Healthcare privacy readiness
This private site is for sample-data setup. It has not been verified as HIPAA compliant and must not be used for real patient information yet.
Contact details connected to pharmacy or healthcare services can be sensitive even when no medication names are included. Do not enter real patient names, addresses, prescriptions, dates of birth, government IDs or clinical records during setup.
Technical safeguards currently implemented
- Private site access and server-side administrator, dispatcher and assigned-driver permissions.
- Customer tracking responses omit patient contact details, addresses, internal notes and delivery proof.
- Changes are checked for conflicting edits and recorded in activity histories. Authorized record views and exports have a separate administrator-only access log. Backup downloads are password-encrypted in the browser; this does not verify the hosting/storage safeguards.
- Page and API responses use no-store caching controls, and pages use a no-referrer policy.
- Order details are not prefilled into personal email drafts. Third-party font and embedded map requests have been removed.
Launch requirements still unverified
- Confirm whether the business is a covered entity or business associate for each pharmacy relationship.
- Confirm that hosting, storage, authentication, backups, logs and notification services are eligible for the intended patient-data use. Execute applicable Business Associate Agreements (BAAs) covering those services.
- Complete a security risk analysis and documented administrative, physical and technical safeguards, including staff access, authentication, session controls and audit review.
- Approve privacy practices, workforce training, incident and breach response, retention/deletion and tested recovery procedures.
- Validate the complete patient workflow in the approved environment before real patient intake.
A private URL, encryption feature or website badge does not establish HIPAA compliance. The current account’s BAA and product eligibility have not been verified. The same marketing website address can be retained while patient workflows are connected to an approved backend or portal if needed.
Official references
HHS guidance on HIPAA and cloud computing · HHS Security Rule summary