Quarrington Care Network / BG-Demo – Escalation
Callcompleted
Quarrington Care Network · 15 Jul 2026 14:15
Escalation after a free-text intake field was indexed into the brain. One chat answer quoted a note. BG-Demo is moving to an allow-list. The COO kept the contract as it is, and the privacy officer will support continued use only once the control is in place.
What was said
What this says
As at Fri 9 Oct 2026Escalation after a free-text intake field was indexed into the brain. One chat answer quoted a note. BG-Demo is moving to an allow-list. The COO kept the contract as it is, and the privacy officer will support continued use only once the control is in place.
What happened: A free-text field added to the referral intake form in June was read by the connector because it was not on the exclusion list. Notes were indexed and one liaison chat answer quoted one.
Customer view: Marisol Vega wants minimum necessary enforced by the system, not by habit. She logged a scope incident under the business associate agreement and said she can support continued use once the allow-list and a field inventory are in place.
Commercial: Gregory Hasselbeck said to keep the contract as it is, the fifty thousand a year, until this is closed. Danielle Okonkwo stressed that usage has climbed and she does not want the brain switched off.
Watch: Marisol was not told until escalation, and Hollie Grieve agreed to copy her on tickets from the start. The call does not show how many notes held sensitive content.
Themes
As at Fri 9 Oct 2026Theme
Intake field scope incident
Importance
complaint
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Hannah Lowe applies the allow-list, sends the access list, query log extract and checked timeline, and runs the connector field inventory.
- Hollie Grieve sends a written summary with owners and copies Marisol Vega on every ticket from the start.
- Danielle Okonkwo changes the intake form and tells the liaisons, and Marisol Vega shares the scope incident reference once logged.
Risks
As at Fri 9 Oct 2026- The privacy officer's support for continued use depends on the allow-list and field inventory being delivered and shown to work.
- The exclusion-list default failed open, so other connected free-text fields such as helpdesk and CRM notes may carry the same exposure until inventoried.
- The customer was not told of the incident until escalation, which could weigh on trust at renewal.
Opportunities
As at Fri 9 Oct 2026- A written note from Marisol Vega on the allow-list design could become a reference for other healthcare accounts.
- Danielle Okonkwo says usage keeps climbing, so a clean close of the incident protects a growing account.
Transcript
Hollie GrieveHi everyone, can you hear me alright? I can see Danielle and Marisol, I think we're just waiting on Greg and Tobias.
Danielle OkonkwoHey Hollie, loud and clear. Greg's literally walking into the room now, he's coming off another call.
Gregory HasselbeckHello, hello. Sorry, can everyone hear me? My headset did something odd.- Hollie GrieveYes, Greg, you're fine. Tobias, are you with us?
Tobias RenwickI am, apologies, I was muted. Good to see everyone. Hannah's here as well, she's been closest to the technical detail so I've asked her to join.
Hannah LoweHello all. Thanks for making the time, I know it's a busy week.- Gregory HasselbeckSo, what decision is needed from me today? I want to be clear on that before we start.
- Hollie GrieveFair question, Greg. Honestly, the short version is that we're not asking for a big decision. We want to walk through what happened with the intake form, agree the fix, and make sure Marisol has what she needs for the record. If anything needs your sign-off, it's the change to how fields are brought in.
- Gregory HasselbeckRight. Keep it simple. Marisol, has this been through you?
Marisol VegaIt has. Before anything else, I would like to confirm what data is in scope for this conversation. Is any PHI in scope on the BG-Demo side, and where did it sit? I would like that said out loud and written down, please, not assumed.- Tobias RenwickOf course, and that's the right place to start. To be precise, the question for your security team will be what left the intake system, where it landed, and who could have seen it. Let me give you the honest answer first, and then Hannah will take you through the detail. A free-text field was added to the referral intake form in June. Our connector reads the form through an exclusion list, meaning we name the fields we do not bring in. That new field was not on the list, so it was brought into the brain on the nightly refresh like any other field.
- Marisol VegaAnd that field is the one where staff type notes.
- Danielle OkonkwoWhich, I'll be honest, is on us. We added it because the liaisons kept asking for somewhere to put context on a referrer. It was meant to be about the relationship. Nobody should be putting a patient's details in there.
- Marisol VegaDanielle, I understand the intent. But the instruction was not enforced by the form, and that is a control gap on our side as well as a configuration gap on yours. I would like both recorded.
- Tobias RenwickAgreed, and I'd rather we say it plainly: the trade-off with an exclusion list is that it fails open. A new field is included unless somebody remembers to exclude it. That's a design choice we made for convenience, and it's the wrong default for a healthcare operator. So I'm not going to describe this as a customer data problem. The platform did what we configured it to do, and the configuration was the weak point.
- Gregory HasselbeckWhat's the risk? In plain terms.
- Hannah LoweSo, the short answer is that the exposure stayed inside your own Snowflake account. Nothing was sent outside your environment, because the brain runs inside it. The longer answer is that some free-text notes were indexed and therefore searchable through the brain by people who have a login, and some of those notes contained more than they should have.
- Marisol VegaSearchable by whom, to be exact? All forty licensed users?
- Hannah LoweAnyone with access to the referral relations and patient services spaces, which is a subset of the forty. I've pulled the access list and I'll put that in writing for you, with the role of each person next to their name. I don't want to give you a rough number off the top of my head, because you'd rightly ask me to prove it.
- Marisol VegaThank you. That is what I would expect. I will also need to know whether any of those notes were returned in answers, not only indexed.
- Hannah LoweYes. That's in the query log, and I've already checked it. There was one answer, in a chat from a liaison, that quoted a note. It was the question that surfaced it, and that's what turned into the high-priority ticket. Nothing else in the logs references the field.
- Danielle OkonkwoThat was Priya's liaison team, I think. Well, one of the liaisons. She flagged it straight away, which, honestly, I want to say was the right call. She did exactly what we've trained them to do.
- Hollie GrieveAnd it came in as a priority ticket within minutes, so thank you to her. Our team picked it up inside the response time for your tier.
- Marisol VegaI will note the timeliness of the report. I will also note that I was not informed by anyone on your side until the ticket was escalated to me, Hollie. I would like that sequence corrected going forward.
- Hollie GrieveThat's fair, and you're right. For anything that touches the scope of the agreement, I'll copy you on the ticket from the start, not once it's been triaged. I'll make that a standing note on the account.
- Gregory HasselbeckGood. And is it contained now?
- Tobias RenwickIt is. On the day of the ticket we removed the field from the index and rebuilt the affected records, so the free text is no longer in the brain and no longer returned by search or chat. Hannah can show you the before and after. But containment is the small part. The point of this call is that the same thing could happen again with the next field somebody adds, and that is what we need to fix.
- Marisol VegaThen please describe the fix.
- Hannah LoweRight. So, instead of listing what we leave out, we list what we bring in. Each field the brain reads from the intake form has to be named on an allow-list that you approve. A new field, like the June one, does nothing until it's on that list. So it fails closed. If somebody adds a field next month, it sits in your intake system and nothing reaches the brain.
- Danielle OkonkwoOkay, and does that break what the liaisons rely on? I need this to be quick. They use the referrer history and the contract view every single day.
- Hannah LoweNo. We've started with the fields the liaisons actually use: referrer name, facility, referral source, dates, status and the structured category. I've compared that list against what you query most. The only thing you lose is the free text, and honestly I'd leave that out of the brain for now.
- Danielle OkonkwoI can live with that. We'll give them a structured dropdown for relationship context instead. Let's loop in the liaisons so they know why the notes box is going away.
- Marisol VegaI would prefer that the approval of the allow-list sits with me, not with a liaison lead. Who approves a change, and how is it recorded?
- Tobias RenwickThat's a good point and it's the design we'd want. Proposed changes come from your team, you approve them, and our side applies them. Each change carries a record: who asked, who approved, what field, what date. Hannah will write that up as a short procedure so you can document the control.
- Marisol VegaThen I will document the control, yes. And I will need the procedure to say what happens when a field is removed from the list, so that previously indexed content is also removed, not only future content.
- Hannah LoweYes, that's in the draft already, but I'll make it explicit. Removing a field from the list removes its content from the index on the next refresh. I'll show you in the sandbox of your test records so it's evidence rather than my word for it.
- Gregory HasselbeckIs there any work for my team in this?
- Hollie GrieveVery little, Greg. Marisol approves the list, Danielle's team tidies the form, and Hannah makes the change. Nothing needed from your side beyond knowing it's done.
- Gregory HasselbeckGood. That's what I wanted to hear.
- Marisol VegaFor the record, I will be logging this as a scope incident under the business associate agreement today. I will reference the intake form field, the period it was indexed, the single answer that returned a note, and the corrective action. Tobias, I will ask your team to confirm the facts in that entry before I close it.
- Tobias RenwickOf course. We'll review the entry for accuracy, and if anything is wrong or vague, we'll say so. We'd rather it was exact than comfortable. Hannah, can you take that?
- Hannah LoweYes. I'll send the access list, the query log extract and the timeline to Marisol and Hollie, and I'll check each statement with our security lead before it goes. I'd rather it took a day longer than that I got a control description slightly wrong.
- Marisol VegaThat is acceptable. Is there anything else in the brain right now that is free text from any connected system and was not explicitly chosen?
- Hannah LoweGood question, and I can't answer it honestly from memory. The helpdesk and the CRM both have notes fields. I'll run a field inventory across every connector in your account and bring you the list, with each field marked as in or out. Then you decide.
- Marisol VegaThank you. That is exactly the scope check I would want.
- Danielle OkonkwoCan I say one thing, because I don't want this to get lost? Usage has been climbing since the spring. The liaisons are asking the brain things I never expected, referrer by referrer, before they walk into a hospital. I do not want this to become a reason to switch it off.
- Gregory HasselbeckNobody's suggesting that, Danielle. As long as Marisol is comfortable.
- Marisol VegaI am not asking for it to be switched off. I am asking that minimum necessary is a rule the system enforces, and not a habit. If the allow-list is in place and I have the inventory, I can support continued use.
- Hollie GrieveThat's very helpful, Marisol. And Danielle, you're right about usage. We're well within the forty licensed users, so no conversation needed on that today. I'll pick up the growth picture with you at the next check-in, not on a call about an incident.
- Gregory HasselbeckFine by me. Keep the contract as it is for now, the fifty thousand a year. Let's get this closed properly first.
- Tobias RenwickThat makes sense to us. One thing from me, since I opened by asking about your security team. When Marisol's review is done, we'd like a short written note from her on whether the allow-list design meets what she needs. We'll keep it as the reference for how we configure other healthcare accounts.
- Marisol VegaI can provide that once I have seen it operating, not before.
- Tobias RenwickThat's the right order. I wouldn't want it any other way.
- Hannah LoweSo, to recap what I have. One, the allow-list is applied to the intake form and I walk Marisol through it. Two, I send the access list, the log extract and the timeline, checked first. Three, I run the field inventory across every connector. Four, I write the change procedure with the approval record. Marisol, did I miss anything?
- Marisol VegaYou have captured it. Add that the scope incident entry is mine, and that I will share its reference with Hollie once it is logged.
- Danielle OkonkwoAnd mine is the form change and the note to the liaisons. I'll do that this week. I need this by Friday, so the liaisons aren't guessing what happened to the box.
- Hollie GrieveI'll send a written summary of today to everyone this afternoon, with owners next to each action, and I'll copy Marisol on every ticket from here. We'll also pick it up in the next check-in, so you hear from us before you have to ask.
- Gregory HasselbeckThank you all. That was efficient. I'll leave it with Marisol and Danielle.
- Tobias RenwickThank you, Greg, and thank you, Marisol, for holding us to the exact version of this. It's a better design because of it.
- Marisol VegaUnderstood. Thank you. I will be in touch once the entry is logged.
- Danielle OkonkwoThanks, everyone. Talk soon.
- Hollie GrieveThanks all, speak soon. Bye now.
Callsmade from