Quillentra handles protected health information (PHI) on behalf of the clinicians and practices that use it, as their business associate under HIPAA. Every practice is covered by our Business Associate Agreement.
Accepting the BAA
The person who creates a practice accepts the Terms of Service and the BAA on the practice’s behalf during setup. The acceptance is recorded with a timestamp.
Safeguards
- Sign-in uses a one-time code emailed to you, or your Google or Apple account. Optional password sign-ins always require an authenticator app.
- Automatic sign-out after 15 minutes of inactivity, and every session ends after at most 12 hours.
- Data is encrypted in transit and at rest. Patient details, transcripts, documents and assistant conversations are encrypted a second time at the field level.
- A tamper-evident audit trail records sign-ins, views, edits, copies and exports. Owners and admins can review it in Settings → Organization → Audit log, export it as CSV and select Verify integrity.
- Our emails contain only links back into the app, never patient information.
- Every vendor that can access PHI has signed a Business Associate Agreement with us. See the list of subprocessors.
SOC 2
We are aligning our controls with SOC 2, but we haven’t completed a SOC 2 examination yet.
Your practice’s part
- Follow your consent policy and confirm consent before recording.
- Decide who should be an admin, and remove people who leave.
- Keep exported files and devices secure.
- File signed notes in your EHR or other record system.