QortexOS HIPAA Overview

HIPAA and QortexOS

QortexOS connects to the systems a managed service provider runs on: tickets, accounting, remote monitoring, documents. If your clients include healthcare organizations, some of what flows through those systems is protected health information ("PHI"). This page explains how Qualsis handles it, what stays your responsibility, and how to get a signed copy of our Business Associate Agreement.

The short version

Our Business Associate Agreement applies to every customer automatically, on every plan, including beta. You accept it with the Terms of Service. There is nothing to sign and nothing to request.
We protect PHI the same way whether or not you hold a signed copy. If your auditors or your own clients need a signed one, it is available upon request.
QortexOS is operational software. It is not a medical record system, and you remain responsible for your own HIPAA compliance.

Who this applies to

You are covered if you are a HIPAA covered entity, or a business associate of one, and the data you bring into QortexOS includes PHI. Most managed service providers with healthcare clients are business associates of those clients. In that case Qualsis is your subcontractor, and our Business Associate Agreement is the written agreement HIPAA requires between you and us.

If none of your data is PHI, nothing here changes anything for you.

The Business Associate Agreement

The agreement is published at https://qualsis.com/legal/trust/baa. It is part of the Terms of Service, so it takes effect when you accept the Terms.

Need a signed copy? Ask through the Qualsis ESign Request form. We will send the current agreement for electronic signature. The signed copy records the published terms; it does not change them.

What Qualsis does

Encryption. PHI is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Inside our network, traffic runs only on private subnets with no public path.
Isolation. Each customer's data is separated by row-level security enforced in the database itself, and automated tests prove on every code change that one customer cannot reach another's data.
Access. Sign-in requires multi-factor authentication. Access to production is limited to authorized Qualsis personnel, requires multi-factor authentication, and every administrative session is logged.
Logging. Security and audit logs are kept for at least twelve months, and personal data is redacted from application logs.
Backups and recovery. Daily backups with point-in-time recovery, and a written disaster-recovery runbook with recovery objectives. We test restoration at least once a year; the most recent test was in August 2026.
Location. PHI is stored in the region assigned to your organization at signup, which follows your business location, with backups kept in the same legal block. Today every customer is hosted in the United States.
Risk analysis. We maintain the security risk analysis HIPAA requires of a business associate, reviewed at least annually, and we have a designated Security Officer and Privacy Officer.
Nowhere else. Customer data is not sent to analytics, error-tracking, or chat tools.

Our Security Overview describes these measures in more detail, and the full technical and organisational measures are in Annex II of our Data Processing Addendum.

Subcontractors

Two subcontractors handle customer data, and both are bound to us by business associate terms: Amazon Web Services (hosting, storage, and the Amazon Bedrock service) and Databricks (analytics pipelines, in a workspace configured to Databricks's HIPAA security profile). The current list, and how we notify you of changes, is at https://qualsis.com/legal/trust/subprocessors.

AI features and PHI

QortexOS AI features run on foundation models operated within AWS infrastructure through Amazon Bedrock, under our AWS agreements. On our current approved Bedrock deployment and models, the companies that build the models do not receive or otherwise process your data, and your data is not used to train models. Today, AI features read the documents you attach, not your ticket text.

What stays with you

Your HIPAA status and your own agreements. You decide whether you are a covered entity or business associate, and you keep the agreements you need with your own clients, including permission to use subcontractors like us.
Minimum necessary. Connect and upload only what you need. Most PHI reaches QortexOS inside ticket descriptions; your ticketing practices decide how much.
Your users. You control who in your organization has access and what role they hold.
The right channel. Send PHI only through QortexOS itself. Do not put it in website contact forms or the post.
Notifications. If an incident ever affects your PHI, we notify you. Notifying individuals, regulators, and your own clients is yours to decide and to do, and we will give you the information you need for it.

If something goes wrong

We tell you about a breach of unsecured PHI without unreasonable delay. Our target for the first notice is 24 hours from the time we confirm it, and never later than HIPAA's outer limit of 60 days from discovery. Other security incidents and uses of PHI the agreement does not allow are reported within ten business days. Notices go to your account's administrator contact unless you give us a different HIPAA contact through the Qualsis Privacy contact form.

When you leave

We delete your data from production within 60 days after your subscription ends, or sooner if you ask. If you would rather have it back, ask before or within 30 days after termination and we will return it in a machine-readable format instead. Encrypted backup copies expire within 90 days after that. We confirm deletion in writing on request.

What we do not claim

There is no official HIPAA certification, and we do not claim one. Qualsis is not a covered entity and does not provide medical, clinical, or diagnostic services.

Questions

Use the Qualsis Privacy contact form, or write to:

Qualsis, LLC
Attn: Privacy
3540 Toringdon Way, Suite 200
Charlotte, NC 28277
United States

About this version

This is version 1.0.2 of this page. It replaces version 1.0.1. The change is to the Location line: PHI is stored in the region assigned to your organization, which follows your business location; today that is the United States. The effective date shown below is the date this version started applying. Archived versions and a change log of material updates are kept at https://qualsis.com/legal/trust/changelog.