Fizyhealth
VLS Pharmacy HIPAA and BAA

VLS Pharmacy HIPAA and BAA: what to confirm

VLS Pharmacy is a licensed 503A compounding pharmacy that handles protected health information every time a prescriber submits a patient-specific order. As a covered entity that also receives PHI from other covered entities, HIPAA compliance is required of VLS Pharmacy as a pharmacy — but clinics evaluating it as a vendor should still confirm whether a business associate agreement is available, what the specific safeguards are, and how PHI is handled when orders are compounded and shipped. VLS Pharmacy does not publish these specifics on its public site, so requesting them in writing before you transmit patient information is the right move.

This page explains HIPAA obligations at a licensed compounding pharmacy, what a BAA covers for a pharmacy relationship, and the questions to ask VLS Pharmacy before sharing PHI.

Compare Fizy Health vs VLS Pharmacy

Proudly Partnered With

How does HIPAA apply to a licensed compounding pharmacy?

A 503A compounding pharmacy is a covered entity under HIPAA because it provides pharmacy services and handles protected health information as part of care operations. As a covered entity, VLS Pharmacy is legally required to maintain HIPAA compliance — unlike a software vendor that only becomes a business associate when it handles PHI on someone else's behalf. The BAA question is still relevant: if a prescribing clinic sends patient information to VLS Pharmacy electronically — by EMR integration or secure fax — and uses VLS Pharmacy as a downstream provider, the nature of that relationship and data handling should be documented. VLS Pharmacy does not publish a standard prescriber agreement or BAA template on its site, so asking for written terms, role-based access documentation, and data-handling procedures is the diligence step before you transmit patient records.

HIPAA verification checklist

What to confirm about VLS Pharmacy and HIPAA

Each row is a HIPAA criterion, what is publicly known about VLS Pharmacy, and the question or document to request before sharing PHI.

Pharmacy covered-entity status
What is publicly knownVLS Pharmacy is a licensed 503A compounding pharmacy and covered entity under HIPAA — it handles PHI as part of its own care operations, not solely as a downstream vendor.
What to requestConfirm the pharmacy's HIPAA covered-entity status and ask how prescriber-sent PHI is handled under its own privacy policies.
Business associate agreement
What is publicly knownVLS Pharmacy does not publish a BAA template for prescribers on its public site. The applicability of a BAA depends on the structure of the prescriber relationship.
What to requestAsk whether a written BAA or prescriber data agreement is available and have your counsel review it before transmitting PHI.
PHI access controls
What is publicly knownVLS Pharmacy does not publish role-based access controls or staff access limitations for patient data on its site.
What to requestAsk which staff roles have access to patient order data, how access is logged, and whether access is limited to compounding staff only.
Data in transit and at rest
What is publicly knownFax and EMR submissions transmit PHI to VLS Pharmacy. The pharmacy does not publish encryption details for stored or in-transit patient data.
What to requestAsk how fax and EMR submissions are stored, whether data at rest is encrypted, and where patient records are hosted.
Compounding staff and downstream sharing
What is publicly knownPatient information is shared within VLS Pharmacy's compounding team for order preparation. The New Drug Loft sister pharmacy may also be involved in certain orders.
What to requestConfirm which staff see PHI in the compounding workflow and whether any patient data is shared with New Drug Loft for order routing.

Sourced from VLS Pharmacy public materials (vlspharmacy.com, newdrugloft.com), reviewed June 2026. HIPAA terms should be confirmed in writing and reviewed by your own counsel.

Confirm HIPAA terms with the pharmacy, or start with a BAA built into onboarding?

VLS Pharmacy fits if

VLS Pharmacy

You will confirm HIPAA documentation and data safeguards during account setup.

  • You are prepared to request BAA or prescriber data agreement terms in writing before transmitting PHI.
  • Your compliance team reviews vendor data terms on a case-by-case basis.
  • Phone and email coordination of HIPAA questions fits your workflow.
Consider Fizy Health if

Fizy Health

You want a BAA signed at onboarding and PHI access audited from the first order.

  • You want a clinic BAA executed at onboarding before you place any order.
  • You want patient-linked cart actions audited per line with organization-scoped access.
  • You want PHI access controls built into the product, not coordinated after the fact.
If you choose Fizy Health

What HIPAA-aware ordering looks like in practice.

Strong HIPAA posture shows up as scoped access, audited actions, and a clear trail — not just a compliance clause in a contract.

See all features
Keep evaluating VLS Pharmacy

More trust and compliance answers.

See the trust & compliance guide
FAQ

What clinics ask about VLS Pharmacy and HIPAA.

  • Definition

    Is VLS Pharmacy HIPAA-compliant?

    VLS Pharmacy is a licensed 503A compounding pharmacy — a HIPAA covered entity — legally required to maintain HIPAA compliance as part of its pharmacy operations. For clinics transmitting patient information, the important steps are confirming a signed prescriber data agreement or BAA and understanding how PHI is handled in the compounding workflow.

  • BAA

    Does VLS Pharmacy provide a business associate agreement?

    VLS Pharmacy does not publish a BAA template for prescribers on its public site. Because the BAA applicability depends on the structure of the relationship, ask whether a written agreement governing PHI handling is available and have your counsel review it before transmitting patient information.

  • Why

    Why does a compounding pharmacy relationship involve HIPAA?

    Placing a compounded order requires the patient's identity, prescriber details, and directions for use — all protected health information. That PHI is transmitted to VLS Pharmacy and seen by its compounding staff. A formal agreement on how it is stored, accessed, and protected is the baseline for a HIPAA-aware vendor relationship.

  • Safeguards

    What HIPAA safeguards should I verify with VLS Pharmacy?

    Ask for administrative, physical, and technical safeguard documentation: who on the compounding staff accesses patient data, how fax and EMR submissions are stored and encrypted, access logging, and whether patient data is shared with the New Drug Loft sister pharmacy for any orders.

  • Fax

    Is fax an acceptable way to transmit PHI to a pharmacy?

    Fax is a recognized method of transmitting PHI to covered entities under HIPAA when appropriate administrative safeguards are in place. Confirm VLS Pharmacy's fax security practices and whether secure or encrypted fax is used.

  • Alternative

    How does Fizy Health handle HIPAA and BAAs?

    Fizy Health signs a clinic BAA at onboarding, keeps patient records organization-scoped, and audits patient-linked cart actions per line. PHI access controls are built into the product so you do not have to negotiate them separately.

Sources reviewed June 2026

  • VLS Pharmacy public website (vlspharmacy.com) and New Drug Loft network pages (newdrugloft.com), reviewed June 2026.
  • HIPAA terms and any BAA should be confirmed in writing with VLS Pharmacy and reviewed by your own counsel.
  • Fizy Health platform capabilities reflect the live product.
Evaluate with real numbers

Start with a BAA at onboarding — not after a contract negotiation.

Fizy Health signs a clinic BAA before your first order and keeps patient access audited and scoped. Free to start.

Start Ordering FreeFizy Health vs VLS Pharmacy