iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Qualtrics can be used to process protected health information (PHI) in a HIPAA-regulated workflow only when the arrangement and the customer’s use meet the applicable requirements. Qualtrics says it signs business associate agreements (BAAs) with covered entity customers and complies with HIPAA to the extent the law imposes obligations on it as a business associate. That is a qualified yes—not a guarantee that every Qualtrics product, feature, account, or workflow is automatically suitable for PHI.
What Qualtrics’ HIPAA statement means
Qualtrics’ official Digital Experience Analytics security and privacy guidance says it complies with HIPAA to the extent HIPAA imposes obligations on Qualtrics as a business associate, and that it signs BAAs with covered entity customers to allow it to process PHI.
A BAA sets out the business associate’s obligations for handling protected information. It does not, by itself, make a customer’s entire workflow compliant. The customer still needs to meet its own HIPAA obligations and confirm that the agreement and service configuration cover the proposed use.
HHS guidance on cloud services likewise says a covered entity or business associate may use a cloud service to create, receive, maintain, or transmit electronic PHI (ePHI) when a HIPAA-compliant BAA is in place and the parties otherwise comply with the HIPAA Rules.
#1 Best Overall
Does the BAA cover the Qualtrics service you plan to use?
Do not assume that the BAA applies to every product, feature, integration, or data flow in your Qualtrics account. Qualtrics’ public guidance reviewed here does not establish plan-by-plan BAA eligibility or the terms of an individual customer’s agreement. Confirm the scope directly with Qualtrics and review the executed agreement before sending PHI.
- Identify the exact Qualtrics services and features involved, including integrations and any third-party components.
- Map what information each part of the workflow receives, stores, accesses, or transmits, and where it goes.
- Confirm in writing that the BAA covers those services and the relevant PHI flows.
- Check the agreement’s responsibilities and provisions for safeguarding information, incident handling, and any applicable subcontractors.
What changes for Digital Experience Analytics?
Qualtrics says individual Digital Experience Analytics (DXA) tools are neither inherently HIPAA-compliant nor inherently non-compliant. A DXA workflow may be used in a way that complies with HIPAA, but the customer is responsible for determining whether the workflow captures visitor data that may be shared with Qualtrics and for obtaining appropriate consent where needed.
Assess the actual collection points rather than judging the tool by its name. For example, determine whether a web page, session replay, survey, contact list, ticket, or integration could capture PHI. Review notices and consent requirements for the specific experience and data flow.
What the security credentials do—and do not—show
Qualtrics lists HITRUST and SOC 2 Type 2 among its security credentials and describes controls including sensitive-data restrictions, access controls, and encryption in transit. These are relevant inputs to vendor review, but they do not certify that a particular customer’s configuration or use complies with HIPAA.
Rank #3
Use the available security information to inform your organization’s assessment. Consider whether the controls and evidence address the risks in your workflow, and whether you need additional assurances in the contract or other documentation.
What your organization should verify before entering PHI
- Confirm the parties and agreement. Determine whether your organization is acting as a covered entity or business associate, and execute a BAA that expressly covers the Qualtrics services and data flows in scope before submitting PHI.
- Map the workflow. Document where PHI is collected, transmitted, stored, accessed, or shared, including through web experiences, surveys, integrations, and other connected services.
- Complete your risk analysis and risk management. HHS places responsibility on the customer to understand the cloud service and assess and manage risks to ePHI. Record the safeguards and decisions for the actual configuration.
- Review consent and notices. Where visitor data may be captured and shared, determine what consent or notice is appropriate. Qualtrics specifically identifies this responsibility for DXA use.
- Assess operational safeguards. Review access controls, retention and deletion, data locations, incident handling, and subcontractors against your requirements and the agreement.
- Request evidence that addresses your risks. Ask for the documentation or contractual assurances your assessment requires, and establish who will provide them and under what terms.
Can you require security documentation or an audit?
HHS says the HIPAA Rules do not expressly require a cloud provider acting as a business associate to provide security documentation or permit customer audits. That does not prevent a customer from seeking additional assurances through contract negotiations or other documents. Decide what evidence you need based on your risk analysis and risk-management activities, then confirm what Qualtrics will provide for your proposed arrangement.
Rank #4
Decision
Qualtrics’ stated willingness to sign BAAs with covered entity customers supports a conditional yes for an appropriately contracted and configured use. Before PHI enters a workflow, verify that the BAA covers the specific service and data flows, assess the customer-side safeguards and consent requirements, and confirm that the arrangement meets your organization’s HIPAA obligations. A general vendor statement or security credential is not a substitute for that review.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
