West Valley Courier Solutions LLC provides medical courier services and, in doing so, may handle Protected Health Information ("PHI") in physical form (sealed specimens, paper records) and in limited electronic form (manifest data and chain-of-custody entries) on behalf of covered entities. This Notice describes WVC's role as a HIPAA business associate. This page is maintained by WVC and is not an audit report or certification.
Business Associate Status
WVC contracts with covered entities under written Business Associate Agreements ("BAAs") that govern WVC's permitted uses and disclosures of PHI, safeguard obligations, breach notification, subcontractor flow-down, and return or destruction of PHI on termination, consistent with 45 CFR §§ 164.502, 164.504, and 164.308–.316.
Permitted Use of PHI
PHI is used only as necessary to (a) perform the courier services the covered entity has engaged WVC to provide, (b) maintain chain-of-custody and incident records required by the covered entity and applicable law, and (c) meet WVC's own legal and regulatory obligations.
Safeguards
WVC maintains administrative, physical, and technical safeguards including:
- Workforce confidentiality and HIPAA-awareness expectations for dispatchers and drivers.
- Sealed and labeled specimen handling with documented custody transfers.
- Temperature-controlled containment for cold-chain transport.
- Access-controlled operator console with role-based authorization and audit-eligible activity records.
- Encryption of application traffic in transit (HTTPS) and encryption of backend storage at rest provided by our hosting infrastructure.
Subcontractors
When WVC engages a subcontractor that may create, receive, maintain, or transmit PHI on its behalf, WVC requires the subcontractor to agree in writing to the same restrictions and conditions that apply to WVC under its BAA with the covered entity.
Breach Notification
WVC will notify the affected covered entity of any breach of unsecured PHI without unreasonable delay and within the timeframe required by the applicable BAA and 45 CFR § 164.410. Covered entities remain responsible for notifying affected individuals under 45 CFR § 164.404.
Individual Rights
Individuals seeking to exercise HIPAA rights of access, amendment, accounting of disclosures, or restrictions in PHI must contact the covered entity that holds the designated record set. WVC will assist the covered entity in fulfilling such requests as required by the applicable BAA.
Reporting Concerns
To report a suspected privacy or security incident involving PHI handled by WVC, contact operations@wvc.solutions or call (602) 796-9261. Individuals may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.
Contact
HIPAA Contact — West Valley Courier Solutions LLC
9393 N. 90th St, Suite 102 #476, Scottsdale, AZ 85258
(602) 796-9261 · operations@wvc.solutions