HIPAA Notice

PharmaRX Pharmacy is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). SyncRx is an internal tool PharmaRX uses to coordinate refills and deliveries. This notice summarizes how Protected Health Information (PHI) is handled in SyncRx and the safeguards in place.

1. Uses and disclosures

PHI in SyncRx is used for treatment (coordinating medication refills), payment and health care operations (delivery planning). PHI is disclosed only to PharmaRX workforce members with a job-related need and to business associates under a signed Business Associate Agreement, or as required by law.

2. Technical safeguards (45 CFR §164.312)

• Access control: unique user accounts created only by administrators, role-based permissions, automatic logoff after 15 minutes of inactivity, and encryption of patient identifiers at rest.
• Audit controls: sign-ins, failed sign-ins, record views, record changes, account changes and API activity are recorded with user, time and IP address.
• Integrity: changes to patient sync status are logged with previous and new values; audit records cannot be edited from the application.
• Person or entity authentication: strong password rules and lockout after 5 failed attempts; integrations authenticate with individually revocable API keys stored only as one-way hashes.
• Transmission security: all traffic is encrypted with HTTPS/TLS.

3. Patient rights

Patients have the right to request access to and copies of their health information, request amendments, request an accounting of disclosures, request restrictions or confidential communications, receive a paper copy of PharmaRX’s Notice of Privacy Practices, and be notified of a breach of unsecured PHI. Requests should be directed to the Privacy Officer below.

4. Workforce responsibilities

• Access only the minimum necessary information for your task.
• Never share login credentials or leave a signed-in session unattended.
• Report any suspected breach, lost device or misdirected information immediately.

5. Breach notification

PharmaRX will investigate suspected incidents and provide notifications to affected individuals, the U.S. Department of Health and Human Services and, where required, the media, in accordance with the HIPAA Breach Notification Rule.

6. Complaints

Anyone who believes their privacy rights have been violated may file a complaint with PharmaRX’s Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. No one will be retaliated against for filing a complaint.

7. Contact