HIPAA & Security

Effective Date: August 30, 2026

How Quaspar works as your Business Associate

Quaspar is a Business Associate

Quaspar Inc., a Delaware corporation with its principal place of business in Chicago, Illinois acts as a HIPAA Business Associate to the practices, health systems, laboratories, and research organizations that use its platform. We sign a Business Associate Agreement with every customer that will handle protected health information (PHI), and we sign it before any PHI enters the system. Our BAA is available for review before you sign up.

What that means in practice

Your obligation as a Covered Entity	What Quaspar does
Only work with Business Associates under a written agreement	We execute a BAA covering the full HIPAA Security Rule before PHI access is enabled
Ensure PHI is safeguarded	Encryption in transit and at rest, access controls, audit logging, and a written security program — see our Security Overview
Limit uses and disclosures to the minimum necessary	Workers retrieve only the data elements their configured task requires; permissions are enforced by our policy engine, not by the AI model
Be notified of breaches so you can notify individuals	We report breaches of unsecured PHI within 10 business days of discovery, with the details you need to make your own notifications
Be able to respond to patient access and amendment requests	We make PHI in a designated record set available to you within 10 business days, and make amendments within 15
Account for disclosures	We log disclosures and provide the information you need within 15 business days
Ensure subcontractors are covered	Every vendor that touches PHI on our behalf has signed a BAA; they are listed publicly in our Sub-processor List

AI models and PHI

This is the question every compliance officer asks first, so here is the direct answer.

PHI is only ever sent to AI model providers that have executed a Business Associate Agreement with Quaspar. Providers without one are technically blocked from PHI workloads by our policy engine — not merely discouraged by policy.
You can see which providers are BAA-covered in our published Sub-processor List, which we update with at least 30 days' notice before adding anyone.
Your data is never used to train general-purpose AI models, by us or by our providers.
Our free tier is for evaluation with synthetic data only. PHI features are locked on it.
Workers that learn from experience store PHI-redacted data scoped to your organization. That data never crosses organizational boundaries and is deleted when you delete the worker or your organization.

Minimum necessary and human review

Quaspar is an administrative and analytical tool. It drafts, retrieves, summarizes, and organizes; it does not make clinical decisions and it is not a medical device. Your staff review outputs before they are relied on, and you configure approval gates for the steps that matter. You decide what each worker can reach, and you can see everything it did.

Your data stays yours

You own your data and the outputs your workers produce. We process it only to provide the service and as you direct. You can export it at any time. When you delete your organization, we delete it from primary storage, backups are overwritten within 35 days, and we retain only what HIPAA and law require — audit logs for six years, billing records for seven.

Where we stand on certifications

Our infrastructure runs on Google Cloud under a BAA, and Google's platform holds SOC 2 Type II, ISO 27001, and HITRUST certifications. Quaspar has not yet completed its own SOC 2 Type II examination; it is on our roadmap and we will publish the report when it is done. We will not claim a certification we do not hold, and we would rather tell you that plainly than have you find out during procurement.

Getting started

Request our BAA, security questionnaire responses, and sub-processor list at support@quaspar.com. We can usually turn a completed vendor security questionnaire around in five business days.