Our Role Under HIPAA
Verum Health RX, LLC ("Verum Health RX") operates as a Business Associate to licensed prescribers and as a fulfillment intermediary to 503A-licensed pharmacies. In this capacity, we may access, receive, or transmit protected health information ("PHI") solely to facilitate the fulfillment of prescriptions submitted through our platform.
We are not a covered entity under HIPAA. We do not provide clinical care, practice medicine, or establish direct treatment relationships with patients. All PHI we handle is subject to Business Associate Agreement obligations with our covered entity partners.
How We Use and Disclose PHI
We use and disclose PHI only as permitted by our Business Associate Agreements and applicable law. The following describes the circumstances under which PHI may be used or disclosed:
Prescription Fulfillment
We transmit prescription and patient information to our licensed 503A pharmacy partners solely to fulfill the specific prescription order submitted by the prescriber. This is the primary and intended use of any PHI we handle.
Shipping and Logistics
We share the minimum necessary patient information (name, shipping address) with logistics and shipping partners solely to facilitate delivery of fulfilled prescriptions.
Platform Operations
We may use de-identified or aggregated data derived from order information to operate, maintain, and improve the platform. We do not use PHI for marketing purposes.
Legal and Regulatory Requirements
We may disclose PHI when required by law, regulation, court order, or valid government process. We will notify our covered entity partners of any such compelled disclosure to the extent permitted by law.
Breach Notification
In the event of a breach of unsecured PHI, we will notify the applicable covered entity partners in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and the terms of our Business Associate Agreements.
Uses and Disclosures We Will Not Make
- We will not sell PHI
- We will not use PHI for marketing or advertising purposes
- We will not disclose PHI for purposes unrelated to prescription fulfillment without written authorization from the applicable covered entity
- We will not use PHI in any manner that would violate our Business Associate Agreement obligations or applicable HIPAA regulations
Safeguards
We implement and maintain administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C) and our Business Associate Agreement obligations. These safeguards include:
- Encryption of PHI in transit (TLS) and at rest
- Role-based access controls limiting PHI access to personnel with a need to know
- Regular risk assessments and security monitoring
- Workforce training on HIPAA obligations
- Incident response and breach notification procedures
Business Associates and Subcontractors
We may engage subcontractors and service providers who access PHI in the course of providing services to us. We require all such subcontractors to enter into written agreements that impose the same HIPAA obligations applicable to us and that restrict their use and disclosure of PHI to the purposes for which it was provided.
Patient Rights
Because Verum Health RX is a Business Associate and not the treating covered entity, patient rights requests (access, amendment, accounting of disclosures, etc.) should be directed to the prescribing provider or the pharmacy that dispensed the medication. We will cooperate with covered entities in responding to patient rights requests as required by our Business Associate Agreements and applicable law.
Changes to This Notice
We reserve the right to change this Notice and the HIPAA practices it describes. Changes will be reflected by updating the effective date above. We will make the current Notice available on this website.
Complaints
If you believe your privacy rights under HIPAA have been violated in connection with our services, you may file a complaint with:
Verum Health RX, LLC — HIPAA Privacy Officer
Email: info@verumhealthrx.com
Address: 3710 Kirby Drive, Suite 1196, Houston, TX 77098
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W., Washington, D.C. 20201
Phone: 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints
We will not retaliate against any person for filing a good-faith complaint.
Contact
For questions about this HIPAA Notice or our privacy practices:
Verum Health RX, LLC — Privacy / HIPAA
Email: info@verumhealthrx.com
Address: 3710 Kirby Drive, Suite 1196, Houston, TX 77098