1025-00009 · Calderwood & Harkness LLP · Memos & Analysis

data-privacy-assessment-cover-memo.docx DOCUMENT M&A / Corporate

4 / 12 ← → ✕

CALDERWOOD & HARKNESS LLP Attorneys at Law

100 Pearl Street, Suite 800 Hartford, CT 06103 Telephone: (860) 555-7200 Facsimile: (860) 555-7201 www.calderwoodharkness.com

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION

TO: Patricia Okonkwo, General Counsel, Quorum Insurance Holdings Corp. Derek Langston, Chief Information Officer, Quorum Insurance Holdings Corp.

FROM: Nathan Ikeda, Lead Associate, Calderwood & Harkness LLP

DATE: April 10, 2024

RE: Data Privacy Impact Assessment — ClaimsIQ™ Platform (Clearpoint Analytics, Inc.)

MATTER NO.: 1025-00009

This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP for the exclusive use of the named recipients. This document contains legal advice and work product protected under applicable privileges. Any unauthorized review, use, disclosure, or distribution is strictly prohibited. If you have received this memorandum in error, please contact the sender immediately and destroy all copies.

I. Executive Summary

This memorandum summarizes the findings and recommendations arising from the data privacy impact assessment ("DPIA") of Clearpoint Analytics, Inc.'s ClaimsIQ™ platform, which was completed on April 8, 2024, by Dravello Data Compliance Advisors LLC ("Fenwick DCA"). The purpose of this memorandum is to present the key conclusions of the DPIA in a form suitable for review by Quorum Insurance Holdings Corp.'s ("Quorum" or the "Company") General Counsel and Chief Information Officer, and to confirm that the residual risks identified in the assessment have been adequately addressed through the contractual mitigants negotiated in the draft SaaS Subscription Agreement with Clearpoint Analytics, Inc. ("Clearpoint").

The DPIA was conducted by Miriam Tanaka, Principal Consultant, Dravello Data Compliance Advisors LLC, located at 45 Milk Street, Suite 600, Boston, MA 02109. Ms. Tanaka has extensive experience in privacy assessments for the insurance and financial services industries, and was engaged by Calderwood & Harkness on behalf of Quorum for this specific assessment. Her full report is enclosed under separate cover and is subject to the attorney-client privilege and work-product doctrine protections applicable to materials prepared at the direction of counsel.

By way of context, Quorum Insurance Holdings Corp. (Nasdaq: QIHC) is entering into a five-year Enterprise SaaS Subscription Agreement with Clearpoint Analytics, Inc. for the enterprise-wide deployment of the ClaimsIQ™ platform across Quorum's property and casualty and specialty lines subsidiaries. The ClaimsIQ™ platform is a cloud-hosted, artificial-intelligence-driven software-as-a-service solution designed to support claims triage, fraud detection, and claims analytics workflows. Quorum has identified ClaimsIQ™ as a strategic investment intended to modernize and streamline the Company's claims-processing operations.

The total contract value of the proposed SaaS Subscription Agreement is Seven Million Dollars ($7,000,000) over the five-year initial term, reflecting an annual contract value of One Million Four Hundred Thousand Dollars ($1,400,000). The deployment scope encompasses approximately 1,200 named users across three claims-processing locations — Hartford, Connecticut; Dallas, Texas; and Jacksonville, Florida — as well as remote-access functionality for Quorum's field adjusters operating in the territories served by Quorum's property and casualty and specialty lines of business.

The Quorum subsidiaries within scope for this deployment are as follows:

• Quorum Property & Casualty Insurance Company, a Connecticut-domiciled insurance company;

• Quorum Specialty Underwriters, Inc., a Delaware corporation; and

• Quorum Digital Solutions LLC, a Delaware limited liability company.

Each of these subsidiaries will utilize the ClaimsIQ™ platform in connection with its respective claims-handling and analytics functions, and Customer Data originating from each subsidiary will be processed through the platform.

Overall Conclusion. Fenwick DCA identified the ClaimsIQ™ platform as generally compliant with applicable data-privacy frameworks, subject to certain residual risks and recommended contractual mitigants. Those mitigants have been incorporated into the Data Processing Addendum (Exhibit C) and the Security Requirements (Exhibit D) of the SaaS Subscription Agreement, as well as into the body of the Agreement itself and related transaction documents. Calderwood & Harkness is satisfied that the mitigants, as negotiated and documented, appropriately address the risks identified by Fenwick DCA and position Quorum favorably from a data-privacy and regulatory-compliance standpoint. Our detailed analysis follows.

II. Scope of the Assessment

The DPIA conducted by Fenwick DCA was scoped in coordination with Calderwood & Harkness, Quorum's internal privacy and compliance teams, and Clearpoint's legal and information security personnel. The scope was designed to evaluate the data-privacy implications of Quorum's proposed use of the ClaimsIQ™ platform across all three in-scope subsidiaries, with attention to the specific categories of data processed, the technical architecture of the platform, and the applicable legal and regulatory frameworks. The following subsections describe the scope of the assessment in detail.

A. Data Categories Evaluated

Fenwick DCA evaluated the following categories of data that Quorum will process through the ClaimsIQ™ platform:

1. Personally Identifiable Information (PII). The assessment encompassed PII of policyholders, claimants, and third-party beneficiaries that is processed through the ClaimsIQ™ platform's claims triage, fraud detection, and analytics modules. This PII includes, but is not limited to, names, addresses, dates of birth, Social Security numbers, policy numbers, claim numbers, contact information, financial account information relevant to claims payments, and other identifying data elements routinely processed in the claims-handling context.

2. Protected Health Information (PHI). The assessment specifically addressed PHI arising from Quorum's workers' compensation lines of business. Workers' compensation claims routinely involve the processing of medical records, treatment histories, physician reports, disability assessments, and related health-related data that constitutes PHI within the meaning of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations. Given that Quorum Property & Casualty Insurance Company underwrites workers' compensation coverage in several states, the processing of PHI through ClaimsIQ™ is a material consideration for the DPIA.

3. Adjuster Notes, Internal Claims Narratives, and Investigative Materials. The assessment evaluated the privacy and confidentiality implications of processing unstructured textual data generated by Quorum's claims adjusters and investigators. These materials frequently contain sensitive personal information, legal assessments, and privileged communications, and their ingestion into a third-party platform raises distinct considerations regarding data security, access controls, and privilege preservation.

4. Customer Data Outputs and Reports. Fenwick DCA also assessed the data-privacy implications of the outputs and reports generated by the ClaimsIQ™ platform from Quorum's proprietary claims data. These outputs include analytics dashboards, fraud-detection scoring, triage recommendations, and trend analyses that are derived from Quorum's Customer Data and may contain or reflect PII and PHI. Ownership, use restrictions, and permissible purposes for these outputs were examined as part of the assessment.

B. Platform Architecture Reviewed

Fenwick DCA conducted a thorough review of the technical architecture of the ClaimsIQ™ platform to understand the data-processing environment and to identify potential privacy and security risks associated with the platform's design and operation. The key aspects of the platform architecture reviewed are as follows:

ClaimsIQ™ is a cloud-hosted, AI-driven SaaS platform purpose-built for claims triage, fraud detection, and analytics in the insurance industry. The platform was founded by Clearpoint Analytics, Inc. in 2017. Clearpoint's headquarters are located at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606. As of the fourth quarter of 2023, Clearpoint has approximately 320 employees and reported approximately $78 million in annual recurring revenue ("ARR"). Clearpoint's growth trajectory and financial position were considered by Fenwick DCA as part of the broader vendor risk assessment, including considerations of financial stability and business continuity.

The ClaimsIQ™ platform is hosted on infrastructure provided by Cobalt Cloud Infrastructure, Inc., a Delaware corporation with its principal offices at 500 Terry Francine Street, San Jose, California 95128. Cobalt Cloud serves as the infrastructure-as-a-service ("IaaS") subprocessor for the ClaimsIQ™ platform, providing compute, storage, and networking resources on which the platform operates. All Customer Data at rest is stored within Cobalt Cloud's data center environments.

Additionally, OCR and document-ingestion processing for the ClaimsIQ™ platform is performed by Redline Document AI, LLC, a California limited liability company that serves as a specialized subprocessor. Redline Document AI provides optical character recognition ("OCR") and document-processing services that enable ClaimsIQ™ to ingest scanned claims documents, medical records, and adjuster correspondence, converting unstructured document images into structured data elements that can be processed by the platform's analytics and triage engines.

Fenwick DCA's review of the platform architecture encompassed data flow mapping across all components, including the interfaces between Quorum's existing policy administration systems and the ClaimsIQ™ ingestion layer, the data-processing environment within ClaimsIQ™, the interactions between ClaimsIQ™ and its subprocessors, and the output/reporting mechanisms through which processed data is returned to Quorum users.

C. Applicable Legal and Regulatory Frameworks

Fenwick DCA assessed the ClaimsIQ™ platform and Clearpoint's data-handling practices against the following legal and regulatory frameworks, each of which is applicable to Quorum's proposed deployment:

1. Connecticut Data Privacy Act ("CTDPA"). Effective July 1, 2023, the CTDPA imposes obligations on controllers and processors of Connecticut consumers' personal data, including requirements regarding data processing agreements, consumer rights facilitation, data protection assessments, and processor accountability. As Quorum Property & Casualty Insurance Company is domiciled in Connecticut and processes personal data of Connecticut consumers, the CTDPA is directly applicable to Quorum's use of the ClaimsIQ™ platform.

2. Health Insurance Portability and Accountability Act ("HIPAA"). HIPAA is applicable to Quorum's workers' compensation lines of business where PHI is processed through the ClaimsIQ™ platform. Under HIPAA's Privacy Rule and Security Rule, covered entities such as Quorum must ensure that business associates (including SaaS providers that process PHI on behalf of the covered entity) enter into Business Associate Agreements and maintain appropriate administrative, physical, and technical safeguards for the protection of PHI.

3. NAIC Insurance Data Security Model Law (Connecticut Adoption). Connecticut has adopted the NAIC Insurance Data Security Model Law, which imposes specific cybersecurity program requirements on insurance licensees and, by extension, requires licensees to exercise due diligence in the oversight of third-party service providers that have access to nonpublic information. The Model Law's requirements regarding risk assessment, access controls, encryption, incident response, and third-party vendor management are directly relevant to Quorum's engagement of Clearpoint.

4. General Insurance Regulatory Data-Handling Requirements. In addition to the foregoing frameworks, Fenwick DCA considered general insurance regulatory requirements applicable to Quorum Property & Casualty Insurance Company as a Connecticut-domiciled insurer and to Quorum Specialty Underwriters, Inc. as a Delaware-domiciled entity, including data-handling and confidentiality obligations arising under applicable insurance codes, regulations, and market conduct standards.

III. Summary of Fenwick DCA Findings

The following sections summarize the principal findings from the Fenwick DCA assessment report. For a complete discussion of methodologies, evidence reviewed, and detailed recommendations, reference should be made to the full Fenwick DCA assessment report enclosed under separate cover.

A. Data Flow Mapping and Classification

Fenwick DCA conducted a comprehensive data-mapping exercise tracing the flow of Customer Data from Quorum's existing policy administration systems through the ClaimsIQ™ ingestion pipeline, processing and analytics layers, and output/reporting functions. This exercise was undertaken to identify all points at which Customer Data — including PII, PHI, and other sensitive data categories — is collected, transmitted, processed, stored, and ultimately deleted or returned to Quorum.

The data-mapping exercise confirmed that Customer Data ingested by ClaimsIQ™ includes structured claims records (such as policy and claim identifiers, dates of loss, loss descriptions, reserve amounts, and payment data), unstructured adjuster notes and internal claims narratives, and scanned documents (including medical records, police reports, and adjuster correspondence) that are processed through the Redline Document AI OCR pipeline. The ingestion of scanned documents is a particularly significant data flow because such documents frequently contain embedded PII and PHI in formats that are not readily susceptible to automated classification or redaction prior to processing.

With respect to data at rest, Fenwick DCA confirmed that all Customer Data processed through ClaimsIQ™ is stored within Cobalt Cloud Infrastructure environments located in the continental United States. Data in transit between Quorum's endpoints and the ClaimsIQ™ platform is encrypted using TLS 1.2 or higher, consistent with current industry standards.

Fenwick DCA confirmed that Quorum's Customer Data — including PII, PHI, adjuster notes, and all outputs and reports generated by the platform — flows through two subprocessors: Cobalt Cloud Infrastructure, Inc. (hosting and storage) and Redline Document AI, LLC (OCR and document processing). No additional subprocessors were identified in the current data flow. This confirmation was a critical element of the assessment because the identification of all subprocessors is a prerequisite for the subprocessor management framework negotiated in the Data Processing Addendum.

B. CTDPA Compliance Posture

Fenwick DCA assessed Clearpoint's current privacy practices against the requirements of the Connecticut Data Privacy Act as they apply to data processors. The assessment concluded that Clearpoint's privacy practices substantially align with CTDPA requirements for data processors, including obligations related to data processing limitations, confidentiality, cooperation with controller obligations, and data security.

However, Fenwick DCA noted that Clearpoint's standard form agreement lacked explicit designations of the respective roles of the parties as data controller and data processor within the meaning of the CTDPA. While the practical allocation of responsibilities between Quorum and Clearpoint is consistent with a controller-processor relationship, the absence of explicit contractual designations creates ambiguity that could complicate compliance efforts and regulatory interactions. Fenwick DCA recommended that the Data Processing Addendum include express language designating Quorum as the data controller and Clearpoint as the data processor with respect to all Customer Data processed through ClaimsIQ™. This recommendation has been adopted in the current draft of Exhibit C.

Fenwick DCA also reviewed Clearpoint's data retention and deletion practices. Clearpoint's standard form agreement was silent on specific timeframes for data export and destruction following termination or expiration of the agreement. Fenwick DCA recommended that the DPA specify a sixty (60) day data-export window during which Quorum may retrieve all Customer Data in usable formats, followed by a thirty (30) day period within which Clearpoint must certify the complete destruction of all Customer Data in its possession or control, including data held by subprocessors. These timeframes have been incorporated into the DPA.

With respect to consumer rights facilitation, Fenwick DCA recommended that the DPA include express obligations requiring Clearpoint to cooperate with and support Quorum in responding to CTDPA consumer data-access, deletion, and opt-out requests. The CTDPA places primary responsibility on the data controller (Quorum) to respond to consumer requests, but the controller's ability to fulfill those obligations depends in significant part on the processor's technical and operational cooperation. The DPA includes provisions requiring Clearpoint to provide reasonable assistance in responding to consumer rights requests and to implement technical measures enabling Quorum to fulfill its obligations under the CTDPA.

C. HIPAA Compliance Assessment

A material component of the Fenwick DCA assessment addressed HIPAA compliance considerations arising from the processing of PHI through the ClaimsIQ™ platform. PHI is processed through ClaimsIQ™ in connection with Quorum's workers' compensation claims, which routinely involve the collection, transmission, and analysis of medical records, treatment documentation, physician narratives, and other health-related information that constitutes PHI under HIPAA.

Fenwick DCA found that Clearpoint does not currently execute Business Associate Agreements ("BAAs") as part of its standard contracting process. This is a significant gap. Under HIPAA, a covered entity such as Quorum is required to obtain satisfactory assurances from any business associate that processes PHI on its behalf, and those assurances must be documented in a written BAA that includes specific provisions mandated by the HIPAA Privacy Rule and Security Rule. The absence of a BAA from Clearpoint's standard contracting practices indicates that Clearpoint may not have previously served customers that process PHI, or that its legal and compliance functions have not prioritized HIPAA compliance in its commercial arrangements.

Fenwick DCA recommended that BAA-equivalent provisions be incorporated within the Data Processing Addendum (Exhibit C) or, alternatively, as a standalone Business Associate Addendum. The BAA provisions should cover the required administrative, physical, and technical safeguards for PHI; restrictions on the use and disclosure of PHI to those purposes permitted or required under the DPA and applicable law; breach notification obligations specific to PHI (including the obligation to notify Quorum without unreasonable delay and in no event later than twenty-four (24) hours following discovery of a breach of unsecured PHI); requirements for return or destruction of PHI upon termination; and Clearpoint's obligation to make its internal practices, books, and records available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining HIPAA compliance. These provisions have been incorporated into the current draft of Exhibit C.

Additionally, Fenwick DCA noted that Clearpoint's current SOC 2 Type II audit report — covering the audit period from April 1, 2023, through March 31, 2024, and conducted by Hawthorne & Ellers, CPAs LLP — addresses security controls that are relevant to HIPAA compliance, including access controls, encryption, change management, and incident response. However, the SOC 2 Type II report does not constitute a HIPAA-specific audit, and it does not provide assurances regarding all of the administrative, physical, and technical safeguard requirements of the HIPAA Security Rule. Fenwick DCA recommended that Clearpoint provide supplemental representations regarding its HIPAA compliance posture, including confirmation that its information security program has been designed to satisfy the applicable requirements of the HIPAA Security Rule with respect to the PHI that it processes on behalf of Quorum. These supplemental representations have been incorporated into the DPA.

D. NAIC Insurance Data Security Model Law Compliance

Connecticut's adoption of the NAIC Insurance Data Security Model Law imposes specific cybersecurity program requirements on insurance licensees, including Quorum Property & Casualty Insurance Company. These requirements extend, through contractual and supervisory mechanisms, to third-party service providers that access, process, or store nonpublic information on behalf of the licensee. Accordingly, the Model Law's requirements are directly relevant to Quorum's engagement of Clearpoint as a vendor that will process significant volumes of nonpublic information.

Fenwick DCA evaluated Clearpoint's information security program against the key requirements of the Model Law, including the following areas:

• Risk Assessment. Clearpoint maintains a documented risk assessment process that identifies reasonably foreseeable internal and external threats to the security, confidentiality, and integrity of nonpublic information. Fenwick DCA found this process to be generally consistent with Model Law expectations.

• Access Controls. Clearpoint employs role-based access controls, multi-factor authentication for administrative access, and least-privilege principles for user access management. These controls were found to be consistent with Model Law expectations and with industry best practices for SaaS platforms processing sensitive insurance data.

• Encryption. Clearpoint employs AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit. These encryption standards meet or exceed Model Law expectations and are consistent with current industry standards for the protection of nonpublic information.

• Incident Response. Fenwick DCA identified a gap in Clearpoint's written incident response plan regarding notification timelines. Clearpoint's standard incident response procedures specified a seventy-two (72) hour notification window for security incidents, which Fenwick DCA determined to be insufficient in light of Model Law expectations and Quorum's internal incident response requirements. Fenwick DCA recommended that the notification timeline be shortened to twenty-four (24) hours for confirmed security incidents involving Customer Data.

• Third-Party Vendor Management. Fenwick DCA identified a gap in Clearpoint's documentation of its third-party vendor management program. While Clearpoint conducts due diligence on its subprocessors, the documentation of that diligence — including records of security assessments, contractual safeguards, and ongoing monitoring — was not consistently maintained in a form that could be readily made available to Quorum or to regulatory examiners. Fenwick DCA recommended that Clearpoint be contractually required to maintain and make available upon Quorum's request its written information security program, including documentation of its third-party vendor management practices.

These recommendations have been incorporated into Exhibit D (Security Requirements) of the SaaS Subscription Agreement, as described in Section VI below.

E. AI and Automated Decision-Making Considerations

ClaimsIQ™ uses AI-driven algorithms for claims triage and fraud detection. These algorithms analyze claims data, identify patterns indicative of potential fraud, and generate triage recommendations that influence the prioritization and handling of claims by Quorum's adjusters. While the platform is designed to augment — rather than replace — human decision-making in the claims process, the use of AI-driven algorithms in claims handling is subject to increasing regulatory attention.

Fenwick DCA noted the emerging regulatory focus on algorithmic transparency and fairness in insurance claim adjudication, including guidance and rulemaking activity at both the state and federal levels. Several state insurance departments have issued bulletins or proposed regulations addressing the use of AI and machine-learning models in underwriting and claims processing, with an emphasis on transparency, explainability, and the avoidance of unfair discrimination. While no jurisdiction in which Quorum currently operates has enacted binding requirements specific to AI-driven claims processing, Fenwick DCA recommended that Quorum proactively address these considerations in the SaaS Subscription Agreement.

Specifically, Fenwick DCA recommended the inclusion of contractual provisions requiring Clearpoint to provide documentation of the logic, inputs, and outputs of its AI models used in claims triage and fraud detection, at a level of detail sufficient to enable Quorum to respond to regulatory inquiries regarding automated decision-making. Additionally, the DPA should require Clearpoint to cooperate with Quorum's regulatory examinations regarding automated decision-making, including providing access to technical personnel and documentation as reasonably requested by Quorum or by applicable regulatory authorities. These provisions have been included in the current drafts of Exhibit C and Exhibit D.

IV. Subprocessor Risk Assessment

A critical component of the DPIA was the assessment of risks associated with Clearpoint's use of subprocessors in connection with the ClaimsIQ™ platform. As noted above, Fenwick DCA confirmed that Customer Data flows through two subprocessors: Cobalt Cloud Infrastructure, Inc. (IaaS hosting and storage) and Redline Document AI, LLC (OCR and document processing). Fenwick DCA assessed the risk profile of each subprocessor and evaluated the adequacy of the contractual and technical safeguards governing their access to and processing of Customer Data.

A. Cobalt Cloud Infrastructure, Inc.

Role: Cobalt Cloud Infrastructure, Inc. serves as the infrastructure-as-a-service provider hosting the ClaimsIQ™ platform. All Customer Data at rest is stored within Cobalt Cloud's data center environments, and Cobalt Cloud provides the compute and networking resources on which the platform operates.

Corporate Information: Cobalt Cloud Infrastructure, Inc. is a Delaware corporation with its principal offices at 500 Terry Francine Street, San Jose, California 95128. Cobalt Cloud is a well-established IaaS provider serving enterprise customers across multiple industries.

Assessment Findings: Fenwick DCA reviewed Cobalt Cloud's publicly available security certifications, including its SOC 2 Type II certification, as well as the contractual relationship between Cobalt Cloud and Clearpoint. Fenwick DCA confirmed that Cobalt Cloud maintains SOC 2 Type II certification and offers data residency within the continental United States. Data residency within the continental United States satisfies Quorum's data-localization preferences, which are driven by both regulatory requirements and internal risk management policies. No evidence of non-U.S. data processing or storage was identified.

Residual Risk: Quorum has no direct contractual privity with Cobalt Cloud; all data-protection obligations flow through Clearpoint as the primary contractor. This means that Quorum's ability to enforce data-protection requirements against Cobalt Cloud is dependent on the enforceability and adequacy of Clearpoint's contractual arrangements with Cobalt Cloud, and on Clearpoint's willingness and ability to exercise its contractual rights against Cobalt Cloud on Quorum's behalf.

Recommendation: The DPA (Exhibit C) requires Clearpoint to impose data-protection obligations on Cobalt Cloud that are at least as protective as those contained in the DPA. Clearpoint is required to remain fully liable for Cobalt Cloud's acts and omissions as if they were Clearpoint's own. Quorum retains the right to audit Cobalt Cloud's compliance with applicable data-protection requirements through Clearpoint, including by requesting audit reports, certifications, and responses to security questionnaires from Cobalt Cloud through Clearpoint as intermediary.

B. Redline Document AI, LLC

Role: Redline Document AI, LLC serves as the OCR and document-processing subprocessor for the ingestion of scanned claim documents into the ClaimsIQ™ platform. Redline's processing converts unstructured document images — including scanned medical records, police reports, adjuster correspondence, and other claim-related documents — into structured data elements that can be analyzed by the platform's triage and fraud-detection engines.

Corporate Information: Redline Document AI, LLC is a California limited liability company. Fenwick DCA reviewed available information regarding Redline's corporate structure, financial position, and security practices.

Assessment Findings: Fenwick DCA noted that Redline processes unstructured documents that may contain PII and PHI embedded in scanned images, medical records, and adjuster correspondence. The nature of Redline's processing means that it has access to some of the most sensitive categories of Customer Data, albeit on a transient basis. Fenwick DCA confirmed that Redline's processing involves temporary data handling — documents are processed through Redline's OCR pipeline and the resulting structured data is returned to the ClaimsIQ™ platform — but that data is not persistently stored by Redline following the completion of processing.

Residual Risk: Although Redline does not persistently store Customer Data, the absence of contractually specified retention and deletion policies creates a risk that residual copies of Customer Data (including PHI) could be retained in Redline's systems, logs, or backup environments for an indeterminate period.

Recommendation: Clearpoint is required to confirm in the DPA that Redline deletes all processed Customer Data within a specified period following the completion of processing (not to exceed seventy-two (72) hours). Quorum is entitled to receive prior written notification before any replacement of or addition to OCR subprocessors, and to exercise objection rights as described in Section IV.C below.

C. Subprocessor Consent and Objection Mechanism

Clearpoint's initial form agreement permitted the unilateral appointment of new subprocessors without prior notice to or consent from the customer. Fenwick DCA identified this as a significant gap in the subprocessor management framework, as it would have permitted Clearpoint to engage additional subprocessors — potentially in jurisdictions or with security practices that do not meet Quorum's requirements — without Quorum's knowledge or approval.

The following subprocessor management framework has been adopted in the DPA (Exhibit C), consistent with Fenwick DCA's recommendation:

• Quorum is entitled to receive written notice of any proposed new subprocessor at least thirty (30) days before the date on which Clearpoint intends to engage such subprocessor for the processing of Customer Data.

• Quorum has the right to object to any proposed new subprocessor within the thirty (30) day notice period, by providing written notice of its objection to Clearpoint specifying reasonable grounds for the objection.

• If Quorum's objection is not resolved to Quorum's reasonable satisfaction within the thirty (30) day notice period, Quorum may terminate the affected services without penalty, without prejudice to Quorum's right to receive a pro rata refund of any prepaid fees for the terminated services.

The current approved subprocessor list consists of:

1. Cobalt Cloud Infrastructure, Inc. — Infrastructure-as-a-service (hosting and storage)

2. Redline Document AI, LLC — OCR and document processing

No additional subprocessors are currently authorized to process Customer Data under the SaaS Subscription Agreement.

V. Residual Risks Identified

Notwithstanding the generally favorable compliance posture of the ClaimsIQ™ platform, Fenwick DCA identified the following residual risks that warranted specific attention and contractual mitigation. Each risk is described below along with the corresponding recommendation and its current status.

A. Aggregated Data Use

Clearpoint's initial form agreement permitted the unrestricted creation and commercial use of de-identified, aggregated data derived from Customer Data. Under the standard form, Clearpoint would have been entitled to aggregate Customer Data with data from other customers, de-identify the resulting dataset, and use the aggregated data for any commercial purpose, including sale to third parties, benchmarking services, and product development.

Fenwick DCA flagged the risk that aggregation methodologies could, under certain circumstances, permit re-identification of Quorum's data or the data of individual policyholders and claimants. This risk is particularly acute where Quorum's data constitutes a significant proportion of the dataset for specific geographic markets or lines of business. For example, if Quorum is one of only a small number of Clearpoint customers writing workers' compensation coverage in a particular state, aggregation of that data with a limited number of other customers may not provide sufficient anonymization to prevent re-identification.

Recommendation (adopted): The DPA restricts Clearpoint's use of Aggregated Data as follows:

• Aggregated Data may be used only for product-improvement purposes, and not for any other commercial purpose.

• Any use of Aggregated Data beyond product improvement requires Quorum's prior written consent, which shall not be unreasonably withheld.

• Clearpoint is prohibited from attempting to re-identify any de-identified or aggregated data.

• Clearpoint is prohibited from selling Aggregated Data to third parties.

These restrictions have been incorporated into the current draft of Exhibit C.

B. Vendor Insolvency and Data Access

Fenwick DCA noted the potential risks associated with Clearpoint's private ownership structure and the possibility of change-of-control or insolvency scenarios that could affect Quorum's access to its Customer Data and the continued availability of the ClaimsIQ™ platform. Clearpoint's ownership is currently concentrated: approximately 62% of Clearpoint's equity is held by Ridgeway Capital Partners, LP, following a $95 million Series C financing round completed in October 2022. While Clearpoint's current financial position appears stable — with approximately $78 million in ARR as of Q4 2023 — the concentration of ownership in a single private equity sponsor introduces risks related to future capital-structure decisions, potential exits or recapitalizations, and the possibility of financial distress.

Recommendation: The following protections have been incorporated to address vendor insolvency and change-of-control:

• Source Code Escrow. Quorum and Clearpoint will enter into a Technology Escrow Agreement with Granite Trust Company, N.A. serving as escrow agent. The source code for the ClaimsIQ™ platform will be deposited and maintained in escrow, with release conditions including: (i) the filing of a voluntary or involuntary bankruptcy petition by or against Clearpoint that is not dismissed within sixty (60) days; (ii) Clearpoint's cessation of business operations or discontinuation of the ClaimsIQ™ platform; or (iii) an uncured material breach of the SaaS Subscription Agreement following the expiration of a sixty (60) day cure period.

• Data Portability. The DPA (Exhibit C) provides Quorum with robust data portability protections, including the right to export all Customer Data in ACORD XML and CSV formats within sixty (60) days of expiration or termination of the Agreement, at no additional charge. Clearpoint is required to provide certified destruction of all Customer Data within thirty (30) days of the completion of the data-export period.

These provisions are designed to ensure that Quorum retains access to its Customer Data and, if necessary, to the underlying platform technology in the event of adverse developments affecting Clearpoint's ownership or financial condition.

C. Cross-Border and Multi-State Data Transfer

Quorum's claims operations span three states — Connecticut, Texas, and Florida — and involve field adjusters operating throughout Quorum's service territories. Fenwick DCA confirmed that all ClaimsIQ™ data flows remain within the continental United States, with all data at rest stored in Cobalt Cloud data centers located domestically. No cross-border data transfers to jurisdictions outside the United States were identified in the current platform architecture or data flow.

While no cross-border data transfer issues were identified at present, the DPA includes a restriction on international data transfers without Quorum's prior written consent, to guard against future changes to the platform architecture or subprocessor arrangements that could result in Customer Data being processed or stored outside the United States. This restriction is consistent with Quorum's data-localization preferences and with the regulatory expectations applicable to the insurance industry.

D. Breach Notification Gap

Clearpoint's initial form agreement specified a seventy-two (72) hour notification period following the discovery of a security incident involving Customer Data. Fenwick DCA determined that this notification timeline is insufficient in light of the following considerations:

• The NAIC Insurance Data Security Model Law, as adopted in Connecticut, expects licensees and their service providers to provide prompt notification of cybersecurity events, and many industry participants have adopted twenty-four (24) hour notification windows as a best practice.

• Quorum's internal incident response plan requires that the Company be notified of potential data breaches within twenty-four (24) hours in order to enable timely assessment, containment, and, where required, notification to affected individuals and regulatory authorities.

• The nature of the data processed through ClaimsIQ™ — including PII and PHI — heightens the potential harm from delayed notification and the regulatory consequences of non-compliance with applicable breach notification requirements.

Recommendation (adopted): The Security Requirements (Exhibit D) require Clearpoint to provide notification to Quorum within twenty-four (24) hours of confirming a security incident involving Customer Data. The notification must include all reasonably available information regarding the nature, scope, and potential impact of the incident, the categories and approximate number of affected data subjects, and the remedial measures taken or planned. This recommendation has been adopted and is reflected in the current draft of Exhibit D.

VI. Recommended Contractual Mitigants

Based on the findings and recommendations of the Fenwick DCA assessment, Calderwood & Harkness negotiated comprehensive contractual mitigants to address the identified risks. These mitigants have been incorporated into the following documents:

A. Mitigants Incorporated into Exhibit C (Data Processing Addendum)

The Data Processing Addendum (Exhibit C to the SaaS Subscription Agreement) incorporates the following mitigants:

1. Controller-Processor Designation. Explicit designation of Quorum as data controller and Clearpoint as data processor with respect to all Customer Data processed through the ClaimsIQ™ platform.

2. Customer Data Ownership. Sole and exclusive ownership of all Customer Data is retained by Quorum at all times. Clearpoint acquires no ownership interest in Customer Data by reason of its processing activities under the Agreement.

3. Aggregated Data Restrictions. Aggregated Data derived from Customer Data may be used only for product-improvement purposes; any other use requires Quorum's prior written consent (not to be unreasonably withheld); re-identification is prohibited; and sale of Aggregated Data to third parties is prohibited.

4. Data Portability. Quorum is entitled to a full export of all Customer Data in ACORD XML and CSV formats within sixty (60) days of the expiration or termination of the Agreement, at no additional charge to Quorum.

5. Data Destruction Certification. Clearpoint is required to certify the complete destruction of all Customer Data — including data held by subprocessors — within thirty (30) days of the completion of the data-export period.

6. HIPAA BAA-Equivalent Provisions. The DPA includes provisions satisfying the requirements of the HIPAA Privacy Rule and Security Rule for Business Associate Agreements, addressing the processing of PHI in connection with Quorum's workers' compensation claims. These provisions cover required administrative, physical, and technical safeguards; restrictions on use and disclosure of PHI; breach notification obligations specific to PHI; and the obligation to return or destroy PHI upon termination.

7. Subprocessor Management Framework. The DPA establishes a subprocessor management framework providing Quorum with thirty (30) day advance written notice of proposed new subprocessors and a corresponding thirty (30) day objection right. If Quorum's objection is not resolved, Quorum may terminate the affected services without penalty.

8. Flow-Down Obligations. Clearpoint is obligated to flow down data-protection requirements to its subprocessors — currently Cobalt Cloud Infrastructure, Inc. and Redline Document AI, LLC — at a level at least as protective as the obligations imposed on Clearpoint under the DPA. Clearpoint remains fully liable for the acts and omissions of its subprocessors.

9. Consumer Rights Support. Clearpoint is obligated to provide reasonable cooperation and technical assistance to support Quorum in responding to CTDPA consumer data-access, deletion, and opt-out requests within applicable statutory timeframes.

10. Restriction on International Data Transfers. Customer Data may not be transferred, processed, or stored outside the continental United States without Quorum's prior written consent.

11. Regulatory Compliance. Clearpoint is required to comply with the CTDPA, HIPAA (with respect to PHI processing), and the NAIC Insurance Data Security Model Law as adopted in Connecticut, to the extent applicable to Clearpoint's data-processing activities under the Agreement.

B. Mitigants Incorporated into Exhibit D (Security Requirements)

The Security Requirements (Exhibit D to the SaaS Subscription Agreement) incorporate the following mitigants:

1. Annual SOC 2 Type II Audit Report. Clearpoint is required to maintain and deliver an annual SOC 2 Type II audit report, conducted by an independent third-party audit firm (current auditor: Hawthorne & Ellers, CPAs LLP). The report must be delivered to Quorum within ninety (90) days of the close of the applicable audit period. The current report covers the period from April 1, 2023, through March 31, 2024.

2. Annual Penetration Testing. Clearpoint is required to engage an independent third-party firm (current vendor: Sentinel Cyber Solutions LLC) to conduct annual penetration testing of the ClaimsIQ™ platform and its supporting infrastructure. An executive summary of the penetration test results must be shared with Quorum within thirty (30) days of the completion of each test.

3. Breach Notification. Clearpoint is required to provide notification to Quorum within twenty-four (24) hours of confirming a security incident involving Customer Data, consistent with NAIC Model Law expectations and Quorum's internal incident response requirements.

4. Encryption Standards. Clearpoint is required to maintain encryption standards of AES-256 for data at rest and TLS 1.2 or higher for data in transit.

5. Access Controls. Clearpoint is required to implement and maintain role-based access controls and least-privilege principles for all personnel and systems with access to Customer Data.

6. Insurance Requirements. Clearpoint is required to maintain the following insurance coverages, all carried with Northern Ridge Mutual Insurance Company or another carrier reasonably acceptable to Quorum:

7. Written Information Security Program. Clearpoint is required to maintain a written information security program and to make such program available to Quorum upon reasonable request, including in connection with regulatory examinations and compliance assessments.

8. AI Model Documentation. Clearpoint is required to provide documentation of the logic, inputs, and outputs of its AI models used in claims triage and fraud detection, and to cooperate with Quorum's regulatory examinations regarding automated decision-making.

C. Mitigants Addressed in Other Agreement Provisions

In addition to the mitigants incorporated into the DPA and Security Requirements, the following protections are addressed in other provisions of the SaaS Subscription Agreement and related transaction documents:

1. Uncapped Data-Breach Indemnification. Clearpoint's indemnification obligation for data breaches caused by Clearpoint's failure to comply with its data-protection obligations is uncapped, ensuring that Quorum is not limited in its recovery for losses arising from a data-breach event. This is addressed in the indemnification section of the SaaS Subscription Agreement.

2. Liability Caps for Other Claims. For intellectual property and general indemnification claims, the liability cap is set at two times (2×) the total contract value, or Fourteen Million Dollars ($14,000,000). The general liability cap for all other claims is set at one times (1×) the total contract value, or Seven Million Dollars ($7,000,000).

3. Source Code Escrow. As described in Section V.B above, the Technology Escrow Agreement with Granite Trust Company, N.A. provides for the release of the ClaimsIQ™ source code upon the occurrence of specified release conditions, including bankruptcy, cessation of business, or uncured material breach following a sixty (60) day cure period.

4. Change-of-Control Assignment Restrictions. The SaaS Subscription Agreement includes assignment restrictions that specifically address change-of-control scenarios involving Ridgeway Capital Partners, LP and other ownership-change events. Clearpoint may not assign the Agreement or undergo a change of control that would result in a change in the identity of the majority equity holder without Quorum's prior written consent.

VII. Open Items and Recommendations for Ongoing Monitoring

While the contractual mitigants described herein address the residual risks identified in the DPIA, data privacy is an evolving field and the risk environment will continue to change over the term of the SaaS Subscription Agreement. Accordingly, Calderwood & Harkness recommends that Quorum implement the following ongoing monitoring practices:

1. Annual SOC 2 Review. Quorum should conduct annual reviews of Clearpoint's SOC 2 Type II reports and penetration test executive summaries upon receipt, with review to be coordinated between the General Counsel's office, the Chief Information Officer's office, and Quorum's internal audit function. Any qualifications, exceptions, or findings noted in the SOC 2 reports should be escalated for assessment and, where appropriate, for discussion with Clearpoint.

2. Subprocessor Monitoring. Quorum should actively monitor subprocessor changes and exercise its objection rights within the thirty (30) day notice period provided in the DPA. Any proposed new subprocessor should be evaluated against Quorum's data-localization, security, and compliance requirements before Quorum provides consent or elects to exercise its objection right.

3. Regulatory Tracking. Quorum's privacy and compliance teams should track evolving CTDPA regulations, HIPAA guidance, and NAIC Model Law amendments for potential contract-update triggers. The CTDPA is a relatively new statute and is likely to be supplemented by implementing regulations, enforcement guidance, and judicial interpretations that may affect the obligations of Quorum and Clearpoint under the DPA. Similarly, HIPAA and NAIC Model Law requirements are subject to periodic amendment and reinterpretation.

4. AI Regulatory Monitoring. Quorum should monitor regulatory developments regarding AI-driven claims processing and algorithmic fairness in insurance, including guidance from the Connecticut Insurance Department, the National Association of Insurance Commissioners, and other relevant regulatory bodies. As noted in Section III.E above, regulatory attention to the use of AI in insurance is increasing, and Quorum should be prepared to adapt its contractual arrangements and internal governance practices in response to new requirements.

5. Periodic Reassessment. Dravello Data Compliance Advisors LLC remains available for periodic reassessments of the ClaimsIQ™ platform as requested by Quorum. Miriam Tanaka, Principal Consultant, has indicated her willingness to perform annual follow-up reviews to assess changes to the platform architecture, subprocessor landscape, or regulatory environment, and to confirm the continued adequacy of the contractual mitigants.

VIII. Conclusion

The Data Privacy Impact Assessment performed by Dravello Data Compliance Advisors LLC confirms that the ClaimsIQ™ platform, as contractually documented in the SaaS Subscription Agreement and its exhibits, presents an acceptable data-privacy risk profile for Quorum's enterprise-wide deployment across its property and casualty and specialty lines subsidiaries.

The key residual risks identified in the DPIA — including risks related to aggregated data use, vendor insolvency and data access, breach notification timing, HIPAA compliance, subprocessor management, and AI-driven decision-making — have been addressed through comprehensive contractual mitigants incorporated into the Data Processing Addendum (Exhibit C), the Security Requirements (Exhibit D), and the body of the SaaS Subscription Agreement, as described in this memorandum.

Calderwood & Harkness recommends proceeding to finalization of the SaaS Subscription Agreement with Clearpoint Analytics, Inc. on the terms reflected in the current draft, inclusive of all mitigants described herein. We are available to coordinate the final execution process and to address any remaining questions from the General Counsel's office, the Chief Information Officer's office, or the procurement team.

Copies of the full Fenwick DCA assessment report dated April 8, 2024, are available upon request. This memorandum constitutes a privileged summary of the DPIA findings and recommendations for internal use by the named recipients and their designees.

Respectfully submitted,

CALDERWOOD & HARKNESS LLP

By: ________

Nathan Ikeda Lead Associate Calderwood & Harkness LLP 100 Pearl Street, Suite 800 Hartford, CT 06103 Telephone: (860) 555-7200 nikeda@calderwoodharkness.com

cc:

Renata Vasquez, Responsible Partner, Calderwood & Harkness LLP

Gabrielle Moss, Working Associate, Calderwood & Harkness LLP

Malcolm Tsai, VP of Procurement, Quorum Insurance Holdings Corp.

Enclosure:

Dravello Data Compliance Advisors LLC — Data Privacy Impact Assessment Report (dated April 8, 2024) [under separate cover, attorney-client privileged]

Coverage Type	Per Occurrence / Per Claim	Aggregate
Commercial General Liability	$5,000,000	$10,000,000
Technology E&O / Cyber Liability	$10,000,000	$20,000,000
Workers' Compensation	Statutory Limits	Statutory Limits

CALDERWOOD & HARKNESS LLP Attorneys at Law
100 Pearl Street, Suite 800 Hartford, CT 06103 Telephone: (860) 555-7200 Facsimile: (860) 555-7201 www.calderwoodharkness.com
MEMORANDUM
PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION
TO: Patricia Okonkwo, General Counsel, Quorum Insurance Holdings Corp. Derek Langston, Chief Information Officer, Quorum Insurance Holdings Corp.
FROM: Nathan Ikeda, Lead Associate, Calderwood & Harkness LLP
DATE: April 10, 2024
RE: Data Privacy Impact Assessment — ClaimsIQ™ Platform (Clearpoint Analytics, Inc.)
MATTER NO.: 1025-00009
This memorandum is a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP for the exclusive use of the named recipients. This document contains legal advice and work product protected under applicable privileges. Any unauthorized review, use, disclosure, or distribution is strictly prohibited. If you have received this memorandum in error, please contact the sender immediately and destroy all copies.
I. Executive Summary
This memorandum summarizes the findings and recommendations arising from the data privacy impact assessment ("DPIA") of Clearpoint Analytics, Inc.'s ClaimsIQ™ platform, which was completed on April 8, 2024, by Dravello Data Compliance Advisors LLC ("Fenwick DCA"). The purpose of this memorandum is to present the key conclusions of the DPIA in a form suitable for review by Quorum Insurance Holdings Corp.'s ("Quorum" or the "Company") General Counsel and Chief Information Officer, and to confirm that the residual risks identified in the assessment have been adequately addressed through the contractual mitigants negotiated in the draft SaaS Subscription Agreement with Clearpoint Analytics, Inc. ("Clearpoint").
The DPIA was conducted by Miriam Tanaka, Principal Consultant, Dravello Data Compliance Advisors LLC, located at 45 Milk Street, Suite 600, Boston, MA 02109. Ms. Tanaka has extensive experience in privacy assessments for the insurance and financial services industries, and was engaged by Calderwood & Harkness on behalf of Quorum for this specific assessment. Her full report is enclosed under separate cover and is subject to the attorney-client privilege and work-product doctrine protections applicable to materials prepared at the direction of counsel.
By way of context, Quorum Insurance Holdings Corp. (Nasdaq: QIHC) is entering into a five-year Enterprise SaaS Subscription Agreement with Clearpoint Analytics, Inc. for the enterprise-wide deployment of the ClaimsIQ™ platform across Quorum's property and casualty and specialty lines subsidiaries. The ClaimsIQ™ platform is a cloud-hosted, artificial-intelligence-driven software-as-a-service solution designed to support claims triage, fraud detection, and claims analytics workflows. Quorum has identified ClaimsIQ™ as a strategic investment intended to modernize and streamline the Company's claims-processing operations.
The total contract value of the proposed SaaS Subscription Agreement is Seven Million Dollars ($7,000,000) over the five-year initial term, reflecting an annual contract value of One Million Four Hundred Thousand Dollars ($1,400,000). The deployment scope encompasses approximately 1,200 named users across three claims-processing locations — Hartford, Connecticut; Dallas, Texas; and Jacksonville, Florida — as well as remote-access functionality for Quorum's field adjusters operating in the territories served by Quorum's property and casualty and specialty lines of business.
The Quorum subsidiaries within scope for this deployment are as follows:
• Quorum Property & Casualty Insurance Company, a Connecticut-domiciled insurance company;
• Quorum Specialty Underwriters, Inc., a Delaware corporation; and
• Quorum Digital Solutions LLC, a Delaware limited liability company.
Each of these subsidiaries will utilize the ClaimsIQ™ platform in connection with its respective claims-handling and analytics functions, and Customer Data originating from each subsidiary will be processed through the platform.
Overall Conclusion. Fenwick DCA identified the ClaimsIQ™ platform as generally compliant with applicable data-privacy frameworks, subject to certain residual risks and recommended contractual mitigants. Those mitigants have been incorporated into the Data Processing Addendum (Exhibit C) and the Security Requirements (Exhibit D) of the SaaS Subscription Agreement, as well as into the body of the Agreement itself and related transaction documents. Calderwood & Harkness is satisfied that the mitigants, as negotiated and documented, appropriately address the risks identified by Fenwick DCA and position Quorum favorably from a data-privacy and regulatory-compliance standpoint. Our detailed analysis follows.
II. Scope of the Assessment
The DPIA conducted by Fenwick DCA was scoped in coordination with Calderwood & Harkness, Quorum's internal privacy and compliance teams, and Clearpoint's legal and information security personnel. The scope was designed to evaluate the data-privacy implications of Quorum's proposed use of the ClaimsIQ™ platform across all three in-scope subsidiaries, with attention to the specific categories of data processed, the technical architecture of the platform, and the applicable legal and regulatory frameworks. The following subsections describe the scope of the assessment in detail.
A. Data Categories Evaluated
Fenwick DCA evaluated the following categories of data that Quorum will process through the ClaimsIQ™ platform:
1. Personally Identifiable Information (PII). The assessment encompassed PII of policyholders, claimants, and third-party beneficiaries that is processed through the ClaimsIQ™ platform's claims triage, fraud detection, and analytics modules. This PII includes, but is not limited to, names, addresses, dates of birth, Social Security numbers, policy numbers, claim numbers, contact information, financial account information relevant to claims payments, and other identifying data elements routinely processed in the claims-handling context.
2. Protected Health Information (PHI). The assessment specifically addressed PHI arising from Quorum's workers' compensation lines of business. Workers' compensation claims routinely involve the processing of medical records, treatment histories, physician reports, disability assessments, and related health-related data that constitutes PHI within the meaning of the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"), and its implementing regulations. Given that Quorum Property & Casualty Insurance Company underwrites workers' compensation coverage in several states, the processing of PHI through ClaimsIQ™ is a material consideration for the DPIA.
3. Adjuster Notes, Internal Claims Narratives, and Investigative Materials. The assessment evaluated the privacy and confidentiality implications of processing unstructured textual data generated by Quorum's claims adjusters and investigators. These materials frequently contain sensitive personal information, legal assessments, and privileged communications, and their ingestion into a third-party platform raises distinct considerations regarding data security, access controls, and privilege preservation.
4. Customer Data Outputs and Reports. Fenwick DCA also assessed the data-privacy implications of the outputs and reports generated by the ClaimsIQ™ platform from Quorum's proprietary claims data. These outputs include analytics dashboards, fraud-detection scoring, triage recommendations, and trend analyses that are derived from Quorum's Customer Data and may contain or reflect PII and PHI. Ownership, use restrictions, and permissible purposes for these outputs were examined as part of the assessment.
B. Platform Architecture Reviewed
Fenwick DCA conducted a thorough review of the technical architecture of the ClaimsIQ™ platform to understand the data-processing environment and to identify potential privacy and security risks associated with the platform's design and operation. The key aspects of the platform architecture reviewed are as follows:
ClaimsIQ™ is a cloud-hosted, AI-driven SaaS platform purpose-built for claims triage, fraud detection, and analytics in the insurance industry. The platform was founded by Clearpoint Analytics, Inc. in 2017. Clearpoint's headquarters are located at 200 South Wacker Drive, Suite 3100, Chicago, Illinois 60606. As of the fourth quarter of 2023, Clearpoint has approximately 320 employees and reported approximately $78 million in annual recurring revenue ("ARR"). Clearpoint's growth trajectory and financial position were considered by Fenwick DCA as part of the broader vendor risk assessment, including considerations of financial stability and business continuity.
The ClaimsIQ™ platform is hosted on infrastructure provided by Cobalt Cloud Infrastructure, Inc., a Delaware corporation with its principal offices at 500 Terry Francine Street, San Jose, California 95128. Cobalt Cloud serves as the infrastructure-as-a-service ("IaaS") subprocessor for the ClaimsIQ™ platform, providing compute, storage, and networking resources on which the platform operates. All Customer Data at rest is stored within Cobalt Cloud's data center environments.
Additionally, OCR and document-ingestion processing for the ClaimsIQ™ platform is performed by Redline Document AI, LLC, a California limited liability company that serves as a specialized subprocessor. Redline Document AI provides optical character recognition ("OCR") and document-processing services that enable ClaimsIQ™ to ingest scanned claims documents, medical records, and adjuster correspondence, converting unstructured document images into structured data elements that can be processed by the platform's analytics and triage engines.
Fenwick DCA's review of the platform architecture encompassed data flow mapping across all components, including the interfaces between Quorum's existing policy administration systems and the ClaimsIQ™ ingestion layer, the data-processing environment within ClaimsIQ™, the interactions between ClaimsIQ™ and its subprocessors, and the output/reporting mechanisms through which processed data is returned to Quorum users.
C. Applicable Legal and Regulatory Frameworks
Fenwick DCA assessed the ClaimsIQ™ platform and Clearpoint's data-handling practices against the following legal and regulatory frameworks, each of which is applicable to Quorum's proposed deployment:
1. Connecticut Data Privacy Act ("CTDPA"). Effective July 1, 2023, the CTDPA imposes obligations on controllers and processors of Connecticut consumers' personal data, including requirements regarding data processing agreements, consumer rights facilitation, data protection assessments, and processor accountability. As Quorum Property & Casualty Insurance Company is domiciled in Connecticut and processes personal data of Connecticut consumers, the CTDPA is directly applicable to Quorum's use of the ClaimsIQ™ platform.
2. Health Insurance Portability and Accountability Act ("HIPAA"). HIPAA is applicable to Quorum's workers' compensation lines of business where PHI is processed through the ClaimsIQ™ platform. Under HIPAA's Privacy Rule and Security Rule, covered entities such as Quorum must ensure that business associates (including SaaS providers that process PHI on behalf of the covered entity) enter into Business Associate Agreements and maintain appropriate administrative, physical, and technical safeguards for the protection of PHI.
3. NAIC Insurance Data Security Model Law (Connecticut Adoption). Connecticut has adopted the NAIC Insurance Data Security Model Law, which imposes specific cybersecurity program requirements on insurance licensees and, by extension, requires licensees to exercise due diligence in the oversight of third-party service providers that have access to nonpublic information. The Model Law's requirements regarding risk assessment, access controls, encryption, incident response, and third-party vendor management are directly relevant to Quorum's engagement of Clearpoint.
4. General Insurance Regulatory Data-Handling Requirements. In addition to the foregoing frameworks, Fenwick DCA considered general insurance regulatory requirements applicable to Quorum Property & Casualty Insurance Company as a Connecticut-domiciled insurer and to Quorum Specialty Underwriters, Inc. as a Delaware-domiciled entity, including data-handling and confidentiality obligations arising under applicable insurance codes, regulations, and market conduct standards.
III. Summary of Fenwick DCA Findings
The following sections summarize the principal findings from the Fenwick DCA assessment report. For a complete discussion of methodologies, evidence reviewed, and detailed recommendations, reference should be made to the full Fenwick DCA assessment report enclosed under separate cover.
A. Data Flow Mapping and Classification
Fenwick DCA conducted a comprehensive data-mapping exercise tracing the flow of Customer Data from Quorum's existing policy administration systems through the ClaimsIQ™ ingestion pipeline, processing and analytics layers, and output/reporting functions. This exercise was undertaken to identify all points at which Customer Data — including PII, PHI, and other sensitive data categories — is collected, transmitted, processed, stored, and ultimately deleted or returned to Quorum.
The data-mapping exercise confirmed that Customer Data ingested by ClaimsIQ™ includes structured claims records (such as policy and claim identifiers, dates of loss, loss descriptions, reserve amounts, and payment data), unstructured adjuster notes and internal claims narratives, and scanned documents (including medical records, police reports, and adjuster correspondence) that are processed through the Redline Document AI OCR pipeline. The ingestion of scanned documents is a particularly significant data flow because such documents frequently contain embedded PII and PHI in formats that are not readily susceptible to automated classification or redaction prior to processing.
With respect to data at rest, Fenwick DCA confirmed that all Customer Data processed through ClaimsIQ™ is stored within Cobalt Cloud Infrastructure environments located in the continental United States. Data in transit between Quorum's endpoints and the ClaimsIQ™ platform is encrypted using TLS 1.2 or higher, consistent with current industry standards.
Fenwick DCA confirmed that Quorum's Customer Data — including PII, PHI, adjuster notes, and all outputs and reports generated by the platform — flows through two subprocessors: Cobalt Cloud Infrastructure, Inc. (hosting and storage) and Redline Document AI, LLC (OCR and document processing). No additional subprocessors were identified in the current data flow. This confirmation was a critical element of the assessment because the identification of all subprocessors is a prerequisite for the subprocessor management framework negotiated in the Data Processing Addendum.
B. CTDPA Compliance Posture
Fenwick DCA assessed Clearpoint's current privacy practices against the requirements of the Connecticut Data Privacy Act as they apply to data processors. The assessment concluded that Clearpoint's privacy practices substantially align with CTDPA requirements for data processors, including obligations related to data processing limitations, confidentiality, cooperation with controller obligations, and data security.
However, Fenwick DCA noted that Clearpoint's standard form agreement lacked explicit designations of the respective roles of the parties as data controller and data processor within the meaning of the CTDPA. While the practical allocation of responsibilities between Quorum and Clearpoint is consistent with a controller-processor relationship, the absence of explicit contractual designations creates ambiguity that could complicate compliance efforts and regulatory interactions. Fenwick DCA recommended that the Data Processing Addendum include express language designating Quorum as the data controller and Clearpoint as the data processor with respect to all Customer Data processed through ClaimsIQ™. This recommendation has been adopted in the current draft of Exhibit C.
Fenwick DCA also reviewed Clearpoint's data retention and deletion practices. Clearpoint's standard form agreement was silent on specific timeframes for data export and destruction following termination or expiration of the agreement. Fenwick DCA recommended that the DPA specify a sixty (60) day data-export window during which Quorum may retrieve all Customer Data in usable formats, followed by a thirty (30) day period within which Clearpoint must certify the complete destruction of all Customer Data in its possession or control, including data held by subprocessors. These timeframes have been incorporated into the DPA.
With respect to consumer rights facilitation, Fenwick DCA recommended that the DPA include express obligations requiring Clearpoint to cooperate with and support Quorum in responding to CTDPA consumer data-access, deletion, and opt-out requests. The CTDPA places primary responsibility on the data controller (Quorum) to respond to consumer requests, but the controller's ability to fulfill those obligations depends in significant part on the processor's technical and operational cooperation. The DPA includes provisions requiring Clearpoint to provide reasonable assistance in responding to consumer rights requests and to implement technical measures enabling Quorum to fulfill its obligations under the CTDPA.
C. HIPAA Compliance Assessment
A material component of the Fenwick DCA assessment addressed HIPAA compliance considerations arising from the processing of PHI through the ClaimsIQ™ platform. PHI is processed through ClaimsIQ™ in connection with Quorum's workers' compensation claims, which routinely involve the collection, transmission, and analysis of medical records, treatment documentation, physician narratives, and other health-related information that constitutes PHI under HIPAA.
Fenwick DCA found that Clearpoint does not currently execute Business Associate Agreements ("BAAs") as part of its standard contracting process. This is a significant gap. Under HIPAA, a covered entity such as Quorum is required to obtain satisfactory assurances from any business associate that processes PHI on its behalf, and those assurances must be documented in a written BAA that includes specific provisions mandated by the HIPAA Privacy Rule and Security Rule. The absence of a BAA from Clearpoint's standard contracting practices indicates that Clearpoint may not have previously served customers that process PHI, or that its legal and compliance functions have not prioritized HIPAA compliance in its commercial arrangements.
Fenwick DCA recommended that BAA-equivalent provisions be incorporated within the Data Processing Addendum (Exhibit C) or, alternatively, as a standalone Business Associate Addendum. The BAA provisions should cover the required administrative, physical, and technical safeguards for PHI; restrictions on the use and disclosure of PHI to those purposes permitted or required under the DPA and applicable law; breach notification obligations specific to PHI (including the obligation to notify Quorum without unreasonable delay and in no event later than twenty-four (24) hours following discovery of a breach of unsecured PHI); requirements for return or destruction of PHI upon termination; and Clearpoint's obligation to make its internal practices, books, and records available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining HIPAA compliance. These provisions have been incorporated into the current draft of Exhibit C.
Additionally, Fenwick DCA noted that Clearpoint's current SOC 2 Type II audit report — covering the audit period from April 1, 2023, through March 31, 2024, and conducted by Hawthorne & Ellers, CPAs LLP — addresses security controls that are relevant to HIPAA compliance, including access controls, encryption, change management, and incident response. However, the SOC 2 Type II report does not constitute a HIPAA-specific audit, and it does not provide assurances regarding all of the administrative, physical, and technical safeguard requirements of the HIPAA Security Rule. Fenwick DCA recommended that Clearpoint provide supplemental representations regarding its HIPAA compliance posture, including confirmation that its information security program has been designed to satisfy the applicable requirements of the HIPAA Security Rule with respect to the PHI that it processes on behalf of Quorum. These supplemental representations have been incorporated into the DPA.
D. NAIC Insurance Data Security Model Law Compliance
Connecticut's adoption of the NAIC Insurance Data Security Model Law imposes specific cybersecurity program requirements on insurance licensees, including Quorum Property & Casualty Insurance Company. These requirements extend, through contractual and supervisory mechanisms, to third-party service providers that access, process, or store nonpublic information on behalf of the licensee. Accordingly, the Model Law's requirements are directly relevant to Quorum's engagement of Clearpoint as a vendor that will process significant volumes of nonpublic information.
Fenwick DCA evaluated Clearpoint's information security program against the key requirements of the Model Law, including the following areas:
• Risk Assessment. Clearpoint maintains a documented risk assessment process that identifies reasonably foreseeable internal and external threats to the security, confidentiality, and integrity of nonpublic information. Fenwick DCA found this process to be generally consistent with Model Law expectations.
• Access Controls. Clearpoint employs role-based access controls, multi-factor authentication for administrative access, and least-privilege principles for user access management. These controls were found to be consistent with Model Law expectations and with industry best practices for SaaS platforms processing sensitive insurance data.
• Encryption. Clearpoint employs AES-256 encryption for data at rest and TLS 1.2 or higher for data in transit. These encryption standards meet or exceed Model Law expectations and are consistent with current industry standards for the protection of nonpublic information.
• Incident Response. Fenwick DCA identified a gap in Clearpoint's written incident response plan regarding notification timelines. Clearpoint's standard incident response procedures specified a seventy-two (72) hour notification window for security incidents, which Fenwick DCA determined to be insufficient in light of Model Law expectations and Quorum's internal incident response requirements. Fenwick DCA recommended that the notification timeline be shortened to twenty-four (24) hours for confirmed security incidents involving Customer Data.
• Third-Party Vendor Management. Fenwick DCA identified a gap in Clearpoint's documentation of its third-party vendor management program. While Clearpoint conducts due diligence on its subprocessors, the documentation of that diligence — including records of security assessments, contractual safeguards, and ongoing monitoring — was not consistently maintained in a form that could be readily made available to Quorum or to regulatory examiners. Fenwick DCA recommended that Clearpoint be contractually required to maintain and make available upon Quorum's request its written information security program, including documentation of its third-party vendor management practices.
These recommendations have been incorporated into Exhibit D (Security Requirements) of the SaaS Subscription Agreement, as described in Section VI below.
E. AI and Automated Decision-Making Considerations
ClaimsIQ™ uses AI-driven algorithms for claims triage and fraud detection. These algorithms analyze claims data, identify patterns indicative of potential fraud, and generate triage recommendations that influence the prioritization and handling of claims by Quorum's adjusters. While the platform is designed to augment — rather than replace — human decision-making in the claims process, the use of AI-driven algorithms in claims handling is subject to increasing regulatory attention.
Fenwick DCA noted the emerging regulatory focus on algorithmic transparency and fairness in insurance claim adjudication, including guidance and rulemaking activity at both the state and federal levels. Several state insurance departments have issued bulletins or proposed regulations addressing the use of AI and machine-learning models in underwriting and claims processing, with an emphasis on transparency, explainability, and the avoidance of unfair discrimination. While no jurisdiction in which Quorum currently operates has enacted binding requirements specific to AI-driven claims processing, Fenwick DCA recommended that Quorum proactively address these considerations in the SaaS Subscription Agreement.
Specifically, Fenwick DCA recommended the inclusion of contractual provisions requiring Clearpoint to provide documentation of the logic, inputs, and outputs of its AI models used in claims triage and fraud detection, at a level of detail sufficient to enable Quorum to respond to regulatory inquiries regarding automated decision-making. Additionally, the DPA should require Clearpoint to cooperate with Quorum's regulatory examinations regarding automated decision-making, including providing access to technical personnel and documentation as reasonably requested by Quorum or by applicable regulatory authorities. These provisions have been included in the current drafts of Exhibit C and Exhibit D.
IV. Subprocessor Risk Assessment
A critical component of the DPIA was the assessment of risks associated with Clearpoint's use of subprocessors in connection with the ClaimsIQ™ platform. As noted above, Fenwick DCA confirmed that Customer Data flows through two subprocessors: Cobalt Cloud Infrastructure, Inc. (IaaS hosting and storage) and Redline Document AI, LLC (OCR and document processing). Fenwick DCA assessed the risk profile of each subprocessor and evaluated the adequacy of the contractual and technical safeguards governing their access to and processing of Customer Data.
A. Cobalt Cloud Infrastructure, Inc.
Role: Cobalt Cloud Infrastructure, Inc. serves as the infrastructure-as-a-service provider hosting the ClaimsIQ™ platform. All Customer Data at rest is stored within Cobalt Cloud's data center environments, and Cobalt Cloud provides the compute and networking resources on which the platform operates.
Corporate Information: Cobalt Cloud Infrastructure, Inc. is a Delaware corporation with its principal offices at 500 Terry Francine Street, San Jose, California 95128. Cobalt Cloud is a well-established IaaS provider serving enterprise customers across multiple industries.
Assessment Findings: Fenwick DCA reviewed Cobalt Cloud's publicly available security certifications, including its SOC 2 Type II certification, as well as the contractual relationship between Cobalt Cloud and Clearpoint. Fenwick DCA confirmed that Cobalt Cloud maintains SOC 2 Type II certification and offers data residency within the continental United States. Data residency within the continental United States satisfies Quorum's data-localization preferences, which are driven by both regulatory requirements and internal risk management policies. No evidence of non-U.S. data processing or storage was identified.
Residual Risk: Quorum has no direct contractual privity with Cobalt Cloud; all data-protection obligations flow through Clearpoint as the primary contractor. This means that Quorum's ability to enforce data-protection requirements against Cobalt Cloud is dependent on the enforceability and adequacy of Clearpoint's contractual arrangements with Cobalt Cloud, and on Clearpoint's willingness and ability to exercise its contractual rights against Cobalt Cloud on Quorum's behalf.
Recommendation: The DPA (Exhibit C) requires Clearpoint to impose data-protection obligations on Cobalt Cloud that are at least as protective as those contained in the DPA. Clearpoint is required to remain fully liable for Cobalt Cloud's acts and omissions as if they were Clearpoint's own. Quorum retains the right to audit Cobalt Cloud's compliance with applicable data-protection requirements through Clearpoint, including by requesting audit reports, certifications, and responses to security questionnaires from Cobalt Cloud through Clearpoint as intermediary.
B. Redline Document AI, LLC
Role: Redline Document AI, LLC serves as the OCR and document-processing subprocessor for the ingestion of scanned claim documents into the ClaimsIQ™ platform. Redline's processing converts unstructured document images — including scanned medical records, police reports, adjuster correspondence, and other claim-related documents — into structured data elements that can be analyzed by the platform's triage and fraud-detection engines.
Corporate Information: Redline Document AI, LLC is a California limited liability company. Fenwick DCA reviewed available information regarding Redline's corporate structure, financial position, and security practices.
Assessment Findings: Fenwick DCA noted that Redline processes unstructured documents that may contain PII and PHI embedded in scanned images, medical records, and adjuster correspondence. The nature of Redline's processing means that it has access to some of the most sensitive categories of Customer Data, albeit on a transient basis. Fenwick DCA confirmed that Redline's processing involves temporary data handling — documents are processed through Redline's OCR pipeline and the resulting structured data is returned to the ClaimsIQ™ platform — but that data is not persistently stored by Redline following the completion of processing.
Residual Risk: Although Redline does not persistently store Customer Data, the absence of contractually specified retention and deletion policies creates a risk that residual copies of Customer Data (including PHI) could be retained in Redline's systems, logs, or backup environments for an indeterminate period.
Recommendation: Clearpoint is required to confirm in the DPA that Redline deletes all processed Customer Data within a specified period following the completion of processing (not to exceed seventy-two (72) hours). Quorum is entitled to receive prior written notification before any replacement of or addition to OCR subprocessors, and to exercise objection rights as described in Section IV.C below.
C. Subprocessor Consent and Objection Mechanism
Clearpoint's initial form agreement permitted the unilateral appointment of new subprocessors without prior notice to or consent from the customer. Fenwick DCA identified this as a significant gap in the subprocessor management framework, as it would have permitted Clearpoint to engage additional subprocessors — potentially in jurisdictions or with security practices that do not meet Quorum's requirements — without Quorum's knowledge or approval.
The following subprocessor management framework has been adopted in the DPA (Exhibit C), consistent with Fenwick DCA's recommendation:
• Quorum is entitled to receive written notice of any proposed new subprocessor at least thirty (30) days before the date on which Clearpoint intends to engage such subprocessor for the processing of Customer Data.
• Quorum has the right to object to any proposed new subprocessor within the thirty (30) day notice period, by providing written notice of its objection to Clearpoint specifying reasonable grounds for the objection.
• If Quorum's objection is not resolved to Quorum's reasonable satisfaction within the thirty (30) day notice period, Quorum may terminate the affected services without penalty, without prejudice to Quorum's right to receive a pro rata refund of any prepaid fees for the terminated services.
The current approved subprocessor list consists of:
1. Cobalt Cloud Infrastructure, Inc. — Infrastructure-as-a-service (hosting and storage)
2. Redline Document AI, LLC — OCR and document processing
No additional subprocessors are currently authorized to process Customer Data under the SaaS Subscription Agreement.
V. Residual Risks Identified
Notwithstanding the generally favorable compliance posture of the ClaimsIQ™ platform, Fenwick DCA identified the following residual risks that warranted specific attention and contractual mitigation. Each risk is described below along with the corresponding recommendation and its current status.
A. Aggregated Data Use
Clearpoint's initial form agreement permitted the unrestricted creation and commercial use of de-identified, aggregated data derived from Customer Data. Under the standard form, Clearpoint would have been entitled to aggregate Customer Data with data from other customers, de-identify the resulting dataset, and use the aggregated data for any commercial purpose, including sale to third parties, benchmarking services, and product development.
Fenwick DCA flagged the risk that aggregation methodologies could, under certain circumstances, permit re-identification of Quorum's data or the data of individual policyholders and claimants. This risk is particularly acute where Quorum's data constitutes a significant proportion of the dataset for specific geographic markets or lines of business. For example, if Quorum is one of only a small number of Clearpoint customers writing workers' compensation coverage in a particular state, aggregation of that data with a limited number of other customers may not provide sufficient anonymization to prevent re-identification.
Recommendation (adopted): The DPA restricts Clearpoint's use of Aggregated Data as follows:
• Aggregated Data may be used only for product-improvement purposes, and not for any other commercial purpose.
• Any use of Aggregated Data beyond product improvement requires Quorum's prior written consent, which shall not be unreasonably withheld.
• Clearpoint is prohibited from attempting to re-identify any de-identified or aggregated data.
• Clearpoint is prohibited from selling Aggregated Data to third parties.
These restrictions have been incorporated into the current draft of Exhibit C.
B. Vendor Insolvency and Data Access
Fenwick DCA noted the potential risks associated with Clearpoint's private ownership structure and the possibility of change-of-control or insolvency scenarios that could affect Quorum's access to its Customer Data and the continued availability of the ClaimsIQ™ platform. Clearpoint's ownership is currently concentrated: approximately 62% of Clearpoint's equity is held by Ridgeway Capital Partners, LP, following a $95 million Series C financing round completed in October 2022. While Clearpoint's current financial position appears stable — with approximately $78 million in ARR as of Q4 2023 — the concentration of ownership in a single private equity sponsor introduces risks related to future capital-structure decisions, potential exits or recapitalizations, and the possibility of financial distress.
Recommendation: The following protections have been incorporated to address vendor insolvency and change-of-control:
• Source Code Escrow. Quorum and Clearpoint will enter into a Technology Escrow Agreement with Granite Trust Company, N.A. serving as escrow agent. The source code for the ClaimsIQ™ platform will be deposited and maintained in escrow, with release conditions including: (i) the filing of a voluntary or involuntary bankruptcy petition by or against Clearpoint that is not dismissed within sixty (60) days; (ii) Clearpoint's cessation of business operations or discontinuation of the ClaimsIQ™ platform; or (iii) an uncured material breach of the SaaS Subscription Agreement following the expiration of a sixty (60) day cure period.
• Data Portability. The DPA (Exhibit C) provides Quorum with robust data portability protections, including the right to export all Customer Data in ACORD XML and CSV formats within sixty (60) days of expiration or termination of the Agreement, at no additional charge. Clearpoint is required to provide certified destruction of all Customer Data within thirty (30) days of the completion of the data-export period.
These provisions are designed to ensure that Quorum retains access to its Customer Data and, if necessary, to the underlying platform technology in the event of adverse developments affecting Clearpoint's ownership or financial condition.
C. Cross-Border and Multi-State Data Transfer
Quorum's claims operations span three states — Connecticut, Texas, and Florida — and involve field adjusters operating throughout Quorum's service territories. Fenwick DCA confirmed that all ClaimsIQ™ data flows remain within the continental United States, with all data at rest stored in Cobalt Cloud data centers located domestically. No cross-border data transfers to jurisdictions outside the United States were identified in the current platform architecture or data flow.
While no cross-border data transfer issues were identified at present, the DPA includes a restriction on international data transfers without Quorum's prior written consent, to guard against future changes to the platform architecture or subprocessor arrangements that could result in Customer Data being processed or stored outside the United States. This restriction is consistent with Quorum's data-localization preferences and with the regulatory expectations applicable to the insurance industry.
D. Breach Notification Gap
Clearpoint's initial form agreement specified a seventy-two (72) hour notification period following the discovery of a security incident involving Customer Data. Fenwick DCA determined that this notification timeline is insufficient in light of the following considerations:
• The NAIC Insurance Data Security Model Law, as adopted in Connecticut, expects licensees and their service providers to provide prompt notification of cybersecurity events, and many industry participants have adopted twenty-four (24) hour notification windows as a best practice.
• Quorum's internal incident response plan requires that the Company be notified of potential data breaches within twenty-four (24) hours in order to enable timely assessment, containment, and, where required, notification to affected individuals and regulatory authorities.
• The nature of the data processed through ClaimsIQ™ — including PII and PHI — heightens the potential harm from delayed notification and the regulatory consequences of non-compliance with applicable breach notification requirements.
Recommendation (adopted): The Security Requirements (Exhibit D) require Clearpoint to provide notification to Quorum within twenty-four (24) hours of confirming a security incident involving Customer Data. The notification must include all reasonably available information regarding the nature, scope, and potential impact of the incident, the categories and approximate number of affected data subjects, and the remedial measures taken or planned. This recommendation has been adopted and is reflected in the current draft of Exhibit D.
VI. Recommended Contractual Mitigants
Based on the findings and recommendations of the Fenwick DCA assessment, Calderwood & Harkness negotiated comprehensive contractual mitigants to address the identified risks. These mitigants have been incorporated into the following documents:
A. Mitigants Incorporated into Exhibit C (Data Processing Addendum)
The Data Processing Addendum (Exhibit C to the SaaS Subscription Agreement) incorporates the following mitigants:
1. Controller-Processor Designation. Explicit designation of Quorum as data controller and Clearpoint as data processor with respect to all Customer Data processed through the ClaimsIQ™ platform.
2. Customer Data Ownership. Sole and exclusive ownership of all Customer Data is retained by Quorum at all times. Clearpoint acquires no ownership interest in Customer Data by reason of its processing activities under the Agreement.
3. Aggregated Data Restrictions. Aggregated Data derived from Customer Data may be used only for product-improvement purposes; any other use requires Quorum's prior written consent (not to be unreasonably withheld); re-identification is prohibited; and sale of Aggregated Data to third parties is prohibited.
4. Data Portability. Quorum is entitled to a full export of all Customer Data in ACORD XML and CSV formats within sixty (60) days of the expiration or termination of the Agreement, at no additional charge to Quorum.
5. Data Destruction Certification. Clearpoint is required to certify the complete destruction of all Customer Data — including data held by subprocessors — within thirty (30) days of the completion of the data-export period.
6. HIPAA BAA-Equivalent Provisions. The DPA includes provisions satisfying the requirements of the HIPAA Privacy Rule and Security Rule for Business Associate Agreements, addressing the processing of PHI in connection with Quorum's workers' compensation claims. These provisions cover required administrative, physical, and technical safeguards; restrictions on use and disclosure of PHI; breach notification obligations specific to PHI; and the obligation to return or destroy PHI upon termination.
7. Subprocessor Management Framework. The DPA establishes a subprocessor management framework providing Quorum with thirty (30) day advance written notice of proposed new subprocessors and a corresponding thirty (30) day objection right. If Quorum's objection is not resolved, Quorum may terminate the affected services without penalty.
8. Flow-Down Obligations. Clearpoint is obligated to flow down data-protection requirements to its subprocessors — currently Cobalt Cloud Infrastructure, Inc. and Redline Document AI, LLC — at a level at least as protective as the obligations imposed on Clearpoint under the DPA. Clearpoint remains fully liable for the acts and omissions of its subprocessors.
9. Consumer Rights Support. Clearpoint is obligated to provide reasonable cooperation and technical assistance to support Quorum in responding to CTDPA consumer data-access, deletion, and opt-out requests within applicable statutory timeframes.
10. Restriction on International Data Transfers. Customer Data may not be transferred, processed, or stored outside the continental United States without Quorum's prior written consent.
11. Regulatory Compliance. Clearpoint is required to comply with the CTDPA, HIPAA (with respect to PHI processing), and the NAIC Insurance Data Security Model Law as adopted in Connecticut, to the extent applicable to Clearpoint's data-processing activities under the Agreement.
B. Mitigants Incorporated into Exhibit D (Security Requirements)
The Security Requirements (Exhibit D to the SaaS Subscription Agreement) incorporate the following mitigants:
1. Annual SOC 2 Type II Audit Report. Clearpoint is required to maintain and deliver an annual SOC 2 Type II audit report, conducted by an independent third-party audit firm (current auditor: Hawthorne & Ellers, CPAs LLP). The report must be delivered to Quorum within ninety (90) days of the close of the applicable audit period. The current report covers the period from April 1, 2023, through March 31, 2024.
2. Annual Penetration Testing. Clearpoint is required to engage an independent third-party firm (current vendor: Sentinel Cyber Solutions LLC) to conduct annual penetration testing of the ClaimsIQ™ platform and its supporting infrastructure. An executive summary of the penetration test results must be shared with Quorum within thirty (30) days of the completion of each test.
3. Breach Notification. Clearpoint is required to provide notification to Quorum within twenty-four (24) hours of confirming a security incident involving Customer Data, consistent with NAIC Model Law expectations and Quorum's internal incident response requirements.
4. Encryption Standards. Clearpoint is required to maintain encryption standards of AES-256 for data at rest and TLS 1.2 or higher for data in transit.
5. Access Controls. Clearpoint is required to implement and maintain role-based access controls and least-privilege principles for all personnel and systems with access to Customer Data.
6. Insurance Requirements. Clearpoint is required to maintain the following insurance coverages, all carried with Northern Ridge Mutual Insurance Company or another carrier reasonably acceptable to Quorum:
7. Written Information Security Program. Clearpoint is required to maintain a written information security program and to make such program available to Quorum upon reasonable request, including in connection with regulatory examinations and compliance assessments.
8. AI Model Documentation. Clearpoint is required to provide documentation of the logic, inputs, and outputs of its AI models used in claims triage and fraud detection, and to cooperate with Quorum's regulatory examinations regarding automated decision-making.
C. Mitigants Addressed in Other Agreement Provisions
In addition to the mitigants incorporated into the DPA and Security Requirements, the following protections are addressed in other provisions of the SaaS Subscription Agreement and related transaction documents:
1. Uncapped Data-Breach Indemnification. Clearpoint's indemnification obligation for data breaches caused by Clearpoint's failure to comply with its data-protection obligations is uncapped, ensuring that Quorum is not limited in its recovery for losses arising from a data-breach event. This is addressed in the indemnification section of the SaaS Subscription Agreement.
2. Liability Caps for Other Claims. For intellectual property and general indemnification claims, the liability cap is set at two times (2×) the total contract value, or Fourteen Million Dollars ($14,000,000). The general liability cap for all other claims is set at one times (1×) the total contract value, or Seven Million Dollars ($7,000,000).
3. Source Code Escrow. As described in Section V.B above, the Technology Escrow Agreement with Granite Trust Company, N.A. provides for the release of the ClaimsIQ™ source code upon the occurrence of specified release conditions, including bankruptcy, cessation of business, or uncured material breach following a sixty (60) day cure period.
4. Change-of-Control Assignment Restrictions. The SaaS Subscription Agreement includes assignment restrictions that specifically address change-of-control scenarios involving Ridgeway Capital Partners, LP and other ownership-change events. Clearpoint may not assign the Agreement or undergo a change of control that would result in a change in the identity of the majority equity holder without Quorum's prior written consent.
VII. Open Items and Recommendations for Ongoing Monitoring
While the contractual mitigants described herein address the residual risks identified in the DPIA, data privacy is an evolving field and the risk environment will continue to change over the term of the SaaS Subscription Agreement. Accordingly, Calderwood & Harkness recommends that Quorum implement the following ongoing monitoring practices:
1. Annual SOC 2 Review. Quorum should conduct annual reviews of Clearpoint's SOC 2 Type II reports and penetration test executive summaries upon receipt, with review to be coordinated between the General Counsel's office, the Chief Information Officer's office, and Quorum's internal audit function. Any qualifications, exceptions, or findings noted in the SOC 2 reports should be escalated for assessment and, where appropriate, for discussion with Clearpoint.
2. Subprocessor Monitoring. Quorum should actively monitor subprocessor changes and exercise its objection rights within the thirty (30) day notice period provided in the DPA. Any proposed new subprocessor should be evaluated against Quorum's data-localization, security, and compliance requirements before Quorum provides consent or elects to exercise its objection right.
3. Regulatory Tracking. Quorum's privacy and compliance teams should track evolving CTDPA regulations, HIPAA guidance, and NAIC Model Law amendments for potential contract-update triggers. The CTDPA is a relatively new statute and is likely to be supplemented by implementing regulations, enforcement guidance, and judicial interpretations that may affect the obligations of Quorum and Clearpoint under the DPA. Similarly, HIPAA and NAIC Model Law requirements are subject to periodic amendment and reinterpretation.
4. AI Regulatory Monitoring. Quorum should monitor regulatory developments regarding AI-driven claims processing and algorithmic fairness in insurance, including guidance from the Connecticut Insurance Department, the National Association of Insurance Commissioners, and other relevant regulatory bodies. As noted in Section III.E above, regulatory attention to the use of AI in insurance is increasing, and Quorum should be prepared to adapt its contractual arrangements and internal governance practices in response to new requirements.
5. Periodic Reassessment. Dravello Data Compliance Advisors LLC remains available for periodic reassessments of the ClaimsIQ™ platform as requested by Quorum. Miriam Tanaka, Principal Consultant, has indicated her willingness to perform annual follow-up reviews to assess changes to the platform architecture, subprocessor landscape, or regulatory environment, and to confirm the continued adequacy of the contractual mitigants.
VIII. Conclusion
The Data Privacy Impact Assessment performed by Dravello Data Compliance Advisors LLC confirms that the ClaimsIQ™ platform, as contractually documented in the SaaS Subscription Agreement and its exhibits, presents an acceptable data-privacy risk profile for Quorum's enterprise-wide deployment across its property and casualty and specialty lines subsidiaries.
The key residual risks identified in the DPIA — including risks related to aggregated data use, vendor insolvency and data access, breach notification timing, HIPAA compliance, subprocessor management, and AI-driven decision-making — have been addressed through comprehensive contractual mitigants incorporated into the Data Processing Addendum (Exhibit C), the Security Requirements (Exhibit D), and the body of the SaaS Subscription Agreement, as described in this memorandum.
Calderwood & Harkness recommends proceeding to finalization of the SaaS Subscription Agreement with Clearpoint Analytics, Inc. on the terms reflected in the current draft, inclusive of all mitigants described herein. We are available to coordinate the final execution process and to address any remaining questions from the General Counsel's office, the Chief Information Officer's office, or the procurement team.
Copies of the full Fenwick DCA assessment report dated April 8, 2024, are available upon request. This memorandum constitutes a privileged summary of the DPIA findings and recommendations for internal use by the named recipients and their designees.
Respectfully submitted,
CALDERWOOD & HARKNESS LLP
By: ________
Nathan Ikeda Lead Associate Calderwood & Harkness LLP 100 Pearl Street, Suite 800 Hartford, CT 06103 Telephone: (860) 555-7200 nikeda@calderwoodharkness.com
cc:
Renata Vasquez, Responsible Partner, Calderwood & Harkness LLP
Gabrielle Moss, Working Associate, Calderwood & Harkness LLP
Malcolm Tsai, VP of Procurement, Quorum Insurance Holdings Corp.
Enclosure:
Dravello Data Compliance Advisors LLC — Data Privacy Impact Assessment Report (dated April 8, 2024) [under separate cover, attorney-client privileged]
Coverage Type | Per Occurrence / Per Claim | Aggregate
Commercial General Liability | $5,000,000 | $10,000,000
Technology E&O / Cyber Liability | $10,000,000 | $20,000,000
Workers' Compensation | Statutory Limits | Statutory Limits

CALDERWOOD & HARKNESS LLP Attorneys at Law

MEMORANDUM

PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION

MATTER NO.: 1025-00009

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts