Protected health information, handled like it matters.
A telehealth platform is custodian of some of the most sensitive data a person has. When a platform is breached, the brands running on it inherit the notification obligation for records they never controlled. This page states exactly what is in place, and one thing that is not.
- HIPAA compliant with a signed Business Associate Agreement
- Encryption in transit and at rest, role-based access control
- Audit logging on every clinical and billing event
- Full data export within 24 hours, any day, no ticket
The controls that are actually in place
Specific rather than reassuring. Each of these is verifiable, and you should ask any vendor in this category to be equally specific.
Executed BAA
A Business Associate Agreement signed as standard on every tier, not a policy page describing our intentions.
Encryption in transit and at rest
TLS on every connection and encryption at rest for stored protected health information, including clinical records and message threads.
Role-based access control
Staff access is scoped by role and least privilege. Clinical records are reachable by the people whose function requires them, not by everyone with a login.
Audit logging
Intake version, provider decision, prescription event, pharmacy transmission and record access are logged per patient and queryable.
Provider credential verification
State licensure, DEA where applicable, NPI, board certification and malpractice coverage are verified before a provider sees a patient.
Breach notification procedure
A defined procedure with defined timelines. The question is never whether a vendor has a plan, but whether they will tell you fast enough for yours to work.
Why ownership is a security control
The strongest protection against a vendor's incident is not being dependent on that vendor's custody in the first place.
- Your merchant account is yours, so your payment data does not sit inside our blast radius.
- Card tokens are portable on request, so a migration is not a mass re-collection of payment details.
- A 24-hour export with no term means you are never holding a hostage position over your own records.
- Audit trails are queryable by you, not just by us, so your compliance story does not depend on our response time.
- The MSO structure keeps the clinical entity and the software vendor properly separated.
- Ask every vendor you evaluate, including us: who is the covered entity, where does PHI physically sit, and what does the BAA actually say.
Stated plainly
| HIPAA | Compliant, with a Business Associate Agreement executed as standard on every tier. |
|---|---|
| SOC 2 Type II | Not currently held. Some competitors do hold it, and for enterprise procurement that can be a hard requirement. |
| Encryption | In transit and at rest for protected health information. |
| Data export | Full export of records, order history and card tokens within 24 hours, on any day, without a support ticket. |
| Contract term | None. Portability is structural rather than contractual. |
| Payment data | Settles into your own Stripe account. PharmaBro never holds patient funds or acts as merchant of record. |
| Breach history | None. |
| Pharmacy partners | State-licensed 503A and 503B facilities, licensure verified before any order routes to them. |
Security questions
Yes, and we sign a Business Associate Agreement. HIPAA compliance is not a certificate you buy; it is an executed BAA plus the technical and administrative controls behind it: encryption in transit and at rest, role-based access control, audit logging on every record touch, and breach notification procedures.
Ask for the specifics
BAA language, export mechanics, audit scope, credential verification. Our compliance team answers these directly.