Our HIPAA Posture

Our software has no patient fields — no names, no dates of birth, no diagnoses, no results. A delivery is identified only by an opaque order reference (for example, “LP-8942”), the facilities at each end, the package type, and its temperature requirement. Requisitions and paperwork travel with the specimen inside sealed packaging, never through our app. A bounded access-notes channel exists for facility logistics; it is warned, isolated, and withheld from couriers until authorization, but it is not technically impossible for a user to type PHI there. Data minimization therefore complements—not replaces—access control, training, agreements, and incident response.

Push notifications, SMS, and email alerts traverse networks we do not control, so every LabPath alert is generated from an order reference and a status only — for example, “Order LP-8942 status: In transit to drop-off.” This is enforced in our codebase, not left to policy: alert text is constructed from those two values, and automated tests fail the build if a contact phone or signer’s name appears in an alert. The production SMS and email providers are not connected yet.

Each delivery carries an auditable record: opaque package-QR verification at pickup, a timestamped status history attributing every change, the receiving staff member’s signature at drop-off, and the cold-chain range the specimen was declared under. These are business records — the artifacts you need when a package is questioned. They are designed without patient fields, but receiver identity and facility logistics data are still sensitive business data.

No federal agency certifies a courier as “HIPAA certified,” and we will not claim a credential that does not exist. Before live service, the business must verify role-appropriate HIPAA and bloodborne-pathogens training, execute the required Business Associate Agreement, approve shipment-specific classification and packaging procedures, and retain the evidence. The repository proves software behavior; it does not prove those operational tasks are complete.