Every connection and every stored record.
Row-level separation between practices. One clinic can never see another's data.
Staff see what their role needs. Admin records and the audit log stay with admins.
A second factor protects every staff account.
Access to and changes within clinical records are logged, and the log is append-only.
Our own personnel get access only as needed to provide support, and that access is logged too.
Continuous monitoring and periodic review of the security configuration.
Records are kept for the periods controlled-substance and REMS regulations require, and exportable at any time.
ComplyRx operates a HIPAA compliance program with a documented risk analysis, written policies, staff training, and an incident response plan. Every service provider that handles protected health information on our behalf is under a BAA. The current list of sub-processors is published in our Privacy Policy.
Controlled-substance records are append-only. A mistake is corrected with a documented reversal that leaves the original entry in place, so the record always shows what happened and what was corrected. Receipts, dispensing, physical counts, and dispositions are exportable on demand.
Some features use an AI model to help read uploaded documents or answer questions about a clinic's own data. Those requests go to a vetted provider under a BAA and under terms that prohibit using the content to train its models. Any suggestion is shown to staff for review before anything is saved. ComplyRx does not make unreviewed clinical decisions.
If we become aware of a security incident affecting protected health information, affected clinics are notified in accordance with HIPAA and our Business Associate Agreement. To report a security concern, write to vmathews@complyrx.ai.
We never sell, rent, or share clinic or patient information with third parties for their own purposes.
We never use your data to train AI models, and neither may any provider we use.
We never let one clinic's information reach another clinic.
We never hold your records hostage. Export is available to you at any time.