Quillmark Health / BB-Demo – Negotiation
Callcompleted
Quillmark Health: documents · 2026-06-29 17:00
Quillmark's procurement director refused to negotiate until the security determination clears. The close date was not accepted as a commitment, and BB-Demo took it off its forecast. Three findings remain open.
What was said
What this says
Current to 11 Oct 26Quillmark's procurement director refused to negotiate until the security determination clears. The close date was not accepted as a commitment, and BB-Demo took it off its forecast. Three findings remain open.
What happened: Tasha Greene, Procurement Director, said commercial discussions do not open until security clears. Megan Alvarez restated three open findings: incident history, access control evidence and a defined notification commitment.
Customer view: Megan said BB-Demo's written incident answer described the process, not events, and that best efforts notification is unacceptable. Her determination is written and goes to the board risk committee, not given verbally.
Commercial: Owen Tallis restated the Enterprise proposal at one hundred and fifty-five thousand, implementation included, then agreed to send no pricing paper. Tasha said the close date does not move on its own and asked that it not be treated as a commitment.
Watch: The decision letter will come from procurement and will be short, with no detailed feedback.
Themes
Current to 9 Oct 26Theme
Negotiation blocked by security
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Jordan Pike to send a signed incident statement to Megan Alvarez by the end of the following day.
- Solutions team to send written evidence on access and deprovisioning that week.
- Owen Tallis to send proposed notification wording to Megan with Tasha Greene copied, and Jordan to move the deal close date out in the CRM.
Risks
Current to 9 Oct 26- The deal could be lost without detailed feedback, since Quillmark gives only a short decision letter.
- The best efforts notification wording in the draft is unacceptable to a covered entity and needs legal rewriting.
- The close date is undetermined and depends on a security determination BB-Demo cannot influence beyond closing findings.
Opportunities
Current to 9 Oct 26- A signed incident statement, access evidence and defined notification wording could close all three findings.
- Quillmark praised BB-Demo's candour about gaps as the reason the review has been orderly.
Transcript
Jordan Pike NoneHi all, can you hear me okay? Owen's just joining, I can see him in the lobby now.
Tasha Greene NoneI can hear you, Jordan. Hello.
Owen Tallis NoneHi, sorry, got held up on the last call. Audio's fine this end. Megan, I think you're on mute.
Megan Alvarez NoneApologies. Hello, everyone. Can you hear me now?- Owen Tallis NonePerfect.
- Jordan Pike NoneThanks for making the time at the end of the day, I know it's been a long week. Quick agenda and a time check: we've got twenty-five minutes. First, where the security findings stand. Second, what that means for the timeline. Third, to be transparent, where commercial terms fit, if they fit at all. Sound fair?
- Tasha Greene NoneThat's fine. Before anything else I'd like to confirm the evaluation timeline, if I may. Per our process, the close date on your side is tomorrow, Tuesday 30 June 2026, and that was set before the security review finished. Is that how you have it?
- Jordan Pike NoneThat's how it sits in our system, yes. Tomorrow's the date on the deal. Owen, anything to add?
- Owen Tallis NoneJust that I'd rather we say out loud what's real. A close date is only a date until somebody signs. So, Tasha, where does this stand against tomorrow? What's the next dated step on your side, and who signs?
- Tasha Greene NonePer our process, the next step is the security determination. Commercial discussions do not open until that has cleared. So at this time I'm not able to negotiate terms, and I want to be clear about that before we use up the time.
- Owen Tallis NoneUnderstood, and I appreciate you saying it plainly. For the record on our side, the Enterprise proposal stands at one hundred and fifty-five thousand, implementation included. I'm not going to push on it while security is open. Let's not discount before there's a yes to discount against.
- Tasha Greene NoneThank you. For clarity, I haven't asked for a discount.
- Owen Tallis NoneNo, fair. That one's on me. I got ahead of myself.
- Jordan Pike NoneRight. Megan, would it help if you walked us through the open items, so we're all looking at the same list? I'll answer each one as straight as I can.
- Megan Alvarez NoneYes. For the record, I'll restate scope first. This is the Enterprise evaluation for our client-services teams, with BB-Demo running inside our own Snowflake account. Hospital client data is in scope, so everything sits under HIPAA and under our risk posture. There are three open findings. One, incident history: I asked for a description of any incidents in the last ninety days. Two, the evidence for how access is controlled and provisioned. Three, the written commitment on notification if something goes wrong.
- Jordan Pike NoneMm. Okay. Can I take them in order?
- Megan Alvarez NonePlease.
- Jordan Pike NoneOn the first, here's where we are. You've had our written answer on incidents. To be transparent, I know you felt it was thinner than what you asked for, and I'd rather hear exactly which part didn't land than guess. We don't want you finding anything out before we tell you.
- Megan Alvarez NoneThe answer described the process. It did not describe events. Those are different things. I asked what happened in the period, not how you would handle it. If there were none, I need that stated plainly and signed by someone accountable. If there were some, I need them listed.
- Jordan Pike NoneGot it. That's fair. I'll take that back and get you a statement that answers the question you asked, signed by someone senior. Owen, can we get that by tomorrow?
- Owen Tallis NoneWe can. I'll make sure it's named and dated, and that it comes from the right person rather than through sales. You'll have it before the end of tomorrow.
- Megan Alvarez NoneThank you. I'll note that it remains outstanding until I have it in writing. I'm not able to treat anything said on this call as the answer.
- Jordan Pike NoneUnderstood.
- Jordan Pike NoneOn the second, access control. Enterprise includes SSO and SCIM, so provisioning and deprovisioning run from your identity provider rather than by hand. I think what you wanted was the evidence, not the feature list. Is that right?
- Megan Alvarez NoneCorrect. A feature list is not evidence. I need to see how deprovisioning is demonstrated, not described, and who at BB-Demo can reach data inside our Snowflake account, and under what controls.
- Jordan Pike NoneOkay. Straight answer: BB-Demo runs inside your account, so who can reach what is largely decided by the roles you grant. I'd want our solutions team to write that up against your own controls instead of me paraphrasing it on a call. I don't want to say something loosely and have you hold me to it.
- Megan Alvarez NoneThat is the correct instinct. I'd also remind you that I don't give verbal approval, so there is no version of this call where I say yes.
- Jordan Pike NoneHa, no, noted. I wasn't fishing. Well, a little. What would make this a yes, though?
- Megan Alvarez NoneA yes is a written determination from me, following the review, reported to the board risk committee. What moves it is closed findings with evidence. I can't tell you in advance what the committee will conclude, and I'd be careful about anyone who says they can.
- Owen Tallis NoneThat's a good steer. Jordan, let's put these in a single document with an owner and a date against each one.
- Jordan Pike NoneYep, I'll own that. Third item, Megan?
- Megan Alvarez NoneThird is notification. The draft language says you will make best efforts to notify us of an incident. I can't accept best efforts. I need a defined commitment: what triggers it, who is told, and how quickly. For a covered entity that is not optional.
- Jordan Pike NoneRight. And I'm not going to dress it up: that's a contract question, not just a security one. Owen, that's yours really.
- Owen Tallis NoneIt is. And I won't commit to wording on a call. I'd want our legal team to write it. What I can say is we're not going to argue that best efforts is good enough for a hospital client's data. If it's a defined commitment you need, we should be able to put one in.
- Megan Alvarez NonePlease send the proposed wording in writing. I'll review it against our requirements. I won't comment on it during this call.
- Tasha Greene NoneIf I may, to keep the file clean: anything that changes terms comes through me, in writing, and only after security has cleared. I'd ask that the wording go to Megan first, and that I'm copied.
- Jordan Pike NoneOf course. Megan first, Tasha copied. Understood.
- Owen Tallis NoneTasha, can I ask a process question? Not negotiation, just so my forecast is honest. If the findings aren't all closed by tomorrow, does the close date simply sit there, or is there something that formally moves it?
- Tasha Greene NoneThe date does not move on its own. It would be reviewed per our process once the determination is made. At this time I can't give you a revised date, and I'd ask you not to treat tomorrow as a commitment from us.
- Owen Tallis NoneThat's useful, thank you. Then I'm taking tomorrow off our forecast. It's not a hopeful date any more, it's an open one. Jordan, can you update the deal today so it says what's true?
- Jordan Pike NoneWill do. I'll move it out and note that it depends on the security determination, no date.
- Tasha Greene NoneI appreciate that. It's easier for us if both files say the same thing.
- Megan Alvarez NoneBefore we conclude, one more for the record. Please describe in writing any change since the review began to the way BB-Demo stores or processes data for customers in a regulated setting. If nothing has changed, say so. I would rather have a short answer than a silence.
- Jordan Pike NoneYes, that's a fourth item then, and a reasonable one. Short answer from me: not that I'm aware of, but I won't assert it on a call. It goes into the written response with a name on it.
- Megan Alvarez NoneThank you. That will do.
- Jordan Pike NoneTasha, can I ask something that isn't commercial? When security has made its determination, will we hear from you or from Megan? I'd like our written responses to go to the right person at the right time, and not three people at once.
- Tasha Greene NoneYou'll hear from me. The decision letter comes from procurement, per our process. Megan's determination feeds it, but she doesn't write to vendors about the outcome. I'd expect it to be short.
- Owen Tallis NoneShort is fine. If the answer's no, I'd still value knowing what we could have done differently, even a line. But I understand if the policy is not to give detail.
- Tasha Greene NoneThat's right. We don't give detailed feedback in writing. I can't promise any more than that. We appreciate your time and effort throughout, and that stands whatever the outcome.
- Owen Tallis NoneFair enough. I'd rather know where I stand than guess.
- Jordan Pike NoneOkay, let me play back what I've got so we're aligned. One, a signed statement on incidents, to Megan, by the end of tomorrow. Two, written evidence on access and deprovisioning from our solutions team, this week. Three, proposed notification wording from Owen's side, to Megan with Tasha copied. Four, the written answer on any changes to storage and processing. Did I miss anything?
- Megan Alvarez NoneThat's complete. I'd add that receipt of documents is not clearance. They will be reviewed in sequence.
- Tasha Greene NoneAnd from my side, nothing changes in the meantime. No commercial discussion, no changes to the file, until I hear from security.
- Owen Tallis NoneClear. We won't send a revised order form or any pricing paper. I'd rather be early on the facts and quiet on the commercials.
- Jordan Pike NoneAnything else from either of you? We've got a few minutes. Megan, anything that would be better said now than in an email?
- Megan Alvarez NoneOnly that I appreciate the candour about the gaps. It is the reason this review has been orderly. That's an observation, not a commitment.
- Jordan Pike NoneAppreciated. Honestly. I'd rather you hear it from us than find it.
- Tasha Greene NoneThen I think we're done. I'll note the timeline on our file as undetermined, and the next contact will be a written one from me. Thank you all.
- Owen Tallis NoneThanks, Tasha. Thanks, Megan. Jordan, stay on for a minute after this about the document?
- Jordan Pike NoneYep, I'll stay on. Thanks everyone, take care. Talk soon.
- Megan Alvarez NoneThank you. Goodbye.
- Tasha Greene NoneGoodbye.
- Jordan Pike NoneOkay, they've dropped. Owen, I'll get the incident statement drafted tonight so it's with the right person for signing first thing.
- Owen Tallis NoneGood. And the deal update today, please, no close date, with the reason in the notes. Who signs the statement, do you think?
- Jordan Pike NoneSomeone senior on the security side, not me. I'll confirm the name with you within the hour.
- Owen Tallis NoneRight. Thanks, Jordan. Good call in the circumstances. Talk later.
- Jordan Pike NoneThanks, Owen.
Callsmade from