Compliance isn't a feature.
It's the architecture.
Every design decision starts with “does this protect patient data?” Here's how.
Business Associate Agreement
Signed BAA with every pharmacy partner. Covers all PHI handling, storage, transmission, and breach notification obligations.
PHI Minimization
Drivers see patient name and delivery address only. Never diagnosis, never medical history, never insurance details. Minimum necessary principle enforced at every layer.
Immutable Audit Trail
Every PHI access is logged — who accessed what, when, from where. Logs cannot be modified or deleted. 7-year retention.
Encryption
TLS 1.3 for all data in transit. AES-256 for all data at rest. Column-level encryption for patient addresses and medication names.
Access Control
Role-based access — pharmacy staff, drivers, admin each see only what they need. Multi-factor authentication required for all privileged accounts. Automatic session timeouts.
Chain of Custody
Digital signature at every handoff — pharmacy release, driver pickup, patient delivery. GPS-stamped, timestamped, photo-verified. Replaces paper logs.
Incident Response
Documented incident response plan. Designated security officer. Breach notification within 60 days per HIPAA requirements. Annual incident response testing.
California Compliance
CCPA/CPRA compliant. AB5 compliant (drivers are W-2 employees). CA Board of Pharmacy delivery regulations followed.
Need our BAA or have compliance questions?
Contact Security Team