Role
Business Associate
Business Associate to covered entities — hospitals, laboratories, pharmacies, and DME providers we run for.
HIPAA & compliance
A Business Associate, not a slogan on a van.
Deliver Ease handles protected health information only as needed to move cargo. We sign BAAs, train the workforce, and refuse identifiers that do not belong on a dispatch ticket.
Rule
Minimum necessary
Campus, dock, product class, temperature, and window. Not a name, not an MRN, not a diagnosis.
Officer
Privacy Officer
privacy@deliverease.com · Dallas desk pages after hours.
What travels with a cooler
Tap an item. See if it is PHI, and how we treat it on the road.
HIPAA protects individually identifiable health information. Logistics still has to move. The line is whether the data can identify a person.
Protected health information
Patient name on a specimen label
PHI. Couriers do not photograph readable labels. Totes stay sealed. Names are not copied onto dispatch tickets.
Minimum necessary on a ticket
One of these notes would be refused. The other would roll.
Refused
STAT for John Smith, MRN 448291, hemophilia factor, DOB 03/12/1961, leave with wife.
Name, MRN, diagnosis, and date of birth do not dispatch a van. They create a record we should never have held.
Accepted
STAT 2–8°C specialty pharmacy. Parkland outpatient pharmacy dock 4 to home delivery — account 8841. Window 90 minutes. Call on approach. Do not include patient identifiers.
Facility, product class, temperature, account, and window. The public request form screens for the first kind.
Security Rule
Administrative, physical, and technical — the three rooms we keep in order.
Who may know, how they are trained, and what happens when they fail.
- 01
Named privacy officer and security officer in Dallas.
- 02
Role-based access: dispatch sees the ticket; accounting sees the invoice; couriers see only the run they are assigned.
- 03
Workforce HIPAA training before the first solo run, then annually. Sanctions for gossip, photos, or leftover paper.
- 04
Business Associate Agreements executed before PHI is allowed on a lane.
- 05
Minimum necessary written into SOPs: dock, product class, temperature, window — not a chart.
- 06
Vendor review before a subcontractor touches a cooler. We do not day-labor PHI.
Business Associate Agreement
Paper the lane before the first cooler.
We execute BAAs with covered entities before PHI is in scope. Describe campuses and product classes only — never a patient. Sending the form opens an email to the privacy officer. A draft goes back only after that message is sent.
Privacy officer: privacy@deliverease.com
Incident response
If something is seen, said, or lost — tell us the same hour.
A lost device, a photograph of a label, a story told off the floor. Call dispatch and ask for the privacy officer. After hours the desk pages. Do not add extra patient detail to the report.
Straight answers