HIPAA Compliance & Security for Law Firms

Yes. We meet all HIPAA requirements and maintain ongoing compliance monitoring. Data is encrypted in transit and at rest, and our most sensitive fields, like CMS sign-in credentials and Social Security numbers, get a second layer of AES-256-GCM encryption on top. Row-level security, role-based access controls, automated backups, audit logging, and enterprise-grade cloud infrastructure from SOC 2 certified providers like Supabase, Vercel, and Expo round it out.

Yes. Every message, document, and treatment update is encrypted in transit using TLS and at rest using AES-256 encryption. CaseChat runs over encrypted connections and syncs securely across the app, the web, and the portal. Row-level security in the database means only your firm’s team and the client can see a case’s data.

We can provide a Business Associate Agreement (BAA) if your organization requires one. Our standard BAA includes all required HIPAA provisions and can be customized to meet your specific needs. Contact our compliance team to request a BAA or learn more about our HIPAA compliance program.

Quilia uses enterprise-grade, SOC 2 certified cloud providers including Supabase for database and authentication, Vercel for web portal and API functions, and Expo for mobile app infrastructure. All providers maintain comprehensive physical security controls, 24/7 monitoring, and regular security audits.

Quilia implements dual-layer encryption for maximum security. First, Supabase provides AES-256 encryption for all data at rest at the database level. Second, we use our own AES-256-GCM application-level encryption for the most sensitive fields: CMS and storage sign-in credentials and sessions, and Social Security numbers. All data in transit is encrypted with TLS 1.2 or higher.

Row-level security ensures that users can only access data they are authorized to view at the database level. This means clients can only see their own case data, attorneys can only access their firm's data, and system administrators have appropriate access controls. It's implemented at the database level for maximum security.

Quilia maintains ongoing compliance monitoring through regular security assessments, policy reviews, and continuous improvement of our security measures. Our compliance program includes comprehensive audit logging, regular security updates, and monitoring to ensure we meet all HIPAA requirements for data protection, access control, and incident response procedures.

All Case Management System (CMS) integration credentials are encrypted with AES-256-GCM before they are stored, and every exchange with your CMS runs over its encrypted API. When a case imports, Quilia stores what it needs to serve the client: contact details, case details, insurance, and medical providers, which can include health information. With document reading on, Quilia also downloads new documents from your CMS to learn the file, keeps the key facts it finds on the case, and deletes its downloaded copy within about 3 days. Your CMS keeps the original. Documents your team chooses to share with the client are kept in the client’s app, like any other case file. Everything Quilia stores, including health information from your CMS, is protected by our HIPAA safeguards and covered by our Business Associate Agreement.

Quilia maintains automated daily backups through Supabase with geographically distributed storage for redundancy. We have point-in-time recovery capabilities, regular backup testing, and comprehensive disaster recovery procedures with defined recovery time objectives. All backup data is encrypted and stored securely.

Quilia maintains comprehensive incident response procedures with a dedicated team including security, legal, and technical personnel. Our response includes immediate detection and assessment, containment measures, investigation and root cause analysis, notification to affected parties as required by HIPAA, remediation measures, and documentation. We also have breach notification procedures in place.