Quaspar
Contact sales
← Back to homepage

Business Associate Agreement

Effective Date: August 30, 2026

HIPAA Business Associate Agreement between Quaspar Inc. and Customer

Replaces the BAA dated July 2, 2026. Updated for the Workforce platform: model providers as subcontractors, learning data, voice, connectors, and organization-level deletion.

This Business Associate Agreement ("BAA") is entered into by Quaspar Inc., a Delaware corporation with its principal place of business in Chicago, Illinois ("Business Associate" or "Quaspar") and the customer identified in the applicable Order Form or account registration ("Covered Entity" or "Customer"). It is incorporated into the Master Subscription Agreement or Terms of Service between the parties (the "Agreement") and controls over the Agreement to the extent of any conflict about PHI.

1. Definitions

Capitalized terms not defined here have the meanings in HIPAA, the HITECH Act, and their implementing regulations at 45 C.F.R. Parts 160 and 164 (the "HIPAA Rules"). "PHI" means Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. "Services" means the Quaspar Workforce platform, browser extension, and related services.

2. Permitted uses and disclosures

2.1 Business Associate may use and disclose PHI only to perform the Services for Covered Entity, as permitted by this BAA, or as required by law. Business Associate will not use or disclose PHI in a way that would violate the HIPAA Rules if done by Covered Entity.

2.2 Business Associate may use PHI for its proper management and administration and to carry out its legal responsibilities, and may disclose PHI for those purposes if required by law or if it obtains reasonable written assurances that the recipient will keep the PHI confidential and report any breach.

2.3 Business Associate may de-identify PHI in accordance with 45 C.F.R. § 164.514 and use de-identified data. Business Associate will not use PHI to train general-purpose AI models. Per-worker learning data is limited to Covered Entity's workspace and is redacted of PHI before storage.

2.4 Business Associate may provide Data Aggregation services relating to Covered Entity's health care operations if requested by Covered Entity.

2.5 Business Associate will make reasonable efforts to limit PHI to the minimum necessary for the purpose of the use, disclosure, or request.

3. Obligations of Business Associate

  • Safeguards. Implement administrative, physical, and technical safeguards that comply with Subpart C of 45 C.F.R. Part 164, including a written risk analysis, access controls, encryption of PHI in transit and at rest, audit controls, integrity controls, transmission security, and workforce training.

  • Reporting. Report to Covered Entity any use or disclosure of PHI not permitted by this BAA, any Security Incident, and any Breach of Unsecured PHI without unreasonable delay and no later than 10 business days after discovery. The report will include, to the extent known, the individuals affected, the PHI involved, what happened, what Business Associate is doing about it, and what Covered Entity should do. Unsuccessful Security Incidents (pings, port scans, blocked login attempts) that do not result in unauthorized access are reported through this sentence and no further notice is required.

  • Subcontractors. Ensure that any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Business Associate agrees in writing to the same restrictions and conditions that apply to Business Associate. Current subcontractors handling PHI are listed in the Sub-processor List. AI model providers that have not executed a BAA with Business Associate are technically blocked from receiving PHI.

  • Access. Within 10 business days of request, make PHI in a Designated Record Set available to Covered Entity so it can meet its obligations under 45 C.F.R. § 164.524.

  • Amendment. Within 15 business days of request, make amendments to PHI in a Designated Record Set as directed by Covered Entity under 45 C.F.R. § 164.526.

  • Accounting. Document disclosures of PHI and, within 15 business days of request, provide the information needed for Covered Entity to respond to a request for an accounting under 45 C.F.R. § 164.528.

  • Covered Entity obligations. To the extent Business Associate carries out an obligation of Covered Entity under Subpart E of Part 164, comply with the requirements that apply to Covered Entity in performing it.

  • Books and records. Make internal practices, books, and records relating to PHI available to the Secretary of HHS for determining compliance.

  • Individual requests. Forward to Covered Entity within 5 business days any request received directly from an individual regarding PHI.

4. Obligations of Covered Entity

Covered Entity will: notify Business Associate of limitations in its notice of privacy practices, of changes in or revocation of an individual's authorization, and of any restriction it has agreed to, to the extent these affect Business Associate's use of PHI; not request Business Associate to use or disclose PHI in a way that would be impermissible for Covered Entity; obtain any consents or authorizations required for connector access; configure worker permissions on a minimum-necessary basis; and not use PHI on the free tier or with model providers that the Services identify as not covered by a BAA.

5. Term and termination

5.1 This BAA is effective on the Agreement's effective date and lasts until all PHI is returned or destroyed.

5.2 Either party may terminate this BAA and the Agreement if the other party materially breaches this BAA and does not cure within 30 days of written notice, or immediately if cure is not possible.

5.3 On termination, Business Associate will return or destroy all PHI and retain no copies, except where return or destruction is infeasible, in which case Business Associate will extend the protections of this BAA to that PHI and limit further use to the purposes that make return or destruction infeasible. Covered Entity may export PHI through the Services for 30 days after termination. Audit logs containing PHI required by the HIPAA Rules are retained for six years and then destroyed.

6. Miscellaneous

Any ambiguity is resolved to permit compliance with the HIPAA Rules. The parties will amend this BAA as needed to comply with changes in law. Nothing in this BAA creates rights in third parties. This BAA is governed by the law of the State of Illinois to the extent not preempted by federal law.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the Effective Date.

QUASPAR INC. (BUSINESS ASSOCIATE)

By: ______________________________

Name: ____________________________

Title: _____________________________

Date: _____________________________

CUSTOMER (COVERED ENTITY)

By: ______________________________

Name: ____________________________

Title: _____________________________

Date: _____________________________