HIPAA Statement.

Apex’s Role Under HIPAA

Apex Courier Logistics Group LLC, DBA Apex Medical OC (“Apex”), California Entity No. B20260171016, provides services to covered entities such as hospitals, clinics, physician groups, occupational health practices, laboratories, and health plans, as those terms are used in 45 CFR Parts 160 and 164. When Apex signs a Business Associate Agreement with a covered entity, Apex acts as that entity’s business associate.

When Apex performs specimen transport, on-site collection, or compliance program administration under a Business Associate Agreement, it creates, receives, maintains, or transmits Protected Health Information on behalf of that covered entity. In that role Apex is directly liable under the HIPAA Security Rule and under the Breach Notification Rule, and is liable under the Privacy Rule for the uses and disclosures set out in its Business Associate Agreements, as provided by the HITECH Act and the Omnibus Rule.

Where Apex moves a sealed, labeled specimen or a sealed document packet without accessing its contents, Apex functions in a conduit capacity for that leg of the work. Apex does not rely on the conduit exception as a shield: because Apex custody records, and the telemetry and notifications planned for the Apex platform, can associate a specimen with an individual, Apex treats itself as a business associate for the entire engagement and signs a Business Associate Agreement accordingly.

The Business Associate Agreement Is Executed Before Service Begins

Apex does not begin any service that involves Protected Health Information until a written Business Associate Agreement has been executed between Apex and the covered entity. There is no pilot, no trial run, and no first pickup ahead of signature.

• Principal-signed. The Apex signature on a Business Associate Agreement is applied by the principal of the firm. It is not delegated to a driver, a dispatcher, a sales representative, or an account manager.
• Pre-engagement. Execution precedes the first specimen, the first collection event, and, once the client portal rolls out, the first portal login.
• Client paper accepted. Apex will execute the covered entity’s own Business Associate Agreement form. Where a client has no form, Apex supplies one for review by client counsel.
• Version-controlled. The executed instrument, its effective date, and its signatories are recorded in the Apex compliance file and are producible on audit.

Minimum Necessary and the Barcode-First Custody Design

The Minimum Necessary standard at 45 CFR 164.502(b) requires that a use or disclosure of PHI be limited to the minimum reasonably needed for the purpose. Apex builds that standard into its custody design rather than relying on a policy statement alone.

Specimens in Apex custody are identified in the field by barcode or QR code rather than by patient name on the label face. The operator who picks up, transports, and delivers the specimen sees an identifier, a run number, a temperature band, and a destination. The operator does not need the patient’s name to do the job, and so is not given it.

The practical result is that the highest-risk surface in medical courier work, the label in a stranger’s hand, carries the least information. Where a covered entity’s own workflow requires a named label, Apex will accept it, but the Apex-generated record remains identifier-first.

Administrative Safeguards

Mapped in plain language to 45 CFR 164.308. Before the first PHI engagement, Apex will designate a security official responsible for the development and implementation of security policy, and a privacy contact for HIPAA-related inquiries. Before the first PHI engagement, Apex will also conduct and document a risk analysis of the systems that hold or transmit PHI, and apply risk management measures proportionate to the findings.

Workforce access is authorized on a role basis before any account is issued, reviewed on change of role, and terminated promptly on separation. Before the first PHI engagement, Apex will adopt an incident response procedure covering identification, containment, investigation, notification, and remediation, and contingency planning covering data backup, restoration testing, and a documented procedure for operating during an emergency so that specimen custody and cold chain are not interrupted.

Physical Safeguards

Mapped to 45 CFR 164.310. Specimens and any accompanying documents are secured in the vehicle in a locked or otherwise controlled compartment and are not left unattended in an unsecured setting. Refrigerated specimens travel in a cooler with battery backup power and a temperature data logger on every run, under procedures designed to keep specimens in range while a vehicle is stopped.

Before the first PHI engagement, Apex will ensure that workstations and mobile devices that can reach PHI are access-controlled, screen-locked, and encrypted, and will put device and media controls in place covering issuance, reassignment, and the sanitization or destruction of media at end of life. Paper custody-and-control forms are handled sealed, are transferred only to the intended recipient, and are not photographed or copied outside the documented process.

Technical Safeguards

Mapped to 45 CFR 164.312. Apex states its posture exactly as follows, and claims nothing beyond it. The website is served over HTTPS. The following controls are planned for the Apex platform as it rolls out:

• TLS for all data in transit between application components, devices, and subprocessors.
• AES-256 encryption at rest for stored PHI and compliance data.
• Role-based access control with unique user identification, so that access to identity is granted only where the role requires it.
• Audit logging of access to and modification of records containing or referencing PHI.
• Daily backups, with restoration procedures for integrity and availability.
• SHA-256 hash-sealing of compliance records, providing an integrity control that makes alteration tamper-evident.

Workforce Training and Sanctions

Apex operators, dispatchers, and administrative users complete HIPAA privacy and security training before being granted access to any system or route that involves PHI, and complete refresher training on a recurring basis and whenever a material change in policy, system, or law warrants it. Training covers the Minimum Necessary standard, the barcode-first custody design, permitted and prohibited uses and disclosures, device handling, social engineering, and the duty to report a suspected incident immediately.

Before the first PHI engagement, Apex will adopt a written sanction policy. Under it, failure to follow privacy or security policy results in discipline proportionate to the conduct, up to and including termination of employment or contract and, where warranted, referral to law enforcement. Training completion and sanction records will be documented and retained. Workforce members are also bound by a written confidentiality obligation that survives the end of the engagement.

Subcontractors and the Flow-Down Chain

Where Apex engages a subcontractor that creates, receives, maintains, or transmits PHI on Apex’s behalf, that subcontractor is itself a business associate under 45 CFR 164.308(b) and 164.502(e)(1)(ii), and Apex obtains satisfactory written assurances through a Business Associate Agreement that flows down the same restrictions and conditions that apply to Apex under its agreement with the covered entity.

This applies to cloud hosting and database infrastructure, clinical form providers, notification providers, voice-capture tooling, and any relief or overflow courier used to perform a covered service. Apex does not place PHI with a vendor that will not sign a Business Associate Agreement. The sales CRM is deliberately outside this chain: no PHI and no regulated testing data are synchronized into it. A current subprocessor list is available to covered entities on request, and Apex will provide notice of a material change to the subprocessor set where the Business Associate Agreement requires it.

Breach Notification

Apex complies with the Breach Notification Rule at 45 CFR Part 164 Subpart D as it applies to a business associate.

• Discovery. A breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to any Apex workforce member other than the person who committed it.
• Notice to the covered entity. Apex notifies the affected covered entity without unreasonable delay and in no case later than 60 calendar days from discovery. Where the Business Associate Agreement sets a shorter period, the shorter period applies.
• Immediate preliminary notice. As a matter of practice Apex issues a preliminary notification as soon as an incident is believed to involve PHI, without waiting for the investigation to close, so the covered entity can begin its own assessment.
• Content. Notice identifies the individuals affected or reasonably believed to be affected, the nature and date of the incident and its discovery, the PHI involved, the containment and mitigation steps taken, and the corrective action adopted.
• Risk assessment and cooperation. Apex performs the four-factor risk assessment, documents its conclusion, and cooperates with the covered entity, which retains responsibility for notifying individuals, the Secretary of Health and Human Services, and, where applicable, the media.

Audit Logging and the Planned Tamper-Evident Record

As the Apex platform rolls out, access to and modification of records that contain or reference PHI will be written to an audit log capturing the acting user, the action, the record, and a UTC timestamp. Audit logs will be retained on the schedule in Section 11 and will be producible to a covered entity on request under the Business Associate Agreement.

Once the platform is live, when a run closes, the chain-of-custody packet, including timestamps, geofence arrival and departure events, temperature data logger readings, operator identity, and the proof-of-delivery signature, will be committed and sealed with a SHA-256 hash. Recomputing the hash of a produced record and comparing it to the stored value will demonstrate whether the record has changed since sealing. That is the entire claim: the seal will make alteration tamper-evident. Apex does not describe the seal as tamper-proof, and does not represent that it establishes authenticity or admissibility on its own.

Retention, Return, and Destruction at Termination

Apex retains compliance and custody records for the periods the regulations require for each record type (retention schedule planned), and retains records under legal hold or open audit until the hold is released. PHI is retained only as long as necessary for the permitted purpose or as required by law or by the Business Associate Agreement.

On termination of a Business Associate Agreement, Apex returns or destroys all PHI received from, or created or received on behalf of, the covered entity, and retains no copies, to the extent feasible. Where return or destruction is not feasible, for example where PHI is embedded in a compliance record that Apex is legally required to retain, Apex notifies the covered entity, extends the protections of the Business Associate Agreement to that information for as long as it is retained, and limits further uses and disclosures to the purposes that make return or destruction infeasible. Destruction, where performed, follows methods that render PHI unreadable and unreconstructable, and is documented.

Raising a Privacy or Security Concern

Any individual, workforce member, client, or subcontractor who believes that PHI handled by Apex has been used or disclosed improperly, or that an Apex safeguard has failed, should report it immediately. Reports may be made by telephone to 888-494-4409, toll-free, by email to chris@apexmedicaloc.com, or in writing to the principal office below. Reports are accepted anonymously.

Apex does not retaliate against any person for reporting a suspected privacy or security concern, for filing a complaint, for participating in an investigation, or for opposing a practice believed to be unlawful under HIPAA. An individual also has the right to file a complaint with the covered entity that holds the direct relationship, and with the Office for Civil Rights of the United States Department of Health and Human Services. Because the covered entity, not Apex, owns the designated record set, requests for access to or amendment of a health record should be directed to that entity, and Apex will support it in responding within the timeframes the Privacy Rule requires.