Privacy Policy
This policy explains how RescriptMD ("we", "us") handles information on this website and in the RescriptMD application (the "Service"). It is written in plain language on purpose. If anything here is unclear, write to ian.ferrer@familymedicinerockies.com.
1. This website
This website is informational. It does not use advertising trackers or analytics cookies. Our hosting provider (Cloudflare) records standard server logs, such as IP address, browser type and the pages requested, to operate and secure the site. If you email us, we keep your message so we can reply.
2. The RescriptMD application
The Service is used by medical practices to prepare prescription refill requests for a licensed prescriber's review. In that role we act as a business associate of each practice under the Health Insurance Portability and Accountability Act (HIPAA). We only receive protected health information (PHI) under a signed Business Associate Agreement (BAA) with the practice, and we use it only to provide the Service to that practice.
Information the Service processes may include: refill requests received by the practice (electronic renewal requests, faxes, voicemails and portal messages), the patient, medication and pharmacy named in them, and the chart facts the practice's protocol requires, such as visit dates, laboratory results, active medications and allergies. This information belongs to the practice and its patients, not to us.
3. How PHI is used and protected
- PHI is used only to prepare a refill recommendation for the practice's prescriber, to draft messages that practice staff review and send, and to keep the audit record the practice needs.
- PHI is never sold, never used for advertising, and never used to train artificial intelligence models.
- Vendors that process PHI on our behalf, including cloud hosting and AI model providers, do so under BAAs and only for the purpose of delivering the Service.
- PHI is encrypted in transit and at rest. Access is limited to personnel who need it to operate the Service, and access is logged.
- Every prescription decision is made and signed by a licensed clinician at the practice. The Service does not prescribe.
4. Patients
If you are a patient, RescriptMD works for your practice, not directly with you. Requests about your records, including access, correction or restrictions, go to your practice, which remains the covered entity responsible for your PHI. We support practices in meeting those requests.
5. Retention
PHI is retained for as long as the practice's agreement with us requires, and then returned or destroyed as that agreement and HIPAA provide. Audit records may be kept longer where the practice or law requires it.
6. Security incidents
If we discover a breach of unsecured PHI, we notify the affected practice without unreasonable delay and as required by the BAA and applicable law, so the practice can meet its own notification obligations.
7. Children
This website is not directed at children under 13, and we do not knowingly collect information from them through it. PHI about minors reaches the Service only through their practice.
8. Changes
We will post any changes to this policy on this page with a new effective date.
9. Contact
Ian Ferrer, RescriptMD
ian.ferrer@familymedicinerockies.com