Access for additional users: intake coordinators

Dear Hollie, Danielle has told me that Quarrington intends to add thirty more users, including the intake coordinators, and has asked me to confirm the access side before anything is switched on. I have reviewed this against our business associate agreement and our minimum necessary standard. My position is as follows. I approve the additional users on one condition: the intake coordinators must see referrer-level data only. That means the referrer, the relationship, the owning liaison and the referral activity in aggregate. No patient fields of any kind may be visible to that group, whether in pages, chat answers, search results or dashboards. I would like three things from you in writing, so that we can document the control. First, confirmation of how that restriction is applied and where it is enforced. Second, confirmation that a coordinator cannot reach patient fields by asking the brain a question that draws on an underlying source. Third, a note of who at BB-Demo can change that configuration, so that it is recorded in our audit trail. Is any PHI in scope for this group at all? If your answer is anything other than a clear no, I need to hear it before the users are added, not after. I will not accept an assurance that we do not store that data without something I can point to. I will review your reply when it arrives. Marisol Vega Privacy and Security Officer, Quarrington Care Network

Dear Marisol, hi Danielle, Thank you for your note of 8 Sep 2026, and for being so specific about the condition. We are happy to work to it. To answer your questions in the order you asked them: 1. The intake coordinators will sit in their own access group, limited to referrer-level views. Patient fields are excluded for that group, so they do not appear in pages, chat answers, search results or dashboards. We will apply this in your Snowflake account, where the brain runs, so the restriction sits with your own data controls. 2. Because the restriction is applied to the group rather than to individual pages, a coordinator asking a question cannot draw a patient field into an answer. Before the users go live, we will test this with a coordinator test login and send you the results. 3. Changes to that configuration will be made by me or by the BB-Demo engineer assigned to your account, and each change will be logged so you have the audit trail you asked for. On your PHI question: for the coordinator group, no patient fields are in scope. If that ever needs to change, we will come to you first and nothing will move without your written approval. I will write all of this up as a short control note for your records. Jordan will handle the order form side separately with Danielle, and we will not enable the users until you have seen the test results. Kind regards, Hollie Hollie Grieve Customer Success Manager, BB-Demo