Quest Analytics Vulnerability Disclosure Policy

Effective Date: October 12, 2026

Purpose

Quest Analytics, L.L.C. (“Quest”) of Overland Park, Kansas, cares about the security of its platform and the data entrusted to us. Our customers include health plans and federal programs, so our systems may hold protected health information (PHI), health plan customer data, and federal (CMS) data. We welcome good-faith reports of security vulnerabilities from outside researchers. We accept, review, and address the vulnerabilities reported to us through this program.

How to Report

Email your report to disclosure@questanalytics.com. Please include the affected product or URL, a description of the vulnerability, steps to reproduce it, its potential impact, and how we can contact you. Do not include PHI, personal data, customer or federal data, credentials, or tokens in your report. If you need to show impact, describe it or use redacted or synthetic examples.

Scope

In scope: Quest Enterprise Service and listed Quest-owned domains.

Out of scope, unless Quest gives advance written permission: customer environments and customer data; production systems that contain PHI, customer, or federal data; third-party cloud, hosting, or vendor services; Quest’s internal corporate systems; physical facilities; and any asset not listed above. Quest cannot authorize access to systems or data owned or controlled by third parties.

Rules for Good-Faith Research

When testing, you must use only your own accounts and data, and access only the minimum needed to confirm a vulnerability. Do not access, copy, download, alter, keep, or disclose PHI or any other non-public data. If you come across such data, stop right away and tell us. Do not cause denial of service or disruption, destroy data, establish persistence, deploy malware, or run high-volume automated scans. Do not use social engineering, phishing, physical intrusion, or credential stuffing. Follow all applicable laws. Give Quest reasonable time to fix the issue before you disclose it publicly.

Safe Harbor

If you research in good faith and materially follow this policy, Quest considers your research authorized, to the extent Quest has authority to authorize it. Quest will not start civil action against you or refer you to law enforcement under the Computer Fraud and Abuse Act for that research. Quest also will not bring claims under Section 1201 of the Digital Millennium Copyright Act for circumventing Quest-controlled technological measures where that circumvention was reasonably necessary for the authorized research. This safe harbor covers only rights Quest controls. It does not bind our customers, government agencies, prosecutors, regulators, or vendors. It is not legal advice.

What to Expect

We aim to acknowledge your report within [3] business days and to send an initial status update within [10] business days. These are goals, not guarantees. We handle reports through Quest’s vulnerability management process and address them in a timely way.

Coordinated Disclosure and Confidentiality

Please keep vulnerability details confidential until Quest has fixed the issue or we have agreed with you on a disclosure date. We will work with you in good faith on timing.

No Bug Bounty

Quest does not run a bug bounty program. Submitting a report does not give you any right to payment, a reward, or other compensation. Any public acknowledgment is at Quest’s sole discretion.

Reservation of Rights

Quest reserves all rights and remedies for conduct that falls outside this policy’s scope, materially violates this policy, or is malicious or unlawful. Nothing in this policy waives any of Quest’s rights. Quest may update this policy at any time. Changes apply only going forward.

Questions

If you aren’t sure whether a test or asset is covered, ask us at disclosure@questanalytics.com before you start testing.