Architecture
Selective HIPAA dispatch stack
Marketing never holds PHI. Portals do. Routing vendors sit behind an anonymous order-ID buffer so a third-party optimizer can sequence stops without learning who lives at the address.
Non-PHI
Public marketing
- Home, services, pricing, about, contact
- Inquiry inbox (no patient fields)
- Architecture & API docs
PHI
Secure portals
- Pharmacy tenant dashboard
- Driver web view + signatures
- Admin console, photos, custody
Buffer
Anonymous routing
- DEL-##### stop alias
- Address + window only
- No names to routing engines
Business flow
- 1Pharmacy submits order (PHI zone)
- 2Tracking code issued (DEL-84029)
- 3Rule engine: county, CS, cold-chain
- 4Admin assigns CS-authorized courier
- 5CSV export: address / alias / notes
- 6Driver navigates, then opens DEL in portal
- 7Signature + photo + temps
- 8Custody confirmed → completed
- 9Stripe charge on order ID only
Data flow
Pharmacy order form (PHI)
Prisma model · tenant key · tracking code
Driver portal (PHI)
CSV buffer (no names)
Stripe (order ID)
Rule engine
Candidate assignment
REJECT
CS + unauthorized driver · out of county · missing temps
WARN
Rush on a high-capacity shift
ALLOW
Assign, export alias, collect proof
Delivery state machine
SubmittedAcceptedAssignedPicked upEn routeDeliveredCustodyCompletedFailedCancelled
Production PHI workloads belong on BAA-covered infrastructure. This workspace persists locally so operations can be exercised without a live covered entity connection.