HIPAA and business associate statement

1. Why this is not a Notice of Privacy Practices

Under HIPAA, a Notice of Privacy Practices is a document a covered entity gives to its patients. PharmaBro is not a covered entity, so publishing one would misrepresent our role.

In the standard structure, the professional entity that employs or contracts the treating clinicians is the covered entity. PharmaBro is a business associate of that entity, and of the brand operator where they too are a covered entity or business associate.

The practical consequence: if you are a patient asking to see, amend or restrict your records, the entity that can act on that request is the brand you bought from and the professional entity that treated you. We can only act on their documented instruction.

2. What we do as a business associate

We execute a Business Associate Agreement as standard with every customer, on every plan including the entry tier. Under it we:

• Use and disclose protected health information only as the agreement permits or as law requires.
• Apply administrative, physical and technical safeguards to protect it.
• Require our subprocessors to accept equivalent obligations before any PHI reaches them.
• Report security incidents and breaches to the covered entity within the timelines the agreement sets.
• Make records available so the covered entity can meet its own access and amendment obligations.
• Return or destroy PHI at the end of the engagement, to the extent feasible.

We do not use protected health information for our own marketing, do not sell it, and do not use it to train machine learning models.

3. What protected health information covers here

PHI is broader than a diagnosis. In this context it includes intake responses, clinical messages between a patient and a provider, prescription and refill records, shipment addresses, and much of the billing information tied to care.

It does not include information that has been de-identified in accordance with HIPAA. We may use aggregated, de-identified data to operate and improve the platform.

4. Safeguards

• Encryption in transit and at rest for stored PHI.
• Role-based access control on a least-privilege basis, so records are reachable only by roles whose function requires them.
• Audit logging of record access alongside clinical and billing events, queryable per patient.
• Provider credential verification, including state licensure and DEA registration where applicable, before access is granted.
• A defined incident response and breach notification procedure.

PharmaBro does not currently hold SOC 2 Type II attestation. Some competitors do, and for an enterprise procurement process that may be decisive. We would rather state it here.

5. Breach notification

If a breach of unsecured protected health information occurs, we notify the affected covered entity without unreasonable delay and within the period specified in the BAA. The covered entity is then responsible for notifying affected individuals, the Secretary of Health and Human Services, and, where required, the media.

This is worth understanding before choosing any infrastructure vendor: when a platform is breached, the obligation to notify patients falls on the brand they trusted, on records the brand did not directly control. The notification terms in a BAA determine how quickly you find out.

6. Exercising your rights

If you are a patient, contact the brand you purchased from. If you are a covered entity or a customer and need to exercise rights or obtain a copy of our BAA, write to support@pharmabro.co.

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for doing so.