Extract to table

For breaches affecting 500 or more individuals, the covered entity must provide notification to the Secretary without unreasonable delay and in no case later than sixty (60) calendar days from the date of discovery of the breach

The results of each annual assessment are to be shared with Quorum, and Palomar is required to develop and implement a remediation plan addressing any findings rated as high or critical severity within defined timelines

For vulnerabilities that are under active exploitation (as determined by CISA, vendor advisories, or industry threat intelligence sources), patching must be completed within seventy-two (72) hours, or compensating controls must be deployed within twenty-four (24) hours pending full remediation

Endpoint Detection and Response: Palomar is required to deploy and maintain endpoint detection and response ("EDR") technology on all systems within its environment that process, store, or transmit Quorum data

EDR solutions must be managed and monitored on a 24/7 basis

Scan results, together with Palomar's remediation plans and timelines, must be provided to Quorum within fifteen (15) business days of each quarterly scan