Quarrington Care Network / BB-Demo – Escalation
Callcompleted
Quarrington Care Network: documents · 2026-07-15 14:15
Escalation after a new free-text intake field was ingested by the connector. BB-Demo accepted the design gap and proposed an allow-list. The customer's privacy officer is logging a scope incident and wants evidence. No commercial change was sought.
What was said
What this says
Current to 11 Oct 26Escalation after a new free-text intake field was ingested by the connector. BB-Demo accepted the design gap and proposed an allow-list. The customer's privacy officer is logging a scope incident and wants evidence. No commercial change was sought.
What happened: Tobias Renwick explained that a new free-text field on the intake form was ingested because the exclusion list did not name it. A liaison raised a ticket and Hannah Lowe contained it the same afternoon.
Customer view: Marisol Vega wants evidence, not assurance, and is opening a scope incident under the business associate agreement. Gregory Hasselbeck asked for simplicity and is content for Marisol to lead. Danielle Okonkwo was relieved by the plain account.
Commercial: Hollie Grieve confirmed Growth is unchanged and nothing commercial was asked. Marisol asked that new users wait until the allow-list is confirmed, which she expects to review within the week.
Watch: BB-Demo owes written evidence, a nightly schema check and a written confirmation on staff access. A dashboards working session is planned once the allow-list is confirmed.
Themes
Current to 9 Oct 26Theme
Data scope incident, allow-list fix
Importance
complaint
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe sends Marisol Vega the job history, verification query, access list, schema comparison and allow-list design.
- Tobias Renwick confirms in writing what the service role access history shows for the field content.
- Hollie Grieve drafts the liaison wording and field request template, and books a check-in once Marisol closes the incident.
Risks
Current to 9 Oct 26- The free-text field may stay recoverable in Snowflake history until the retention period lapses, and the privacy officer must record the incident.
- New user additions are paused until the allow-list is confirmed, which slows adoption.
- BB-Demo owes evidence and written confirmations, and any slip would undermine trust with a regulated customer.
Opportunities
Current to 9 Oct 26- Handled well, the allow-list and nightly schema check leave a stronger control that supports the Growth renewal.
- A dashboards working session on the referral trend is planned once the allow-list is confirmed.
Transcript
Hollie Grieve NoneHello, hello. Can everyone hear me all right? I've got a bit of an echo on my side, so shout if it's bad.
Danielle Okonkwo NoneLoud and clear, Hollie. Good afternoon from Chicago. Before we start, quick win from the field: one of our liaisons walked into a physician group on Monday and already knew the referrer's whole history. The doctor was thrilled.- Hollie Grieve NoneThat's lovely to hear. That's exactly what it's for. Afternoon, Marisol, afternoon Hannah. Tobias is just joining, I think.
Marisol Vega NoneGood afternoon. Before we go further, I would like to confirm what data is in scope for this call. Is any PHI in scope for the discussion today, or are we dealing only with field names and configuration?
Hannah Lowe NoneGood question, and I'll put that in writing afterwards. The short answer is we don't need any record content on this call at all. The longer answer is that we'll talk about which fields were ingested, not what was in them.- Marisol Vega NoneThank you. Please keep it that way. If anyone needs to look at content, we stop and I decide how.
Tobias Renwick NoneSorry, sorry, I'm here. Back to back this morning. Good afternoon, all. Marisol, to be precise, I'd rather start with what your security team will need to see, so I'll build the explanation around that.
Gregory Hasselbeck NoneAfternoon, everyone. What decision is needed from me today?- Hollie Grieve NoneFair question, and it's a short list. Nothing today beyond agreeing the approach and noting that Marisol is logging a scope incident. We want you to hear it from us properly, and then we want you comfortable that it's closed.
- Gregory Hasselbeck NoneUnderstood. Keep it simple, please. Has Marisol signed off the approach?
- Marisol Vega NoneNot yet. I have reviewed the draft from Hannah and I have questions. That is partly why we are all on this call.
- Gregory Hasselbeck NoneGood. Then I'll listen.
- Tobias Renwick NoneRight. Let me set out what happened, as plainly as I can, and I'll state my assumptions as I go. The honest answer is that this was our design gap as much as anything on your side. Your intake form gained a new free-text field in June. Our connector reads the intake form and pulls a defined set of fields into the brain, which sits inside your own Snowflake account. The way we had protected sensitive fields was an exclusion list: a list of fields the connector must not ingest.
- Danielle Okonkwo NoneAnd the new field wasn't on that list.
- Tobias Renwick NoneCorrect. The trade-off with an exclusion list is that anything new is included by default until someone adds it to the list. Nobody told us the field existed, and our connector had no way of knowing it was sensitive. So it was ingested, like any other new column.
- Marisol Vega NoneLet me be clear about my concern. A free-text field is exactly the kind of field where staff type whatever is in front of them. My question is whether you can state what was in it. Not tell me it was probably fine.
- Hannah Lowe NoneI can't state what was in it, and I wouldn't want to, because that would mean someone at BB-Demo reading it. What I can state is where it went. The field landed in one table inside your Snowflake account, it was indexed by the brain, and it was visible to the users who have access to the referral view. It did not leave your account.
- Marisol Vega NoneVisible to which users, to be precise?
- Hannah Lowe NoneTo the referral relations team and the patient services team, so the same people who already use the intake form. I've pulled the access list and I'll send it to you through the channel you specified. I haven't pasted it into any chat.
- Marisol Vega NoneGood. That is the correct channel. Continue.
- Danielle Okonkwo NoneCan I jump in? I want to know how this was found. Because if it was one of my liaisons who noticed, I need to thank them. I never let a liaison's flag go unanswered.
- Hollie Grieve NoneIt was a liaison, actually. A user asked the brain a question about a referrer and the answer quoted a snippet that looked like it had been typed by a person in a hurry. They raised a ticket straight away. The one ticket we've had this month, and a high priority one, rightly.
- Danielle Okonkwo NoneGood. That's what I want to hear. They did the right thing.
- Hollie Grieve NoneCompletely. And Hannah picked it up that same afternoon.
- Hannah Lowe NoneYes. First step was to stop the connector reading that field, so nothing further was ingested. Second, I removed the field's contents from the brain's index and from the intermediate table, and re-ran the index so the snippets can't surface. I've kept a log of what I ran and when, which is part of what Marisol will want for the incident record.
- Marisol Vega NoneI will want that log in full. Timestamps, the commands, who executed them, and confirmation of deletion, not simply that a job reported success.
- Hannah Lowe NoneUnderstood. To be precise, I'll give you the job history from the warehouse and a verification query that you can run yourselves, so you aren't relying on our word. Your team can see the table is empty of that field.
- Marisol Vega NoneThat is acceptable in principle. I will say that I do not accept we do not store that without evidence, so the evidence matters more to me than the assurance.
- Tobias Renwick NoneI'd expect nothing less, and I'd say that's the right standard. The one place I want to be careful is backups and any warehouse time travel. Snowflake keeps historical versions for a retention period you control. So the field may remain recoverable inside your account until that period lapses, unless you choose to shorten it. That's your decision, not ours, but we'll explain how.
- Marisol Vega NoneThat is a useful point and I had not raised it. I will take that to our infrastructure team and document the control.
- Gregory Hasselbeck NoneWhat's the risk if it stays in the history for a while?
- Marisol Vega NoneIt remains inside our own controlled environment, with the same access as the rest of our warehouse. The risk is lower than if it had left, but I still must record it. A scope incident under the business associate agreement is about documenting that something entered a system it should not have, whatever the eventual harm.
- Gregory Hasselbeck NoneFine. Log it. I'd rather it was recorded than argued over.
- Marisol Vega NoneI intend to. I will open it today and I would like BB-Demo to cooperate with the entries.
- Hollie Grieve NoneOf course. Tell us what you need from our side and we'll provide it, in writing, with names against each item.
- Danielle Okonkwo NoneSo, what's the fix going forward? Because I don't want my team going through this again every time someone in intake adds a box to the form.
- Tobias Renwick NoneThis is the part I'd most like Marisol to challenge. We move from an exclusion list to an allow-list. The connector will ingest only the fields that are named. A new field on the intake form is ignored until someone with the right authority approves it. The trade-off is a little friction when your team genuinely wants a new field to appear in the brain, but I think it's the right trade for a regulated operator.
- Marisol Vega NoneThat aligns with minimum necessary. I support it. I want it to be explicit who approves an addition to the allow-list.
- Hannah Lowe NoneWe'd suggest that you name the approver. It might be you, Marisol, or a delegate in your team. Our side only applies the change once we have that approval in writing, so there's a record of who agreed and when.
- Marisol Vega NoneIt should be me, with a named deputy for absence. I will state that in the incident record.
- Danielle Okonkwo NoneHow long does it take to approve something? If a liaison wants a field, I need an answer fast. I need this by Friday kind of fast, sometimes.
- Marisol Vega NoneDanielle, I will not commit to a speed that compromises review. But I can commit to a standard process, and a standard response time. A simple field request with a stated purpose should not take long.
- Danielle Okonkwo NoneThat works for me. Just so long as it's a process and not a mystery.
- Hollie Grieve NoneWe can help with that. I can set up a simple request template, so a liaison says which field, why they want it, and which team will see it. Marisol gets a tidy request each time.
- Marisol Vega NoneI would welcome that. Include a line for whether free text is involved, because free text is the category I treat most carefully.
- Hollie Grieve NoneNoted. Free text, yes or no, on the template.
- Tobias Renwick NoneMay I add something on free text specifically? Even with an allow-list, I wouldn't recommend ingesting free-text fields at all unless there's a clear need. If there is, the honest answer is that we'd want a documented review of how staff are instructed to use it, because we can't see inside it and shouldn't.
- Marisol Vega NoneI agree. And the instruction to staff on the intake form is on our side. I will address that with the intake team, including a label on the field itself.
- Danielle Okonkwo NoneSorry, one thing. Was that field added by my team or by patient services? Because I'd rather know so I can talk to the right people.
- Marisol Vega NoneIt came through a change request approved on our side for a legitimate operational reason. I will not name individuals in this call. The record will state the change and the date, and the review will be about process, not blame.
- Tobias Renwick NoneAnd I'd add, in the same spirit, that we run this as a blameless review. The connector did what we built it to do. The weakness was in our default, so the correction is ours to make.
- Danielle Okonkwo NoneI appreciate that. Honestly, it's a relief to hear someone say it plainly.
- Gregory Hasselbeck NoneDoes this affect what we pay or the contract?
- Hollie Grieve NoneNo. You're on Growth at fifty thousand a year, forty licensed users, and nothing here changes that. We're not asking for anything commercial, and I wouldn't want anyone thinking this call is a prelude to that.
- Gregory Hasselbeck NoneGood. Thank you. Keep it simple.
- Danielle Okonkwo NoneAnd on the seats, since you mentioned it, Hollie. We've had a lot of new liaisons come on in the last few months. I want to be sure this incident doesn't put a freeze on adding people.
- Hollie Grieve NoneNo freeze from us. Usage has grown a lot since you started, which is good news, and we're comfortably inside the forty. If you get close we'll have a separate conversation, but that's for another day.
- Marisol Vega NoneI would ask that new users are not added until the allow-list is in place and I have confirmed it. That is a reasonable pause for a few days. It is not a freeze, but it is a condition.
- Danielle Okonkwo NoneHmm. How long are we talking? I've got a couple of liaisons waiting.
- Hannah Lowe NoneLet me answer that practically. The allow-list change is a configuration change on the connector and I can have it ready for Marisol's review quickly. The review is hers. So the pause is as long as it takes to review, and I won't be the bottleneck.
- Marisol Vega NoneI will review within the week, provided I receive the evidence I asked for. That is my commitment.
- Danielle Okonkwo NoneOkay. I can live with that. I'll let the liaisons know it's a short hold and why.
- Tobias Renwick NoneMay I suggest the wording? Something like: a new field was added to the intake form that the system should not have picked up, it has been removed, and new access resumes once the safeguard is confirmed. Nothing about content, nothing alarming.
- Danielle Okonkwo NoneThat's good. Send me that in an email and I'll adapt it. No patient information in it, obviously.
- Hollie Grieve NoneWill do. I'll draft it today.
- Marisol Vega NoneI want to return to one item. The scope of the incident. Is it confined to this one field, or did the connector pick up anything else new during that period? I would like a comparison of the full column list against the allow-list we are about to define.
- Hannah Lowe NoneThat's the next thing I did, in fact. I compared the source schema as of the day before the change with the current one. There was one new column, the free-text field. Nothing else was added. I'll include that comparison with the log so you can see it's complete.
- Marisol Vega NoneGood. That answers it. I will state that scope is a single field.
- Tobias Renwick NoneI'd like to add a detective control too, because an allow-list prevents ingestion, but it doesn't tell you when your source changes. We can add a check that compares the source schema each night with the allow-list and raises a notice when anything unknown appears. You'd see that a field exists without it ever being read.
- Marisol Vega NoneThat is valuable. An alert would be an audit trail in itself. Please include it in the written proposal.
- Hannah Lowe NoneI'll put that in writing, with the behaviour described precisely, including what it does not do. It won't tell you what's in a field, only that it's new.
- Danielle Okonkwo NoneThat actually sounds like a better system than before. Is it weird to say I'm glad it happened?
- Marisol Vega NoneI would not go so far. But I will accept that handled properly, the control will be stronger afterwards.
- Hollie Grieve NoneI'd say that's a fair summary. Let me recap who does what, and tell me if I've got anything wrong. Hannah sends Marisol the job history, the verification query, the access list and the schema comparison. Hannah also writes up the allow-list design and the nightly check.
- Hannah Lowe NoneYes, and the retention note about Snowflake history, so your infrastructure team has what they need to decide.
- Hollie Grieve NoneRight. Marisol opens the scope incident under the business associate agreement and reviews the evidence. Danielle tells the liaisons about the short hold. I send the wording and the field request template.
- Marisol Vega NoneCorrect. One addition. I would like Tobias to confirm in writing that BB-Demo personnel did not access the field content at any point.
- Tobias Renwick NoneI can do that, but I want to be exact so it's accurate. Our staff do not have standing access to your Snowflake account. Access is by your grant, and logged. I'll ask Hannah to pull the access history for our service role over that period, and I'll confirm what it shows, not what I assume.
- Marisol Vega NoneThank you. That is the right way to answer it.
- Gregory Hasselbeck NoneAnything I need to do?
- Hollie Grieve NoneHonestly, no. Just the nod that you're content for Marisol to lead on this and for the allow-list to go ahead once she's happy.
- Gregory Hasselbeck NoneI'm content. Marisol leads. If she's satisfied, I'm satisfied.
- Marisol Vega NoneUnderstood. I will keep you informed at the level you need, which I expect is a single line when it is closed.
- Gregory Hasselbeck NoneExactly that. Thank you.
- Danielle Okonkwo NoneWhile we're all here, can I ask something a bit different? Looking ahead, the leadership team keeps asking what the referral trend is. Once we're through this, can we get back to the dashboards for that?
- Hollie Grieve NoneAbsolutely. It's a Growth feature and your team is already using it. Once the allow-list is confirmed we can go back to that. Maybe a short working session with Hannah, and I'd bring the liaisons who build the views.
- Danielle Okonkwo NoneGreat. Let's loop in the liaisons. I'll pick two who really use it.
- Hannah Lowe NoneHappy to. And I'd suggest we use the allow-listed fields only, so the dashboards are built on exactly what Marisol has approved. It keeps things tidy.
- Marisol Vega NoneThat is sensible. I would like to see the list of fields feeding each dashboard. Minimum necessary applies there as well.
- Hannah Lowe NoneOf course. I'll attach it to the design note.
- Tobias Renwick NoneOne last thing from me, if I may. I'd like to be clear that I'm not promising any feature on a date. The allow-list and the nightly check are things we are doing now for you, and I'll confirm each one is live in writing when it is, not before.
- Marisol Vega NoneThat is how I prefer it. Confirmation when complete, with evidence.
- Hollie Grieve NoneShall I also book a check-in for after the review? Just a short one, to close this out together and make sure nothing's dangling.
- Danielle Okonkwo NoneYes please. Same crowd, if possible.
- Marisol Vega NoneI would attend. It should happen after I have formally closed the incident, not before.
- Hollie Grieve NoneAgreed. I'll hold it until you tell me the incident is closed, and put the invite out then.
- Danielle Okonkwo NoneWonderful. Honestly, thank you all. I came in a bit nervous and I'm leaving feeling like we're in good hands.
- Hollie Grieve NoneThat's kind, Danielle. And thanks to the liaison who raised it. Please pass that on.
- Danielle Okonkwo NoneWill do first thing. Okay, I've got a thing at the top of the hour, so I'll drop.
- Hannah Lowe NoneThanks, all. You'll have the pack from me shortly. Speak soon.
- Marisol Vega NoneThank you. Good afternoon.
- Tobias Renwick NoneBest to everyone. Thank you for the candour, Marisol especially.
- Hollie Grieve NoneCheers, all. Bye for now.
Callsmade from