Skip to content

QortexOS Entering Public Beta Q3 Sign-Up Today ->

Business Associate Agreement

Version 1.0.2

Qualsis Business Associate Agreement

1. About this BAA

1.1. Part of the Terms

This Business Associate Agreement (this "BAA") forms part of the Qualsis Terms of Service at https://qualsis.com/legal/terms (the "Terms") between Qualsis, LLC ("Qualsis") and the Customer organization that has accepted the Terms ("Customer"). Qualsis and Customer are each a "Party." The Terms, the Qualsis Data Processing Addendum at https://qualsis.com/legal/trust/dpa (the "DPA"), the applicable Order, and any other agreement between the Parties governing the Services are together the "Underlying Agreement."

1.2. When this BAA applies

This BAA applies automatically, to every Customer, on every subscription plan and in every program (including beta and evaluation programs), to the extent Customer is a Covered Entity or a Business Associate and Customer Data includes PHI. Customer does not need to select a plan, make an election, or ask for it to apply.

1.3. Acceptance and signed copies

Customer accepts this BAA by accepting the Terms, and Qualsis is bound by it from the same moment. No signature is needed. Qualsis handles PHI in the same way whether or not Customer holds a signed copy.

A digitally signed copy of the then-current BAA is available upon request. A Customer that needs one for its records may ask through the Qualsis ESign Request form, and Qualsis will provide the BAA for electronic signature. A signed copy records these terms; it does not change them.

1.4. Customer's HIPAA status

  • Where Customer is a Covered Entity, Qualsis acts as Customer's Business Associate.
  • Where Customer is a Business Associate, Qualsis acts as Customer's Subcontractor. This BAA is then the written agreement required by 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), and Qualsis owes each obligation in this BAA to Customer so that Customer can meet its own obligations to its Covered Entities. References in this BAA to Customer's obligations under HIPAA include the obligations Customer has assumed toward its Covered Entities.

1.5. Order of precedence

For the handling of PHI, this BAA controls over the rest of the Underlying Agreement. The DPA continues to apply to PHI to the extent it does not conflict with this BAA. Nothing in this BAA displaces the Standard Contractual Clauses or equivalent transfer instruments where they apply. For every other matter, the Underlying Agreement controls.

1.6. What Qualsis provides

The Services are operational intelligence software. Qualsis does not provide medical, clinical, diagnostic, or treatment services and is not a Covered Entity. Unless an Order expressly states otherwise, Qualsis is not a custodian of medical records and does not undertake to retain PHI for any legally required retention period; Customer remains responsible for its own record-retention obligations.

2. Definitions

Capitalized terms used but not defined in this BAA have the meanings given in HIPAA or, if not defined there, in the Underlying Agreement.

  • "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, the Health Information Technology for Economic and Clinical Health Act (Title XIII of the American Recovery and Reinvestment Act of 2009), and their implementing regulations at 45 CFR Parts 160 and 164, each as amended from time to time.
  • "Breach," "Business Associate," "Covered Entity," "Data Aggregation," "Designated Record Set," "Disclosure," "Individual," "Minimum Necessary," "Protected Health Information" ("PHI"), "Required by Law," "Secretary," "Security Incident," "Subcontractor," "Unsecured Protected Health Information," and "Use" have the meanings given in HIPAA. In this BAA, PHI means only the PHI that Qualsis creates, receives, maintains, or transmits on Customer's behalf, and includes electronic PHI.
  • "Services" and "Customer Data" have the meanings given in the Terms.

3. Permitted uses and disclosures of PHI

3.1. Permitted uses

Qualsis may Use PHI only:

  • to provide the Services to Customer and perform Qualsis's obligations under the Underlying Agreement;
  • for the proper management and administration of Qualsis and to carry out Qualsis's legal responsibilities;
  • to provide Data Aggregation services relating to the health care operations of Customer or its Covered Entities, but only where Customer has requested those services in writing;
  • to carry out the duties this BAA expressly requires of Qualsis; and
  • as Required by Law.

3.2. Permitted disclosures

Qualsis may Disclose PHI only:

  • to provide the Services to Customer and perform Qualsis's obligations under the Underlying Agreement, including to Subcontractors engaged under Section 4.3;
  • as Required by Law; and
  • for the proper management and administration of Qualsis or to carry out Qualsis's legal responsibilities, if (a) the Disclosure is Required by Law, or (b) Qualsis obtains reasonable assurances from the recipient that the PHI will be held confidentially and Used or further Disclosed only as Required by Law or for the purpose for which it was disclosed, and the recipient agrees to notify Qualsis of any instance of which it becomes aware in which the confidentiality of the PHI has been breached.

3.3. Minimum Necessary

Qualsis will limit its Uses, Disclosures, and requests of PHI to the Minimum Necessary to accomplish the intended purpose, consistent with 45 CFR 164.502(b).

3.4. Restrictions

Qualsis will not:

  • Use or further Disclose PHI other than as permitted or required by this BAA or as Required by Law;
  • Use or Disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by Customer, except for the management, administration, and Data Aggregation purposes permitted in Sections 3.1 and 3.2;
  • sell PHI or receive remuneration in exchange for PHI, except as HIPAA permits; or
  • Use or Disclose PHI for marketing, except as HIPAA permits and Customer has directed in writing.

3.5. De-identified information

Qualsis may de-identify PHI in accordance with 45 CFR 164.514(a)-(c) and may use and disclose the de-identified information as HIPAA permits. De-identified information is not PHI. Qualsis will not attempt to re-identify de-identified information, except as 45 CFR 164.514(c) permits for the purpose of returning information to Customer.

3.6. No model training on PHI

Qualsis will not use PHI to train any artificial intelligence or machine learning model, and will not authorize any Subcontractor to do so. This restriction does not apply to information that has first been de-identified under Section 3.5 where Customer has authorized that use in writing. The no-training commitments in the Underlying Agreement apply to PHI in addition to this Section.

4. Safeguards

4.1. Safeguards and Security Rule compliance

Qualsis will use appropriate administrative, physical, and technical safeguards, and will comply with the applicable requirements of Subpart C of 45 CFR Part 164 (the Security Rule) with respect to electronic PHI, to prevent Use or Disclosure of PHI other than as provided for by this BAA.

4.2. Technical and organisational measures

The technical and organisational measures Qualsis applies to the Services are described in Annex II of the DPA. Those measures apply to PHI. Qualsis may update them from time to time, provided the update does not materially reduce the overall level of protection for PHI.

4.3. Subcontractors

In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), Qualsis will ensure that each Subcontractor that creates, receives, maintains, or transmits PHI on Qualsis's behalf agrees in writing to the same restrictions and conditions that apply to Qualsis under this BAA with respect to that PHI, and agrees to comply with the applicable requirements of the Security Rule. Qualsis will not permit a Subcontractor to handle PHI before that written agreement is in place.

The Subprocessors listed at https://qualsis.com/legal/trust/subprocessors that handle PHI are Qualsis's Subcontractors for purposes of this BAA. The notice and objection procedure in Section 7 of the DPA applies to changes in those Subcontractors.

4.4. Location of PHI

Qualsis stores PHI in the region assigned to Customer under Section 3.3 of the Terms, which follows Customer's business location recorded at signup, together with backup and disaster-recovery copies kept within the same legal block. Qualsis will not move PHI to a different region unless Customer agrees in writing. As of the effective date, the United States is the only region in operation.

5. Reporting

5.1. Uses and Disclosures not permitted by this BAA

Qualsis will report to Customer any Use or Disclosure of PHI not provided for by this BAA of which Qualsis becomes aware, without unreasonable delay and in any event within ten (10) business days after Qualsis becomes aware of it. Breaches of Unsecured PHI are reported under Section 5.3.

5.2. Security Incidents

Qualsis will report to Customer any Security Incident of which it becomes aware, as follows:

  • Successful Security Incidents. Qualsis will report a Security Incident that results in unauthorized access, Use, Disclosure, modification, or destruction of PHI, or interference with system operations that affects PHI, without unreasonable delay and in any event within ten (10) business days after Qualsis becomes aware of it.
  • Unsuccessful Security Incidents. The Parties agree that this Section is Qualsis's ongoing notice to Customer of unsuccessful Security Incidents, for which no further report is required. Unsuccessful Security Incidents are attempts that do not result in unauthorized access, Use, Disclosure, modification, or destruction of PHI or interference with system operations, such as pings and other broadcast attacks on a firewall, port scans, unsuccessful log-on attempts, and denial-of-service attempts that do not affect PHI.

5.3. Breach of Unsecured PHI

Following the discovery of a Breach of Unsecured PHI, Qualsis will notify Customer in accordance with 45 CFR 164.410.

  • Discovery. A Breach is treated as discovered by Qualsis as of the first day on which it is known to Qualsis or, by exercising reasonable diligence, would have been known to Qualsis, as provided in 45 CFR 164.410(a)(2).
  • Timing. Qualsis will notify Customer without unreasonable delay and in no case later than sixty (60) calendar days after discovery of the Breach. Qualsis's target timing for initial notification is twenty-four (24) hours from Qualsis's confirmed awareness of the Breach. Initial notification may be preliminary; Qualsis will supplement it as the investigation progresses.
  • Content. To the extent possible, the notification will identify each Individual whose Unsecured PHI has been, or is reasonably believed by Qualsis to have been, accessed, acquired, used, or disclosed during the Breach. Qualsis will also provide, at the time of notification or promptly afterward as it becomes available, any other available information that Customer is required to include in its notification to Individuals under 45 CFR 164.404(c), including a description of what happened, the dates of the Breach and of its discovery, the types of Unsecured PHI involved, and what Qualsis is doing to investigate, mitigate harm, and protect against further Breaches.

5.4. Law enforcement delay

Qualsis may delay a notification under this Section 5 to the extent and for the period that 45 CFR 164.412 requires or permits.

5.5. Mitigation and cooperation

Qualsis will mitigate, to the extent practicable, any harmful effect known to Qualsis of a Use or Disclosure of PHI in violation of this BAA. Qualsis will reasonably cooperate with Customer's investigation, risk assessment, and notification activities and will provide the information Customer reasonably requires to meet its own notification obligations.

5.6. Who sends notices

Customer is responsible for determining whether a reported event requires notification, and for any notification to Individuals, the Secretary, the media, other regulators, and (where Customer is a Business Associate) Customer's Covered Entities. Qualsis will not notify those persons directly about an event affecting Customer's PHI unless Required by Law, and where legally permitted will inform Customer before doing so.

5.7. Where reports go

Qualsis will send reports under this Section 5 to the administrator contact for Customer's account, or to another contact Customer designates for HIPAA matters through the Qualsis Privacy contact form. Customer will keep those contact details current.

5.8. No admission

A report or notification under this Section 5 is not an admission of fault or liability by Qualsis.

6. Individual rights and government access

6.1. Access

To the extent Qualsis maintains PHI in a Designated Record Set, Qualsis will make that PHI available to Customer, or as Customer directs to the Individual or the Individual's designee, within ten (10) business days after Customer's written request, so that Customer can meet its obligations under 45 CFR 164.524. Where the Services let Customer retrieve the PHI itself, Qualsis satisfies this Section by keeping that capability available.

6.2. Amendment

To the extent Qualsis maintains PHI in a Designated Record Set, Qualsis will make that PHI available for amendment and will incorporate any amendment Customer directs, within ten (10) business days after Customer's written request, so that Customer can meet its obligations under 45 CFR 164.526.

6.3. Accounting of Disclosures

Qualsis will document the Disclosures of PHI it makes, and the information related to those Disclosures, that Customer would need to respond to a request for an accounting of Disclosures under 45 CFR 164.528. Qualsis will provide that information to Customer within twenty (20) business days after Customer's written request.

6.4. Requests received by Qualsis

If an Individual contacts Qualsis directly to exercise a right under HIPAA, Qualsis will forward the request to Customer within five (5) business days and will not respond on the substance, other than to acknowledge receipt and direct the Individual to Customer.

6.5. Carrying out Customer's obligations

To the extent Qualsis is to carry out an obligation of Customer under Subpart E of 45 CFR Part 164, Qualsis will comply with the requirements of Subpart E that apply to Customer in the performance of that obligation. Qualsis carries out such an obligation only where the Parties have expressly agreed in writing that it will.

6.6. Access by the Secretary

Qualsis will make its internal practices, books, and records relating to the Use and Disclosure of PHI received from, or created or received by Qualsis on behalf of, Customer available to the Secretary for purposes of determining compliance with HIPAA. Where legally permitted, Qualsis will tell Customer about a request from the Secretary that concerns Customer's PHI.

7. Obligations of Customer

7.1. Notice of limitations, changes, and restrictions

Customer will notify Qualsis in writing of any of the following, to the extent it may affect Qualsis's Use or Disclosure of PHI: (a) a limitation in an applicable notice of privacy practices under 45 CFR 164.520; (b) a change in, or revocation of, an Individual's permission to Use or Disclose PHI; and (c) a restriction on the Use or Disclosure of PHI agreed to under 45 CFR 164.522.

7.2. Lawful submission and Minimum Necessary

Customer is responsible for the lawfulness of the PHI it submits to the Services and for its own compliance with HIPAA. Customer will obtain every consent, authorization, and permission needed for Qualsis to handle the PHI as this BAA and the Underlying Agreement describe, and will submit only the Minimum Necessary PHI for its use of the Services.

7.3. No impermissible requests

Customer will not ask Qualsis to Use or Disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by Customer, except for the management, administration, and Data Aggregation purposes permitted in Section 3.

7.4. PHI goes through the Services

Customer will submit PHI to Qualsis only through the Services. Customer will not include PHI in website contact forms, postal mail, or other communications with Qualsis outside the Services unless Qualsis asks for it. If PHI reaches Qualsis outside the Services, Qualsis will protect it as this BAA requires, and the Parties will cooperate to move or delete it.

7.5. Customer's own safeguards

Customer is responsible for its own use of the Services, including configuring user access, managing its users' credentials, and using the security features Qualsis makes available.

7.6. Upstream agreements

Where Customer is a Business Associate, Customer represents that its agreements with its Covered Entities permit it to engage Qualsis as a Subcontractor and to disclose PHI to Qualsis as this BAA describes.

8. Term and termination

8.1. Term

This BAA takes effect when Customer accepts the Terms or on the effective date shown below, whichever is later. It continues until the Underlying Agreement ends and all PHI has been returned or destroyed under Section 8.4, or, where return or destruction is not feasible, for as long as Qualsis retains PHI under Section 8.5.

8.2. Termination by Customer

Customer may terminate this BAA, and the portion of the Underlying Agreement that involves PHI, if Customer determines that Qualsis has violated a material term of this BAA and Qualsis has not cured the violation within thirty (30) days after Customer's written notice describing it. If cure is not possible, Customer may terminate immediately on written notice.

8.3. Customer's breach; termination with the Underlying Agreement

A material breach of this BAA by Customer is a material breach of the Terms. This BAA terminates automatically when the Underlying Agreement terminates or expires, subject to Sections 8.4 and 8.5.

8.4. Return or destruction of PHI

On termination of this BAA for any reason, Qualsis will, if feasible, return or destroy all PHI that Qualsis still maintains in any form and will retain no copies, as follows:

  • Qualsis will delete PHI from active production systems within sixty (60) days after termination, or earlier on Customer's written instruction.
  • As an alternative to deletion, Customer may, by written request received before or within thirty (30) days after termination, instruct Qualsis to return the PHI in a structured, commonly used, machine-readable format. Return is in place of deletion, not in addition to it, and Qualsis deletes its copies after the return.
  • On Customer's request, Qualsis will certify in writing that deletion from active production systems is complete and identify any residual backup retention under Section 8.5.

8.5. Where return or destruction is not feasible

Immediate destruction of PHI held in encrypted backup and versioned copies is not feasible. Those copies expire through Qualsis's ordinary retention processes no later than ninety (90) days after deletion from active production systems. Qualsis will not restore them to an active environment except as necessary for disaster recovery, correction of accidental corruption, loss, or erroneous deletion, or legal compliance; any restoration containing deleted PHI will remain isolated, and Qualsis will re-apply the deletion before the restored environment returns to service.

If return or destruction of any other PHI is not feasible, Qualsis will tell Customer why. For all PHI that Qualsis retains after termination, Qualsis will extend the protections of this BAA to that PHI, limit further Uses and Disclosures to the purposes that make return or destruction infeasible, and return or destroy the PHI once it becomes feasible.

9. General

9.1. Liability

Each Party's liability arising out of or relating to this BAA is subject to the exclusions and limitations of liability in the Terms, including the separate cap the Terms apply to personal data breach claims. Nothing in this BAA limits a liability that cannot be limited under applicable law.

9.2. Independent contractors

The Parties are independent contractors. Qualsis is not Customer's agent, and Customer does not control the manner in which Qualsis performs the Services. Nothing in this BAA creates a partnership, joint venture, or agency relationship.

9.3. Updates to this BAA

Qualsis may update this BAA. An update needed to comply with a change in HIPAA, or one that does not reduce the protection of PHI, takes effect on at least thirty (30) days' notice given as the Terms provide. Any other material change takes effect at Customer's next renewal, as the Terms provide for material changes. The version in effect, with its effective date, is published at https://qualsis.com/legal/trust/baa. The published version governs every Customer, including a Customer that holds a signed copy of an earlier version, unless the Parties have agreed otherwise in a writing signed by both.

9.4. Survival

Sections 5 (for events occurring before termination), 6.6, 8.4, 8.5, and 9 survive termination of this BAA for as long as Qualsis retains PHI, and otherwise as needed to give them effect.

9.5. Interpretation

This BAA will be interpreted to permit the Parties to comply with HIPAA, and any ambiguity will be resolved in favor of a meaning that does. A reference to a HIPAA section means that section as in effect at the relevant time.

9.6. No third-party beneficiaries

Nothing in this BAA confers any right or remedy on any person other than the Parties and their permitted successors and assigns.

9.7. Notices

Except for reports under Section 5, notices under this BAA are given as the Terms provide. Notices to Qualsis about HIPAA matters must also be submitted through the Qualsis Privacy contact form.

9.8. Governing law

This BAA is governed by the law that governs the Terms, except to the extent HIPAA preempts it.

9.9. Entire agreement; severability

This BAA is the Parties' entire agreement on the handling of PHI and supersedes any earlier business associate agreement between them covering the Services. If a provision of this BAA is held unenforceable, the rest remains in effect and the provision will be enforced to the greatest extent permitted.

About this version

This is version 1.0.2 of the Qualsis Business Associate Agreement. It replaces version 1.0.1. The change is to Section 4.4: PHI is stored in the region assigned to Customer under the Terms, which follows Customer's business location; today that is the United States. The effective date shown below is the date this version started applying. Archived versions and a change log of material updates are kept at https://qualsis.com/legal/trust/changelog.

Last updated: September 22, 2026 · Effective: September 22, 2026