Is Qualtrics HIPAA compliant?

Qualtrics says it will execute BAAs on request with customers who are covered entities, and its security framework says a BAA is considered only for covered entities or business associates. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access.

How to get the BAA

Qualtrics says BAAs are executed on request; the pages read do not give a specific process, so ask your Qualtrics contact.

What the vendor says to do

• Monitor Authorized Users and their data
• Enforce your own HIPAA policies, including for data downloaded from the platform
• Have Authorized Users destroy PHI once it is no longer needed

What we couldn’t confirm

Qualtrics’s pages don’t say which plans qualify, and its documents differ on how firmly it commits to a BAA. Don’t assume a free account is covered.

Proof from the vendor

• Safeguarding Patient Information in the Digital AgeWill execute BAAs on request with covered entity customers
• Cloud Security and Privacy FrameworkAppendix A BAA conditions and customer duties; December 2022, version 8.1
• HITRUSTHITRUST claims with no BAA or plan terms