Security & compliance
Compliance you can verify — not just a badge in the footer.
STAT couriers carry specimens, results, and patient data. On LabCourier, the controls a HIPAA review asks about aren't bolted on after the fact — they're wired into how every order is taken, stored, moved, and proven.
How we protect PHI
Six areas, no hand-waving.
Each control below is part of how the platform actually works today — described plainly so your compliance team can map it to their requirements.
Data protection
- Database encrypted at rest with transparent data encryption (TDE)
- TLS in transit across every surface and integration
- Database backups encrypted and stored off-site
- External API responses minimize PHI to what the provider needs
Identity & access
- Scoped roles separate platform, carrier, provider, and facility access
- Multi-factor authentication required for platform-owner accounts
- Each provider's data is isolated by tenant — never commingled
- API keys are scoped to a single provider and stored only as hashes
Auditability
- Every dispatch action writes an audit log entry
- Every status change writes a tracking event
- Every external API request is access-logged (who · what · result)
- Audit and access records retained on a six-year HIPAA floor
AI & messaging
- Order extraction runs on OpenAI under a signed Business Associate Agreement
- AI output is validated against a strict schema — no invented data
- SMS and MMS ride Telnyx as a transport conduit
- A send-path tripwire blocks PHI from leaving over email — enforced in code
Integrity & availability
- Raw inbound payloads are stored before any processing
- Every webhook is idempotent — no event is processed twice
- Outbound webhooks are signed (HMAC) and verifiable by the recipient
- Every dispatch and override is attributable in the audit log
Vendor management
- Business Associate Agreements with carriers handling PHI
- A published, current list of subprocessors and their data scope
- Conduit vendors are documented as no-PHI-access where applicable
- Backup and storage vendors covered by agreement
Business Associate Agreements
We sign a BAA with every carrier that handles PHI.
A Business Associate Agreement is the contract HIPAA requires between a covered entity and the services that touch its protected health information. We execute one with each carrier on the platform, and our own subprocessors are covered in turn — including the AI that reads inbound messages.
Need our security documentation, a BAA, or a subprocessor list for a vendor review?
Security
Bring your compliance team. We'll bring the receipts.
We'll walk your team through how PHI is handled at each step — intake, storage, transport, and proof — and answer the questions a vendor review asks.