Extract to table

404): Quorum must notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed as a result of the breach

This notification must be provided without unreasonable delay, and in no case later than sixty (60) calendar days after the date of discovery of the breach

406): If the breach involves the PHI of more than 500 residents of any single state or jurisdiction, Quorum must provide notice to prominent media outlets serving that state or jurisdiction

This media notification must be provided without unreasonable delay and in no case later than sixty (60) calendar days after discovery

Under the Connecticut Insurance Data Security Law, Quorum is required to notify the Connecticut Insurance Commissioner within seventy-two (72) hours of a determination that a "cybersecurity event" has occurred

Data Security Exhibit (Exhibit D, as Amended) The MSA, as amended by Amendment 2 (executed September 15, 2022), contains a comprehensive Data Security Exhibit, designated as Exhibit D, which sets forth the security obligations that Palomar is required to maintain in connection with its processing, storage, and transmission of Quorum data