Extract to table

While this timeline is commercially reasonable and, as we will demonstrate, appropriately aggressive to accommodate the most stringent regulatory deadlines applicable to Quorum, the DSA must be carefully drafted to accomplish several critical objectives

The DSA must precisely define the term "Discovery" using an objective standard that prevents any party from delaying the commencement of the notification clock

It must clearly delineate responsibilities for regulatory reporting to federal and state authorities, including insurance-specific regulators

And it must account for the full multi-jurisdictional scope of applicable federal and state laws, given Quorum's operations in all 50 states and the District of Columbia

We conclude that the 48-hour contractual notification obligation agreed upon in principle by the parties is appropriate and should be maintained, but that substantial additional drafting work is required to ensure that the DSA adequately protects Quorum's interests across the full spectrum of applicable legal requirements

Taken together, these factors establish that the proposed data-licensing arrangement carries an exceptionally high risk profile from a data-security and breach-notification perspective, and that the contractual provisions governing incident response and breach notification must be drafted with corresponding rigor