HIPAA & Protected Health Information
How we handle health information as a business associate, and the safeguards we apply to every job.
Effective September 21, 2026
Our role under HIPAA
When we carry prescriptions, laboratory specimens, medical devices, or supplies for a pharmacy, laboratory, hospital, or other covered entity, we may create, receive, or have access to protected health information (PHI) in the course of that work. In those situations we act as a business associate of the covered entity.
As a business associate, we handle PHI only as permitted by our agreement with the covered entity and as required by law. We do not use or disclose PHI for our own marketing, and we do not sell PHI.
Safeguards we apply
- Access to PHI is limited to the staff and couriers who need it to complete a specific job.
- Delivery details, chain-of-custody records, and proof of delivery are stored in access-controlled systems, with encryption in transit.
- Couriers receive confidentiality training and are bound by written confidentiality obligations.
- Proof of delivery is shared only with the parties entitled to see it — normally the sender and the intended recipient.
- We maintain an incident response process for suspected privacy or security incidents, and we notify affected covered entities as required.
What we do not do
We do not open, inspect, or read the contents of sealed packages beyond what is necessary to verify the item against your instructions and to record chain of custody. We do not keep copies of prescriptions or records we are asked to transport.
Reporting a concern
If you believe health information has been mishandled in connection with a delivery, contact us immediately at hello@gomedroute.com so we can investigate.