Quillmark Health - Security Questionnaire v1
Documentdraft Quillmark Health: documents · security_questionnaire · draft · 2026-06-01
Draft first-pass answers from Hannah Lowe to Megan Alvarez at Quillmark Health for the Enterprise tier under HIPAA. Availability and P1 response figures are deferred to the order form. Most security points are marked Open.
What it says
What this says
Current to 11 Oct 26Draft first-pass answers from Hannah Lowe to Megan Alvarez at Quillmark Health for the Enterprise tier under HIPAA. Availability and P1 response figures are deferred to the order form. Most security points are marked Open.
What it is: a draft vendor-review response dated 1 Jun 2026, marked "Status: Draft, version 1." It is for Megan Alvarez at Quillmark Health and is written by Hannah Lowe, Solutions Engineer.
Commits: the nightly refresh completes by 07:00 local time on business days, and Enterprise is credited for freshness as well as availability. Availability and P1 response figures are not stated; the text says "The exact figure is set in the order form."
Unusual: sections C and D are all Open, including the business associate agreement and incident history. The incident answer is an explicit promise to disclose anything relevant.
Not settled: data residency, the architecture diagram, staff access roles, logging, protected health information scope and deletion at exit. Hannah says she will send version two once each open point is in writing.
As found in this document
Current to 9 Oct 26- Availability commitmentThe Enterprise availability commitment applies, with service credits. The exact figure is set in the order form.The Enterprise availability commitment applies, with service credits. The exact figure is set in the order form. · Source: object_read:doc_006_005
- P1 first responseEnterprise carries the fastest first-response time we offer. The exact time is set in the order form.Enterprise carries the fastest first-response time we offer. The exact time is set in the order form. · Source: object_read:doc_006_005
- Nightly refreshThe nightly refresh completes by 07:00 your local time on business days.The nightly refresh completes by 07:00 your local time on business days. · Source: object_read:doc_006_005
- Data freshness creditEnterprise is credited for data freshness as well as availability.Enterprise is credited for data freshness as well as availability. · Source: object_read:doc_006_005
The document
Body
Quillmark Health - Security Questionnaire v1
Status: Draft, version 1. Not for final scoring.
| Date | 1 Jun 2026 |
| Reviewer | Megan Alvarez, Chief Information Security Officer, Quillmark Health |
| Respondent | Hannah Lowe, Solutions Engineer, BB-Demo |
| Product under review | BB-Demo, Enterprise tier |
| Regulatory context | HIPAA |
How to read this draft
This is the first pass of our answers to your vendor review. Where an answer is complete we say so. Where it is not, it is marked Open and we will put the answer in writing before this document is finalised. We would rather show you an open point than give you an answer we have not checked.
Section A: Architecture and data location
Read the whole document (4,982 characters)
| Ref | Question | Response | Status |
|---|---|---|---|
| A1 | Where is our data stored and processed? | BB-Demo is built and run inside the customer's own Snowflake account. Your data stays in your Snowflake environment. BB-Demo is not a separate store that your data is copied into. | Answered |
| A2 | Which source systems would be connected? | Only the systems you choose to connect. Each connector is scoped in the order form. For this evaluation, the sources would be those your client-services teams use for hospital client records. | Answered |
| A3 | Is data residency configurable? | Dedicated US data residency is available as an add-on. The short answer is yes. The longer answer depends on how your Snowflake account is deployed, which we need to confirm with your IT team. | Open |
| A4 | Please provide an architecture diagram. | A diagram showing the brain inside the customer's Snowflake account, with the connectors and access paths, will be attached to the final version. | Open |
Section B: Access control
| Ref | Question | Response | Status |
|---|---|---|---|
| B1 | How is user access managed? | Enterprise includes SSO and SCIM, so provisioning and removal follow your identity provider. | Answered |
| B2 | How is BB-Demo staff access to our environment controlled? | Access is limited to the Snowflake roles you grant. To be precise, we would operate within those roles and nothing wider. We will list the proposed roles in the final version. | Open |
| B3 | Is access logged? | Snowflake's own access history applies, since the brain runs in your account. A description of any logging BB-Demo adds on top will be confirmed in writing. | Open |
Section C: Protected health information
| Ref | Question | Response | Status |
|---|---|---|---|
| C1 | Will BB-Demo need to process protected health information? | This depends on which sources are connected. We recommend scoping connectors so that clinical content is excluded unless there is a clear need. We will not assume it is out of scope. | Open |
| C2 | Is a business associate agreement available? | We will confirm our position and the form of agreement in writing. This is not answered in this draft. | Open |
| C3 | How is data deleted at the end of the relationship? | Because the data stays in your Snowflake account, deletion is under your control. We will document what BB-Demo removes from your environment at exit. | Open |
Section D: Incident history and response
| Ref | Question | Response | Status |
|---|---|---|---|
| D1 | Please describe any incidents in the last ninety days. | Not answered in this draft. We will give you a written statement on incident history, confirmed with our security lead before it is sent, and we will disclose anything relevant rather than leave you to find it. | Open |
| D2 | What is your incident notification process? | We will provide the written process and the notification commitment that would sit in the order form. | Open |
| D3 | Do you test your incident response? | We will confirm what is tested, and how often, in writing. | Open |
Section E: Service levels
| Ref | Question | Response | Status |
|---|---|---|---|
| E1 | What availability commitment applies? | The Enterprise availability commitment applies, with service credits. The exact figure is set in the order form. | Answered |
| E2 | How quickly do you respond to a P1 issue? | Enterprise carries the fastest first-response time we offer. The exact time is set in the order form. | Answered |
| E3 | How fresh is the data? | The nightly refresh completes by 07:00 your local time on business days. Enterprise is credited for data freshness as well as availability. | Answered |
Open points summary
- Data residency and Snowflake deployment details (A3).
- Architecture diagram (A4).
- Staff access roles and logging (B2, B3).
- Scope of protected health information, business associate agreement and deletion at exit (C1 to C3).
- Incident history, notification process and testing (D1 to D3).
Next steps
I'll put each open point in writing and send version two for your review. If any question above is not framed the way your risk committee needs it, tell me and I will restructure the answer.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- Business associate agreement not yet confirmed
- Incident history left unanswered in draft
- Service figures deferred to the order form