FlowScript, Inc., doing business as ScriptRoute, is a Business Associate of every provider organization it works with. This agreement covers the patient information ScriptRoute handles on your behalf. Read it and sign below. Version 2026-08-12-draft-1.
1. The parties and the services
This Business Associate Agreement is between FlowScript, Inc., doing business as ScriptRoute ("Business Associate") and the provider organization creating this account ("Covered Entity"). It supplements the Provider Service Agreement between them.
ScriptRoute operates a medication procurement platform through which Covered Entity compares compounded-medication pricing, submits orders, and has those orders routed to licensed compounding pharmacies. ScriptRoute is a medication procurement broker. It is not a pharmacy, a wholesaler or a distributor: it never takes title to any medication, never handles product, and never takes custody of funds passing between Covered Entity and a pharmacy.
Terms not defined here have the meaning given in 45 CFR Parts 160 and 164.
2. What ScriptRoute receives and what it discloses
ScriptRoute receives patient name, date of birth, sex, address, contact details, medical record number, diagnosis, clinical notes and allergies where supplied; prescriber name, NPI and DEA registration; prescription documents; and the contents of pharmacy invoices submitted for price comparison.
ScriptRoute discloses to a fulfilling pharmacy only: patient first and last name, date of birth, ship-to address, product, variant and quantity, prescriber name, NPI and DEA registration, the prescription document, and order identifiers.
ScriptRoute never discloses to a pharmacy: diagnosis, clinical notes, allergies, medical record number, patient phone or email, any other patient, any other order, or any other covered entity’s information.
3. Permitted uses and disclosures
ScriptRoute uses and discloses protected health information only as necessary to perform the services, as required by law, or as this agreement otherwise permits, and never in a manner that would violate Subpart E of 45 CFR Part 164 if done by Covered Entity.
Every use, disclosure and request is limited to the minimum necessary to accomplish its purpose.
ScriptRoute does not sell protected health information, does not use or disclose it for marketing, and does not use or disclose it to train any third-party model.
4. Safeguards
ScriptRoute uses appropriate administrative, physical and technical safeguards and complies with Subpart C of 45 CFR Part 164 with respect to electronic protected health information.
Specifically, ScriptRoute maintains: encryption at rest under AES-256-GCM with a distinct data encryption key per covered entity; TLS 1.3 in transit; database-level tenant isolation enforced independently of application code; multi-factor authentication on all accounts; and an append-only audit log of every access, recording field names and record identifiers and never values.
5. Reporting
ScriptRoute reports to Covered Entity any use or disclosure not provided for by this agreement of which it becomes aware.
ScriptRoute reports any breach of unsecured protected health information without unreasonable delay, and in no case later than five business days after discovery, with an initial notification within 72 hours where a breach is confirmed. The report identifies each individual involved, the nature of the breach, the dates of occurrence and discovery, and the steps taken to mitigate and prevent recurrence, so far as known, and is supplemented as more is learned.
Security incidents are reported on request and periodically. Unsuccessful attempts that result in no unauthorized access are reported in aggregate.
ScriptRoute mitigates, to the extent practicable, any harmful effect known to it of a use or disclosure in violation of this agreement.
6. Subcontractors and individual rights
ScriptRoute ensures that every subcontractor that creates, receives, maintains or transmits protected health information on its behalf agrees in writing to restrictions at least as restrictive as those that apply to ScriptRoute here. Each pharmacy to which an order is routed is such a subcontractor and executes an agreement before any protected health information reaches it.
ScriptRoute makes protected health information available to Covered Entity, or at its direction to the individual, as necessary to satisfy 45 CFR §164.524; makes it available for amendment under §164.526; and maintains and makes available the information required for an accounting of disclosures under §164.528.
ScriptRoute makes its internal practices, books and records relating to the use and disclosure of protected health information available to the Secretary of Health and Human Services for purposes of determining Covered Entity’s compliance.
7. Term and termination
This agreement takes effect on execution and continues until all protected health information is returned or destroyed, or until the protections below are extended indefinitely.
On termination ScriptRoute returns or destroys the protected health information it maintains for Covered Entity. Where return or destruction is infeasible, ScriptRoute extends the protections of this agreement to that information and limits further use and disclosure to the purposes that make return or destruction infeasible, for as long as it is retained.
PROVISIONAL: the retention period, what triggers destruction, and whether backup archives are treated as infeasible are under legal review and are not settled by this draft. A final agreement will state them.
Covered Entity may terminate this agreement if ScriptRoute materially breaches it and the breach is not cured within a reasonable period after notice.
8. General
The parties will negotiate in good faith to amend this agreement as necessary to comply with any change to HIPAA, the HITECH Act, or their implementing regulations. Any ambiguity is resolved to permit compliance with HIPAA. Nothing here creates rights in any person other than the parties.