This page is general product information, not a covered entity's Notice of Privacy Practices and not legal advice. Patients should contact their clinic or pharmacy about a specific record or privacy request.
1. Our Role Under HIPAA
When Onlymeds processes Protected Health Information (PHI) on behalf of a covered entity under an applicable agreement, its role and obligations are governed by that agreement and applicable law.
When Onlymeds is acting as a Business Associate, its obligations are governed by HIPAA, HITECH, and the applicable Business Associate Agreement. A covered entity or business associate must not use the Platform for PHI until any agreement required for that use is in place.
2. What Is Protected Health Information?
PHI is individually identifiable health information that relates to a patient's past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare. PHI processed through Onlymeds includes:
- Patient name, date of birth, address, and contact information
- Prescription details including medication name, strength, quantity, and directions
- Prescriber name, NPI, and DEA number associated with a prescription
- Order status and fulfillment records
- Allergy and medication history entered into the Platform
3. How We Use and Disclose PHI
3.1 Permitted Uses and Disclosures
The Platform supports workflows that may involve treatment, payment, and healthcare operations. The applicable agreement and law determine what is permitted for each participating organization, including:
- Treatment: Transmitting prescriptions to pharmacy partners for compounding and dispensing
- Healthcare Operations: Quality assurance, audit logging, and compliance monitoring
- Payment: Processing order transactions and generating invoices
- Legal Requirements: Disclosures required by law, including to the DEA, state pharmacy boards, or law enforcement as required by applicable regulations
- Business Associate Functions: Performing services on behalf of covered entities as described in our BAAs
3.2 Uses Requiring Authorization
Onlymeds will not use or disclose PHI for marketing purposes, sell PHI, or use PHI in ways not permitted by our BAAs without obtaining a valid HIPAA authorization from the patient, except as required by law.
The Platform does not currently include a patient-marketing workflow.
3.3 Minimum Necessary Standard
Platform access and notification paths are designed to limit data to the fields needed for the stated workflow. Each participating organization remains responsible for applying its minimum-necessary policies.
4. How We Protect PHI
Technical controls implemented in the Platform include:
- Data protection: AES-256-GCM authenticated encryption of patient fields at the application layer, encrypted transport, authenticated decryption that rejects altered ciphertext, and fail-closed key handling
- Access controls: unique user accounts, role- and tenant-scoped authorization, multi-factor authentication requirements, and inactivity-based session expiration
- Accountability: audit records for covered operational mutations and patient-data access paths implemented by the Platform
- Incident obligations: investigation and notification responsibilities governed by applicable law and agreement
5. Your Rights Regarding PHI
As a Business Associate, Onlymeds supports covered entities in fulfilling patient rights under HIPAA. Patients who wish to exercise their rights regarding their PHI, including the right to access, amend, or request an accounting of disclosures, should contact the covered entity (prescriber or clinic) that submitted their information to the Platform.
Covered entities using Onlymeds should use the privacy contact identified in the agreement governing their organization's use of the Platform to request assistance in fulfilling patient rights requests.
6. Breach Notification
Investigation, mitigation, and notification responsibilities for a security incident are governed by applicable law and the agreement with the participating organization.
7. Subcontractors and Third Parties
Service providers used to operate the Platform and configured pharmacy connections may process data on Onlymeds's behalf. Their permitted use and any Business Associate Agreement requirements are governed by the applicable contracts. Depending on configuration, providers may include:
- Vercel: Application hosting
- Supabase: Managed database and authentication
- Configured pharmacy-system providers: Routing and fulfillment data for the selected participating pharmacy
- Resend: Transactional email delivery
8. Retention of PHI
Retention, return, and deletion of PHI are governed by the agreement with the participating organization and applicable law.
9. Changes to This Notice
Onlymeds reserves the right to modify this Notice at any time. Changes will be effective upon posting to the Platform. Material changes will be communicated to covered entities via email.
10. Complaints and Contact
If you believe Onlymeds has violated your HIPAA privacy rights, you may file a complaint with:
- Onlymeds privacy contact: Use the contact identified in the agreement governing your organization's use of the Platform.
- U.S. Department of Health and Human Services, Office for Civil Rights: www.hhs.gov/ocr or 1-800-368-1019
Onlymeds will not retaliate against any individual for filing a complaint in good faith.
Onlymeds is a provisional product name. Its operating legal entity, privacy contact, and mailing address must be confirmed in the applicable agreement before this information is published.