Security and HIPAA
How client information is protected
Medicare numbers and medication lists are protected health information. This page describes, in plain terms, what ShareMyRx does with it.
A Business Associate Agreement with every agent
Before an agent can send a single invitation, they sign a Business Associate Agreement with ShareMyRx inside the app. The signature is recorded with the exact agreement text (fingerprinted), the date and time, IP address and device details, and a copy is always available to the agent under Settings. Agents also accept an email sending policy: only their own clients, no purchased lists, opt-outs honored.
Private links that expire
Each client gets a unique, unguessable link to their own form. Links stop working 120 days after the last invitation. Before the form opens, the client confirms their date of birth. We never ask for any part of the Medicare number to prove identity. An emailed link remembers that check on the same device for 120 days. Medicare numbers are never pre-filled in full; after verification, the form shows only the last four characters as a hint.
Data isolation
Every agent’s clients and submissions are isolated by database row-level security: an agent can only ever read their own records. Admin access to agent data is logged.
Invitations are sent from a dedicated, authenticated sending domain (SPF, DKIM and DMARC) with a one-click unsubscribe in every message. Sending is rate-limited, stops after two reminders when a client never opens the form, and is monitored for bounces and complaints so that one agent’s list cannot affect another’s deliverability.
Where data lives
Application data is stored in Amazon Aurora (PostgreSQL, hosted in the United States) encrypted at rest with a customer-managed key and in transit with TLS. The application runs on Amazon Web Services (AWS Amplify Hosting, Cognito for sign-in, S3 and CloudFront for images), all covered by AWS's HIPAA Business Associate Addendum. Email is delivered by Amazon SES and payments by Stripe; Stripe never shares card numbers with ShareMyRx. Drug and provider lookups are proxied through ShareMyRx to the National Library of Medicine, openFDA and the CMS NPI Registry; those services receive search terms only, never client identities.
What we do not do
We do not sell or share client information, do not use it to market plans, and do not contact your clients except on your behalf when you send an invitation.
Questions
Email support@sharemyrx.com. See also the privacy policy and terms of service.