HIPAA scope and data residency in your Snowflake
Email thread Quillmark Health · sales
Ben Kowalski liked the demo on Quillmark's own data and asked for clear answers on HIPAA scope and US data residency before security engages. Jordan Pike offered the US residency add-on and took the HIPAA detail away to answer in writing.
What was said
What this says
As at Fri 9 Oct 2026Ben Kowalski liked the demo on Quillmark's own data and asked for clear answers on HIPAA scope and US data residency before security engages. Jordan Pike offered the US residency add-on and took the HIPAA detail away to answer in writing.
Ask: which data the brain touches, whether any PHI sits outside Quillmark's Snowflake account, and how residency works. Security will not look at anything until these are answered.
Customer view: Ben is positive and valued Jordan not papering over HIPAA. He passed the note to security and left the residency add-on to procurement.
Next: Jordan must answer the business associate agreement and connector field questions in writing. Quillmark's security questionnaire is still to come.
The thread
Updated 9 Oct 26Messages
Ben Kowalski 23 Feb 2026 10:40Jordan, Love where we've got to so far, and the demo on our own data really landed with the client-services folks. This is exactly the gap. Before security will look at anything, they've asked me to get clear answers on two things: - HIPAA scope: which of our data would the brain actually touch, and would any PHI sit anywhere outside our Snowflake account? - Data residency: we want everything to stay in our own Snowflake in the US. Can you confirm how that works on your side? I know it's a lot of detail, but if I can give them something concrete, I can keep things moving. Ben
Jordan Pike 24 Feb 2026 08:09Ben, Good questions, and exactly what your security team should be asking. Here's where we are. To be transparent about the architecture: the brain is built and run inside your own Snowflake account. That is the core of how we work, so your data stays where you put it, and you control access with your own roles. On residency, we also offer dedicated US data residency as an add-on if your team wants it written into the order form. Where I don't want to guess is the HIPAA detail. Whether a business associate agreement is needed, and exactly which fields the connectors read, are things I'll take to our security lead and put in writing for your team, rather than answer loosely over email. Enterprise includes support for the security review, so we would work through it with them step by step. What would make this a yes for security? If they can send me their questionnaire, or even a list of their concerns, I'll make sure every item gets a straight answer, including the ones we can't tick. Thanks, Jordan- Ben Kowalski 25 Feb 2026 14:28Jordan, Thanks, that's really helpful, and I appreciate you not papering over the HIPAA bit. Security will respect that. I've passed your note to them. They'll send over their questionnaire shortly, and I'll forward it as soon as I have it. Let me socialise it internally and see what comes back. On the residency add-on, I'll leave that with procurement to look at, as that side isn't mine. Talk soon, Ben