Data Protection

Last updated: November 2026. These pages describe how QuickMBS operates its website and services. They are written for the QuickMBS website and its SMS program; they are not a substitute for legal advice, and QuickMBS should have them reviewed by a US healthcare attorney before launch.

1. Our approach

QuickMBS handles two kinds of information: (a) business contact information from website visitors, governed by our Privacy Policy; and (b) protected health information (PHI) belonging to our clients' patients, which we handle only as a HIPAA business associate under a signed Business Associate Agreement (BAA).

2. HIPAA and Business Associate Agreements

Before we receive any PHI from a practice, we sign a BAA with that practice. The BAA governs how we may use and disclose PHI, the safeguards we must apply, and what happens if there is a breach. We do not accept PHI through the website contact forms, those forms are for business enquiries only.

3. Security measures

We apply reasonable administrative, physical, and technical safeguards, including: HTTPS across this website; access controls so only staff who need PHI can access it; secure, agreed channels for receiving and returning PHI; and staff training on HIPAA and confidentiality. We regularly review these measures and update them as our services change.

4. Data minimization and retention

We collect and keep only the information needed for the service we are providing. PHI is retained only as long as the BAA and the client's instructions require, and is then returned or securely destroyed. Website enquiry data is kept only as long as needed to respond to the enquiry and meet legal obligations.

5. Breach notification

If we discover a breach of unsecured PHI, we will notify the affected covered entity without unreasonable delay, as required by HIPAA and the BAA, so that the covered entity can notify affected individuals.

6. Your rights and requests

Patients should direct requests about their own health information to their healthcare provider, which is the covered entity responsible for that information. Practices and website visitors can contact us at info@quickmbs.com or +1 (312) 588-6166 about data protection questions.

7. International transfers

Our team includes staff outside the United States. Where PHI is accessed from outside the US, it is accessed only under the BAA, with the safeguards described above, and only for the services the practice has engaged us to provide.

Questions about this page? Contact us at info@quickmbs.com or call +1 (312) 588-6166.