HIPAA Compliance Frequently Asked Questions

We've spoken with multiple discovery commissioners, and they've confirmed that privilege is preserved as long as (1) the client is invited after signing the retainer, and (2) only the law firm has access to the client's info. Quilia checks both boxes, just like email or text communication, it's protected.

Only the attorney or their firm can invite a client to use Quilia. This ensures attorney-client privilege starts at the right point (after a retainer is signed) and no outside party is ever involved in the onboarding process.

Only your firm’s team, the client, and anyone the client adds to their case, such as a family member who helps them. Quilia never hands what clients enter to insurance companies or any other outside party. When a client finishes treatment, Quilia can request their records from that provider on your firm’s behalf, so the request goes out in your name.

Yes. We meet all HIPAA requirements and maintain ongoing compliance monitoring. Data is encrypted in transit and at rest, and our most sensitive fields, like CMS sign-in credentials and Social Security numbers, get a second layer of AES-256-GCM encryption on top. Row-level security, role-based access controls, automated backups, audit logging, and enterprise-grade cloud infrastructure from SOC 2 certified providers like Supabase, Vercel, and Expo round it out.

Yes. Every message, document, and treatment update is encrypted in transit using TLS and at rest using AES-256 encryption. CaseChat runs over encrypted connections and syncs securely across the app, the web, and the portal. Row-level security in the database means only your firm’s team and the client can see a case’s data.

We can provide a Business Associate Agreement (BAA) if your organization requires one. Our standard BAA includes all required HIPAA provisions and can be customized to meet your specific needs. Contact our compliance team to request a BAA or learn more about our HIPAA compliance program.

Quilia uses enterprise-grade, SOC 2 certified cloud providers including Supabase for database and authentication, Vercel for web portal and API functions, and Expo for mobile app infrastructure. All providers maintain comprehensive physical security controls, 24/7 monitoring, and regular security audits.

Quilia implements dual-layer encryption for maximum security. First, Supabase provides AES-256 encryption for all data at rest at the database level. Second, we use our own AES-256-GCM application-level encryption for the most sensitive fields: CMS and storage sign-in credentials and sessions, and Social Security numbers. All data in transit is encrypted with TLS 1.2 or higher.

Row-level security ensures that users can only access data they are authorized to view at the database level. This means clients can only see their own case data, attorneys can only access their firm's data, and system administrators have appropriate access controls. It's implemented at the database level for maximum security.

Quilia maintains ongoing compliance monitoring through regular security assessments, policy reviews, and continuous improvement of our security measures. Our compliance program includes comprehensive audit logging, regular security updates, and monitoring to ensure we meet all HIPAA requirements for data protection, access control, and incident response procedures.

All Case Management System (CMS) integration credentials are encrypted with AES-256-GCM before they are stored, and every exchange with your CMS runs over its encrypted API. When a case imports, Quilia stores what it needs to serve the client: contact details, case details, insurance, and medical providers, which can include health information. With document reading on, Quilia also downloads new documents from your CMS to learn the file, keeps the key facts it finds on the case, and deletes its downloaded copy within about 3 days. Your CMS keeps the original. Documents your team chooses to share with the client are kept in the client’s app, like any other case file. Everything Quilia stores, including health information from your CMS, is protected by our HIPAA safeguards and covered by our Business Associate Agreement.

Quilia maintains automated daily backups through Supabase with geographically distributed storage for redundancy. We have point-in-time recovery capabilities, regular backup testing, and comprehensive disaster recovery procedures with defined recovery time objectives. All backup data is encrypted and stored securely.

Quilia maintains comprehensive incident response procedures with a dedicated team including security, legal, and technical personnel. Our response includes immediate detection and assessment, containment measures, investigation and root cause analysis, notification to affected parties as required by HIPAA, remediation measures, and documentation. We also have breach notification procedures in place.