Trust & accountability

How Quillward supports HIPAA compliance operations

Quillward helps care practices keep their HIPAA administrative work visible and accountable. Here is what that means for your information, your responsibilities, and the limits of what the product can promise.

A clear line of responsibility
Quillward keeps the work visible. Your practice makes the decisions.

01

Quillward

Data handling

Quillward stores the information you choose to put into your workspace so your team can maintain a shared record of practice profiles, policies, checklists, risk assessments, training, agreements, reminders, regulatory references, evidence metadata, and uploaded files.

The workspace is intended for administrative compliance work. It is not a general-purpose patient chart or file store. Your practice decides what it is permitted to upload, what information is appropriate to enter, how long to retain or delete it, and who should have access to it.

  • Authorize only the people and systems permitted to access your workspace, review permissions as roles change, and remove access promptly when it is no longer needed.
  • Set and follow retention and deletion practices that fit your obligations, and remove information that is no longer needed for your workflow.
  • Maintain your own incident-response process, including how your practice investigates and handles an incident, and contact us promptly if you believe an account or piece of information has been accessed improperly.

02

Quillward

Customer responsibilities

Your practice remains responsible for deciding what information belongs in Quillward and for putting appropriate safeguards around the people, devices, workforce, and vendors that support your work.

Quillward can surface recommendations and make follow-through easier to see, but your team must implement those recommendations, keep records and staff training current, and maintain and secure Business Associate Agreements with relevant vendors.

  • Decide what your organization is authorized to upload and share. Implement recommendations, document the decisions your organization makes, and keep evidence and other operational records current.
  • Keep workforce training and access safeguards current, including training for new staff and role changes.
  • Maintain, review, and secure BAAs and other vendor safeguards when a vendor’s services or access make them appropriate.
  • Keep your own retention, incident-response, and recovery practices current for the information you manage.

03

Quillward

Limitations

Quillward provides compliance-support tooling: it helps your team organize work, keep recommendations visible, and maintain evidence. It is not legal advice, a security assessment, or a substitute for a qualified privacy or compliance professional.

Quillward does not certify compliance.

Using Quillward, completing a checklist, or keeping evidence in the workspace does not certify that your practice meets HIPAA or any other requirement.

Statuses, reminders, checklists, assessments, policies, evidence, training records, and reports reflect customer inputs and workflow activity. They can be incomplete, inaccurate, or stale; they are not independently verified proof of a control, event, or compliance status.

Your organization remains responsible for evaluating its obligations, implementing safeguards, and acting on the risks its reviews uncover.

  • Requirements vary by organization, role, location, contract, and the information you handle.
  • You are responsible for evaluating whether Quillward fits your program and for implementing the safeguards your program requires.
  • If you need a determination about compliance, consult qualified counsel or a compliance professional.