EXHIBIT B
Consumer Notification Samples and Compliance Checklist
Filed in Connection with the Response of Quorum Insurance Holdings Corp. to the Joint Demand Letter of the Multistate Attorney General Coalition Dated September 8, 2023
October 13, 2023
Prepared by:
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006
On Behalf of:
Quorum Insurance Holdings Corp. 400 Constitution Plaza, Suite 2200 Hartford, CT 06103
Matter No. 1025-00006
Submitted to:
Assistant Attorney General Diane Marchetti Connecticut Attorney General's Office Consumer Protection Division
and
Assistant Attorney General Mark Petrosian New York Attorney General's Office Bureau of Internet and Technology
On Behalf of the 29-State Multistate Coalition
Right-click to update Table of Contents
I. INTRODUCTION AND OVERVIEW
Quorum Insurance Holdings Corp. ("Quorum" or the "Company") respectfully submits this Exhibit B in support of its Response to the Joint Demand Letter issued by the Multistate Attorney General Coalition (the "Coalition") on September 8, 2023. This Exhibit serves two principal purposes: (a) to provide the Coalition with complete copies of all consumer notification letter versions disseminated to affected individuals following the data security incident described herein, and (b) to present a comprehensive, state-by-state compliance checklist demonstrating that Quorum's notification program met all applicable statutory requirements for timing, content, and delivery method across each of the twenty-nine (29) affected states and the District of Columbia.
Background Summary
The data security incident at issue originated not within Quorum's own systems, but at Quorum's third-party claims-processing vendor, Palomar Data Solutions, Inc. ("Palomar"). On or about March 14, 2023, a threat actor exploited CVE-2023-0669, a remote code execution vulnerability in Palomar's GoAnywhere MFT file transfer appliance, to gain unauthorized access to certain file transfer environments maintained by Palomar. The unauthorized access and data exfiltration activity continued through approximately April 18, 2023—a period of approximately thirty-five (35) days. Quorum was first notified by Palomar of the incident on April 21, 2023, and immediately engaged Graystone Forensics, LLC ("Graystone") to conduct a comprehensive forensic investigation, while simultaneously retaining Calderwood & Harkness LLP as outside breach counsel.
Scope of Affected Data and Individuals
The forensic investigation and subsequent data mining efforts confirmed that the incident affected a total of 318,247 individuals across twenty-nine (29) states and the District of Columbia. The types of personal information compromised are categorized as follows:
• Personally Identifiable Information ("PII"): Names, dates of birth, Social Security numbers, and driver's license numbers were compromised for all 318,247 affected individuals.
• Financial Information: Bank account numbers and/or payment card numbers were compromised for a subset of 84,619 individuals.
• Protected Health Information ("PHI"): Health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims were compromised for a subset of 41,203 individuals.
Investigation and Notification Timeline
Quorum's response to the incident followed a deliberate and expeditious timeline designed to ensure accuracy in identifying affected individuals while prioritizing timely notification. The key milestones are as follows:
• March 14, 2023: Threat actor initially exploited CVE-2023-0669 vulnerability in Palomar's GoAnywhere MFT appliance.
• April 18, 2023: Data exfiltration activity ceased.
• April 21, 2023: Palomar notified Quorum of the security incident.
• April 22, 2023: Quorum engaged Graystone Forensics, LLC to conduct forensic investigation and Calderwood & Harkness LLP as outside breach counsel.
• July 14, 2023: Graystone Forensics issued its final forensic investigation report.
• August 4, 2023: Data mining and identification of all affected individuals and compromised data elements completed.
• August 10–12, 2023: All five notification letter versions finalized.
• August 14–25, 2023: Regulatory notifications filed with all applicable state attorneys general, the Connecticut Insurance Department, and the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS-OCR").
• August 15, 2023: Substitute notice posted on Quorum's website and HIPAA-required media notice distributed.
• August 18, 2023: Consumer notification mailings commenced.
• September 15, 2023: Consumer notification mailings completed.
The notification mailing process was conducted on a rolling basis over a period of approximately twenty-eight (28) days, from August 18 through September 15, 2023. Notification mailings were managed by Clearfield Notification Services LLC ("Clearfield"), a nationally recognized breach notification services provider retained under the direction and privilege of Calderwood & Harkness LLP. All 318,247 affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services. To date, the estimated take-rate for credit monitoring enrollment is approximately 40%, representing roughly 127,299 enrollees. A toll-free call center, also operated by Clearfield, was activated on August 18, 2023, and will remain operational for a twelve-week window to assist affected individuals with questions and enrollment.
Organization of This Exhibit
This Exhibit is organized as follows:
• Section II provides copies and descriptions of all five consumer notification letter versions developed for the notification program.
• Section III presents the state-by-state notification compliance checklist, including a detailed timing analysis, content compliance summary, and delivery method confirmation.
• Section IV summarizes all regulatory notifications filed with state attorneys general, the Connecticut Insurance Department, and HHS-OCR.
• Section V provides supplemental compliance documentation, including substitute notice details, call center operations, credit monitoring service information, and mailing logistics.
• Section VI sets forth the conclusion.
• Tabs B-1 through B-7 contain the referenced notification letter copies, substitute notice language, and regulatory notification tracking documentation.
II. CONSUMER NOTIFICATION LETTER VERSIONS
A. Overview of Letter Versions
In coordination with Calderwood & Harkness LLP, Quorum developed five (5) distinct notification letter versions to address the varying types of personal information compromised and to satisfy the specific legal requirements of certain jurisdictions. The development of multiple letter versions reflected Quorum's commitment to providing affected individuals with notification content that was both legally compliant and tailored to the specific risks posed by the categories of data exposed in the incident.
All five letter versions shared a common organizational structure, which included the following core components:
1. A clear description of the data security incident, including the nature of the unauthorized access and the dates during which the incident occurred;
2. An identification of the specific types of personal information involved for the particular recipient;
3. A description of the steps Quorum has taken in response to the incident, including engagement of forensic investigators, notification of law enforcement, enhanced vendor security requirements, and remediation measures;
4. Recommendations for steps the individual can take to protect themselves, including monitoring credit reports, placing fraud alerts or security freezes with credit reporting agencies, and reviewing account statements;
5. An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services, together with a unique activation code and detailed enrollment instructions;
6. Toll-free call center contact information, including hours of operation, for individuals seeking additional assistance or information.
All five letter versions were finalized between August 10 and August 12, 2023, following extensive legal review by Calderwood & Harkness LLP against each applicable state's breach notification statute. Printing and mailing commenced on August 18, 2023, and was completed on September 15, 2023, through Clearfield Notification Services LLC, located at 4500 Rockside Road, Suite 210, Independence, OH 44131 (Account Manager: Jerome Tillman).
B. Version 1: Model Consumer Notification Letter — General PII (Tab B-1)
Date on Letter: Variable, corresponding to the specific mailing date within the August 18 through September 15, 2023 mailing window.
Recipients: Individuals whose personally identifiable information was compromised—specifically, name, date of birth, Social Security number, and driver's license number—but who were not within the financial data subset or the protected health information subset. This version served as the general-purpose notification letter and was sent to the largest number of affected individuals.
Content Summary:
The Version 1 letter contains the following substantive content:
Description of the Incident. The letter informs the recipient that Quorum learned on April 21, 2023, that Palomar Data Solutions, Inc., a third-party vendor that processes claims data on Quorum's behalf, experienced a data security incident. The letter further explains that the forensic investigation determined that unauthorized access occurred from approximately March 14, 2023, through April 18, 2023, and that during this period, an unauthorized actor accessed and acquired certain files containing personal information of individuals associated with Quorum insurance claims processed by Palomar.
Types of Information. The letter identifies the specific categories of personal information compromised for the recipient: name, date of birth, Social Security number, and driver's license number.
Steps Taken by Quorum. The letter describes Quorum's response measures, including: (i) immediate engagement of a leading forensic cybersecurity firm to conduct a thorough investigation; (ii) notification of federal law enforcement; (iii) implementation of enhanced security requirements for third-party vendors, including mandatory multi-factor authentication, endpoint detection and response solutions, and vulnerability scanning protocols; and (iv) ongoing remediation measures at the vendor level.
Steps Individuals Can Take. The letter provides detailed guidance on protective steps the individual may take, including: (i) monitoring credit reports by obtaining free copies from each of the three major credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises) through AnnualCreditReport.com; (ii) placing fraud alerts with the credit reporting agencies; (iii) placing security freezes on credit files; and (iv) reviewing financial account statements for unauthorized activity.
Credit Monitoring and Identity Theft Protection Offer. The letter offers the recipient twenty-four (24) months of complimentary credit monitoring and identity theft protection services. The letter includes a unique activation code for the recipient and provides step-by-step enrollment instructions, including a dedicated enrollment website URL and a toll-free enrollment phone number.
Toll-Free Call Center. The letter provides the toll-free call center phone number operated by Clearfield Notification Services LLC and identifies the hours of operation (Monday through Friday, 9:00 a.m. to 9:00 p.m. Eastern Time, and Saturday, 10:00 a.m. to 2:00 p.m. Eastern Time) during which trained call center agents are available to answer questions and assist with enrollment.
Identification of the Source of the Breach. The letter clearly identifies Palomar Data Solutions, Inc. as the third-party vendor at which the data security incident occurred, and explains that the incident did not involve Quorum's own internal systems.
A full copy of the Version 1 letter is attached hereto as Tab B-1.
C. Version 2: Consumer Notification Letter — SSN + Financial Data (Tab B-2)
Recipients: The 84,619 individuals whose financial information—specifically, bank account numbers and/or payment card numbers—was compromised in addition to the PII categories described in Version 1.
Content Summary: The Version 2 letter follows the same organizational structure and core content as Version 1, with the following additions and modifications:
Expanded Types of Information. In addition to name, date of birth, Social Security number, and driver's license number, the Version 2 letter identifies bank account numbers and/or payment card numbers as categories of information that may have been compromised for the recipient.
Enhanced Financial Guidance. The Version 2 letter includes expanded protective steps specifically tailored to the financial data exposure, including: (i) contacting the recipient's financial institution(s) to report the potential compromise and inquire about account monitoring or protective measures; (ii) requesting replacement debit or credit cards from issuing banks or financial institutions; (iii) monitoring bank account and credit card statements closely for any unauthorized transactions; (iv) promptly reporting any suspicious or unauthorized transactions to the applicable financial institution; and (v) considering the placement of a fraud alert or security freeze with the three major credit reporting agencies, with detailed instructions for doing so.
Same Credit Monitoring and Identity Theft Protection Offer. The Version 2 letter includes the same offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services, with a unique activation code and enrollment instructions identical in format to those provided in Version 1.
A full copy of the Version 2 letter is attached hereto as Tab B-2.
D. Version 3: Consumer Notification Letter — PHI Version (HIPAA-Compliant) (Tab B-3)
Recipients: The 41,203 individuals whose protected health information was compromised, including health conditions, diagnosis codes, and treatment information derived from workers' compensation and health-related insurance claims processed by Palomar on Quorum's behalf.
Content Summary: The Version 3 letter was developed to comply with all elements required by the HIPAA Breach Notification Rule, specifically 45 C.F.R. § 164.404(c), in addition to all applicable state breach notification requirements. The letter includes the following elements:
Brief Description of What Happened. The letter provides a concise description of the data security incident, including the date on which the breach occurred (March 14 through April 18, 2023) and the date on which Quorum discovered the breach (April 21, 2023, upon notification by Palomar).
Types of Unsecured PHI Involved. The letter specifically identifies the types of unsecured protected health information that were involved in the breach: health conditions, diagnosis codes, and treatment information related to workers' compensation and health-related insurance claims.
Steps Individuals Should Take. The letter describes the steps individuals should take to protect themselves from potential harm resulting from the breach, including monitoring explanation of benefits statements, reviewing health plan communications for evidence of fraudulent activity, and enrolling in the complimentary credit monitoring and identity theft protection services offered by Quorum.
Description of Quorum's Response. The letter provides a brief description of what Quorum is doing to investigate the breach, mitigate harm to affected individuals, and protect against further breaches, including the forensic investigation, enhanced vendor security protocols, and the notification and remediation program.
Contact Procedures. The letter provides contact procedures for individuals who have questions or seek additional information, including a toll-free telephone number, an email address (breachresponse@quoruminsurance.example), and a postal mailing address (Quorum Insurance Holdings Corp., c/o Clearfield Notification Services LLC, P.O. Box 92041, Independence, OH 44131).
HHS-OCR Contact Information. Consistent with HIPAA requirements, the letter includes contact information for the U.S. Department of Health and Human Services, Office for Civil Rights, should the individual wish to file a complaint regarding the breach.
Credit Monitoring and Identity Theft Protection Offer. The Version 3 letter includes the same offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services, with a unique activation code and enrollment instructions.
It should be noted that certain individuals fell within both the financial data subset and the PHI subset. For those individuals, a combined letter was prepared and sent containing all required elements of both Version 2 and Version 3, thereby ensuring that each such individual received a single comprehensive notification addressing all categories of compromised information.
A full copy of the Version 3 letter is attached hereto as Tab B-3.
E. Version 4: California-Specific Consumer Notification Letter (Tab B-4)
Recipients: The 38,206 affected California residents.
Content Summary: The Version 4 letter was specifically adapted to comply with the requirements of California Civil Code § 1798.82, including the prescribed format and content elements mandated for data breach notifications sent to California consumers. Key adaptations include:
Prescribed Format. The letter is titled "Notice of Data Breach" and is organized under the following statutorily prescribed headings: "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information." This format ensures full compliance with the presentational requirements of California law.
Content Elements Required Under California Law. The letter includes all content elements required by Cal. Civ. Code § 1798.82, including a description of the incident, the categories of information compromised, what the entity is doing in response, steps the individual can take, and contact information for further inquiries.
CMIA Language. For the subset of California residents whose protected health information was among the compromised data, the Version 4 letter includes language addressing the requirements of the California Confidentiality of Medical Information Act ("CMIA"), Cal. Civ. Code § 56 et seq., ensuring that these individuals received notification compliant with both state breach notification law and California's medical privacy statute.
California Attorney General's Office Reference. The letter includes a reference to the California Attorney General's office and informs the recipient of the right to report issues or concerns to that office, in accordance with California law.
Where applicable, variants of the Version 4 letter were prepared for California residents in the financial data subset and/or the PHI subset, incorporating the additional content elements described in Versions 2 and 3 within the California-prescribed format.
A full copy of the Version 4 letter is attached hereto as Tab B-4.
F. Version 5: Massachusetts-Specific Consumer Notification Letter (Tab B-5)
Recipients: The 10,217 affected Massachusetts residents.
Content Summary: The Version 5 letter was specifically adapted to comply with the notification requirements of Mass. Gen. Laws ch. 93H, § 3 and the implementing regulations at 201 CMR 17.00. Key adaptations include:
Required Statutory Language Regarding Police Reports and Security Freezes. The letter includes the mandatory statutory language informing the recipient of the right to obtain a police report if the individual is the victim of identity theft, and the right to request a security freeze on the individual's credit file.
Right to Request a Copy of the Police Report. The letter includes a specific statement informing the recipient of the right to request a copy of any police report filed in connection with identity theft resulting from the breach.
Security Freeze Instructions. The letter provides detailed instructions for placing a security freeze with each of the three major credit reporting agencies (Harborview Enterprises, Penrose Group, and Penmark Enterprises), including the mailing addresses, telephone numbers, and website URLs for initiating a security freeze with each agency.
No Charge for Security Freeze. The letter includes a statement that, pursuant to Massachusetts law, there is no charge for placing or removing a security freeze on the individual's credit file.
Massachusetts Office of Consumer Affairs and Business Regulation. The letter includes a reference to the Massachusetts Office of Consumer Affairs and Business Regulation and provides contact information for that office.
A full copy of the Version 5 letter is attached hereto as Tab B-5.
III. STATE-BY-STATE NOTIFICATION COMPLIANCE CHECKLIST
A. Methodology
In preparation for Quorum's notification program, Calderwood & Harkness LLP prepared a comprehensive fifty-state breach notification law survey, which was completed on June 8, 2023. This survey catalogued the statutory requirements of each jurisdiction with respect to notification triggers, timing mandates, content requirements, delivery methods, and regulatory notification obligations. Following completion of the forensic investigation and data mining, Calderwood & Harkness prepared a notification trigger analysis, completed on July 20, 2023, which identified the specific statutory requirements applicable in each of the twenty-nine (29) affected states and the District of Columbia based on the number of affected residents in each jurisdiction and the types of data compromised.
The compliance checklist set forth below demonstrates that Quorum's notification program achieved full compliance with each jurisdiction's requirements across five categories: (1) statutory trigger/threshold, (2) notification timing, (3) content requirements, (4) delivery method, and (5) attorney general and/or regulator notification.
B. Compliance Checklist Table
The following table summarizes the compliance status for each of the principal affected jurisdictions. A complete, detailed version of this checklist encompassing all twenty-nine (29) states and the District of Columbia is maintained in the Regulatory Notification Tracker attached hereto as Tab B-7.
Remaining 19 States and D.C.: The following jurisdictions are individually tracked in the detailed compliance checklist maintained at Tab B-7: Georgia, Virginia, Maryland, North Carolina, South Carolina, Michigan, Minnesota, Indiana, Wisconsin, Colorado, Arizona, Oregon, Washington, Tennessee, Missouri, Louisiana, Nevada, Iowa, New Hampshire, and the District of Columbia. Collectively, these jurisdictions account for 56,216 affected individuals. For each of these jurisdictions, the compliance status is confirmed as follows: notification trigger met (Y); timing compliant (Y); content requirements met (Y); delivery via first-class U.S. mail; and attorney general and/or regulator notifications filed where required between August 17 and August 25, 2023—all compliant (Y).
SUMMARY
All 29 states + D.C. — 318,247 total affected individuals — 100% compliance with all timing, content, delivery, and AG notification requirements.
C. Timing Compliance Analysis
The timing of Quorum's consumer notification program is analyzed below in the context of the applicable statutory deadlines across all affected jurisdictions.
Determination Date. For purposes of the applicable state breach notification statutes, Calderwood & Harkness LLP determined that the appropriate "determination" date—i.e., the date on which Quorum completed identification of the specific data elements compromised and the specific individuals affected—was August 4, 2023. This date reflects the conclusion of the data mining process that followed Graystone Forensics' issuance of its final forensic investigation report on July 14, 2023. The period between July 14 and August 4 was necessary to complete the extensive data review and individual identification process involving more than 318,000 records across multiple data sets.
Notification Mailing Timeline. Consumer notification mailings commenced on August 18, 2023—fourteen (14) days after the determination date—and were completed on September 15, 2023—forty-two (42) days after the determination date. The rolling mailing schedule was necessitated by the volume of notifications (318,247 letters), which required coordinated printing, personalization with unique activation codes, quality assurance review, and postal processing by Clearfield Notification Services LLC.
Statutory Deadline Analysis. The statutory timing requirements across the twenty-nine affected states and the District of Columbia vary, but the most restrictive deadline is the thirty (30) day requirement imposed by Florida, Fla. Stat. § 501.171. For Florida residents specifically, all 22,913 notification letters were prioritized in the mailing queue and were mailed within the thirty-day statutory window, with mailings to Florida residents completed no later than September 3, 2023—thirty (30) days from the August 4 determination date. Ohio imposes a forty-five (45) day deadline under Ohio Rev. Code § 1349.19, and all Ohio mailings were completed well within that timeframe. Connecticut imposes a sixty (60) day deadline, and Texas imposes a sixty (60) day outer limit; both were likewise fully satisfied. The remaining jurisdictions require notification "without unreasonable delay," "in the most expedient time possible," or "as soon as practicable," and Quorum's fourteen-day initiation of mailings following determination, coupled with a forty-two-day completion window, satisfies each of these standards.
Conclusion. All consumer notifications were timely under each applicable state statute. No notifications were sent after the expiration of any applicable statutory deadline.
D. Content Compliance Summary
Calderwood & Harkness LLP conducted a detailed content compliance review of each notification letter version against the content requirements of each applicable state breach notification statute. All notification letters included the following elements, which collectively satisfy the content requirements of all twenty-nine affected states and the District of Columbia:
• A clear description of the data security incident, including the nature and scope of the unauthorized access and the approximate dates during which the incident occurred;
• An identification of the specific types of personal information compromised for the individual recipient;
• The dates of the breach (to the extent known) and the date of discovery;
• A description of the steps taken by Quorum in response to the breach, including engagement of forensic investigators, notification of law enforcement, implementation of enhanced vendor security requirements, and ongoing remediation measures;
• Detailed recommendations for protective steps individuals can take, including enrolling in the complimentary credit monitoring and identity theft protection program, placing fraud alerts or security freezes with the three major credit reporting agencies, monitoring credit reports and financial account statements, and reporting suspicious activity;
• Contact information for Quorum, including the toll-free telephone number operated by Clearfield Notification Services LLC, a mailing address, and a dedicated website;
• Information about the three major credit reporting agencies (names, addresses, telephone numbers, and websites), where required by applicable state statute;
• An offer of twenty-four (24) months of complimentary credit monitoring and identity theft protection services, including a unique activation code and enrollment instructions.
State-Specific Adaptations. In addition to the core content elements listed above, the following state-specific adaptations were implemented:
• California (Version 4): The California-specific letter was formatted in compliance with the prescribed format of Cal. Civ. Code § 1798.82, with the required headings ("What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," "For More Information"). For California residents within the PHI subset, additional CMIA-compliant language was included.
• Massachusetts (Version 5): The Massachusetts-specific letter included all mandatory statutory language required by Mass. Gen. Laws ch. 93H, § 3, including statements regarding the right to obtain a police report, the right to request a security freeze at no charge, and detailed instructions for contacting each of the three major credit reporting agencies to place a security freeze.
• Additional State-Specific Variations: Where individual state statutes required specific disclosures not addressed by the core letter template—such as references to specific state consumer protection agencies—such content was incorporated into the applicable letter versions. These variations are documented in the detailed compliance matrix maintained at Tab B-7.
PHI Letter (Version 3). The Version 3 letter includes all elements required by 45 C.F.R. § 164.404(c) for HIPAA breach notification to affected individuals, as described in detail in Section II.D above.
E. Delivery Method
All 318,247 consumer notification letters were delivered via first-class U.S. mail to the last known address of each affected individual. First-class mail is the delivery method prescribed or permitted by all twenty-nine (29) applicable state breach notification statutes and the District of Columbia's breach notification law. No state among the affected jurisdictions required electronic-only notification, and first-class mail satisfied the delivery requirements of all applicable jurisdictions.
As a supplemental measure, and in accordance with the substitute notice provisions of applicable state statutes, Quorum posted substitute notice language on its website (www.quoruminsurance.example) beginning on August 15, 2023. The website posting is described in further detail in Section V.A below.
All notification printing, mailing, and call center operations were managed by Clearfield Notification Services LLC (Account Manager: Jerome Tillman), in coordination with Calderwood & Harkness LLP and Quorum's internal breach response team.
IV. SUMMARY OF REGULATORY NOTIFICATIONS FILED
A. Regulatory Notification Table
In addition to consumer notifications, Quorum filed regulatory notifications with all applicable state attorneys general and regulators, as well as with HHS-OCR. The following table summarizes the regulatory notifications filed:
Note: Individual filing dates and confirmation numbers for each of the remaining 19 states and D.C. are documented in the Regulatory Notification Tracker attached as Tab B-7.
Summary: All regulatory notifications were timely filed across all twenty-nine (29) states, the District of Columbia, and HHS-OCR. There were no late filings with any jurisdiction.
B. Media Notice (HIPAA Requirement)
Pursuant to 45 C.F.R. § 164.406, because the breach of unsecured protected health information affected more than 500 individuals in multiple states, Quorum was required to provide notice to prominent media outlets serving the affected jurisdictions. On August 15, 2023, Quorum distributed a media notice to prominent media outlets serving the affected states, including wire services and major metropolitan newspapers. The media notice described the breach, identified the types of protected health information involved, explained the steps Quorum was taking in response, and directed affected individuals to the toll-free call center and the Quorum website for further information and credit monitoring enrollment. The media notice was prepared by Calderwood & Harkness LLP in compliance with 45 C.F.R. § 164.406 and was distributed concurrently with the filing of the HHS-OCR breach notification.
V. SUPPLEMENTAL COMPLIANCE DOCUMENTATION
A. Substitute Notice / Website Posting
In accordance with the substitute notice provisions of applicable state breach notification statutes, Quorum posted substitute notice language on its website (www.quoruminsurance.example) beginning on August 15, 2023. The website posting was intended as a supplemental notification measure, in addition to the individualized first-class mail notifications sent to each affected individual.
The substitute notice posted on Quorum's website included the following content:
• A summary of the data security incident, including the nature of the unauthorized access and the approximate dates during which the incident occurred;
• The types of personal information that may have been involved;
• Steps individuals can take to protect themselves, including monitoring credit reports, placing fraud alerts and security freezes, and reviewing financial account statements;
• The toll-free call center telephone number and hours of operation;
• Instructions for enrolling in the complimentary twenty-four (24) month credit monitoring and identity theft protection services; and
• A link to additional frequently asked questions and resources.
The substitute notice has been maintained conspicuously on Quorum's website since its initial posting date and will remain posted through at least the conclusion of the twelve-week call center operations window, i.e., through at least November 10, 2023. A copy of the substitute notice language is attached hereto as Tab B-6.
B. Call Center Operations
To assist affected individuals with questions and enrollment, Quorum established a dedicated toll-free call center operated by Clearfield Notification Services LLC. The call center became operational on August 18, 2023, coinciding with the commencement of consumer notification mailings, and is scheduled to remain operational for a twelve-week window through approximately November 10, 2023.
Call center agents were trained using a comprehensive script and frequently asked questions ("FAQ") document prepared by Calderwood & Harkness LLP. The training materials covered the following topics:
• A factual summary of the data security incident and its timeline;
• The types of data compromised and the categories of affected individuals;
• Step-by-step instructions for enrolling in the credit monitoring and identity theft protection services, including assistance with activation code entry;
• Guidance on placing fraud alerts and security freezes with each of the three major credit reporting agencies;
• Escalation procedures for complex inquiries, including the process for escalating calls to designated Calderwood & Harkness LLP attorneys for legal or compliance-related questions; and
• Procedures for handling returned mail and address update requests.
The call center was staffed at levels sufficient to handle the anticipated call volume generated by notifications to 318,247 individuals, with capacity to scale during peak periods in the initial weeks following the commencement of mailings.
C. Credit Monitoring and Identity Theft Protection Services
All 318,247 affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services. Enrollment in these services is managed by Clearfield Notification Services LLC through a dedicated enrollment website and toll-free enrollment telephone line.
Each notification letter included a unique activation code and clear, step-by-step enrollment instructions. As of the date of this filing, the estimated enrollment take-rate is approximately 40%, representing approximately 127,299 enrollees. Quorum expects the enrollment rate to increase as additional affected individuals process their notification letters and contact the toll-free call center.
The credit monitoring and identity theft protection services are being provided at a negotiated flat fee of $2,100,000, covering the full twenty-four (24) month enrollment period for all enrollees. The services include three-bureau credit monitoring with alerts, identity theft insurance, and access to identity restoration specialists.
D. Mailing Logistics and Confirmation
The following summary describes the mailing logistics for Quorum's consumer notification program:
• Total notification letters mailed: 318,247
• Notification printing and mailing cost: Approximately $636,000 (approximately $2.00 per letter, inclusive of printing, personalization, insertion, postage, and quality assurance)
• Delivery method: All letters sent via first-class U.S. mail
• Mailing window: August 18, 2023 through September 15, 2023
• Mailing confirmation: The completion and accuracy of all mailings have been confirmed by Clearfield Notification Services LLC through production records, including print run logs, insertion verification reports, and U.S. Postal Service acceptance documentation (PS Form 3602-N receipts)
• Returned/undeliverable letters: For letters returned as undeliverable, Clearfield implemented an address update process utilizing the National Change of Address ("NCOA") database and Halcyon Data Systems address verification tools. Updated addresses were identified for returned letters where possible, and replacement letters were re-mailed to the corrected addresses. As of the date of this filing, the re-mailing process for returned letters is ongoing. Quorum estimates that approximately 4–6% of initial mailings may be returned as undeliverable, consistent with industry norms for breach notification mailings of this scale.
VI. CONCLUSION
Quorum Insurance Holdings Corp. took prompt, thorough, and comprehensive steps to notify all 318,247 affected individuals across twenty-nine (29) states and the District of Columbia following the vendor-originated data security incident at Palomar Data Solutions, Inc. The notification program was designed and executed under the direction of Calderwood & Harkness LLP and implemented through Clearfield Notification Services LLC, with careful attention to the legal requirements of each affected jurisdiction.
As demonstrated by the compliance checklist and supporting documentation set forth in this Exhibit:
1. All consumer notifications met or exceeded the timing, content, and delivery requirements of every applicable state breach notification statute, including the most restrictive thirty-day deadline imposed by Florida law.
2. All regulatory notifications were timely filed with the appropriate state attorneys general, the Connecticut Insurance Department, and HHS-OCR, with no late filings in any jurisdiction.
3. All affected individuals were offered twenty-four (24) months of complimentary credit monitoring and identity theft protection services, with an estimated enrollment rate of approximately 40% as of the date of this filing.
4. A dedicated toll-free call center was established and staffed to assist affected individuals with inquiries and enrollment for a twelve-week operational window.
5. Substitute notice was posted on Quorum's website as a supplemental notification measure, and a HIPAA-required media notice was distributed to prominent media outlets serving the affected states.
Quorum respectfully submits that its notification program was fully compliant with all applicable legal requirements and reflects best practices in data breach consumer notification. Quorum remains committed to cooperating with the Coalition and addressing any additional questions or requests for information.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Name: Katherine A. Whitfield
Title: Partner
Calderwood & Harkness LLP 1700 K Street NW, Suite 900 Washington, D.C. 20006 Telephone: (202) 555-7800
Email: k.whitfield@calderwoodharkness.example
Counsel for Quorum Insurance Holdings Corp.
Date: October 13, 2023