Is Quill Therapy Solutions HIPAA compliant?
Quill Therapy Solutions (Zapstar Solutions, LLC) signs a Business Associate Agreement for Quill Therapy Solutions, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Quill Therapy Solutions with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.
Does Quill Therapy Solutions sign a BAA?
Yes, it signs a BAA
Quill writes therapy progress notes and treatment plans from a therapist's spoken or typed session summary, without recording sessions. Its FAQ says a BAA is included for all users at no extra cost, signed from the account page, and it says it has signed BAAs with its AI partners.
- Business associate
- Quill Therapy Solutions (Zapstar Solutions, LLC)
- Tool
- Quill Therapy Solutions
- Plans with a BAA
- Free trial / Individual / Team (self-serve)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free trial / Individual / Team (self-serve) | Signs a BAA | Accept or sign onlineRequest page | The FAQ says BAAs are included for all users at no extra cost. A logged-in user signs from the BAA page or with a 'Sign BAA' button on the My Account page. Individual plans are $20/month. Team plans are $20/month for the first user and $16/month for each additional member. The free trial includes 5 notes and 5 treatment plans.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Quill Therapy Solutions (Zapstar Solutions, LLC) says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI progress notes and treatment plans | Covered | Quill says it has signed BAAs with all of its technology and AI partners. Summaries go to an unnamed US AI provider under a zero data retention agreement that bars training. Quill says it stores no session summaries or generated notes.[1],[2] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.