Quillmark Health

Security review set-up: On 28 May 2026 Jordan Pike asked Megan Alvarez for a session with Hannah Lowe on the open findings. Megan would attend alone, wanted written answers and incident history, and would not share how the review is scored.

Session one: On 1 Jun 2026 Megan gave no verbal view and said nothing is approved until the written review is complete. Jordan put the proposal at £155k with implementation included, close pencilled for 30 Jun 2026.

Agenda: On 8 Jun 2026 Hannah took over scheduling. Megan ranked access control, connector credentials and logging first.

Session two: On 15 Jun 2026 Megan worked through seven findings and closed none. Model processing and connector-by-connector access enforcement were the main open items, and the incident notification clause was unconfirmed.

Commercial: On 24 Jun 2026 Megan declined a commercial call, saying the outcome would come in writing from the board risk committee.

Outcome: On the 29 Jun 2026 call Tasha Greene and Megan said Quillmark will not proceed. Nothing is negotiated until security clears a vendor, and any future contact goes through procurement.

Open at the end: the reads do not show the business associate agreement status or the US-only support answer. BG-Demo was to confirm the evaluation environment wind-down, mark the deal lost in the CRM and close the findings with documented evidence.

Start: On 23 Jan 2026 Jordan Pike asked Ben Kowalski for a discovery call. Ben called it exactly the gap but would only socialise it with security, and BG-Demo missed the slots he offered.

Discovery: The 2 Feb 2026 call covered one view of each hospital client inside Ben's own Snowflake account. Jordan pencilled in Enterprise at a working placeholder, and Ben said procurement owns price.

Demo: Ben chose a Thursday slot on 12 Feb 2026 and the demo ran on 16 Feb 2026. Hannah Lowe could not say from memory whether patient-level data would leave the account, and owes written answers.

HIPAA: On 23 Feb 2026 Ben asked for clear answers on HIPAA scope and US data residency before security engages. Jordan offered the US residency add-on and took the business associate agreement question away.

News: On 2 Mar 2026 Quillmark Health reported steady results and a review of how its internal systems connect. The news item reports no acquisition, new executive or restructuring.

Proposal: On 25 Mar 2026 Ben accepted a walkthrough but would give no decision timeline. On 31 Mar 2026 Procurement Director Tasha Greene said terms are not negotiated until security clears.

Open at the end: Security follow-ups on access control, logging and healthcare data are open. The £155k is a total of subscription plus implementation, and Tasha wants the two shown separately in the order form.

This period holds one read, a news item. There were no calls, email threads or tickets in the quarter.

News: On 7 May 2025 Quillmark Health announced a phased expansion of services for hospital groups, adding capacity for hospital group clients across the United States. Existing clients should see no interruption.

Security: The firm is subject to HIPAA and said it will apply rigorous security review to technology and service providers. New tooling must meet its hospital clients' standards.

Opportunity: The read rates this as an upsell signal of medium significance. Added client-services capacity could mean extra users, connectors or a new team.

Risk: Any extension may need a fresh vendor security review before approval. No investment figure or timetable was given, so the size of any change is unknown.

Open at the end: The suggested next step was to ask the account contact which teams are growing and what security review evidence they will need. The read does not show that this was done, or any customer reaction.