Free tools Windows power users keep installed
One-click scans. No signup required.
Qualified yes: Qualtrics says it will sign business associate agreements (BAAs) with covered-entity customers and comply with HIPAA to the extent the law applies to it as a business associate. That does not make every Qualtrics product, account, feature, or workflow automatically suitable for protected health information (PHI). Before collecting PHI, confirm that your BAA covers the specific service and data flows, then assess and configure your own workflow to meet your organization’s HIPAA obligations.
What Qualtrics says about HIPAA
Qualtrics’ Digital Experience Analytics (DXA) security guidance says it complies with HIPAA to the extent HIPAA imposes obligations on it as a business associate, and that it signs BAAs with covered-entity customers to process PHI. That is a conditional statement about Qualtrics’ role under an agreement—not a blanket certification of every Qualtrics service or every customer use.
As an Amazon Associate I earn from qualifying purchases.
Whether a particular arrangement is appropriate depends on the contracted services, the information handled, how it moves through the system, and the safeguards and procedures your organization applies. The public guidance reviewed does not establish which plans or specific services are eligible for a BAA, so confirm that directly with Qualtrics for the proposed use.
Why a BAA is necessary but not enough
HHS says a covered entity or business associate may use a cloud service to create, receive, maintain, or transmit electronic PHI (ePHI) when it has a HIPAA-compliant BAA with the cloud provider and the parties otherwise comply with the HIPAA Rules. The agreement establishes satisfactory assurances and requires the business associate to safeguard PHI. It does not transfer the customer’s own compliance responsibilities to the vendor. HHS cloud-computing guidance also emphasizes that customers need to understand the service and conduct risk analysis and risk management.
#1 Best Overall
Qualtrics lists HITRUST and SOC 2 Type 2 among its security credentials and describes controls such as access restrictions and encryption in transit. Those are relevant evidence to consider, but they do not establish that your particular workflow is compliant. Review the actual service scope, agreement, configuration, and your organization’s risk analysis. Qualtrics’ security information describes its stated credentials and controls.
How to assess a Qualtrics workflow before entering PHI
- Identify the data and service. Map where PHI will be collected, viewed, stored, transmitted, or connected to other systems. Include surveys, web pages, session replay or analytics, contact lists, support tickets, and integrations if they are part of the workflow.
- Confirm BAA coverage in writing. Execute a BAA before submitting PHI and verify that it covers the specific Qualtrics services, features, and data flows you intend to use. Qualtrics says it signs BAAs with covered-entity customers, but its public guidance reviewed here does not specify plan-by-plan eligibility or the terms of an individual agreement.
- Complete your risk analysis. Document how the actual configuration handles ePHI, the risks identified, and the safeguards and risk-management measures your organization will use. HHS places this assessment on the customer, not just the cloud provider.
- Review notices and consent. Qualtrics says individual DXA tools are neither inherently HIPAA compliant nor non-compliant; DXA may be used in a HIPAA-compliant way, but the customer is responsible for appropriate visitor consent where data may be captured and shared with Qualtrics. Review what the tool records and what visitors are told before enabling collection.
- Settle operational and procurement details. Review access controls, retention and deletion, incident handling, data locations, subcontractors, and any security documentation or audit requirements that matter to your risk analysis. Record the relevant responsibilities and terms in your procurement and contract review.
What to request from Qualtrics
HHS says the HIPAA Rules do not expressly require a cloud provider acting as a business associate to provide security documentation or permit customer audits. A customer may seek additional assurances through contracts or other documents based on its risk analysis and risk-management activities. HHS’ guidance on cloud-provider documentation and audits explains this distinction.
For your use case, ask Qualtrics to confirm which services are covered by the proposed BAA, what data flows and features are in scope, and what evidence is available for your security review. Your organization should determine whether that evidence and the contract terms address the risks it identified; a vendor credential by itself is not a substitute for that decision.
Recommended Free Tools
Quick Recap
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
