed by the Breach Notification Rule.
5. The Entity provided the required media notice pursuant to 45 C.F.R. § 164.406, applicable to breaches of unsecured PHI affecting more than five hundred (500) individuals in a single state or jurisdiction. The media notice was issued on August 15, 2023.
6. The notification letters to affected individuals contained all elements required by 45 C.F.R. § 164.404(c), including: (a) a brief description of the breach, including the date of the breach and the date of discovery; (b) a description of the types of unsecured PHI involved in the breach; (c) steps individuals should take to protect themselves from potential harm resulting from the breach; (d) a brief description of the Entity's investigation of the breach and the mitigation steps taken by the Entity in response; and (e) contact procedures for individuals to ask questions or learn additional information, including a toll-free telephone number, an e-mail address, a postal address, and a website, as well as contact information for the Secretary of HHS.
7. The Entity offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services to all individuals affected by the breach.
8. The Entity took accountability measures with respect to its business associate, including the initiation of contractual indemnification demands and the imposition of enhanced security requirements upon the business associate.
9. The Entity represented that it is reviewing and strengthening its vendor risk management and information security programs in response to the incident, including its processes for evaluating and monitoring the security practices of its business associates.
[C&H Annotation — Alan Burke: "This is the critical passage of the letter. OCR expressly credits nine distinct factors that collectively reflect Quorum's overall compliance posture. These are exactly the factors we emphasized in our October 5, 2023, response to OCR's inquiry (prepared by K. Ostrowski and A. Burke; reviewed by M. Featherstone). Breaking this down:
(a) The vendor-originated nature of the breach — OCR credits this as the first factor, which underscores that the primary compliance failure (the exploitation of the file transfer vulnerability, the 35-day dwell time) was Palomar's, not Quorum's. This is the most favorable single finding in the letter.
(b) The existence of the BAA — OCR notes the BAA was 'incorporated within the Master Services Agreement framework.' This is consistent with the structure of the Quorum-Palomar MSA (executed January 12, 2021; BAA provisions at Exhibit F). We should note that OCR does not evaluate the adequacy of the BAA's terms in any detail — it simply notes that a BAA existed and contained relevant provisions. This is sufficient for closure purposes but should not be read as OCR's endorsement of the specific BAA terms.
(c) Timely notifications across all three channels — OCR expressly credits the August 15 filing with the Secretary, the August 18 – September 15 individual notification mailing window, and the August 15 media notice. This validates the notification strategy and timeline developed by C&H and implemented by Quorum. The fact that all three notification deadlines were met is significant because late notification is one of the most common grounds for OCR enforcement action in breach cases.
(d) Notification content compliance — OCR confirms the individual notification letters met all content requirements of § 164.404(c). This validates the C&H drafting approach, including the inclusion of the toll-free number, the website, and the HHS contact information.
(e) Credit monitoring — The 24-month credit monitoring offer exceeds the minimum that OCR has historically credited (typically 12 months), and OCR explicitly notes it as a favorable factor.
(f) Vendor accountability measures — OCR credits the contractual indemnification demands and enhanced security requirements. This is consistent with the demand letter sent to Palomar on June 2, 2023, and the subsequent settlement and amended MSA terms.
(g) Ongoing remediation — OCR credits Quorum's representation regarding the review and strengthening of vendor risk management programs. This aligns with the remediation workstream we have been advising on.
This language strongly supports that Quorum's HIPAA compliance posture was sound and that OCR found no basis for enforcement action." ]
Based on its review of the information and materials submitted by the Entity, OCR is not making any determination as to whether Quorum Insurance Holdings Corp. violated the Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule"), 45 C.F.R. Part 160 and Subparts A and E of Part 164; the Security Standards for the Protection of Electronic Protected Health Information ("Security Rule"), 45 C.F.R. Part 160 and Subparts A and C of Part 164; or the Breach Notification Rule, 45 C.F.R. Part 160 and Subparts A and D of Part 164.
Based on its review, OCR has determined that no further action is warranted at this time regarding the breach reported by the Entity in Breach Report No. OCR-BI-23-014837.
[C&H Annotation — Alan Burke: "This is standard OCR closing language — 'no further action warranted at this time.' Two important points require emphasis. First, note the 'at this time' qualifier. This language is boilerplate and is included in virtually all OCR no-further-action letters; it is not unique to this matter and should not be read as signaling any particular residual concern about Quorum's compliance. The qualifier preserves OCR's discretion to reopen the matter if new information comes to light — for example, if affected individuals file HIPAA complaints with OCR alleging that the breach resulted from Quorum's own Security Rule deficiencies, or if a subsequent breach at Quorum or Palomar suggests systemic compliance failures.
Second, and critically, this is NOT an affirmative finding of compliance. OCR expressly states it is 'not making any determination as to whether [Quorum] violated' the HIPAA Rules. This means the letter cannot be cited as a regulatory finding that Quorum complied with HIPAA. In any subsequent litigation by affected individuals — for example, in the class action context or in individual state-law negligence claims — plaintiffs may argue that the absence of an affirmative compliance finding means the letter has no defensive value. We should advise the client that the letter is a favorable closure disposition (no fine, no penalty, no consent order, no corrective action plan) but is not a safe harbor against future regulatory scrutiny or private litigation. The distinction matters for any subsequent use of this letter in litigation or settlement discussions.
Recommend we advise Thomas Whitfield and Jennifer Liang accordingly during the final matter debrief." ]
Reservations
OCR advises the Entity that the closure of this matter does not constitute a determination by OCR that the Entity is or has been in compliance with the HIPAA Privacy Rule, the HIPAA Security Rule, or the Breach Notification Rule. The closure of this matter similarly does not constitute a determination by OCR that the Entity is or has been in non-compliance with any of the foregoing Rules.
OCR further advises the Entity that individuals may file complaints with OCR alleging violations of the HIPAA Rules at any time, and OCR retains full discretion to investigate any such complaints that may be filed in connection with the Entity's practices or the breach that is the subject of this letter.
OCR reserves the right to reopen this matter at any time if additional information comes to OCR's attention that, in OCR's judgment, warrants further review.
OCR encourages the Entity to continue its efforts to comply with the HIPAA Privacy, Security, and Breach Notification Rules, including the ongoing assessment of business associate agreements and the security practices of vendors and business associates to whom the Entity entrusts protected health information.
[C&H Annotation — Alan Burke: "These are standard reservations included in virtually all OCR closure letters. They are not unique to this matter, and comparable language appears in the OCR closure letters reviewed in our research for the October 5 response. However, one aspect of the concluding paragraph merits attention: the specific encouragement to 'continue its efforts to comply' with HIPAA, 'including the ongoing assessment of business associate agreements and the security practices of vendors and business associates.' While this is consistent with OCR's general emphasis on vendor risk management — an area OCR has highlighted in multiple enforcement actions and resolution agreements over the past several years — the specific mention of BAA assessment and vendor security practices in this letter may signal that OCR views vendor risk management as a continuing area of focus for Quorum.
This language aligns directly with our post-incident recommendations to Quorum, as set forth in the Post-Incident Lessons Learned & Remediation Recommendations Memo dated November 30, 2023 (C&H Memo 1025-00006-MEM-019). Specifically, Recommendation Nos. 3 (enhanced BAA terms incorporating security audit rights, incident response SLAs, and vulnerability management obligations), 4 (annual vendor security assessments using standardized questionnaires and penetration testing requirements), and 5 (tiered vendor risk classification program) are directly responsive to the concerns implied by this passage.
We should flag this language to Jennifer Liang (CPO) and Priya Deshmukh (Associate General Counsel — Privacy & Regulatory) as reinforcing the need for prompt implementation of the enhanced vendor oversight measures we recommended. David Naranjo (CISO) should also be notified, as the vendor security assessment program falls within his operational remit." ]
Closing
Accordingly, this office is closing its file on Breach Report No. OCR-BI-23-014837. No further response from the Entity or its counsel is required at this time. Should you have any questions regarding this letter or the closure of this matter, please contact this office at the address and telephone number listed above, referencing the breach report number in all communications.
Sincerely,
Margaret A. Callahan Regional Manager (Acting) Office for Civil Rights, Region I U.S. Department of Health and Human Services J.F.K. Federal Building, Room 1875 Boston, MA 02203
PART TWO
CALDERWOOD & HARKNESS SUMMARY ANNOTATIONS
(Attorney Work Product — Do Not Distribute)
Annotation Block 1: Significance of Closure
[C&H Annotation — Alan Burke, December 1, 2023:]
This OCR no-further-action letter, dated November 30, 2023, represents the third and final regulatory closure in the Palomar Data Solutions data breach matter. The three regulatory tracks that were opened in connection with the breach have now all concluded:
1. Multistate Attorneys General Inquiry. The multistate inquiry, led by the Connecticut Attorney General's Office and joined by the attorneys general of Massachusetts, New York, and New Jersey, closed without enforcement action on November 22, 2023. The closure letter from the Connecticut AG's office confirmed that the participating states would take no further action in connection with the breach. (See C&H Matter File 1025-00006-REG-AG, Closure Letter dated November 22, 2023.)
2. Connecticut Insurance Department Inquiry. The Connecticut Insurance Department ("CID") inquiry, initiated following the breach notification submitted to CID on August 15, 2023, closed without enforcement action on November 28, 2023. The CID closure letter confirmed that the Department would take no further regulatory action in connection with the breach. (See C&H Matter File 1025-00006-REG-CID, Closure Letter dated November 28, 2023.)
3. HHS-OCR Breach Report Review. This OCR no-further-action letter, dated November 30, 2023, closes the third and final regulatory track.
All three regulatory tracks have now closed without enforcement action, fines, penalties, consent orders, corrective action plans, or resolution agreements. This is a highly favorable outcome for Quorum.
Combined with the Palomar Data Solutions settlement agreement executed on October 27, 2023 (C&H Matter File 1025-00006-SET-001; total recovery of $6,156,000, consisting of a $4,200,000 cash payment and an 18-month fee reduction valued at $1,956,000), and the cyber insurance claim submitted to Atlas Mutual Insurance Company on November 15, 2023 (Claim No. CYB-CLM-2023-05892; $5,730,250 payable by Atlas under Policy No. CYB-2023-041587 in excess of the $2,500,000 self-insured retention), this closure effectively resolves all active workstreams in the Palomar data breach matter.
I recommend that the C&H team proceed with formal matter closure procedures effective December 1, 2023, subject to the ongoing monitoring obligations described in Annotation Block 3 below and the document retention requirements outlined in the Document Retention & Privilege Log Protocol Memo dated December 1, 2023 (C&H Memo 1025-00006-MEM-020).
Annotation Block 2: Key Takeaways for Client
[C&H Annotation — Alan Burke, December 1, 2023:]
The following key takeaways should be communicated to the client in the final matter debrief (to be scheduled by Kevin Ostrowski):
1. Business Associate Characterization. OCR's characterization of Palomar as a business associate and the breach as BA-originated is favorable and shifts primary responsibility for the underlying security failure to Palomar under the HIPAA framework. Under 45 C.F.R. § 164.314(a)(2)(i), business associates are independently required to comply with the Security Rule with respect to the electronic PHI they create, receive, maintain, or transmit on behalf of a covered entity. The fact that the breach originated in Palomar's systems — specifically, through a vulnerability in Palomar's file transfer appliance — means the Security Rule compliance failure was Palomar's, not Quorum's. OCR's express acknowledgment of this point is significant and may have defensive value in any future litigation.
2. Business Associate Agreement. The existence and terms of the BAA (incorporated as Exhibit F to the Quorum-Palomar Master Services Agreement, executed January 12, 2021) were cited as a positive factor by OCR. This reinforces the critical importance of maintaining robust, current BAA terms in all vendor agreements involving PHI. The BAA's inclusion of breach notification obligations (requiring Palomar to notify Quorum within 72 hours of discovering a breach), indemnification provisions, and security safeguard requirements contributed to OCR's favorable assessment. Going forward, Quorum should ensure that all BAAs are reviewed and updated in accordance with the enhanced BAA template provisions recommended in the Remediation Recommendations Memo.
3. Timely Notification. OCR expressly credited Quorum's timely notification across all three required channels: (a) the breach report to the Secretary of HHS, filed August 15, 2023; (b) individual notification letters mailed between August 18, 2023, and September 15, 2023; and (c) media notice issued on August 15, 2023. All three notifications were completed within the sixty (60) day window required by 45 C.F.R. §§ 164.404, 164.406, and 164.408. This validates the notification strategy and timeline developed by C&H in coordination with Quorum's legal and compliance teams during the period following the breach determination.
4. Notification Content. OCR confirmed that the individual notification letters met all content requirements of 45 C.F.R. § 164.404(c). This validates the C&H drafting approach, which was based on a comprehensive review of OCR guidance, prior OCR enforcement actions involving deficient notifications, and best practices in breach notification communications.
5. Credit Monitoring and Remediation. OCR expressly credited Quorum's offer of 24 months of complimentary credit monitoring and identity theft protection services to all affected individuals, as well as the vendor accountability measures (contractual indemnification demands and enhanced security requirements) taken against Palomar. The 24-month credit monitoring period exceeds the 12-month period that is more commonly offered in comparable breach responses and was a deliberate choice to demonstrate good faith and mitigate potential harm to affected individuals.
6. "At This Time" Qualifier. The "at this time" qualifier in OCR's closure language is standard boilerplate and should not be a cause for concern. However, it does mean that OCR retains the theoretical ability to reopen this matter if new information warrants. Accordingly, Quorum should maintain all breach-related documentation and continue its HIPAA compliance efforts. The closure letter is a favorable disposition but is not an affirmative finding of compliance and does not constitute a safe harbor against future regulatory scrutiny or private litigation.
Annotation Block 3: Recommended Follow-Up Actions
[C&H Annotation — Alan Burke, December 1, 2023:]
The following follow-up actions are recommended:
1. Client Distribution. Forward a clean (unannotated) copy of the OCR letter to Thomas R. Whitfield (General Counsel, Quorum Insurance Holdings Corp.), Jennifer Liang (Chief Privacy Officer), and David Naranjo (Chief Information Security Officer) under cover email from Kevin Ostrowski. The cover email should summarize the significance of the closure and note the key takeaways outlined in Annotation Block 2 above. Sara Hendricks to prepare draft cover email for Kevin's review.
2. Board Audit Committee Briefing. Include the OCR closure in the final Board Audit Committee briefing memo. The memorandum to Franklin Reeves (Chair, Audit Committee of the Board of Directors) dated November 29, 2023 (C&H Memo 1025-00006-MEM-018) should be supplemented with a brief addendum reflecting the November 30, 2023, OCR closure. Alan Burke to prepare the addendum for Kevin Ostrowski's review and transmittal.
3. Matter File Documentation. File the original OCR letter in the matter documentation under the regulatory correspondence section (C&H Matter File 1025-00006-REG-OCR). The annotated copy should be maintained in a separate subfolder designated for attorney work product. Both documents should be reflected on the privilege log.
4. No Further Response to OCR. No further response to OCR is required. The letter expressly states that no further response is necessary.
5. Implementation of Remediation Recommendations. Recommend that Quorum implement the enhanced vendor risk management and BAA provisions outlined in the Post-Incident Lessons Learned & Remediation Recommendations Memo dated November 30, 2023 (C&H Memo 1025-00006-MEM-019). The OCR letter's concluding language encouraging ongoing assessment of BAAs and vendor security practices reinforces the importance of these recommendations. Jennifer Liang and Priya Deshmukh should be specifically advised that OCR's language supports prioritizing the following recommendations from the Memo: (a) Recommendation No. 3 — enhanced BAA template with security audit rights, incident response SLAs, and vulnerability management obligations; (b) Recommendation No. 4 — annual vendor security assessments; and (c) Recommendation No. 5 — tiered vendor risk classification program.
6. Document Retention. All breach-related documentation — including forensic reports (Graystone Digital Forensics & Incident Response report dated July 14, 2023), notification records (copies of all individual notification letters, media notice, and OCR breach report), regulatory correspondence (AG inquiry correspondence, CID inquiry correspondence, and OCR correspondence), settlement agreements (Palomar settlement agreement dated October 27, 2023), and insurance claim documentation (Atlas Mutual claim submission dated November 15, 2023) — should be retained for a minimum of six (6) years from the date of this closure letter (i.e., through at least November 30, 2029). This retention period is consistent with HIPAA record retention requirements under 45 C.F.R. § 164.530(j) and with the retention schedule set forth in the Document Retention & Privilege Log Protocol Memo dated December 1, 2023 (C&H Memo 1025-00006-MEM-020). Quorum's records management team should be notified of the retention hold.
7. Ongoing Monitoring. Monitor for any individual HIPAA complaints filed with OCR related to this breach. OCR expressly reserved the right to investigate complaints from affected individuals. While we have no reason to expect such complaints, the possibility cannot be excluded, particularly given the size of the affected population (41,203 individuals). If Quorum receives any correspondence from OCR indicating that a complaint has been filed, Quorum should immediately notify Kevin Ostrowski at C&H.
Annotation Block 4: Impact on Pending Matters
[C&H Annotation — Alan Burke, December 1, 2023:]
The OCR closure has the following implications for the remaining pending matters and workstreams:
Insurance Claim — Atlas Mutual Insurance Company
Claim No. CYB-CLM-2023-05892, filed November 15, 2023. The OCR closure without any fine, penalty, corrective action plan, or resolution agreement means there is no regulatory fine or penalty amount to include in the insurance claim. The total breach response costs remain at $8,230,250, as detailed in the cost summary prepared by C&H and submitted to Atlas Mutual in connection with the claim. Of this amount, $5,730,250 is payable by Atlas Mutual under the primary cyber insurance policy (Policy No. CYB-2023-041587) in excess of the $2,500,000 self-insured retention ("SIR"). The absence of any regulatory penalty reduces the complexity of the claim and should facilitate timely processing by Atlas. No amendment to the claim submission is required as a result of the OCR closure.
Palomar Data Solutions Settlement
The settlement agreement with Palomar Data Solutions, Inc., was fully executed on October 27, 2023. The OCR closure does not affect the terms of the settlement. The total recovery under the settlement — $4,200,000 in cash (payable in two installments: $2,100,000 on November 15, 2023, and $2,100,000 on February 15, 2024) and an 18-month fee reduction of 8% across all service lines, valued at approximately $1,956,000 — remains intact. Total recovery: $6,156,000. The settlement agreement contains no provision conditioning performance on the outcome of any regulatory review, and Palomar's obligations are unconditional.
SEC Disclosure Considerations
The OCR closure without enforcement action is favorable for the materiality analysis discussed in the SEC Disclosure Analysis Memo dated July 19, 2023 (C&H Memo 1025-00006-MEM-009, prepared by the Capital Markets group in consultation with the Privacy & Data Security group). The absence of any regulatory enforcement action across all three tracks (multistate AG, CID, and OCR) supports the position that the incident's financial impact does not rise to a level requiring a Current Report on Form 8-K under Item 1.05 (Material Cybersecurity Incidents), as adopted by the SEC in July 2023.
The total breach response costs of $8,230,250, measured against Quorum's annual revenue of approximately $4.82 billion and market capitalization of approximately $6.1 billion, represent less than 0.2% of annual revenue and approximately 0.13% of market cap. When offset by the Palomar settlement recovery ($6,156,000) and the expected Atlas Mutual insurance recovery ($5,730,250), the net financial impact to Quorum is expected to be de minimis or favorable. These figures, combined with the absence of any regulatory fine, penalty, or consent order, support the conclusion that the incident does not meet the quantitative or qualitative materiality thresholds for 8-K disclosure.
Notwithstanding the foregoing, ongoing disclosure in the risk factors section of Quorum's quarterly reports on Form 10-Q should be maintained for at least the next two reporting periods, consistent with the disclosure approach outlined in the SEC Disclosure Analysis Memo. The risk factor disclosure should reflect the occurrence of the breach, the completion of the breach response and notification process, the closure of all regulatory inquiries without enforcement action, and the ongoing risk of data security incidents. Kevin Ostrowski to coordinate with Quorum's securities counsel (outside counsel at Foley & Palmer LLP, or in-house as appropriate) regarding the specific language for the upcoming 10-Q filing.
PART THREE
DISTRIBUTION AND FILING INSTRUCTIONS
[Instructions — Alan Burke to Sara Hendricks, December 1, 2023:]
Sara — please take the following actions regarding this document and the underlying OCR letter:
1. Matter File. Save this annotated copy to Matter No. 1025-00006, Regulatory Correspondence subfolder, under the HHS-OCR designation (C&H Matter File 1025-00006-REG-OCR). File as document number OCR-003 (following the initial breach report filing as OCR-001 and the October 5 inquiry response as OCR-002).
2. Privilege Log. Add this annotated copy to the privilege log under the attorney work product category. The entry should reflect: (a) document title: "HHS-OCR No Further Action Letter — Calderwood & Harkness Internal Annotated Copy"; (b) date: December 1, 2023; (c) author: Alan Burke; (d) privilege basis: attorney work product (mental impressions, conclusions, opinions, and legal theories of counsel); (e) description: internal annotated copy of OCR closure letter with C&H analysis of regulatory, litigation, and compliance implications.
3. Client Distribution — Clean Copy Only. Send a clean (unannotated) copy of the OCR letter — i.e., the letter as received from OCR, without any C&H annotations — to Thomas R. Whitfield (General Counsel, Quorum), Jennifer Liang (CPO, Quorum), and David Naranjo (CISO, Quorum). The clean copy should be transmitted under a cover email from Kevin Ostrowski. Please prepare a draft cover email for Kevin's review by 10:00 a.m. ET on December 4, 2023.
4. Do Not Transmit Annotated Version to Client. The annotated version of this letter — i.e., this document — must not be transmitted to the client or to any person outside of Calderwood & Harkness LLP. The annotations constitute internal attorney work product reflecting the mental impressions and legal analysis of C&H attorneys and are maintained solely within the firm's files.
5. Regulatory Notification Tracker. Update the Regulatory Notification Tracker (the master tracking spreadsheet finalized on August 25, 2023, maintained on the C&H shared drive at Matter 1025-00006/Trackers/) to reflect the OCR closure date of November 30, 2023. All three regulatory tracks should now show a status of "Closed — No Action" with the respective closure dates (AG: November 22, 2023; CID: November 28, 2023; OCR: November 30, 2023).
Thank you. Please confirm completion of these actions by email to me and Kevin Ostrowski.
— Alan Burke
— END OF DOCUMENT —
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
Calderwood & Harkness LLP | Matter No. 1025-00006 | Quorum Insurance Holdings Corp. — Palomar Data Breach Response
This document and all annotations contained herein constitute attorney work product prepared in anticipation of litigation and in the course of providing legal advice to the client. This document is protected from disclosure under Federal Rule of Civil Procedure 26(b)(3), the work product doctrine, and applicable state law equivalents. Any inadvertent disclosure does not constitute a waiver of privilege or protection.

PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT

PART ONE

FULL TEXT OF THE HHS-OCR LETTER

U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES

VIA ELECTRONIC MAIL AND U.S. MAIL

PART TWO

CALDERWOOD & HARKNESS SUMMARY ANNOTATIONS

PART THREE

DISTRIBUTION AND FILING INSTRUCTIONS

Record

Parties

Dates

Amounts