Skip to content
Back to home

Product information

HIPAA and privacy information

A product overview of ScriptExchange's role and technical controls when processing protected health information. Applicable agreements and law govern each participating organization.

Draft last edited: September 18, 2026

Draft — approval required. This page is pending product-owner and counsel review and is not an approved or effective policy.

This page is general product information, not a covered entity's Notice of Privacy Practices and not legal advice. Patients should contact their clinic or pharmacy about a specific record or privacy request.

1. Our Role Under HIPAA

When ScriptExchange processes Protected Health Information (PHI) on behalf of a covered entity under an applicable agreement, its role and obligations are governed by that agreement and applicable law.

When ScriptExchange is acting as a Business Associate, its obligations are governed by HIPAA, HITECH, and the applicable Business Associate Agreement. A covered entity or business associate must not use the Platform for PHI until any agreement required for that use is in place.

2. What Is Protected Health Information?

PHI is individually identifiable health information that relates to a patient's past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare. PHI processed through ScriptExchange includes:

  • Patient name, date of birth, address, and contact information
  • Prescription details including medication name, strength, quantity, and directions
  • Prescriber name, NPI, and DEA number associated with a prescription
  • Order status and fulfillment records
  • Allergy and medication history entered into the Platform

3. How We Use and Disclose PHI

3.1 Permitted Uses and Disclosures

The Platform supports workflows that may involve treatment, payment, and healthcare operations. The applicable agreement and law determine what is permitted for each participating organization, including:

  • Treatment: Transmitting prescriptions to pharmacy partners for compounding and dispensing
  • Healthcare Operations: Quality assurance, audit logging, and compliance monitoring
  • Payment: Processing order transactions and generating invoices
  • Legal Requirements: Disclosures required by law, including to the DEA, state pharmacy boards, or law enforcement as required by applicable regulations
  • Business Associate Functions: Performing services on behalf of covered entities as described in our BAAs

3.2 Uses Requiring Authorization

ScriptExchange will not use or disclose PHI for marketing purposes, sell PHI, or use PHI in ways not permitted by our BAAs without obtaining a valid HIPAA authorization from the patient, except as required by law.

The Platform does not currently include a patient-marketing workflow.

3.3 Minimum Necessary Standard

Platform access and notification paths are designed to limit data to the fields needed for the stated workflow. Each participating organization remains responsible for applying its minimum-necessary policies.

4. How We Protect PHI

Technical controls implemented in the Platform include:

  • Data protection: AES-256-GCM authenticated encryption of patient fields at the application layer, encrypted transport, authenticated decryption that rejects altered ciphertext, and fail-closed key handling
  • Access controls: unique user accounts, role- and tenant-scoped authorization, multi-factor authentication requirements, and inactivity-based session expiration
  • Accountability: audit records for covered operational mutations and patient-data access paths implemented by the Platform
  • Incident obligations: investigation and notification responsibilities governed by applicable law and agreement

5. Your Rights Regarding PHI

As a Business Associate, ScriptExchange supports covered entities in fulfilling patient rights under HIPAA. Patients who wish to exercise their rights regarding their PHI, including the right to access, amend, or request an accounting of disclosures, should contact the covered entity (prescriber or clinic) that submitted their information to the Platform.

Covered entities using ScriptExchange may contact us at privacy@scriptexchange.com to request assistance in fulfilling patient rights requests.

6. Breach Notification

Investigation, mitigation, and notification responsibilities for a security incident are governed by applicable law and the agreement with the participating organization.

7. Subcontractors and Third Parties

Service providers used to operate the Platform and configured pharmacy connections may process data on ScriptExchange's behalf. Their permitted use and any Business Associate Agreement requirements are governed by the applicable contracts. Depending on configuration, providers may include:

  • Vercel: Application hosting
  • Supabase: Managed database and authentication
  • Configured pharmacy-system providers: Routing and fulfillment data for the selected participating pharmacy
  • Resend: Transactional email delivery

8. Retention of PHI

Retention, return, and deletion of PHI are governed by the agreement with the participating organization and applicable law.

9. Changes to This Notice

ScriptExchange reserves the right to modify this Notice at any time. Changes will be effective upon posting to the Platform. Material changes will be communicated to covered entities via email.

10. Complaints and Contact

If you believe ScriptExchange has violated your HIPAA privacy rights, you may file a complaint with:

ScriptExchange will not retaliate against any individual for filing a complaint in good faith.

Privacy Officer, ScriptExchange, LLC
Email: privacy@scriptexchange.com
Address: 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801