Compliance

Effective Date: August 30, 2026

Regulatory frameworks Quaspar operates under

HIPAA and HITECH

Quaspar operates as a Business Associate under 45 C.F.R. Parts 160 and 164. We maintain written Security Rule policies, an annual risk analysis, workforce training, access controls, audit logging, contingency planning, and a breach notification procedure. We execute a Business Associate Agreement with every customer handling PHI and with every subcontractor that handles PHI on our behalf. See our HIPAA & Security page.

CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)

The rule requires impacted payers to implement FHIR-based Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization APIs, with compliance dates beginning in 2026 and 2027. Quaspar's architecture is built on FHIR and SMART on FHIR standards so that practices can take advantage of these APIs as payers bring them online. We are not a payer and the rule does not impose obligations on Quaspar directly.

ONC / ASTP certification and information blocking

Quaspar is not a certified health IT module and does not seek ONC certification, because it does not perform certified functions. We integrate with certified EHRs through their published SMART on FHIR APIs under each vendor's developer program. We support, and do not interfere with, the lawful access, exchange, and use of electronic health information.

FDA

Quaspar's platform is intended to support administrative workflows and to help qualified professionals organize, retrieve, summarize, and analyze information, in a way that lets the user independently review the basis for any output. It is not intended to diagnose, treat, cure, mitigate, or prevent disease and is not a medical device. It has not been cleared or approved by the FDA. Customers who configure a worker for an intended use that would make it a device become the manufacturer of that device and are responsible for compliance.

State privacy laws

Illinois. We comply with the Personal Information Protection Act, including its breach notification requirements. We do not collect biometric identifiers; our voice features transcribe speech and do not create voiceprints, so the Biometric Information Privacy Act's consent requirements are not triggered. Our Biometric Data Policy governs any future change.
California. We act as a service provider under the CCPA/CPRA. We do not sell or share personal information and do not use it outside the direct business relationship.
Other states. We honor access, correction, deletion, and portability requests under comprehensive state privacy laws through the process in our Privacy Policy.

For customers processing EU or UK personal data, Quaspar acts as a processor under a Data Processing Addendum incorporating the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Our technical and organizational measures are described in Annex 2 of the DPA and in our Security Overview.

AI regulation

Quaspar's Responsible AI Policy describes how we design, evaluate, and govern our AI systems. Our platform is not intended for consequential decisions about individuals — employment, credit, housing, insurance, education, or clinical determinations — and our terms prohibit using it that way without meaningful human review. We are monitoring the Colorado Artificial Intelligence Act, amendments to the Illinois Human Rights Act addressing AI, and the EU AI Act, and will update our controls and documentation as they take effect.

Payments

Payments are processed by Stripe, a PCI DSS Level 1 certified service provider. Quaspar does not store full payment card numbers; we retain only the card brand and last four digits returned by Stripe.

Accessibility

We are working toward WCAG 2.1 Level AA. Our current status and how to report a barrier are on our Accessibility page.

Certifications: our honest status

Framework	Status
HIPAA Business Associate obligations	Met; BAA available
Google Cloud (our infrastructure) — SOC 2 Type II, ISO 27001, ISO 27017/27018, HITRUST	Held by Google; we inherit these infrastructure controls
Quaspar SOC 2 Type II	Roadmap — not yet held
HITRUST certification of Quaspar	Not currently pursued
Third-party penetration test	Planned; summary will be published
PCI DSS	Handled by Stripe; Quaspar is out of scope for cardholder data

We list what we do not have alongside what we do. If a certification is a requirement for your organization, tell us — it helps us prioritize.

Documentation

Available on request at support@quaspar.com: Business Associate Agreement, Data Processing Addendum, Sub-processor List, Security Overview, completed vendor security questionnaires, and our Service Level Agreement.