Quarrington Care Network - Security Questionnaire
Documentfinal Quarrington Care Network: documents · security_questionnaire · final · 2026-02-11
Final security and privacy answers from BB-Demo to prospect Quarrington Care Network, dated 11 Feb 2026, for a Growth subscription under a business associate agreement. It is not a contract and states no price, availability percentage or P1 time.
What it says
What this says
Current to 11 Oct 26Final security and privacy answers from BB-Demo to prospect Quarrington Care Network, dated 11 Feb 2026, for a Growth subscription under a business associate agreement. It is not a contract and states no price, availability percentage or P1 time.
What it is: a security questionnaire prepared by Hannah Lowe for a HIPAA-regulated prospect. It states "there is no contracted annual recurring revenue for this account, because Quarrington is still a prospect."
Commits: the document says "The business associate agreement is signed before any connector is switched on." It also says BB-Demo staff see data only "through access that Quarrington grants inside its own account."
Unusual: it makes no HIPAA certification claim. Single sign-on, Premium support, the Sandbox and data residency are named as not included in Growth.
Not settled: the region requirement is left to be confirmed in the order form. Availability and P1 response are referred to the standard Growth service levels, with no figures given. The evidence does not show whether an order form was signed.
As found in this document
Current to 9 Oct 26- Business associate agreementThe business associate agreement is signed before any connector is switched on.The business associate agreement is signed before any connector is switched on. · Source: object_read:doc_079_001
- Service credits on GrowthOn Growth, credits apply for availability only, not for data freshness.On Growth, credits apply for availability only, not for data freshness. · Source: object_read:doc_079_001
- Nightly refreshThe nightly refresh completes by early morning customer local time on business days, on every tier.The nightly refresh completes by early morning customer local time on business days, on every tier. · Source: object_read:doc_079_001
- Security incident notificationBB-Demo will notify the customer contact named in the order form, and the business associate agreement sets the notification obligations.BB-Demo will notify the customer contact named in the order form, and the business associate agreement sets the notification obligations. · Source: object_read:doc_079_001
The document
Body
Quarrington Care Network - Security Questionnaire
Status: Final Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 11 Feb 2026 Customer: Quarrington Care Network, Chicago Account owner: Jordan Pike Customer success manager: Hollie Grieve Tier in scope: Growth
Purpose and scope
This document answers the security and privacy questions raised by Quarrington Care Network ahead of its Growth subscription. Quarrington is a home-health and hospice operator across Illinois, Indiana and Wisconsin and is subject to HIPAA. The subscription is to be held under a business associate agreement, so the referral-relations and patient-services teams can see each referring hospital's calls, tickets and contracts together.
To be precise about scope: the answers below describe the company brain as BB-Demo delivers it on the Growth tier. Where a control belongs to a different tier or to a paid add-on, the answer says so rather than implying it is included.
At the date of this document there is no contracted annual recurring revenue for this account, because Quarrington is still a prospect.
Architecture and data location
Read the whole document (5,831 characters)
| Question | Answer |
|---|---|
| Where does the customer's data live? | The company brain is built and run inside the customer's own Snowflake account. Source data is not copied into a BB-Demo-owned data store. |
| Who controls the Snowflake account? | Quarrington. Access to the account, its roles and its network settings remain with Quarrington's own administrators. |
| Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. Quarrington operates in the US, and its region requirement should be confirmed in the order form. |
| How does data reach the brain? | Through connectors to the systems Quarrington chooses, for example Salesforce, Zendesk, Gong, Microsoft 365 or SharePoint. The Growth connector allowance applies, and a connector promised in an order form carries a live-within-days commitment. |
| Is there a separate test environment? | The Sandbox is an add-on and is not part of the Growth tier. It can be added if Quarrington wants one. |
Access control
| Question | Answer |
|---|---|
| How do users sign in? | Growth uses standard account sign-in. Single sign-on and SCIM provisioning are Enterprise features and are not included in Growth. |
| Can access be limited by team? | Yes, in the sense that the brain reads through the customer's Snowflake roles. What a person sees depends on how Quarrington's administrators configure those roles. |
| Who at BB-Demo can see customer data? | Only staff working on the implementation or on a support request, and only through access that Quarrington grants inside its own account. Quarrington can revoke that access at any time. |
| Is there a named support engineer? | Not on Growth. Premium support, with a named engineer, is an add-on. |
Healthcare data and HIPAA
| Question | Answer |
|---|---|
| Will BB-Demo sign a business associate agreement? | Yes. The Growth subscription is being bought on the basis of a business associate agreement, and that agreement sits alongside the order form under the master agreement. |
| Does the brain need patient-identifiable records? | The use case described is referral relations and patient services: calls, tickets and contracts per referring hospital. The connectors in scope should be agreed so that only the sources needed for that use case are connected. |
| Can sources be excluded? | Yes. Quarrington chooses which systems and which parts of them are connected, and a connector can be removed by the customer's administrators. |
| Does BB-Demo make a HIPAA compliance claim for its software? | No. HIPAA obligations are met through the business associate agreement, the architecture above and Quarrington's own configuration. This document makes no certification claim. |
Availability and support
| Question | Answer |
|---|---|
| What availability applies? | The Growth tier availability commitment in the standard service levels. An executed order form can change it. |
| How quickly is a priority issue answered? | The Growth first-response commitment for a P1 issue, measured in business hours. |
| How fresh is the data? | The nightly refresh completes by early morning customer local time on business days, on every tier. |
| What are the service credits? | On Growth, credits apply for availability only, not for data freshness. Credits for freshness belong to Enterprise. |
Change, incident and exit
| Question | Answer |
|---|---|
| How is Quarrington told about a security incident? | BB-Demo will notify the customer contact named in the order form, and the business associate agreement sets the notification obligations. |
| What happens at the end of the term? | Because the brain lives in Quarrington's own Snowflake account, the data stays with Quarrington. Connector access granted to BB-Demo is withdrawn. |
| Is there a review cycle? | Growth includes quarterly business reviews led by the customer success manager, and those are a natural place to revisit these answers. |
Points confirmed in writing
I'll put the following in writing, as they are the points a security team usually wants fixed before signature:
- Single sign-on is not part of Growth. If Quarrington's IT team requires it, the Enterprise tier is the route.
- Data residency is an add-on and must appear in the order form if it is required.
- Premium support and the Sandbox are add-ons, not Growth inclusions.
- The business associate agreement is signed before any connector is switched on.
Sign-off
| Role | Name |
|---|---|
| Prepared by | Hannah Lowe, Solutions Engineer, BB-Demo |
| Commercial owner | Jordan Pike |
| Customer success | Hollie Grieve |
| Date | 11 Feb 2026 |
Unusual terms
Current to 9 Oct 26- Business associate agreement before connectors
- No HIPAA certification claim
- SSO and SCIM not in Growth