Incident history: written confirmation requested
Email thread Quillmark Health · exec
Megan Alvarez restated an open review item: BG-Demo must describe incidents in the last ninety days in writing, or confirm there were none. She wants it attested by someone with authority. No BG-Demo reply in this thread.
What was said
What this says
As at Fri 9 Oct 2026Megan Alvarez restated an open review item: BG-Demo must describe incidents in the last ninety days in writing, or confirm there were none. She wants it attested by someone with authority. No BG-Demo reply in this thread.
Ask: Megan wants, for each incident, what happened and when, which customers were notified and how soon, and what changed. A verbal assurance or a best-effort answer will not do.
Customer view: The board risk committee expects vendors to disclose before the customer finds out for itself.
Next: A reply routed through Megan and reviewed by an authorised person is outstanding in this thread.
The thread
Updated 9 Oct 26Messages
Megan Alvarez 23 Jul 2026 12:26Jordan, For the record, I am writing to restate an open item in our review of BG-Demo. Please describe any incidents in the last ninety days that affected the availability, integrity or confidentiality of any customer environment, whether or not Quillmark Health data was involved. For each one, please state the following: First, what happened and when it was detected. Second, which customers were notified, and how soon. Third, what was changed afterwards. If there were none, I need that confirmed in writing, and not by a verbal assurance. A response described as best effort will not satisfy our risk posture. Our board risk committee expects vendors to disclose before we find out for ourselves. Please route the reply through me directly. I would also ask that it be reviewed by someone with authority to attest to its accuracy. Megan Alvarez, CISO