Ellerby Dental Group - Security Questionnaire
Documentfinal Ellerby Dental Group: documents · security_questionnaire · final · 2025-03-01
A one-version security questionnaire filed under Ellerby Dental Group, created 1 Mar 2025 and stored as final. Eight answers cover risk assessment, encryption, access, incident response, backups, vendors, policies and compliance. It states no service levels or price.
What it says
What this says
Current to 11 Oct 26A one-version security questionnaire filed under Ellerby Dental Group, created 1 Mar 2025 and stored as final. Eight answers cover risk assessment, encryption, access, incident response, backups, vendors, policies and compliance. It states no service levels or price.
What it is: a question-and-answer sheet on information security, filed in the customer's Security folder. The answers refer to "all practice locations", so they read as Ellerby's own controls rather than BB-Demo's.
Commits: nothing commercial. It states controls such as "TLS 1.2 or higher" and "AES-256", plus daily backups, but no service levels, price, billing or notice terms.
Unusual: nothing off standard terms. It names no signatory, party or date other than the 1 Mar 2025 creation and modification date.
Not settled: who completed it, who it was submitted to, and whether the controls are still current. The record has had no change since 1 Mar 2025, and the stored status is a hint only, since the text carries no approval wording.
As found in this document
The document
Body
Ellerby Dental Group - Security Questionnaire
Information Security
| Question | Answer |
|---|---|
| Do you carry out an annual risk assessment? | Yes. An annual information security risk assessment is conducted across all practice locations, covering data storage, access controls, backup procedures and incident response. |
| What is your approach to data encryption? | Data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 on all systems holding patient or financial data. |
| How do you manage access to sensitive data? | Role-based access control is implemented. Staff members have access only to the systems and data required for their role. Credentials are managed through a central directory with multi-factor authentication. |
| What incident response procedures are in place? | An incident response plan is documented and reviewed annually. All staff who handle patient data receive annual security training. Incidents are logged, investigated and reported to relevant parties within the timescales required by regulation. |
| How often is data backed up? | Daily. Backups are stored in geographically separate locations. Backup in |
Read the whole document (1,941 characters)
tegrity is verified monthly and restore procedures are tested annually. | | What vendor management controls do you have? | All third-party suppliers are assessed for security and compliance before engagement. Data processing agreements are in place where required. | | Do you have documented security policies? | Yes. Policies cover acceptable use, password management, data handling, incident response and business continuity. All staff acknowledge these policies on induction and annually thereafter. | | How do you ensure compliance with data protection regulation? | Senior management has responsibility for compliance oversight. Procedures are documented and reviewed annually to ensure alignment with current regulatory requirements. |